From f6e0b239a2657ea8cb67f0d83d0bfdbfd19a481b Mon Sep 17 00:00:00 2001 From: Jarek Poplawski Date: Fri, 22 Aug 2008 03:24:05 -0700 Subject: [PATCH 01/73] pkt_sched: Fix qdisc list locking Since some qdiscs call qdisc_tree_decrease_qlen() (so qdisc_lookup()) without rtnl_lock(), adding and deleting from a qdisc list needs additional locking. This patch adds global spinlock qdisc_list_lock and wrapper functions for modifying the list. It is considered as a temporary solution until hfsc_dequeue(), netem_dequeue() and tbf_dequeue() (or qdisc_tree_decrease_qlen()) are redone. With feedback from Herbert Xu and David S. Miller. Signed-off-by: Jarek Poplawski Acked-by: Herbert Xu Signed-off-by: David S. Miller --- include/net/pkt_sched.h | 1 + net/sched/sch_api.c | 44 ++++++++++++++++++++++++++++++++++++----- net/sched/sch_generic.c | 5 ++--- 3 files changed, 42 insertions(+), 8 deletions(-) diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h index 853fe83d9f37..b786a5b09253 100644 --- a/include/net/pkt_sched.h +++ b/include/net/pkt_sched.h @@ -78,6 +78,7 @@ extern struct Qdisc *fifo_create_dflt(struct Qdisc *sch, struct Qdisc_ops *ops, extern int register_qdisc(struct Qdisc_ops *qops); extern int unregister_qdisc(struct Qdisc_ops *qops); +extern void qdisc_list_del(struct Qdisc *q); extern struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle); extern struct Qdisc *qdisc_lookup_class(struct net_device *dev, u32 handle); extern struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r, diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 45f442d7de47..e7fb9e0d21b4 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -199,19 +199,53 @@ struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle) return NULL; } +/* + * This lock is needed until some qdiscs stop calling qdisc_tree_decrease_qlen() + * without rtnl_lock(); currently hfsc_dequeue(), netem_dequeue(), tbf_dequeue() + */ +static DEFINE_SPINLOCK(qdisc_list_lock); + +static void qdisc_list_add(struct Qdisc *q) +{ + if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) { + spin_lock_bh(&qdisc_list_lock); + list_add_tail(&q->list, &qdisc_root_sleeping(q)->list); + spin_unlock_bh(&qdisc_list_lock); + } +} + +void qdisc_list_del(struct Qdisc *q) +{ + if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) { + spin_lock_bh(&qdisc_list_lock); + list_del(&q->list); + spin_unlock_bh(&qdisc_list_lock); + } +} +EXPORT_SYMBOL(qdisc_list_del); + struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle) { unsigned int i; + struct Qdisc *q; + + spin_lock_bh(&qdisc_list_lock); for (i = 0; i < dev->num_tx_queues; i++) { struct netdev_queue *txq = netdev_get_tx_queue(dev, i); - struct Qdisc *q, *txq_root = txq->qdisc_sleeping; + struct Qdisc *txq_root = txq->qdisc_sleeping; q = qdisc_match_from_root(txq_root, handle); if (q) - return q; + goto unlock; } - return qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle); + + q = qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle); + +unlock: + spin_unlock_bh(&qdisc_list_lock); + + return q; } static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid) @@ -810,8 +844,8 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue, goto err_out3; } } - if ((parent != TC_H_ROOT) && !(sch->flags & TCQ_F_INGRESS)) - list_add_tail(&sch->list, &dev_queue->qdisc_sleeping->list); + + qdisc_list_add(sch); return sch; } diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index c3ed4d44fc14..5f0ade7806a7 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -526,10 +526,9 @@ void qdisc_destroy(struct Qdisc *qdisc) !atomic_dec_and_test(&qdisc->refcnt)) return; - if (qdisc->parent) - list_del(&qdisc->list); - #ifdef CONFIG_NET_SCHED + qdisc_list_del(qdisc); + qdisc_put_stab(qdisc->stab); #endif gen_kill_estimator(&qdisc->bstats, &qdisc->rate_est); From fdc0bde90a689b9145f2b6f271c03f4c99d09667 Mon Sep 17 00:00:00 2001 From: "Denis V. Lunev" Date: Sat, 23 Aug 2008 04:43:33 -0700 Subject: [PATCH 02/73] icmp: icmp_sk() should not use smp_processor_id() in preemptible code Pass namespace into icmp_xmit_lock, obtain socket inside and return it as a result for caller. Thanks Alexey Dobryan for this report: Steps to reproduce: CONFIG_PREEMPT=y CONFIG_DEBUG_PREEMPT=y tracepath BUG: using smp_processor_id() in preemptible [00000000] code: tracepath/3205 caller is icmp_sk+0x15/0x30 Pid: 3205, comm: tracepath Not tainted 2.6.27-rc4 #1 Call Trace: [] debug_smp_processor_id+0xe4/0xf0 [] icmp_sk+0x15/0x30 [] icmp_send+0x4b/0x3f0 [] ? trace_hardirqs_on_caller+0xd5/0x160 [] ? trace_hardirqs_on+0xd/0x10 [] ? local_bh_enable_ip+0x95/0x110 [] ? _spin_unlock_bh+0x39/0x40 [] ? mark_held_locks+0x4c/0x90 [] ? trace_hardirqs_on+0xd/0x10 [] ? trace_hardirqs_on_caller+0xd5/0x160 [] ip_fragment+0x8d4/0x900 [] ? ip_finish_output2+0x0/0x290 [] ? ip_finish_output+0x0/0x60 [] ? dst_output+0x0/0x10 [] ip_finish_output+0x4c/0x60 [] ip_output+0xa3/0xf0 [] ip_local_out+0x20/0x30 [] ip_push_pending_frames+0x27f/0x400 [] udp_push_pending_frames+0x233/0x3d0 [] udp_sendmsg+0x321/0x6f0 [] inet_sendmsg+0x45/0x80 [] sock_sendmsg+0xdf/0x110 [] ? autoremove_wake_function+0x0/0x40 [] ? validate_chain+0x415/0x1010 [] ? __do_fault+0x140/0x450 [] ? __lock_acquire+0x260/0x590 [] ? sockfd_lookup_light+0x45/0x80 [] sys_sendto+0xea/0x120 [] ? _spin_unlock_irqrestore+0x42/0x80 [] ? __up_read+0x4c/0xb0 [] ? up_read+0x26/0x30 [] system_call_fastpath+0x16/0x1b icmp6_sk() is similar. Signed-off-by: Denis V. Lunev Signed-off-by: David S. Miller --- net/ipv4/icmp.c | 22 ++++++++++++++-------- net/ipv6/icmp.c | 23 ++++++++++++----------- 2 files changed, 26 insertions(+), 19 deletions(-) diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 860558633b2c..55c355e63234 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -204,18 +204,22 @@ static struct sock *icmp_sk(struct net *net) return net->ipv4.icmp_sk[smp_processor_id()]; } -static inline int icmp_xmit_lock(struct sock *sk) +static inline struct sock *icmp_xmit_lock(struct net *net) { + struct sock *sk; + local_bh_disable(); + sk = icmp_sk(net); + if (unlikely(!spin_trylock(&sk->sk_lock.slock))) { /* This can happen if the output path signals a * dst_link_failure() for an outgoing ICMP packet. */ local_bh_enable(); - return 1; + return NULL; } - return 0; + return sk; } static inline void icmp_xmit_unlock(struct sock *sk) @@ -354,15 +358,17 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb) struct ipcm_cookie ipc; struct rtable *rt = skb->rtable; struct net *net = dev_net(rt->u.dst.dev); - struct sock *sk = icmp_sk(net); - struct inet_sock *inet = inet_sk(sk); + struct sock *sk; + struct inet_sock *inet; __be32 daddr; if (ip_options_echo(&icmp_param->replyopts, skb)) return; - if (icmp_xmit_lock(sk)) + sk = icmp_xmit_lock(net); + if (sk == NULL) return; + inet = inet_sk(sk); icmp_param->data.icmph.checksum = 0; @@ -419,7 +425,6 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) if (!rt) goto out; net = dev_net(rt->u.dst.dev); - sk = icmp_sk(net); /* * Find the original header. It is expected to be valid, of course. @@ -483,7 +488,8 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) } } - if (icmp_xmit_lock(sk)) + sk = icmp_xmit_lock(net); + if (sk == NULL) return; /* diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c index abedf95fdf2d..b3157a0cc15d 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c @@ -91,19 +91,22 @@ static struct inet6_protocol icmpv6_protocol = { .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, }; -static __inline__ int icmpv6_xmit_lock(struct sock *sk) +static __inline__ struct sock *icmpv6_xmit_lock(struct net *net) { + struct sock *sk; + local_bh_disable(); + sk = icmpv6_sk(net); if (unlikely(!spin_trylock(&sk->sk_lock.slock))) { /* This can happen if the output path (f.e. SIT or * ip6ip6 tunnel) signals dst_link_failure() for an * outgoing ICMP6 packet. */ local_bh_enable(); - return 1; + return NULL; } - return 0; + return sk; } static __inline__ void icmpv6_xmit_unlock(struct sock *sk) @@ -392,11 +395,10 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info, fl.fl_icmp_code = code; security_skb_classify_flow(skb, &fl); - sk = icmpv6_sk(net); - np = inet6_sk(sk); - - if (icmpv6_xmit_lock(sk)) + sk = icmpv6_xmit_lock(net); + if (sk == NULL) return; + np = inet6_sk(sk); if (!icmpv6_xrlim_allow(sk, type, &fl)) goto out; @@ -539,11 +541,10 @@ static void icmpv6_echo_reply(struct sk_buff *skb) fl.fl_icmp_type = ICMPV6_ECHO_REPLY; security_skb_classify_flow(skb, &fl); - sk = icmpv6_sk(net); - np = inet6_sk(sk); - - if (icmpv6_xmit_lock(sk)) + sk = icmpv6_xmit_lock(net); + if (sk == NULL) return; + np = inet6_sk(sk); if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst)) fl.oif = np->mcast_oif; From f410a1fba7afa79d2992620e874a343fdba28332 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Sat, 23 Aug 2008 05:16:46 -0700 Subject: [PATCH 03/73] ipv6: protocol for address routes This fixes a problem spotted with zebra, but not sure if it is necessary a kernel problem. With IPV6 when an address is added to an interface, Zebra creates a duplicate RIB entry, one as a connected route, and other as a kernel route. When an address is added to an interface the RTN_NEWADDR message causes Zebra to create a connected route. In IPV4 when an address is added to an interface a RTN_NEWROUTE message is set to user space with the protocol RTPROT_KERNEL. Zebra ignores these messages, because it already has the connected route. The problem is that route created in IPV6 has route protocol == RTPROT_BOOT. Was this a design decision or a bug? This fixes it. Same patch applies to both net-2.6 and stable. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller --- net/ipv6/addrconf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index e2d3b7580b76..7b6a584b62dd 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1688,6 +1688,7 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev, .fc_dst_len = plen, .fc_flags = RTF_UP | flags, .fc_nlinfo.nl_net = dev_net(dev), + .fc_protocol = RTPROT_KERNEL, }; ipv6_addr_copy(&cfg.fc_dst, pfx); From 819ddcafb33136f2ba18018a22edcf857f640528 Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Sun, 24 Aug 2008 02:45:32 +0200 Subject: [PATCH 04/73] mv643xx_eth: fix NAPI 'rotting packet' issue When a receive interrupt occurs, mv643xx_eth would first process the receive descriptors and then ACK the receive interrupt, instead of the other way round. This would leave a small race window between processing the last receive descriptor and clearing the receive interrupt status in which a new packet could come in, which would then 'rot' in the receive ring until the next receive interrupt would come in. Fix this by ACKing (clearing) the receive interrupt condition before processing the receive descriptors. Signed-off-by: Lennert Buytenhek --- drivers/net/mv643xx_eth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c index 46819af3b062..af279f26c407 100644 --- a/drivers/net/mv643xx_eth.c +++ b/drivers/net/mv643xx_eth.c @@ -650,8 +650,6 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget) if (rx < budget) { netif_rx_complete(mp->dev, napi); - wrl(mp, INT_CAUSE(mp->port_num), 0); - wrl(mp, INT_CAUSE_EXT(mp->port_num), 0); wrl(mp, INT_MASK(mp->port_num), INT_TX_END | INT_RX | INT_EXT); } @@ -1796,6 +1794,7 @@ static irqreturn_t mv643xx_eth_irq(int irq, void *dev_id) */ #ifdef MV643XX_ETH_NAPI if (int_cause & INT_RX) { + wrl(mp, INT_CAUSE(mp->port_num), ~(int_cause & INT_RX)); wrl(mp, INT_MASK(mp->port_num), 0x00000000); rdl(mp, INT_MASK(mp->port_num)); From 92c70f27d2a78873c940e77c7f075cd8e2e60a2d Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Sun, 24 Aug 2008 01:59:05 +0200 Subject: [PATCH 05/73] mv643xx_eth: fix double add_timer() on the receive oom timer Commit 12e4ab79cd828563dc090d2117dc8626b344bc8f ("mv643xx_eth: be more agressive about RX refill") changed the condition for the receive out-of-memory timer to be scheduled from "the receive ring is empty" to "the receive ring is not full". This can lead to a situation where the receive out-of-memory timer is pending because a previous rxq_refill() didn't manage to refill the receive ring entirely as a result of being out of memory, and rxq_refill() is then called again as a side effect of a packet receive interrupt, and that rxq_refill() call then again does not succeed to refill the entire receive ring with fresh empty skbuffs because we are still out of memory, and then tries to call add_timer() on the already scheduled out-of-memory timer. This patch fixes this issue by changing the add_timer() call in rxq_refill() to a mod_timer() call. If the OOM timer was not already scheduled, this will behave as before, whereas if it was already scheduled, this patch will push back its firing time a bit, which is safe because we've (unsuccessfully) attempted to refill the receive ring just before we do this. Signed-off-by: Lennert Buytenhek --- drivers/net/mv643xx_eth.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c index af279f26c407..8a91d79383dd 100644 --- a/drivers/net/mv643xx_eth.c +++ b/drivers/net/mv643xx_eth.c @@ -509,10 +509,8 @@ static void rxq_refill(struct rx_queue *rxq) skb_reserve(skb, 2); } - if (rxq->rx_desc_count != rxq->rx_ring_size) { - rxq->rx_oom.expires = jiffies + (HZ / 10); - add_timer(&rxq->rx_oom); - } + if (rxq->rx_desc_count != rxq->rx_ring_size) + mod_timer(&rxq->rx_oom, jiffies + (HZ / 10)); spin_unlock_irqrestore(&mp->lock, flags); } From 8e0b1bf6ac6c4c6dd985e586cd765aede4678bba Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Sun, 24 Aug 2008 02:30:42 +0200 Subject: [PATCH 06/73] mv643xx_eth: fix inconsistent lock semantics Nicolas Pitre noted that mv643xx_eth_poll was incorrectly using non-IRQ-safe locks while checking whether to wake up the netdevice's transmit queue. Convert the locking to *_irq() variants, since we are running from softirq context where interrupts are enabled. Signed-off-by: Lennert Buytenhek --- drivers/net/mv643xx_eth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c index 8a91d79383dd..30e6d4b8d564 100644 --- a/drivers/net/mv643xx_eth.c +++ b/drivers/net/mv643xx_eth.c @@ -634,9 +634,9 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget) txq_reclaim(mp->txq + i, 0); if (netif_carrier_ok(mp->dev)) { - spin_lock(&mp->lock); + spin_lock_irq(&mp->lock); __txq_maybe_wake(mp->txq + mp->txq_primary); - spin_unlock(&mp->lock); + spin_unlock_irq(&mp->lock); } } #endif From 9e1f37724265725ad4c14fc2ef60a162dc13ac64 Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Sun, 24 Aug 2008 02:33:47 +0200 Subject: [PATCH 07/73] mv643xx_eth: fix NULL pointer dereference in rxq_process() When we are low on memory, the assumption that every descriptor in the receive ring will have an skbuff associated with it does not hold. rxq_process() was assuming that if the receive descriptor it is working on is not owned by the hardware, it can safely be processed and handed to the networking stack. But a descriptor in the receive ring not being owned by the hardware can also happen when we are low on memory and did not manage to refill the receive ring fully. This patch changes rxq_process()'s bailout condition from "the first receive descriptor to be processed is owned by the hardware" to "the first receive descriptor to be processed is owned by the hardware OR the number of valid receive descriptors in the ring is zero". Signed-off-by: Lennert Buytenhek --- drivers/net/mv643xx_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c index 30e6d4b8d564..e33dfc0165f6 100644 --- a/drivers/net/mv643xx_eth.c +++ b/drivers/net/mv643xx_eth.c @@ -527,7 +527,7 @@ static int rxq_process(struct rx_queue *rxq, int budget) int rx; rx = 0; - while (rx < budget) { + while (rx < budget && rxq->rx_desc_count) { struct rx_desc *rx_desc; unsigned int cmd_sts; struct sk_buff *skb; From abe787170bb3888c5e587e8e986711fe32ddf2f9 Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Sun, 24 Aug 2008 03:00:20 +0200 Subject: [PATCH 08/73] mv643xx_eth: enforce multiple-of-8-bytes receive buffer size restriction The mv643xx_eth hardware ignores the lower three bits of the buffer size field in receive descriptors, causing the reception of full-sized packets to fail at some MTUs. Fix this by rounding the size of allocated receive buffers up to a multiple of eight bytes. While we are at it, add a bit of extra space to each receive buffer so that we can handle multiple vlan tags on ingress. Signed-off-by: Lennert Buytenhek --- drivers/net/mv643xx_eth.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c index e33dfc0165f6..a02a5f4a0294 100644 --- a/drivers/net/mv643xx_eth.c +++ b/drivers/net/mv643xx_eth.c @@ -474,11 +474,19 @@ static void rxq_refill(struct rx_queue *rxq) /* * Reserve 2+14 bytes for an ethernet header (the * hardware automatically prepends 2 bytes of dummy - * data to each received packet), 4 bytes for a VLAN - * header, and 4 bytes for the trailing FCS -- 24 - * bytes total. + * data to each received packet), 16 bytes for up to + * four VLAN tags, and 4 bytes for the trailing FCS + * -- 36 bytes total. */ - skb_size = mp->dev->mtu + 24; + skb_size = mp->dev->mtu + 36; + + /* + * Make sure that the skb size is a multiple of 8 + * bytes, as the lower three bits of the receive + * descriptor's buffer size field are ignored by + * the hardware. + */ + skb_size = (skb_size + 7) & ~7; skb = dev_alloc_skb(skb_size + dma_get_cache_alignment() - 1); if (skb == NULL) @@ -552,7 +560,7 @@ static int rxq_process(struct rx_queue *rxq, int budget) spin_unlock_irqrestore(&mp->lock, flags); dma_unmap_single(NULL, rx_desc->buf_ptr + 2, - mp->dev->mtu + 24, DMA_FROM_DEVICE); + rx_desc->buf_size, DMA_FROM_DEVICE); rxq->rx_desc_count--; rx++; From c4560318cf8fed91e3146a3c1247e11542d91d91 Mon Sep 17 00:00:00 2001 From: Lennert Buytenhek Date: Sun, 24 Aug 2008 07:33:05 +0200 Subject: [PATCH 09/73] mv643xx_eth: bump version to 1.3 Signed-off-by: Lennert Buytenhek --- drivers/net/mv643xx_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c index a02a5f4a0294..0a18b9e96da1 100644 --- a/drivers/net/mv643xx_eth.c +++ b/drivers/net/mv643xx_eth.c @@ -55,7 +55,7 @@ #include static char mv643xx_eth_driver_name[] = "mv643xx_eth"; -static char mv643xx_eth_driver_version[] = "1.2"; +static char mv643xx_eth_driver_version[] = "1.3"; #define MV643XX_ETH_CHECKSUM_OFFLOAD_TX #define MV643XX_ETH_NAPI From 30c2235cbc477d4629983d440cdc4f496fec9246 Mon Sep 17 00:00:00 2001 From: Vlad Yasevich Date: Mon, 25 Aug 2008 15:16:19 -0700 Subject: [PATCH 10/73] sctp: add verification checks to SCTP_AUTH_KEY option The structure used for SCTP_AUTH_KEY option contains a length that needs to be verfied to prevent buffer overflow conditions. Spoted by Eugene Teo . Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller --- net/sctp/auth.c | 4 ++++ net/sctp/socket.c | 5 +++++ 2 files changed, 9 insertions(+) diff --git a/net/sctp/auth.c b/net/sctp/auth.c index 675a5c3e68a6..1fcb4cf2f4c9 100644 --- a/net/sctp/auth.c +++ b/net/sctp/auth.c @@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp) { struct sctp_auth_bytes *key; + /* Verify that we are not going to overflow INT_MAX */ + if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes)) + return NULL; + /* Allocate the shared key */ key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp); if (!key) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index bb5c9ef13046..afa952e726d7 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -3144,6 +3144,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk, goto out; } + if (authkey->sca_keylength > optlen) { + ret = -EINVAL; + goto out; + } + asoc = sctp_id2assoc(sk, authkey->sca_assoc_id); if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) { ret = -EINVAL; From 2f4520d35d89ca6c5cd129c38e3b11f0283b7d1b Mon Sep 17 00:00:00 2001 From: Al Viro Date: Mon, 25 Aug 2008 15:17:44 -0700 Subject: [PATCH 11/73] ipv4: sysctl fixes net.ipv4.neigh should be a part of skeleton to avoid ordering problems Signed-off-by: Al Viro Signed-off-by: David S. Miller --- net/ipv4/route.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/net/ipv4/route.c b/net/ipv4/route.c index cca921ea8550..e91bafeb32f4 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -3116,13 +3116,22 @@ static ctl_table ipv4_route_table[] = { { .ctl_name = 0 } }; -static __net_initdata struct ctl_path ipv4_route_path[] = { - { .procname = "net", .ctl_name = CTL_NET, }, - { .procname = "ipv4", .ctl_name = NET_IPV4, }, - { .procname = "route", .ctl_name = NET_IPV4_ROUTE, }, - { }, +static struct ctl_table empty[1]; + +static struct ctl_table ipv4_skeleton[] = +{ + { .procname = "route", .ctl_name = NET_IPV4_ROUTE, + .child = ipv4_route_table}, + { .procname = "neigh", .ctl_name = NET_IPV4_NEIGH, + .child = empty}, + { } }; +static __net_initdata struct ctl_path ipv4_path[] = { + { .procname = "net", .ctl_name = CTL_NET, }, + { .procname = "ipv4", .ctl_name = NET_IPV4, }, + { }, +}; static struct ctl_table ipv4_route_flush_table[] = { { @@ -3136,6 +3145,13 @@ static struct ctl_table ipv4_route_flush_table[] = { { .ctl_name = 0 }, }; +static __net_initdata struct ctl_path ipv4_route_path[] = { + { .procname = "net", .ctl_name = CTL_NET, }, + { .procname = "ipv4", .ctl_name = NET_IPV4, }, + { .procname = "route", .ctl_name = NET_IPV4_ROUTE, }, + { }, +}; + static __net_init int sysctl_route_net_init(struct net *net) { struct ctl_table *tbl; @@ -3287,7 +3303,7 @@ int __init ip_rt_init(void) */ void __init ip_static_sysctl_init(void) { - register_sysctl_paths(ipv4_route_path, ipv4_route_table); + register_sysctl_paths(ipv4_path, ipv4_skeleton); } #endif From ce3113ec57abcd41cc5a2fed02474aee3f63d12c Mon Sep 17 00:00:00 2001 From: Al Viro Date: Mon, 25 Aug 2008 15:18:15 -0700 Subject: [PATCH 12/73] ipv6: sysctl fixes Braino: net.ipv6 in ipv6 skeleton has no business in rotable class Signed-off-by: Al Viro Signed-off-by: David S. Miller --- net/ipv6/sysctl_net_ipv6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c index e6dfaeac6be3..587f8f60c489 100644 --- a/net/ipv6/sysctl_net_ipv6.c +++ b/net/ipv6/sysctl_net_ipv6.c @@ -156,7 +156,7 @@ static struct ctl_table_header *ip6_base; int ipv6_static_sysctl_register(void) { static struct ctl_table empty[1]; - ip6_base = register_net_sysctl_rotable(net_ipv6_ctl_path, empty); + ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty); if (ip6_base == NULL) return -ENOMEM; return 0; From 2772f9037355a031725987661621290380e58f52 Mon Sep 17 00:00:00 2001 From: Eilon Greenstein Date: Mon, 25 Aug 2008 15:19:17 -0700 Subject: [PATCH 13/73] bnx2x: Rx work check The has Rx work check was wrong: when the FW was at the end of the page, the driver was already at the beginning of the next page. Since the check only validated that both driver and FW are pointing to the same place, it concluded that there is still work to be done. This caused some serious issues including long latency results on ping-pong test and lockups while unloading the driver in that condition. Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller --- drivers/net/bnx2x.h | 2 +- drivers/net/bnx2x_main.c | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h index b468f904c7f8..a14dba1afcc5 100644 --- a/drivers/net/bnx2x.h +++ b/drivers/net/bnx2x.h @@ -271,7 +271,7 @@ struct bnx2x_fastpath { (fp->tx_pkt_prod != fp->tx_pkt_cons)) #define BNX2X_HAS_RX_WORK(fp) \ - (fp->rx_comp_cons != le16_to_cpu(*fp->rx_cons_sb)) + (fp->rx_comp_cons != rx_cons_sb) #define BNX2X_HAS_WORK(fp) (BNX2X_HAS_RX_WORK(fp) || BNX2X_HAS_TX_WORK(fp)) diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c index 971576b43687..272f5d112bb3 100644 --- a/drivers/net/bnx2x_main.c +++ b/drivers/net/bnx2x_main.c @@ -9250,6 +9250,7 @@ static int bnx2x_poll(struct napi_struct *napi, int budget) napi); struct bnx2x *bp = fp->bp; int work_done = 0; + u16 rx_cons_sb; #ifdef BNX2X_STOP_ON_ERROR if (unlikely(bp->panic)) @@ -9265,10 +9266,16 @@ static int bnx2x_poll(struct napi_struct *napi, int budget) if (BNX2X_HAS_TX_WORK(fp)) bnx2x_tx_int(fp, budget); + rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb); + if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT) + rx_cons_sb++; if (BNX2X_HAS_RX_WORK(fp)) work_done = bnx2x_rx_int(fp, budget); rmb(); /* BNX2X_HAS_WORK() reads the status block */ + rx_cons_sb = le16_to_cpu(*fp->rx_cons_sb); + if ((rx_cons_sb & MAX_RCQ_DESC_CNT) == MAX_RCQ_DESC_CNT) + rx_cons_sb++; /* must not complete if we consumed full budget */ if ((work_done < budget) && !BNX2X_HAS_WORK(fp)) { From 7add905f93fa62d11d45fb1d2d05980661f2ccde Mon Sep 17 00:00:00 2001 From: Eilon Greenstein Date: Mon, 25 Aug 2008 15:20:48 -0700 Subject: [PATCH 14/73] bnx2x: Fan failure mechanism on additional design The A1021G board is also using the fan failure mechanism in the same way the A1022G board does Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller --- drivers/net/bnx2x_main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c index 272f5d112bb3..2e207b8eea97 100644 --- a/drivers/net/bnx2x_main.c +++ b/drivers/net/bnx2x_main.c @@ -2550,6 +2550,7 @@ static inline void bnx2x_attn_int_deasserted0(struct bnx2x *bp, u32 attn) BNX2X_ERR("SPIO5 hw attention\n"); switch (bp->common.board & SHARED_HW_CFG_BOARD_TYPE_MASK) { + case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1021G: case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G: /* Fan failure attention */ @@ -5337,6 +5338,7 @@ static int bnx2x_init_common(struct bnx2x *bp) } switch (bp->common.board & SHARED_HW_CFG_BOARD_TYPE_MASK) { + case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1021G: case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G: /* Fan failure is indicated by SPIO 5 */ bnx2x_set_spio(bp, MISC_REGISTERS_SPIO_5, @@ -5531,6 +5533,7 @@ static int bnx2x_init_port(struct bnx2x *bp) /* Port DMAE comes here */ switch (bp->common.board & SHARED_HW_CFG_BOARD_TYPE_MASK) { + case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1021G: case SHARED_HW_CFG_BOARD_TYPE_BCM957710A1022G: /* add SPIO 5 to group 0 */ val = REG_RD(bp, MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0); From 76b190c592d952b37227f057a14f39e316754156 Mon Sep 17 00:00:00 2001 From: Eilon Greenstein Date: Mon, 25 Aug 2008 15:22:46 -0700 Subject: [PATCH 15/73] bnx2x: Minimize lock time After iSCSI boot, the HW lock should only protect the flag so only the first function will reset the chip and not then entire chip reset process Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller --- drivers/net/bnx2x_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c index 2e207b8eea97..9972d0c02677 100644 --- a/drivers/net/bnx2x_main.c +++ b/drivers/net/bnx2x_main.c @@ -6824,6 +6824,10 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp) */ bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI); val = REG_RD(bp, DORQ_REG_NORM_CID_OFST); + if (val == 0x7) + REG_WR(bp, DORQ_REG_NORM_CID_OFST, 0); + bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI); + if (val == 0x7) { u32 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS; /* save our func */ @@ -6901,7 +6905,6 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp) (SHMEM_RD(bp, func_mb[bp->func].drv_mb_header) & DRV_MSG_SEQ_NUMBER_MASK); } - bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI); } } From 46230476b7c66f7cbc013b771873c797f7ba770b Mon Sep 17 00:00:00 2001 From: Eilon Greenstein Date: Mon, 25 Aug 2008 15:23:30 -0700 Subject: [PATCH 16/73] bnx2x: HW lock timeout Increasing the lock timeout to 5 seconds instead of 1 second to minimize the chance of failures due to timeout Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller --- drivers/net/bnx2x_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c index 9972d0c02677..cb91802ea48a 100644 --- a/drivers/net/bnx2x_main.c +++ b/drivers/net/bnx2x_main.c @@ -1717,8 +1717,8 @@ static int bnx2x_acquire_hw_lock(struct bnx2x *bp, u32 resource) return -EEXIST; } - /* Try for 1 second every 5ms */ - for (cnt = 0; cnt < 200; cnt++) { + /* Try for 5 second every 5ms */ + for (cnt = 0; cnt < 1000; cnt++) { /* Try to acquire the lock */ REG_WR(bp, hw_lock_control_reg + 4, resource_bit); lock_status = REG_RD(bp, hw_lock_control_reg); From 3cdf1db7db1649771d683b6ba323ff604ea3cc5e Mon Sep 17 00:00:00 2001 From: Yitchak Gertner Date: Mon, 25 Aug 2008 15:24:21 -0700 Subject: [PATCH 17/73] bnx2x: Initialization structure The TPA initialization is part of the FW internal memory initialization and so it is moved to the appropriate function Signed-off-by: Yitchak Gertner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller --- drivers/net/bnx2x_main.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c index cb91802ea48a..398daeb5be90 100644 --- a/drivers/net/bnx2x_main.c +++ b/drivers/net/bnx2x_main.c @@ -4606,6 +4606,17 @@ static void bnx2x_init_internal_common(struct bnx2x *bp) { int i; + if (bp->flags & TPA_ENABLE_FLAG) { + struct tstorm_eth_tpa_exist tpa = {0}; + + tpa.tpa_exist = 1; + + REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_TPA_EXIST_OFFSET, + ((u32 *)&tpa)[0]); + REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_TPA_EXIST_OFFSET + 4, + ((u32 *)&tpa)[1]); + } + /* Zero this manually as its initialization is currently missing in the initTool */ for (i = 0; i < (USTORM_AGG_DATA_SIZE >> 2); i++) @@ -5365,17 +5376,6 @@ static int bnx2x_init_common(struct bnx2x *bp) enable_blocks_attention(bp); - if (bp->flags & TPA_ENABLE_FLAG) { - struct tstorm_eth_tpa_exist tmp = {0}; - - tmp.tpa_exist = 1; - - REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_TPA_EXIST_OFFSET, - ((u32 *)&tmp)[0]); - REG_WR(bp, BAR_TSTRORM_INTMEM + TSTORM_TPA_EXIST_OFFSET + 4, - ((u32 *)&tmp)[1]); - } - if (!BP_NOMCP(bp)) { bnx2x_acquire_phy_lock(bp); bnx2x_common_init_phy(bp, bp->common.shmem_base); From d101463499b769d04e37d3bcb0e0c6876780ce08 Mon Sep 17 00:00:00 2001 From: Yitchak Gertner Date: Mon, 25 Aug 2008 15:25:45 -0700 Subject: [PATCH 18/73] bnx2x: NIC load failure cleanup Load failures were not handled correctly Signed-off-by: Yitchak Gertner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller --- drivers/net/bnx2x_main.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c index 398daeb5be90..1c81da45f691 100644 --- a/drivers/net/bnx2x_main.c +++ b/drivers/net/bnx2x_main.c @@ -6341,7 +6341,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode) rc = bnx2x_init_hw(bp, load_code); if (rc) { BNX2X_ERR("HW init failed, aborting\n"); - goto load_error; + goto load_int_disable; } /* Setup NIC internals and enable interrupts */ @@ -6353,7 +6353,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode) if (!load_code) { BNX2X_ERR("MCP response failure, aborting\n"); rc = -EBUSY; - goto load_int_disable; + goto load_rings_free; } } @@ -6372,7 +6372,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode) rc = bnx2x_setup_leading(bp); if (rc) { BNX2X_ERR("Setup leading failed!\n"); - goto load_stop_netif; + goto load_netif_stop; } if (CHIP_IS_E1H(bp)) @@ -6385,7 +6385,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode) for_each_nondefault_queue(bp, i) { rc = bnx2x_setup_multi(bp, i); if (rc) - goto load_stop_netif; + goto load_netif_stop; } if (CHIP_IS_E1(bp)) @@ -6430,20 +6430,18 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode) return 0; -load_stop_netif: +load_netif_stop: for_each_queue(bp, i) napi_disable(&bnx2x_fp(bp, i, napi)); - -load_int_disable: - bnx2x_int_disable_sync(bp); - - /* Release IRQs */ - bnx2x_free_irq(bp); - +load_rings_free: /* Free SKBs, SGEs, TPA pool and driver internals */ bnx2x_free_skbs(bp); for_each_queue(bp, i) bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE); +load_int_disable: + bnx2x_int_disable_sync(bp); + /* Release IRQs */ + bnx2x_free_irq(bp); load_error: bnx2x_free_mem(bp); From 65abd74dd52a79226070904f138f3f8cbcdcf10b Mon Sep 17 00:00:00 2001 From: Yitchak Gertner Date: Mon, 25 Aug 2008 15:26:24 -0700 Subject: [PATCH 19/73] bnx2x: NAPI and interrupts enable/disable Fixing the order of enabling and disabling NAPI and the interrupts Signed-off-by: Yitchak Gertner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller --- drivers/net/bnx2x_main.c | 151 +++++++++++++++++++-------------------- 1 file changed, 74 insertions(+), 77 deletions(-) diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c index 1c81da45f691..f0b04c98e45e 100644 --- a/drivers/net/bnx2x_main.c +++ b/drivers/net/bnx2x_main.c @@ -6058,6 +6058,44 @@ static int bnx2x_req_irq(struct bnx2x *bp) return rc; } +static void bnx2x_napi_enable(struct bnx2x *bp) +{ + int i; + + for_each_queue(bp, i) + napi_enable(&bnx2x_fp(bp, i, napi)); +} + +static void bnx2x_napi_disable(struct bnx2x *bp) +{ + int i; + + for_each_queue(bp, i) + napi_disable(&bnx2x_fp(bp, i, napi)); +} + +static void bnx2x_netif_start(struct bnx2x *bp) +{ + if (atomic_dec_and_test(&bp->intr_sem)) { + if (netif_running(bp->dev)) { + if (bp->state == BNX2X_STATE_OPEN) + netif_wake_queue(bp->dev); + bnx2x_napi_enable(bp); + bnx2x_int_enable(bp); + } + } +} + +static void bnx2x_netif_stop(struct bnx2x *bp) +{ + bnx2x_int_disable_sync(bp); + if (netif_running(bp->dev)) { + bnx2x_napi_disable(bp); + netif_tx_disable(bp->dev); + bp->dev->trans_start = jiffies; /* prevent tx timeout */ + } +} + /* * Init service functions */ @@ -6363,8 +6401,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode) /* Enable Rx interrupt handling before sending the ramrod as it's completed on Rx FP queue */ - for_each_queue(bp, i) - napi_enable(&bnx2x_fp(bp, i, napi)); + bnx2x_napi_enable(bp); /* Enable interrupt handling */ atomic_set(&bp->intr_sem, 0); @@ -6431,8 +6468,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode) return 0; load_netif_stop: - for_each_queue(bp, i) - napi_disable(&bnx2x_fp(bp, i, napi)); + bnx2x_napi_disable(bp); load_rings_free: /* Free SKBs, SGEs, TPA pool and driver internals */ bnx2x_free_skbs(bp); @@ -6614,11 +6650,9 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode) bp->rx_mode = BNX2X_RX_MODE_NONE; bnx2x_set_storm_rx_mode(bp); - if (netif_running(bp->dev)) { - netif_tx_disable(bp->dev); - bp->dev->trans_start = jiffies; /* prevent tx timeout */ - } - + bnx2x_netif_stop(bp); + if (!netif_running(bp->dev)) + bnx2x_napi_disable(bp); del_timer_sync(&bp->timer); SHMEM_WR(bp, func_mb[BP_FUNC(bp)].drv_pulse_mb, (DRV_PULSE_ALWAYS_ALIVE | bp->fw_drv_pulse_wr_seq)); @@ -6632,9 +6666,7 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode) smp_rmb(); while (BNX2X_HAS_TX_WORK(fp)) { - if (!netif_running(bp->dev)) - bnx2x_tx_int(fp, 1000); - + bnx2x_tx_int(fp, 1000); if (!cnt) { BNX2X_ERR("timeout waiting for queue[%d]\n", i); @@ -6650,18 +6682,42 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode) smp_rmb(); } } - /* Give HW time to discard old tx messages */ msleep(1); - for_each_queue(bp, i) - napi_disable(&bnx2x_fp(bp, i, napi)); - /* Disable interrupts after Tx and Rx are disabled on stack level */ - bnx2x_int_disable_sync(bp); - /* Release IRQs */ bnx2x_free_irq(bp); + if (CHIP_IS_E1(bp)) { + struct mac_configuration_cmd *config = + bnx2x_sp(bp, mcast_config); + + bnx2x_set_mac_addr_e1(bp, 0); + + for (i = 0; i < config->hdr.length_6b; i++) + CAM_INVALIDATE(config->config_table[i]); + + config->hdr.length_6b = i; + if (CHIP_REV_IS_SLOW(bp)) + config->hdr.offset = BNX2X_MAX_EMUL_MULTI*(1 + port); + else + config->hdr.offset = BNX2X_MAX_MULTICAST*(1 + port); + config->hdr.client_id = BP_CL_ID(bp); + config->hdr.reserved1 = 0; + + bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_SET_MAC, 0, + U64_HI(bnx2x_sp_mapping(bp, mcast_config)), + U64_LO(bnx2x_sp_mapping(bp, mcast_config)), 0); + + } else { /* E1H */ + REG_WR(bp, NIG_REG_LLH0_FUNC_EN + port*8, 0); + + bnx2x_set_mac_addr_e1h(bp, 0); + + for (i = 0; i < MC_HASH_SIZE; i++) + REG_WR(bp, MC_HASH_OFFSET(bp, i), 0); + } + if (unload_mode == UNLOAD_NORMAL) reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS; @@ -6690,37 +6746,6 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode) } else reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS; - if (CHIP_IS_E1(bp)) { - struct mac_configuration_cmd *config = - bnx2x_sp(bp, mcast_config); - - bnx2x_set_mac_addr_e1(bp, 0); - - for (i = 0; i < config->hdr.length_6b; i++) - CAM_INVALIDATE(config->config_table[i]); - - config->hdr.length_6b = i; - if (CHIP_REV_IS_SLOW(bp)) - config->hdr.offset = BNX2X_MAX_EMUL_MULTI*(1 + port); - else - config->hdr.offset = BNX2X_MAX_MULTICAST*(1 + port); - config->hdr.client_id = BP_CL_ID(bp); - config->hdr.reserved1 = 0; - - bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_SET_MAC, 0, - U64_HI(bnx2x_sp_mapping(bp, mcast_config)), - U64_LO(bnx2x_sp_mapping(bp, mcast_config)), 0); - - } else { /* E1H */ - bnx2x_set_mac_addr_e1h(bp, 0); - - for (i = 0; i < MC_HASH_SIZE; i++) - REG_WR(bp, MC_HASH_OFFSET(bp, i), 0); - } - - if (CHIP_IS_E1H(bp)) - REG_WR(bp, NIG_REG_LLH0_FUNC_EN + port*8, 0); - /* Close multi and leading connections Completions for ramrods are collected in a synchronous way */ for_each_nondefault_queue(bp, i) @@ -8621,34 +8646,6 @@ test_mem_exit: return rc; } -static void bnx2x_netif_start(struct bnx2x *bp) -{ - int i; - - if (atomic_dec_and_test(&bp->intr_sem)) { - if (netif_running(bp->dev)) { - bnx2x_int_enable(bp); - for_each_queue(bp, i) - napi_enable(&bnx2x_fp(bp, i, napi)); - if (bp->state == BNX2X_STATE_OPEN) - netif_wake_queue(bp->dev); - } - } -} - -static void bnx2x_netif_stop(struct bnx2x *bp) -{ - int i; - - if (netif_running(bp->dev)) { - netif_tx_disable(bp->dev); - bp->dev->trans_start = jiffies; /* prevent tx timeout */ - for_each_queue(bp, i) - napi_disable(&bnx2x_fp(bp, i, napi)); - } - bnx2x_int_disable_sync(bp); -} - static void bnx2x_wait_for_link(struct bnx2x *bp, u8 link_up) { int cnt = 1000; From 231fd58a4d21aa633db734274a27a67395155e51 Mon Sep 17 00:00:00 2001 From: Yitchak Gertner Date: Mon, 25 Aug 2008 15:27:06 -0700 Subject: [PATCH 20/73] bnx2x: Multi Queue The multi queue support is still disabled by default for the bnx2x (needs some more testing and validation), but there are 2 obvious bug in it which are fixed in this patch Signed-off-by: Yitchak Gertner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller --- drivers/net/bnx2x_main.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c index f0b04c98e45e..95e058238afe 100644 --- a/drivers/net/bnx2x_main.c +++ b/drivers/net/bnx2x_main.c @@ -6492,7 +6492,7 @@ static int bnx2x_stop_multi(struct bnx2x *bp, int index) /* halt the connection */ bp->fp[index].state = BNX2X_FP_STATE_HALTING; - bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_HALT, index, 0, 0, 0); + bnx2x_sp_post(bp, RAMROD_CMD_ID_ETH_HALT, index, 0, index, 0); /* Wait for completion */ rc = bnx2x_wait_ramrod(bp, BNX2X_FP_STATE_HALTED, index, @@ -9492,8 +9492,7 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev) fp_index = (smp_processor_id() % bp->num_queues); fp = &bp->fp[fp_index]; - if (unlikely(bnx2x_tx_avail(bp->fp) < - (skb_shinfo(skb)->nr_frags + 3))) { + if (unlikely(bnx2x_tx_avail(fp) < (skb_shinfo(skb)->nr_frags + 3))) { bp->eth_stats.driver_xoff++, netif_stop_queue(dev); BNX2X_ERR("BUG! Tx ring full when queue awake!\n"); @@ -9556,7 +9555,6 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev) tx_bd->vlan = cpu_to_le16(pkt_prod); if (xmit_type) { - /* turn on parsing and get a BD */ bd_prod = TX_BD(NEXT_TX_IDX(bd_prod)); pbd = (void *)&fp->tx_desc_ring[bd_prod]; From c2d42545774c4bba7232521d836d0793330e3a4e Mon Sep 17 00:00:00 2001 From: Eilon Greenstein Date: Mon, 25 Aug 2008 15:30:39 -0700 Subject: [PATCH 21/73] bnx2x: Version update Version update Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller --- drivers/net/bnx2x_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c index 95e058238afe..82deea0a63f5 100644 --- a/drivers/net/bnx2x_main.c +++ b/drivers/net/bnx2x_main.c @@ -59,8 +59,8 @@ #include "bnx2x.h" #include "bnx2x_init.h" -#define DRV_MODULE_VERSION "1.45.17" -#define DRV_MODULE_RELDATE "2008/08/13" +#define DRV_MODULE_VERSION "1.45.20" +#define DRV_MODULE_RELDATE "2008/08/25" #define BNX2X_BC_VER 0x040200 /* Time in jiffies before concluding the transmitter is hung */ From 3c34a5d821b825b720189e87561ba18500cf8026 Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Mon, 18 Aug 2008 15:40:02 -0400 Subject: [PATCH 22/73] atmel: return ENOENT on request_firmware failure Return errors from request_firmware() (like other drivers that do firmware load on device open) and make up plausible codes for other error conditions. Gives userspace tools like NetworkManager a clue that firmware may be missing when the result of setting IFF_UP is ENOENT. Signed-off-by: Dan Williams v2: fix reversed check of atmel_wakeup_firmware() in probe_atmel_card() Signed-off-by: John W. Linville --- drivers/net/wireless/atmel.c | 41 +++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c index bd35bb0a1480..f23bcd07dee8 100644 --- a/drivers/net/wireless/atmel.c +++ b/drivers/net/wireless/atmel.c @@ -1304,7 +1304,7 @@ EXPORT_SYMBOL(atmel_open); int atmel_open(struct net_device *dev) { struct atmel_private *priv = netdev_priv(dev); - int i, channel; + int i, channel, err; /* any scheduled timer is no longer needed and might screw things up.. */ del_timer_sync(&priv->management_timer); @@ -1328,8 +1328,9 @@ int atmel_open(struct net_device *dev) priv->site_survey_state = SITE_SURVEY_IDLE; priv->station_is_associated = 0; - if (!reset_atmel_card(dev)) - return -EAGAIN; + err = reset_atmel_card(dev); + if (err) + return err; if (priv->config_reg_domain) { priv->reg_domain = priv->config_reg_domain; @@ -3580,12 +3581,12 @@ static int atmel_wakeup_firmware(struct atmel_private *priv) if (i == 0) { printk(KERN_ALERT "%s: MAC failed to boot.\n", priv->dev->name); - return 0; + return -EIO; } if ((priv->host_info_base = atmel_read16(priv->dev, MR2)) == 0xffff) { printk(KERN_ALERT "%s: card missing.\n", priv->dev->name); - return 0; + return -ENODEV; } /* now check for completion of MAC initialization through @@ -3609,19 +3610,19 @@ static int atmel_wakeup_firmware(struct atmel_private *priv) if (i == 0) { printk(KERN_ALERT "%s: MAC failed to initialise.\n", priv->dev->name); - return 0; + return -EIO; } /* Check for MAC_INIT_OK only on the register that the MAC_INIT_OK was set */ if ((mr3 & MAC_INIT_COMPLETE) && !(atmel_read16(priv->dev, MR3) & MAC_INIT_OK)) { printk(KERN_ALERT "%s: MAC failed MR3 self-test.\n", priv->dev->name); - return 0; + return -EIO; } if ((mr1 & MAC_INIT_COMPLETE) && !(atmel_read16(priv->dev, MR1) & MAC_INIT_OK)) { printk(KERN_ALERT "%s: MAC failed MR1 self-test.\n", priv->dev->name); - return 0; + return -EIO; } atmel_copy_to_host(priv->dev, (unsigned char *)iface, @@ -3642,7 +3643,7 @@ static int atmel_wakeup_firmware(struct atmel_private *priv) iface->func_ctrl = le16_to_cpu(iface->func_ctrl); iface->mac_status = le16_to_cpu(iface->mac_status); - return 1; + return 0; } /* determine type of memory and MAC address */ @@ -3693,7 +3694,7 @@ static int probe_atmel_card(struct net_device *dev) /* Standard firmware in flash, boot it up and ask for the Mac Address */ priv->card_type = CARD_TYPE_SPI_FLASH; - if (atmel_wakeup_firmware(priv)) { + if (atmel_wakeup_firmware(priv) == 0) { atmel_get_mib(priv, Mac_Address_Mib_Type, 0, dev->dev_addr, 6); /* got address, now squash it again until the network @@ -3835,6 +3836,7 @@ static int reset_atmel_card(struct net_device *dev) struct atmel_private *priv = netdev_priv(dev); u8 configuration; int old_state = priv->station_state; + int err = 0; /* data to add to the firmware names, in priority order this implemenents firmware versioning */ @@ -3868,11 +3870,12 @@ static int reset_atmel_card(struct net_device *dev) dev->name); strcpy(priv->firmware_id, "atmel_at76c502.bin"); } - if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) != 0) { + err = request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev); + if (err != 0) { printk(KERN_ALERT "%s: firmware %s is missing, cannot continue.\n", dev->name, priv->firmware_id); - return 0; + return err; } } else { int fw_index = 0; @@ -3901,7 +3904,7 @@ static int reset_atmel_card(struct net_device *dev) "%s: firmware %s is missing, cannot start.\n", dev->name, priv->firmware_id); priv->firmware_id[0] = '\0'; - return 0; + return -ENOENT; } } @@ -3926,8 +3929,9 @@ static int reset_atmel_card(struct net_device *dev) release_firmware(fw_entry); } - if (!atmel_wakeup_firmware(priv)) - return 0; + err = atmel_wakeup_firmware(priv); + if (err != 0) + return err; /* Check the version and set the correct flag for wpa stuff, old and new firmware is incompatible. @@ -3968,10 +3972,9 @@ static int reset_atmel_card(struct net_device *dev) if (!priv->radio_on_broken) { if (atmel_send_command_wait(priv, CMD_EnableRadio, NULL, 0) == CMD_STATUS_REJECTED_RADIO_OFF) { - printk(KERN_INFO - "%s: cannot turn the radio on. (Hey radio, you're beautiful!)\n", + printk(KERN_INFO "%s: cannot turn the radio on.\n", dev->name); - return 0; + return -EIO; } } @@ -4006,7 +4009,7 @@ static int reset_atmel_card(struct net_device *dev) wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL); } - return 1; + return 0; } static void atmel_send_command(struct atmel_private *priv, int command, From d0c2912fe8df81a8b723fb6ec4d4cdf523cbaff7 Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Mon, 18 Aug 2008 15:32:41 -0400 Subject: [PATCH 23/73] atmel: try open system authentication too When the AP rejects a Shared Key authentication request, try Open System auth too. Signed-off-by: Dan Williams Signed-off-by: John W. Linville --- drivers/net/wireless/atmel.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c index f23bcd07dee8..bd65c485098c 100644 --- a/drivers/net/wireless/atmel.c +++ b/drivers/net/wireless/atmel.c @@ -3062,12 +3062,20 @@ static void authenticate(struct atmel_private *priv, u16 frame_len) } if (status == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) { - /* Do opensystem first, then try sharedkey */ + /* Flip back and forth between WEP auth modes until the max + * authentication tries has been exceeded. + */ if (system == WLAN_AUTH_OPEN) { priv->CurrentAuthentTransactionSeqNum = 0x001; priv->exclude_unencrypted = 1; send_authentication_request(priv, WLAN_AUTH_SHARED_KEY, NULL, 0); return; + } else if ( system == WLAN_AUTH_SHARED_KEY + && priv->wep_is_on) { + priv->CurrentAuthentTransactionSeqNum = 0x001; + priv->exclude_unencrypted = 0; + send_authentication_request(priv, WLAN_AUTH_OPEN, NULL, 0); + return; } else if (priv->connect_to_any_BSS) { int bss_index; From 004829730cb1b03abe7555e1c1faadec62cbcf6f Mon Sep 17 00:00:00 2001 From: Jiri Slaby Date: Mon, 18 Aug 2008 21:45:27 +0200 Subject: [PATCH 24/73] Ath5k: lock beacons Beacons setup and config was racy with beacon send. Ensure that ISR and reset functions see consistent state of bbuf. Use also dev_kfree_skb_any in ath5k_txbuf_free since we call it from atomic now. Signed-off-by: Jiri Slaby Cc: Nick Kossifidis Cc: Luis R. Rodriguez Signed-off-by: John W. Linville --- drivers/net/wireless/ath5k/base.c | 15 ++++++++++++--- drivers/net/wireless/ath5k/base.h | 1 + 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c index b20a45aa8680..7bc012fca059 100644 --- a/drivers/net/wireless/ath5k/base.c +++ b/drivers/net/wireless/ath5k/base.c @@ -251,7 +251,7 @@ static inline void ath5k_txbuf_free(struct ath5k_softc *sc, return; pci_unmap_single(sc->pdev, bf->skbaddr, bf->skb->len, PCI_DMA_TODEVICE); - dev_kfree_skb(bf->skb); + dev_kfree_skb_any(bf->skb); bf->skb = NULL; } @@ -466,6 +466,7 @@ ath5k_pci_probe(struct pci_dev *pdev, mutex_init(&sc->lock); spin_lock_init(&sc->rxbuflock); spin_lock_init(&sc->txbuflock); + spin_lock_init(&sc->block); /* Set private data */ pci_set_drvdata(pdev, hw); @@ -2179,8 +2180,11 @@ ath5k_beacon_config(struct ath5k_softc *sc) sc->imask |= AR5K_INT_SWBA; - if (ath5k_hw_hasveol(ah)) + if (ath5k_hw_hasveol(ah)) { + spin_lock(&sc->block); ath5k_beacon_send(sc); + spin_unlock(&sc->block); + } } /* TODO else AP */ @@ -2403,7 +2407,9 @@ ath5k_intr(int irq, void *dev_id) TSF_TO_TU(tsf), (unsigned long long) tsf); } else { + spin_lock(&sc->block); ath5k_beacon_send(sc); + spin_unlock(&sc->block); } } if (status & AR5K_INT_RXEOL) { @@ -3050,6 +3056,7 @@ static int ath5k_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb) { struct ath5k_softc *sc = hw->priv; + unsigned long flags; int ret; ath5k_debug_dump_skb(sc, skb, "BC ", 1); @@ -3059,12 +3066,14 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb) goto end; } + spin_lock_irqsave(&sc->block, flags); ath5k_txbuf_free(sc, sc->bbuf); sc->bbuf->skb = skb; ret = ath5k_beacon_setup(sc, sc->bbuf); if (ret) sc->bbuf->skb = NULL; - else { + spin_unlock_irqrestore(&sc->block, flags); + if (!ret) { ath5k_beacon_config(sc); mmiowb(); } diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h index d7e03e6b8271..7ec2f377d5c7 100644 --- a/drivers/net/wireless/ath5k/base.h +++ b/drivers/net/wireless/ath5k/base.h @@ -172,6 +172,7 @@ struct ath5k_softc { struct tasklet_struct txtq; /* tx intr tasklet */ struct ath5k_led tx_led; /* tx led */ + spinlock_t block; /* protects beacon */ struct ath5k_buf *bbuf; /* beacon buffer */ unsigned int bhalq, /* SW q for outgoing beacons */ bmisscount, /* missed beacon transmits */ From 67d2e2dfab31b4c0497ce8a84d63efc931f10bb7 Mon Sep 17 00:00:00 2001 From: Jiri Slaby Date: Mon, 18 Aug 2008 21:45:28 +0200 Subject: [PATCH 25/73] Ath5k: fix bintval setup bintval is set to the initial value at .config_interface which is too late, since it overwrites previously set value from .config. Move the initialization to the .add_interface. Signed-off-by: Jiri Slaby Cc: Nick Kossifidis Cc: Luis R. Rodriguez Signed-off-by: John W. Linville --- drivers/net/wireless/ath5k/base.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c index 7bc012fca059..0676c6d84383 100644 --- a/drivers/net/wireless/ath5k/base.c +++ b/drivers/net/wireless/ath5k/base.c @@ -2751,6 +2751,11 @@ static int ath5k_add_interface(struct ieee80211_hw *hw, ret = -EOPNOTSUPP; goto end; } + + /* Set to a reasonable value. Note that this will + * be set to mac80211's value at ath5k_config(). */ + sc->bintval = 1000; + ret = 0; end: mutex_unlock(&sc->lock); @@ -2795,9 +2800,6 @@ ath5k_config_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif, struct ath5k_hw *ah = sc->ah; int ret; - /* Set to a reasonable value. Note that this will - * be set to mac80211's value at ath5k_config(). */ - sc->bintval = 1000; mutex_lock(&sc->lock); if (sc->vif != vif) { ret = -EIO; From 988b02f1bf5b608ef91a9d98c7170d037d0f12e3 Mon Sep 17 00:00:00 2001 From: Felipe Balbi Date: Mon, 18 Aug 2008 22:56:53 +0300 Subject: [PATCH 26/73] net: rfkill: add missing line break Trivial patch adding a missing line break on rfkill_claim_show(). Signed-off-by: Felipe Balbi Acked-by: Ivo van Doorn Signed-off-by: John W. Linville --- net/rfkill/rfkill.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c index 35a9994e2339..74aecc098bad 100644 --- a/net/rfkill/rfkill.c +++ b/net/rfkill/rfkill.c @@ -377,7 +377,7 @@ static ssize_t rfkill_claim_show(struct device *dev, { struct rfkill *rfkill = to_rfkill(dev); - return sprintf(buf, "%d", rfkill->user_claim); + return sprintf(buf, "%d\n", rfkill->user_claim); } static ssize_t rfkill_claim_store(struct device *dev, From 087d833e5a9f67ba933cb32eaf5a2279c1a5b47c Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Tue, 19 Aug 2008 10:54:32 +0300 Subject: [PATCH 27/73] mac80211: Use IWEVASSOCREQIE instead of IWEVCUSTOM The previous code was using IWEVCUSTOM to report IEs from AssocReq and AssocResp frames into user space. This can easily hit the 256 byte limit (IW_CUSTOM_MAX) with APs that include number of vendor IEs in AssocResp. This results in the event message not being sent and dmesg showing "wlan0 (WE) : Wireless Event too big (366)" type of errors. Convert mac80211 to use IWEVASSOCREQIE/IWEVASSOCRESPIE to avoid the issue of being unable to send association IEs as wireless events. These newer event types use binary encoding and larger maximum size (IW_GENERIC_IE_MAX = 1024), so the likelyhood of not being able to send the IEs is much smaller than with IWEVCUSTOM. As an extra benefit, the code is also quite a bit simpler since there is no need to allocate an extra buffer for hex encoding. Signed-off-by: Jouni Malinen Signed-off-by: John W. Linville --- net/mac80211/mlme.c | 48 +++++++++------------------------------------ 1 file changed, 9 insertions(+), 39 deletions(-) diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 1e97fb9fb34b..09a56e24b799 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -478,51 +478,21 @@ int ieee80211_ht_addt_info_ie_to_ht_bss_info( static void ieee80211_sta_send_associnfo(struct net_device *dev, struct ieee80211_if_sta *ifsta) { - char *buf; - size_t len; - int i; union iwreq_data wrqu; - if (!ifsta->assocreq_ies && !ifsta->assocresp_ies) - return; - - buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len + - ifsta->assocresp_ies_len), GFP_KERNEL); - if (!buf) - return; - - len = sprintf(buf, "ASSOCINFO("); if (ifsta->assocreq_ies) { - len += sprintf(buf + len, "ReqIEs="); - for (i = 0; i < ifsta->assocreq_ies_len; i++) { - len += sprintf(buf + len, "%02x", - ifsta->assocreq_ies[i]); - } + memset(&wrqu, 0, sizeof(wrqu)); + wrqu.data.length = ifsta->assocreq_ies_len; + wireless_send_event(dev, IWEVASSOCREQIE, &wrqu, + ifsta->assocreq_ies); } + if (ifsta->assocresp_ies) { - if (ifsta->assocreq_ies) - len += sprintf(buf + len, " "); - len += sprintf(buf + len, "RespIEs="); - for (i = 0; i < ifsta->assocresp_ies_len; i++) { - len += sprintf(buf + len, "%02x", - ifsta->assocresp_ies[i]); - } + memset(&wrqu, 0, sizeof(wrqu)); + wrqu.data.length = ifsta->assocresp_ies_len; + wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, + ifsta->assocresp_ies); } - len += sprintf(buf + len, ")"); - - if (len > IW_CUSTOM_MAX) { - len = sprintf(buf, "ASSOCRESPIE="); - for (i = 0; i < ifsta->assocresp_ies_len; i++) { - len += sprintf(buf + len, "%02x", - ifsta->assocresp_ies[i]); - } - } - - memset(&wrqu, 0, sizeof(wrqu)); - wrqu.data.length = len; - wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf); - - kfree(buf); } From 667d8af9af775a5fea203890978037ea750816cc Mon Sep 17 00:00:00 2001 From: Julia Lawall Date: Sat, 23 Aug 2008 18:27:38 +0200 Subject: [PATCH 28/73] net/mac80211/mesh.c: correct the argument to __mesh_table_free In the function mesh_table_grow, it is the new table not the argument table that should be freed if the function fails (cf commit bd9b448f4c0a514559bdae4ca18ca3e8cd999c6d) The semantic match that detects this problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // @r exists@ local idexpression x; expression E,f; position p1,p2,p3; identifier l; statement S; @@ x = mesh_table_alloc@p1(...) ... if (x == NULL) S ... when != E = x when != mesh_table_free(x) goto@p2 l; ... when != E = x when != f(...,x,...) when any ( return \(0\|x\); | return@p3 ...; ) @script:python@ p1 << r.p1; p2 << r.p2; p3 << r.p3; @@ print "%s: call on line %s not freed or saved before return on line %s via line %s" % (p1[0].file,p1[0].line,p3[0].line,p2[0].line) // Signed-off-by: Julia Lawall Signed-off-by: John W. Linville --- net/mac80211/mesh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c index b5933b271491..35f2f95f2fa7 100644 --- a/net/mac80211/mesh.c +++ b/net/mac80211/mesh.c @@ -383,7 +383,7 @@ errcopy: hlist_for_each_safe(p, q, &newtbl->hash_buckets[i]) tbl->free_node(p, 0); } - __mesh_table_free(tbl); + __mesh_table_free(newtbl); endgrow: return NULL; } From 93015f0f34e81a47c4126329746ce5f364bafd11 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 25 Aug 2008 11:57:06 +0300 Subject: [PATCH 29/73] mac80211: Fix debugfs file add/del for netdev Previous version was using incorrect union structures for non-AP interfaces when adding and removing max_ratectrl_rateidx and force_unicast_rateidx entries. Depending on the vif type, this ended up in corrupting debugfs entries since the dentries inside different union structures ended up going being on top of eachother.. As the end result, debugfs files were being left behind with references to freed data (instant kernel oops on access) and directories were not removed properly when unloading mac80211 drivers. This patch fixes those issues by using only a single union structure based on the vif type. Signed-off-by: Jouni Malinen Signed-off-by: John W. Linville --- net/mac80211/debugfs_netdev.c | 24 ++++++++++++------------ net/mac80211/ieee80211_i.h | 6 ++++++ 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c index 475f89a8aee1..8165df578c92 100644 --- a/net/mac80211/debugfs_netdev.c +++ b/net/mac80211/debugfs_netdev.c @@ -248,8 +248,8 @@ IEEE80211_IF_WFILE(min_discovery_timeout, static void add_sta_files(struct ieee80211_sub_if_data *sdata) { DEBUGFS_ADD(drop_unencrypted, sta); - DEBUGFS_ADD(force_unicast_rateidx, ap); - DEBUGFS_ADD(max_ratectrl_rateidx, ap); + DEBUGFS_ADD(force_unicast_rateidx, sta); + DEBUGFS_ADD(max_ratectrl_rateidx, sta); DEBUGFS_ADD(state, sta); DEBUGFS_ADD(bssid, sta); @@ -283,8 +283,8 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata) static void add_wds_files(struct ieee80211_sub_if_data *sdata) { DEBUGFS_ADD(drop_unencrypted, wds); - DEBUGFS_ADD(force_unicast_rateidx, ap); - DEBUGFS_ADD(max_ratectrl_rateidx, ap); + DEBUGFS_ADD(force_unicast_rateidx, wds); + DEBUGFS_ADD(max_ratectrl_rateidx, wds); DEBUGFS_ADD(peer, wds); } @@ -292,8 +292,8 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata) static void add_vlan_files(struct ieee80211_sub_if_data *sdata) { DEBUGFS_ADD(drop_unencrypted, vlan); - DEBUGFS_ADD(force_unicast_rateidx, ap); - DEBUGFS_ADD(max_ratectrl_rateidx, ap); + DEBUGFS_ADD(force_unicast_rateidx, vlan); + DEBUGFS_ADD(max_ratectrl_rateidx, vlan); } static void add_monitor_files(struct ieee80211_sub_if_data *sdata) @@ -381,8 +381,8 @@ static void add_files(struct ieee80211_sub_if_data *sdata) static void del_sta_files(struct ieee80211_sub_if_data *sdata) { DEBUGFS_DEL(drop_unencrypted, sta); - DEBUGFS_DEL(force_unicast_rateidx, ap); - DEBUGFS_DEL(max_ratectrl_rateidx, ap); + DEBUGFS_DEL(force_unicast_rateidx, sta); + DEBUGFS_DEL(max_ratectrl_rateidx, sta); DEBUGFS_DEL(state, sta); DEBUGFS_DEL(bssid, sta); @@ -416,8 +416,8 @@ static void del_ap_files(struct ieee80211_sub_if_data *sdata) static void del_wds_files(struct ieee80211_sub_if_data *sdata) { DEBUGFS_DEL(drop_unencrypted, wds); - DEBUGFS_DEL(force_unicast_rateidx, ap); - DEBUGFS_DEL(max_ratectrl_rateidx, ap); + DEBUGFS_DEL(force_unicast_rateidx, wds); + DEBUGFS_DEL(max_ratectrl_rateidx, wds); DEBUGFS_DEL(peer, wds); } @@ -425,8 +425,8 @@ static void del_wds_files(struct ieee80211_sub_if_data *sdata) static void del_vlan_files(struct ieee80211_sub_if_data *sdata) { DEBUGFS_DEL(drop_unencrypted, vlan); - DEBUGFS_DEL(force_unicast_rateidx, ap); - DEBUGFS_DEL(max_ratectrl_rateidx, ap); + DEBUGFS_DEL(force_unicast_rateidx, vlan); + DEBUGFS_DEL(max_ratectrl_rateidx, vlan); } static void del_monitor_files(struct ieee80211_sub_if_data *sdata) diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index ec59345af65b..586a9b49b0fc 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -470,6 +470,8 @@ struct ieee80211_sub_if_data { struct dentry *auth_transaction; struct dentry *flags; struct dentry *num_beacons_sta; + struct dentry *force_unicast_rateidx; + struct dentry *max_ratectrl_rateidx; } sta; struct { struct dentry *drop_unencrypted; @@ -483,9 +485,13 @@ struct ieee80211_sub_if_data { struct { struct dentry *drop_unencrypted; struct dentry *peer; + struct dentry *force_unicast_rateidx; + struct dentry *max_ratectrl_rateidx; } wds; struct { struct dentry *drop_unencrypted; + struct dentry *force_unicast_rateidx; + struct dentry *max_ratectrl_rateidx; } vlan; struct { struct dentry *mode; From 8ab65b03b7893da4a49009e7e356e36e27b0c407 Mon Sep 17 00:00:00 2001 From: Jan-Espen Pettersen Date: Mon, 25 Aug 2008 20:29:22 +0200 Subject: [PATCH 30/73] mac80211: don't send empty extended rates IE The association request includes a list of supported data rates. 802.11b: 4 supported rates. 802.11g: 12 (8 + 4) supported rates. 802.11a: 8 supported rates. The rates tag of the assoc request has room for only 8 rates. In case of 802.11g an extended rate tag is appended. However in net/wireless/mlme.c an extended (empty) rate tag is also appended if the number of rates is exact 8. This empty (length=0) extended rates tag causes some APs to deny association with code 18 (unsupported rates). These APs include my ZyXEL G-570U, and according to Tomas Winkler som Cisco APs. 'If count == 8' has been used to check for the need for an extended rates tag. But count would also be equal to 8 if the for loop exited because of no more supported rates. Therefore a check for count being less than rates_len would seem more correct. Thanks to: * Dan Williams for newbie guidance * Tomas Winkler for confirming the problem Signed-off-by: Jan-Espen Pettersen Signed-off-by: John W. Linville --- net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 09a56e24b799..74777ade6b22 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -783,7 +783,7 @@ static void ieee80211_send_assoc(struct net_device *dev, } } - if (count == 8) { + if (rates_len > count) { pos = skb_put(skb, rates_len - count + 2); *pos++ = WLAN_EID_EXT_SUPP_RATES; *pos++ = rates_len - count; From 576fdeaef631976c3afcb1d78ef196051282611d Mon Sep 17 00:00:00 2001 From: "John W. Linville" Date: Tue, 26 Aug 2008 20:33:34 -0400 Subject: [PATCH 31/73] mac80211: quiet chatty IBSS merge message It seems obvious that this #ifndef should be the opposite polarity... Signed-off-by: John W. Linville --- net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 74777ade6b22..9bb68c6a8f44 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -2838,7 +2838,7 @@ static void ieee80211_rx_bss_info(struct net_device *dev, jiffies); #endif /* CONFIG_MAC80211_IBSS_DEBUG */ if (beacon_timestamp > rx_timestamp) { -#ifndef CONFIG_MAC80211_IBSS_DEBUG +#ifdef CONFIG_MAC80211_IBSS_DEBUG printk(KERN_DEBUG "%s: beacon TSF higher than " "local TSF - IBSS merge with BSSID %s\n", dev->name, print_mac(mac, mgmt->bssid)); From 736783b8528bdce7f090dfae66f57411be40c5f8 Mon Sep 17 00:00:00 2001 From: Mike Frysinger Date: Wed, 27 Aug 2008 11:47:57 +0800 Subject: [PATCH 32/73] Blackfin EMAC Driver: the BF526 also supports the MAC, so update things accordingly Signed-off-by: Mike Frysinger Signed-off-by: Bryan Wu Signed-off-by: Jeff Garzik --- drivers/net/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig index a5c141cecd4e..4a11296a9514 100644 --- a/drivers/net/Kconfig +++ b/drivers/net/Kconfig @@ -822,14 +822,14 @@ config ULTRA32 will be called smc-ultra32. config BFIN_MAC - tristate "Blackfin 527/536/537 on-chip mac support" - depends on NET_ETHERNET && (BF527 || BF537 || BF536) + tristate "Blackfin on-chip MAC support" + depends on NET_ETHERNET && (BF526 || BF527 || BF536 || BF537) select CRC32 select MII select PHYLIB select BFIN_MAC_USE_L1 if DMA_UNCACHED_NONE help - This is the driver for blackfin on-chip mac device. Say Y if you want it + This is the driver for Blackfin on-chip mac device. Say Y if you want it compiled into the kernel. This driver is also available as a module ( = code which can be inserted in and removed from the running kernel whenever you want). The module will be called bfin_mac. From 3d01625a4f30ec9db8e964b7fde1f902f522e992 Mon Sep 17 00:00:00 2001 From: Alexander Duyck Date: Tue, 26 Aug 2008 18:30:04 -0700 Subject: [PATCH 33/73] ixgbe: fix vlan filtering VLAN filtering is broken, due to reading the incorrect register for the VLAN filtering settings. Fixed by reading/writing the correct register. Signed-off-by: Alexander Duyck Signed-off-by: Jesse Brandeburg Signed-off-by: Jeff Kirsher Signed-off-by: Jeff Garzik --- drivers/net/ixgbe/ixgbe_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c index 34bca16d48a6..53f41b649f03 100644 --- a/drivers/net/ixgbe/ixgbe_main.c +++ b/drivers/net/ixgbe/ixgbe_main.c @@ -1636,16 +1636,17 @@ static void ixgbe_set_multi(struct net_device *netdev) struct ixgbe_hw *hw = &adapter->hw; struct dev_mc_list *mc_ptr; u8 *mta_list; - u32 fctrl; + u32 fctrl, vlnctrl; int i; /* Check for Promiscuous and All Multicast modes */ fctrl = IXGBE_READ_REG(hw, IXGBE_FCTRL); + vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL); if (netdev->flags & IFF_PROMISC) { fctrl |= (IXGBE_FCTRL_UPE | IXGBE_FCTRL_MPE); - fctrl &= ~IXGBE_VLNCTRL_VFE; + vlnctrl &= ~IXGBE_VLNCTRL_VFE; } else { if (netdev->flags & IFF_ALLMULTI) { fctrl |= IXGBE_FCTRL_MPE; @@ -1653,10 +1654,11 @@ static void ixgbe_set_multi(struct net_device *netdev) } else { fctrl &= ~(IXGBE_FCTRL_UPE | IXGBE_FCTRL_MPE); } - fctrl |= IXGBE_VLNCTRL_VFE; + vlnctrl |= IXGBE_VLNCTRL_VFE; } IXGBE_WRITE_REG(hw, IXGBE_FCTRL, fctrl); + IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl); if (netdev->mc_count) { mta_list = kcalloc(netdev->mc_count, ETH_ALEN, GFP_ATOMIC); From 0623807a18c4baa2effcdb298e8b31d90e3ef69f Mon Sep 17 00:00:00 2001 From: Brice Goglin Date: Tue, 26 Aug 2008 23:29:12 +0200 Subject: [PATCH 34/73] myri10ge: update version string to 1.4.3-1.358 Update myri10ge version string to 1.4.3-1.358. Signed-off-by: Brice Goglin Signed-off-by: Jeff Garzik --- drivers/net/myri10ge/myri10ge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c index 5d76cd09e246..f6847531bf9e 100644 --- a/drivers/net/myri10ge/myri10ge.c +++ b/drivers/net/myri10ge/myri10ge.c @@ -76,7 +76,7 @@ #include "myri10ge_mcp.h" #include "myri10ge_mcp_gen_header.h" -#define MYRI10GE_VERSION_STR "1.3.99-1.347" +#define MYRI10GE_VERSION_STR "1.4.3-1.358" MODULE_DESCRIPTION("Myricom 10G driver (10GbE)"); MODULE_AUTHOR("Maintainer: help@myri.com"); From 666d9bbedfff7c2c37eab92e715641922dee6864 Mon Sep 17 00:00:00 2001 From: Jarek Poplawski Date: Wed, 27 Aug 2008 02:12:52 -0700 Subject: [PATCH 35/73] pkt_sched: Fix dev_graft_qdisc() locking During dev_graft_qdisc() dev is deactivated, so qdisc_root_lock() returns wrong lock of noop_qdisc instead of qdisc_sleeping. Signed-off-by: Jarek Poplawski Acked-by: Herbert Xu Signed-off-by: David S. Miller --- net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index e7fb9e0d21b4..341d558b6e39 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -624,7 +624,7 @@ static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue, struct Qdisc *oqdisc = dev_queue->qdisc_sleeping; spinlock_t *root_lock; - root_lock = qdisc_root_lock(oqdisc); + root_lock = qdisc_lock(oqdisc); spin_lock_bh(root_lock); /* Prune old scheduler */ From a866bbf6aacf95f849810079442a20be118ce905 Mon Sep 17 00:00:00 2001 From: Francois Romieu Date: Tue, 26 Aug 2008 21:56:06 +0200 Subject: [PATCH 36/73] r8169: balance pci_map / pci_unmap pair MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The leak hurts with swiotlb and jumbo frames. Fix http://bugzilla.kernel.org/show_bug.cgi?id=9468. Heavily hinted by Ilpo Järvinen . Signed-off-by: Francois Romieu Tested-by: Alistair John Strachan Tested-by: Timothy J Fontaine Cc: Edward Hsu Signed-off-by: Jeff Garzik --- drivers/net/r8169.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c index a3e3895e5032..0f6f9747d255 100644 --- a/drivers/net/r8169.c +++ b/drivers/net/r8169.c @@ -2792,7 +2792,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev, pkt_size, PCI_DMA_FROMDEVICE); rtl8169_mark_to_asic(desc, tp->rx_buf_sz); } else { - pci_unmap_single(pdev, addr, pkt_size, + pci_unmap_single(pdev, addr, tp->rx_buf_sz, PCI_DMA_FROMDEVICE); tp->Rx_skbuff[entry] = NULL; } From 7a6ea550f2f7592742ac765e5a3b4b5d1461e0bd Mon Sep 17 00:00:00 2001 From: Alexander Duyck Date: Tue, 26 Aug 2008 04:25:03 -0700 Subject: [PATCH 37/73] igb: force all queues to interrupt once every 2 seconds Set the EICS bit for each of the RX queues at least once every 2 seconds to prevent the rx queues from stalling. Signed-off-by: Jeff Kirsher Signed-off-by: Alexander Duyck Signed-off-by: Jeff Garzik --- drivers/net/igb/igb_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c index 8f66e15ec8d6..465a810b670a 100644 --- a/drivers/net/igb/igb_main.c +++ b/drivers/net/igb/igb_main.c @@ -2290,7 +2290,9 @@ static void igb_watchdog_task(struct work_struct *work) struct igb_ring *tx_ring = adapter->tx_ring; struct e1000_mac_info *mac = &adapter->hw.mac; u32 link; + u32 eics = 0; s32 ret_val; + int i; if ((netif_carrier_ok(netdev)) && (rd32(E1000_STATUS) & E1000_STATUS_LU)) @@ -2392,7 +2394,13 @@ link_up: } /* Cause software interrupt to ensure rx ring is cleaned */ - wr32(E1000_ICS, E1000_ICS_RXDMT0); + if (adapter->msix_entries) { + for (i = 0; i < adapter->num_rx_queues; i++) + eics |= adapter->rx_ring[i].eims_value; + wr32(E1000_EICS, eics); + } else { + wr32(E1000_ICS, E1000_ICS_RXDMT0); + } /* Force detection of hung controller every watchdog period */ tx_ring->detect_tx_hung = true; From fe59de38c58d3eedc025be61ff3055a41776bbd4 Mon Sep 17 00:00:00 2001 From: Alexander Duyck Date: Tue, 26 Aug 2008 04:25:05 -0700 Subject: [PATCH 38/73] igb: ethtool -d reads EICR which is incorrect as it is read on clear Ethtool -d is reading the EICR and ICR registers which is currently clearing these registers and masking off interrupts. To prevent this we read the EICS and ICS equivilents as they can be read without clearing or masking. Signed-off-by: Alexander Duyck Signed-off-by: Jeff Kirsher Signed-off-by: Jeff Garzik --- drivers/net/igb/igb_ethtool.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/igb/igb_ethtool.c b/drivers/net/igb/igb_ethtool.c index 11aee1309951..3eb78a66f8b6 100644 --- a/drivers/net/igb/igb_ethtool.c +++ b/drivers/net/igb/igb_ethtool.c @@ -373,13 +373,17 @@ static void igb_get_regs(struct net_device *netdev, regs_buff[12] = rd32(E1000_EECD); /* Interrupt */ - regs_buff[13] = rd32(E1000_EICR); + /* Reading EICS for EICR because they read the + * same but EICS does not clear on read */ + regs_buff[13] = rd32(E1000_EICS); regs_buff[14] = rd32(E1000_EICS); regs_buff[15] = rd32(E1000_EIMS); regs_buff[16] = rd32(E1000_EIMC); regs_buff[17] = rd32(E1000_EIAC); regs_buff[18] = rd32(E1000_EIAM); - regs_buff[19] = rd32(E1000_ICR); + /* Reading ICS for ICR because they read the + * same but ICS does not clear on read */ + regs_buff[19] = rd32(E1000_ICS); regs_buff[20] = rd32(E1000_ICS); regs_buff[21] = rd32(E1000_IMS); regs_buff[22] = rd32(E1000_IMC); From 34a20e89739e9ac1cb89bdf430b694d2c946ebff Mon Sep 17 00:00:00 2001 From: Alexander Duyck Date: Tue, 26 Aug 2008 04:25:13 -0700 Subject: [PATCH 39/73] igb: fix setting the number of tx queues The real_num_tx_queues was not being set when in MSI-X only mode. This patch corrects that path so all interrupt types are correctly configured. Signed-off-by: Alexander Duyck Signed-off-by: Jeff Kirsher Signed-off-by: Jeff Garzik --- drivers/net/igb/igb_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c index 465a810b670a..e6eb13a303c0 100644 --- a/drivers/net/igb/igb_main.c +++ b/drivers/net/igb/igb_main.c @@ -521,7 +521,7 @@ static void igb_set_interrupt_capability(struct igb_adapter *adapter) adapter->msix_entries, numvecs); if (err == 0) - return; + goto out; igb_reset_interrupt_capability(adapter); @@ -531,7 +531,7 @@ msi_only: adapter->num_tx_queues = 1; if (!pci_enable_msi(adapter->pdev)) adapter->flags |= IGB_FLAG_HAS_MSI; - +out: /* Notify the stack of the (possibly) reduced Tx Queue count. */ adapter->netdev->real_num_tx_queues = adapter->num_tx_queues; return; From f4f62301c6f42127b7462274abfcbc278f84d59a Mon Sep 17 00:00:00 2001 From: Heiko Schocher Date: Mon, 25 Aug 2008 20:20:53 -0500 Subject: [PATCH 40/73] fs_enet: Fix SCC Ethernet on CPM2, and crash in fs_enet_rx_napi() Signed-off-by: Heiko Schocher Signed-off-by: Vitaly Bordug Signed-off-by: Kumar Gala Signed-off-by: Jeff Garzik --- arch/powerpc/include/asm/cpm2.h | 5 +++++ drivers/net/fs_enet/fs_enet-main.c | 8 ++++++++ drivers/net/fs_enet/mac-scc.c | 8 +++++++- 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/include/asm/cpm2.h b/arch/powerpc/include/asm/cpm2.h index 2a6fa0183ac9..0f5e8ff59a85 100644 --- a/arch/powerpc/include/asm/cpm2.h +++ b/arch/powerpc/include/asm/cpm2.h @@ -337,6 +337,11 @@ typedef struct scc_param { uint scc_tcrc; /* Internal */ } sccp_t; +/* Function code bits. +*/ +#define SCC_EB ((u_char) 0x10) /* Set big endian byte order */ +#define SCC_GBL ((u_char) 0x20) /* Snooping enabled */ + /* CPM Ethernet through SCC1. */ typedef struct scc_enet { diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c index 9a51ec8293cc..9d461825bf4c 100644 --- a/drivers/net/fs_enet/fs_enet-main.c +++ b/drivers/net/fs_enet/fs_enet-main.c @@ -792,6 +792,10 @@ static int fs_enet_open(struct net_device *dev) int r; int err; + /* to initialize the fep->cur_rx,... */ + /* not doing this, will cause a crash in fs_enet_rx_napi */ + fs_init_bds(fep->ndev); + if (fep->fpi->use_napi) napi_enable(&fep->napi); @@ -1167,6 +1171,10 @@ static struct of_device_id fs_enet_match[] = { .compatible = "fsl,cpm1-scc-enet", .data = (void *)&fs_scc_ops, }, + { + .compatible = "fsl,cpm2-scc-enet", + .data = (void *)&fs_scc_ops, + }, #endif #ifdef CONFIG_FS_ENET_HAS_FCC { diff --git a/drivers/net/fs_enet/mac-scc.c b/drivers/net/fs_enet/mac-scc.c index 029b3c7ef29c..22f50dd8b277 100644 --- a/drivers/net/fs_enet/mac-scc.c +++ b/drivers/net/fs_enet/mac-scc.c @@ -47,7 +47,6 @@ #include "fs_enet.h" /*************************************************/ - #if defined(CONFIG_CPM1) /* for a 8xx __raw_xxx's are sufficient */ #define __fs_out32(addr, x) __raw_writel(x, addr) @@ -62,6 +61,8 @@ #define __fs_out16(addr, x) out_be16(addr, x) #define __fs_in32(addr) in_be32(addr) #define __fs_in16(addr) in_be16(addr) +#define __fs_out8(addr, x) out_8(addr, x) +#define __fs_in8(addr) in_8(addr) #endif /* write, read, set bits, clear bits */ @@ -262,8 +263,13 @@ static void restart(struct net_device *dev) /* Initialize function code registers for big-endian. */ +#ifndef CONFIG_NOT_COHERENT_CACHE + W8(ep, sen_genscc.scc_rfcr, SCC_EB | SCC_GBL); + W8(ep, sen_genscc.scc_tfcr, SCC_EB | SCC_GBL); +#else W8(ep, sen_genscc.scc_rfcr, SCC_EB); W8(ep, sen_genscc.scc_tfcr, SCC_EB); +#endif /* Set maximum bytes per receive buffer. * This appears to be an Ethernet frame size, not the buffer From d3d7b53d1ae46534cd73e1073a5c29e3b61a0552 Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Fri, 22 Aug 2008 19:24:15 +0100 Subject: [PATCH 41/73] [netdrvr] fix build issue: undefined reference to `NS8390p_init' Signed-off-by: Alan 'pass the paper bags' Cox Signed-off-by: Jeff Garzik --- drivers/net/wd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wd.c b/drivers/net/wd.c index 6f9aa1643743..fa14255282af 100644 --- a/drivers/net/wd.c +++ b/drivers/net/wd.c @@ -337,7 +337,7 @@ static int __init wd_probe1(struct net_device *dev, int ioaddr) #ifdef CONFIG_NET_POLL_CONTROLLER dev->poll_controller = ei_poll; #endif - NS8390p_init(dev, 0); + NS8390_init(dev, 0); #if 1 /* Enable interrupt generation on softconfig cards -- M.U */ From 2b356b463933031374c373f70d9a3b14ec707161 Mon Sep 17 00:00:00 2001 From: Martin Schwidefsky Date: Thu, 21 Aug 2008 17:10:22 +0200 Subject: [PATCH 42/73] claw: fix memory leak in claw_probe. probe_error() frees memory only, if cgdev->dev.driver_data refers to the claw_privbk structure. Move forward its setting in claw_probe() to ensure proper freeing of claw_privbk allocations. Cc: Daniel Signed-off-by: Martin Schwidefsky Signed-off-by: Ursula Braun Signed-off-by: Jeff Garzik --- drivers/s390/net/claw.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/drivers/s390/net/claw.c b/drivers/s390/net/claw.c index a08b1682c8e8..cc5697deb1d3 100644 --- a/drivers/s390/net/claw.c +++ b/drivers/s390/net/claw.c @@ -271,6 +271,7 @@ claw_probe(struct ccwgroup_device *cgdev) if (!get_device(&cgdev->dev)) return -ENODEV; privptr = kzalloc(sizeof(struct claw_privbk), GFP_KERNEL); + cgdev->dev.driver_data = privptr; if (privptr == NULL) { probe_error(cgdev); put_device(&cgdev->dev); @@ -305,7 +306,6 @@ claw_probe(struct ccwgroup_device *cgdev) privptr->p_env->p_priv = privptr; cgdev->cdev[0]->handler = claw_irq_handler; cgdev->cdev[1]->handler = claw_irq_handler; - cgdev->dev.driver_data = privptr; CLAW_DBF_TEXT(2, setup, "prbext 0"); return 0; @@ -1960,19 +1960,16 @@ init_ccw_bk(struct net_device *dev) static void probe_error( struct ccwgroup_device *cgdev) { - struct claw_privbk *privptr; + struct claw_privbk *privptr; CLAW_DBF_TEXT(4, trace, "proberr"); - privptr=(struct claw_privbk *)cgdev->dev.driver_data; - if (privptr!=NULL) { + privptr = (struct claw_privbk *) cgdev->dev.driver_data; + if (privptr != NULL) { + cgdev->dev.driver_data = NULL; kfree(privptr->p_env); - privptr->p_env=NULL; - kfree(privptr->p_mtc_envelope); - privptr->p_mtc_envelope=NULL; - kfree(privptr); - privptr=NULL; - } - return; + kfree(privptr->p_mtc_envelope); + kfree(privptr); + } } /* probe_error */ /*-------------------------------------------------------------------* From 6951df34d50330f1b117fd8371d7f7df39f43f6a Mon Sep 17 00:00:00 2001 From: Peter Tiedemann Date: Thu, 21 Aug 2008 17:10:23 +0200 Subject: [PATCH 43/73] claw: netdev->priv vs. netdev->ml_priv Use netdev->ml_priv instead of netdev->priv Signed-off-by: Peter Tiedemann Signed-off-by: Ursula Braun Signed-off-by: Jeff Garzik --- drivers/s390/net/claw.c | 60 ++++++++++++++++++++--------------------- 1 file changed, 30 insertions(+), 30 deletions(-) diff --git a/drivers/s390/net/claw.c b/drivers/s390/net/claw.c index cc5697deb1d3..e10ac9ab2d44 100644 --- a/drivers/s390/net/claw.c +++ b/drivers/s390/net/claw.c @@ -133,14 +133,14 @@ claw_register_debug_facility(void) static inline void claw_set_busy(struct net_device *dev) { - ((struct claw_privbk *) dev->priv)->tbusy=1; + ((struct claw_privbk *)dev->ml_priv)->tbusy = 1; eieio(); } static inline void claw_clear_busy(struct net_device *dev) { - clear_bit(0, &(((struct claw_privbk *) dev->priv)->tbusy)); + clear_bit(0, &(((struct claw_privbk *) dev->ml_priv)->tbusy)); netif_wake_queue(dev); eieio(); } @@ -149,20 +149,20 @@ static inline int claw_check_busy(struct net_device *dev) { eieio(); - return ((struct claw_privbk *) dev->priv)->tbusy; + return ((struct claw_privbk *) dev->ml_priv)->tbusy; } static inline void claw_setbit_busy(int nr,struct net_device *dev) { netif_stop_queue(dev); - set_bit(nr, (void *)&(((struct claw_privbk *)dev->priv)->tbusy)); + set_bit(nr, (void *)&(((struct claw_privbk *)dev->ml_priv)->tbusy)); } static inline void claw_clearbit_busy(int nr,struct net_device *dev) { - clear_bit(nr,(void *)&(((struct claw_privbk *)dev->priv)->tbusy)); + clear_bit(nr, (void *)&(((struct claw_privbk *)dev->ml_priv)->tbusy)); netif_wake_queue(dev); } @@ -171,7 +171,7 @@ claw_test_and_setbit_busy(int nr,struct net_device *dev) { netif_stop_queue(dev); return test_and_set_bit(nr, - (void *)&(((struct claw_privbk *) dev->priv)->tbusy)); + (void *)&(((struct claw_privbk *) dev->ml_priv)->tbusy)); } @@ -319,7 +319,7 @@ static int claw_tx(struct sk_buff *skb, struct net_device *dev) { int rc; - struct claw_privbk *privptr=dev->priv; + struct claw_privbk *privptr = dev->ml_priv; unsigned long saveflags; struct chbk *p_ch; @@ -404,7 +404,7 @@ claw_pack_skb(struct claw_privbk *privptr) static int claw_change_mtu(struct net_device *dev, int new_mtu) { - struct claw_privbk *privptr=dev->priv; + struct claw_privbk *privptr = dev->ml_priv; int buff_size; CLAW_DBF_TEXT(4, trace, "setmtu"); buff_size = privptr->p_env->write_size; @@ -434,7 +434,7 @@ claw_open(struct net_device *dev) struct ccwbk *p_buf; CLAW_DBF_TEXT(4, trace, "open"); - privptr = (struct claw_privbk *)dev->priv; + privptr = (struct claw_privbk *)dev->ml_priv; /* allocate and initialize CCW blocks */ if (privptr->buffs_alloc == 0) { rc=init_ccw_bk(dev); @@ -780,7 +780,7 @@ claw_irq_tasklet ( unsigned long data ) p_ch = (struct chbk *) data; dev = (struct net_device *)p_ch->ndev; CLAW_DBF_TEXT(4, trace, "IRQtask"); - privptr = (struct claw_privbk *) dev->priv; + privptr = (struct claw_privbk *)dev->ml_priv; unpack_read(dev); clear_bit(CLAW_BH_ACTIVE, (void *)&p_ch->flag_a); CLAW_DBF_TEXT(4, trace, "TskletXt"); @@ -805,7 +805,7 @@ claw_release(struct net_device *dev) if (!dev) return 0; - privptr = (struct claw_privbk *) dev->priv; + privptr = (struct claw_privbk *)dev->ml_priv; if (!privptr) return 0; CLAW_DBF_TEXT(4, trace, "release"); @@ -960,7 +960,7 @@ claw_write_next ( struct chbk * p_ch ) if (p_ch->claw_state == CLAW_STOP) return; dev = (struct net_device *) p_ch->ndev; - privptr = (struct claw_privbk *) dev->priv; + privptr = (struct claw_privbk *) dev->ml_priv; claw_free_wrt_buf( dev ); if ((privptr->write_free_count > 0) && !skb_queue_empty(&p_ch->collect_queue)) { @@ -1042,7 +1042,7 @@ add_claw_reads(struct net_device *dev, struct ccwbk* p_first, struct ccw1 temp_ccw; struct endccw * p_end; CLAW_DBF_TEXT(4, trace, "addreads"); - privptr = dev->priv; + privptr = dev->ml_priv; p_end = privptr->p_end_ccw; /* first CCW and last CCW contains a new set of read channel programs @@ -1212,7 +1212,7 @@ find_link(struct net_device *dev, char *host_name, char *ws_name ) int rc=0; CLAW_DBF_TEXT(2, setup, "findlink"); - privptr=dev->priv; + privptr = dev->ml_priv; p_env=privptr->p_env; switch (p_env->packing) { @@ -1264,7 +1264,7 @@ claw_hw_tx(struct sk_buff *skb, struct net_device *dev, long linkid) struct chbk *ch; CLAW_DBF_TEXT(4, trace, "hw_tx"); - privptr = (struct claw_privbk *) (dev->priv); + privptr = (struct claw_privbk *)(dev->ml_priv); p_ch=(struct chbk *)&privptr->channel[WRITE]; p_env =privptr->p_env; claw_free_wrt_buf(dev); /* Clean up free chain if posible */ @@ -1483,8 +1483,8 @@ init_ccw_bk(struct net_device *dev) struct ccwbk*p_last_CCWB; struct ccwbk*p_first_CCWB; struct endccw *p_endccw=NULL; - addr_t real_address; - struct claw_privbk *privptr=dev->priv; + addr_t real_address; + struct claw_privbk *privptr = dev->ml_priv; struct clawh *pClawH=NULL; addr_t real_TIC_address; int i,j; @@ -1997,7 +1997,7 @@ claw_process_control( struct net_device *dev, struct ccwbk * p_ccw) CLAW_DBF_TEXT(2, setup, "clw_cntl"); udelay(1000); /* Wait a ms for the control packets to *catch up to each other */ - privptr=dev->priv; + privptr = dev->ml_priv; p_env=privptr->p_env; tdev = &privptr->channel[READ].cdev->dev; memcpy( &temp_host_name, p_env->host_name, 8); @@ -2275,7 +2275,7 @@ claw_send_control(struct net_device *dev, __u8 type, __u8 link, struct sk_buff *skb; CLAW_DBF_TEXT(2, setup, "sndcntl"); - privptr=dev->priv; + privptr = dev->ml_priv; p_ctl=(struct clawctl *)&privptr->ctl_bk; p_ctl->command=type; @@ -2345,7 +2345,7 @@ static int claw_snd_conn_req(struct net_device *dev, __u8 link) { int rc; - struct claw_privbk *privptr=dev->priv; + struct claw_privbk *privptr = dev->ml_priv; struct clawctl *p_ctl; CLAW_DBF_TEXT(2, setup, "snd_conn"); @@ -2405,7 +2405,7 @@ claw_snd_sys_validate_rsp(struct net_device *dev, int rc; CLAW_DBF_TEXT(2, setup, "chkresp"); - privptr = dev->priv; + privptr = dev->ml_priv; p_env=privptr->p_env; rc=claw_send_control(dev, SYSTEM_VALIDATE_RESPONSE, p_ctl->linkid, @@ -2443,7 +2443,7 @@ net_device_stats *claw_stats(struct net_device *dev) struct claw_privbk *privptr; CLAW_DBF_TEXT(4, trace, "stats"); - privptr = dev->priv; + privptr = dev->ml_priv; return &privptr->stats; } /* end of claw_stats */ @@ -2479,7 +2479,7 @@ unpack_read(struct net_device *dev ) p_last_ccw=NULL; p_packh=NULL; p_packd=NULL; - privptr=dev->priv; + privptr = dev->ml_priv; p_dev = &privptr->channel[READ].cdev->dev; p_env = privptr->p_env; @@ -2648,7 +2648,7 @@ claw_strt_read (struct net_device *dev, int lock ) int rc = 0; __u32 parm; unsigned long saveflags = 0; - struct claw_privbk *privptr=dev->priv; + struct claw_privbk *privptr = dev->ml_priv; struct ccwbk*p_ccwbk; struct chbk *p_ch; struct clawh *p_clawh; @@ -2705,7 +2705,7 @@ claw_strt_out_IO( struct net_device *dev ) if (!dev) { return; } - privptr=(struct claw_privbk *)dev->priv; + privptr = (struct claw_privbk *)dev->ml_priv; p_ch=&privptr->channel[WRITE]; CLAW_DBF_TEXT(4, trace, "strt_io"); @@ -2738,7 +2738,7 @@ static void claw_free_wrt_buf( struct net_device *dev ) { - struct claw_privbk *privptr=(struct claw_privbk *)dev->priv; + struct claw_privbk *privptr = (struct claw_privbk *)dev->ml_priv; struct ccwbk*p_first_ccw; struct ccwbk*p_last_ccw; struct ccwbk*p_this_ccw; @@ -2795,13 +2795,13 @@ claw_free_netdevice(struct net_device * dev, int free_dev) if (!dev) return; CLAW_DBF_TEXT_(2, setup, "%s", dev->name); - privptr = dev->priv; + privptr = dev->ml_priv; if (dev->flags & IFF_RUNNING) claw_release(dev); if (privptr) { privptr->channel[READ].ndev = NULL; /* say it's free */ } - dev->priv=NULL; + dev->ml_priv = NULL; #ifdef MODULE if (free_dev) { free_netdev(dev); @@ -2918,7 +2918,7 @@ claw_new_device(struct ccwgroup_device *cgdev) printk(KERN_WARNING "%s:alloc_netdev failed\n",__func__); goto out; } - dev->priv = privptr; + dev->ml_priv = privptr; cgdev->dev.driver_data = privptr; cgdev->cdev[READ]->dev.driver_data = privptr; cgdev->cdev[WRITE]->dev.driver_data = privptr; @@ -2999,7 +2999,7 @@ claw_shutdown_device(struct ccwgroup_device *cgdev) ret = claw_release(ndev); ndev->flags &=~IFF_RUNNING; unregister_netdev(ndev); - ndev->priv = NULL; /* cgdev data, not ndev's to free */ + ndev->ml_priv = NULL; /* cgdev data, not ndev's to free */ claw_free_netdevice(ndev, 1); priv->channel[READ].ndev = NULL; priv->channel[WRITE].ndev = NULL; From 261893d30b0ddb5587f9143df18a6efed39a7ed6 Mon Sep 17 00:00:00 2001 From: Peter Tiedemann Date: Thu, 21 Aug 2008 17:10:24 +0200 Subject: [PATCH 44/73] ctcm: netdev->priv vs. netdev->ml_priv Use netdev->ml_priv instead of netdev->priv Signed-off-by: Peter Tiedemann Signed-off-by: Ursula Braun Signed-off-by: Jeff Garzik --- drivers/s390/net/ctcm_fsms.c | 56 ++++++++++++++++++------------------ drivers/s390/net/ctcm_main.c | 24 ++++++++-------- drivers/s390/net/ctcm_main.h | 9 +++--- drivers/s390/net/ctcm_mpc.c | 46 ++++++++++++++--------------- 4 files changed, 68 insertions(+), 67 deletions(-) diff --git a/drivers/s390/net/ctcm_fsms.c b/drivers/s390/net/ctcm_fsms.c index 0b4e6253abe4..42776550acfd 100644 --- a/drivers/s390/net/ctcm_fsms.c +++ b/drivers/s390/net/ctcm_fsms.c @@ -245,7 +245,7 @@ static void chx_txdone(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct sk_buff *skb; int first = 1; int i; @@ -336,7 +336,7 @@ void ctcm_chx_txidle(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; CTCM_PR_DEBUG("%s(%s): %s\n", __func__, ch->id, dev->name); @@ -357,7 +357,7 @@ static void chx_rx(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; int len = ch->max_bufsize - ch->irb->scsw.cmd.count; struct sk_buff *skb = ch->trans_skb; __u16 block_len = *((__u16 *)skb->data); @@ -459,7 +459,7 @@ static void chx_firstio(fsm_instance *fi, int event, void *arg) chx_rxidle(fi, event, arg); } else { struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; fsm_newstate(fi, CTC_STATE_TXIDLE); fsm_event(priv->fsm, DEV_EVENT_TXUP, dev); } @@ -496,7 +496,7 @@ static void chx_firstio(fsm_instance *fi, int event, void *arg) if ((CHANNEL_DIRECTION(ch->flags) == READ) && (ch->protocol == CTCM_PROTO_S390)) { struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; fsm_event(priv->fsm, DEV_EVENT_RXUP, dev); } } @@ -514,7 +514,7 @@ static void chx_rxidle(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; __u16 buflen; int rc; @@ -699,7 +699,7 @@ static void ctcm_chx_cleanup(fsm_instance *fi, int state, struct channel *ch) { struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; CTCM_DBF_TEXT_(SETUP, CTC_DBF_NOTICE, "%s(%s): %s[%d]\n", @@ -784,7 +784,7 @@ static void ctcm_chx_setuperr(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; /* * Special case: Got UC_RCRESET on setmode. @@ -874,7 +874,7 @@ static void ctcm_chx_rxiniterr(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; if (event == CTC_EVENT_TIMER) { if (!IS_MPCDEV(dev)) @@ -902,7 +902,7 @@ static void ctcm_chx_rxinitfail(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; CTCM_DBF_TEXT_(ERROR, CTC_DBF_ERROR, "%s(%s): RX %s busy, init. fail", @@ -923,7 +923,7 @@ static void ctcm_chx_rxdisc(fsm_instance *fi, int event, void *arg) struct channel *ch = arg; struct channel *ch2; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; CTCM_DBF_TEXT_(TRACE, CTC_DBF_NOTICE, "%s: %s: remote disconnect - re-init ...", @@ -954,7 +954,7 @@ static void ctcm_chx_txiniterr(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; if (event == CTC_EVENT_TIMER) { fsm_deltimer(&ch->timer); @@ -984,7 +984,7 @@ static void ctcm_chx_txretry(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct sk_buff *skb; CTCM_PR_DEBUG("Enter: %s: cp=%i ch=0x%p id=%s\n", @@ -1057,7 +1057,7 @@ static void ctcm_chx_iofatal(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; int rd = CHANNEL_DIRECTION(ch->flags); fsm_deltimer(&ch->timer); @@ -1207,7 +1207,7 @@ static void ctcmpc_chx_txdone(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct sk_buff *skb; int first = 1; @@ -1368,7 +1368,7 @@ static void ctcmpc_chx_rx(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct sk_buff *skb = ch->trans_skb; struct sk_buff *new_skb; @@ -1471,7 +1471,7 @@ static void ctcmpc_chx_firstio(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *gptr = priv->mpcg; CTCM_PR_DEBUG("Enter %s: id=%s, ch=0x%p\n", @@ -1525,7 +1525,7 @@ void ctcmpc_chx_rxidle(fsm_instance *fi, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; int rc; unsigned long saveflags = 0; /* avoids compiler warning */ @@ -1580,7 +1580,7 @@ static void ctcmpc_chx_attn(fsm_instance *fsm, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; CTCM_PR_DEBUG("%s(%s): %s(ch=0x%p), cp=%i, ChStat:%s, GrpStat:%s\n", @@ -1639,7 +1639,7 @@ static void ctcmpc_chx_attnbusy(fsm_instance *fsm, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; CTCM_PR_DEBUG("%s(%s): %s\n ChState:%s GrpState:%s\n", @@ -1724,7 +1724,7 @@ static void ctcmpc_chx_resend(fsm_instance *fsm, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; fsm_event(grp->fsm, MPCG_EVENT_XID0DO, ch); @@ -1740,7 +1740,7 @@ static void ctcmpc_chx_send_sweep(fsm_instance *fsm, int event, void *arg) { struct channel *ach = arg; struct net_device *dev = ach->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct channel *wch = priv->channel[WRITE]; struct channel *rch = priv->channel[READ]; @@ -2050,7 +2050,7 @@ int mpc_ch_fsm_len = ARRAY_SIZE(ctcmpc_ch_fsm); static void dev_action_start(fsm_instance *fi, int event, void *arg) { struct net_device *dev = arg; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; int direction; CTCMY_DBF_DEV_NAME(SETUP, dev, ""); @@ -2076,7 +2076,7 @@ static void dev_action_stop(fsm_instance *fi, int event, void *arg) { int direction; struct net_device *dev = arg; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; CTCMY_DBF_DEV_NAME(SETUP, dev, ""); @@ -2096,7 +2096,7 @@ static void dev_action_restart(fsm_instance *fi, int event, void *arg) { int restart_timer; struct net_device *dev = arg; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; CTCMY_DBF_DEV_NAME(TRACE, dev, ""); @@ -2133,12 +2133,12 @@ static void dev_action_restart(fsm_instance *fi, int event, void *arg) static void dev_action_chup(fsm_instance *fi, int event, void *arg) { struct net_device *dev = arg; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; int dev_stat = fsm_getstate(fi); CTCM_DBF_TEXT_(SETUP, CTC_DBF_NOTICE, "%s(%s): priv = %p [%d,%d]\n ", CTCM_FUNTAIL, - dev->name, dev->priv, dev_stat, event); + dev->name, dev->ml_priv, dev_stat, event); switch (fsm_getstate(fi)) { case DEV_STATE_STARTWAIT_RXTX: @@ -2195,7 +2195,7 @@ static void dev_action_chdown(fsm_instance *fi, int event, void *arg) { struct net_device *dev = arg; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; CTCMY_DBF_DEV_NAME(SETUP, dev, ""); diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c index 126a3ebb8ab2..b11fec24c7d2 100644 --- a/drivers/s390/net/ctcm_main.c +++ b/drivers/s390/net/ctcm_main.c @@ -69,7 +69,7 @@ struct channel *channels; void ctcm_unpack_skb(struct channel *ch, struct sk_buff *pskb) { struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; __u16 len = *((__u16 *) pskb->data); skb_put(pskb, 2 + LL_HEADER_LENGTH); @@ -414,7 +414,7 @@ int ctcm_ch_alloc_buffer(struct channel *ch) */ int ctcm_open(struct net_device *dev) { - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; CTCMY_DBF_DEV_NAME(SETUP, dev, ""); if (!IS_MPC(priv)) @@ -432,7 +432,7 @@ int ctcm_open(struct net_device *dev) */ int ctcm_close(struct net_device *dev) { - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; CTCMY_DBF_DEV_NAME(SETUP, dev, ""); if (!IS_MPC(priv)) @@ -573,7 +573,7 @@ static int ctcm_transmit_skb(struct channel *ch, struct sk_buff *skb) skb_pull(skb, LL_HEADER_LENGTH + 2); } else if (ccw_idx == 0) { struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; priv->stats.tx_packets++; priv->stats.tx_bytes += skb->len - LL_HEADER_LENGTH; } @@ -592,7 +592,7 @@ static void ctcmpc_send_sweep_req(struct channel *rch) struct channel *ch; /* int rc = 0; */ - priv = dev->priv; + priv = dev->ml_priv; grp = priv->mpcg; ch = priv->channel[WRITE]; @@ -652,7 +652,7 @@ static int ctcmpc_transmit_skb(struct channel *ch, struct sk_buff *skb) { struct pdu *p_header; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct th_header *header; struct sk_buff *nskb; @@ -867,7 +867,7 @@ done: /* first merge version - leaving both functions separated */ static int ctcm_tx(struct sk_buff *skb, struct net_device *dev) { - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; if (skb == NULL) { CTCM_DBF_TEXT_(ERROR, CTC_DBF_ERROR, @@ -911,7 +911,7 @@ static int ctcm_tx(struct sk_buff *skb, struct net_device *dev) static int ctcmpc_tx(struct sk_buff *skb, struct net_device *dev) { int len = 0; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct sk_buff *newskb = NULL; @@ -1025,7 +1025,7 @@ static int ctcm_change_mtu(struct net_device *dev, int new_mtu) if (new_mtu < 576 || new_mtu > 65527) return -EINVAL; - priv = dev->priv; + priv = dev->ml_priv; max_bufsize = priv->channel[READ]->max_bufsize; if (IS_MPC(priv)) { @@ -1050,7 +1050,7 @@ static int ctcm_change_mtu(struct net_device *dev, int new_mtu) */ static struct net_device_stats *ctcm_stats(struct net_device *dev) { - return &((struct ctcm_priv *)dev->priv)->stats; + return &((struct ctcm_priv *)dev->ml_priv)->stats; } static void ctcm_free_netdevice(struct net_device *dev) @@ -1060,7 +1060,7 @@ static void ctcm_free_netdevice(struct net_device *dev) CTCM_DBF_TEXT_(SETUP, CTC_DBF_INFO, "%s(%s)", CTCM_FUNTAIL, dev->name); - priv = dev->priv; + priv = dev->ml_priv; if (priv) { grp = priv->mpcg; if (grp) { @@ -1125,7 +1125,7 @@ static struct net_device *ctcm_init_netdevice(struct ctcm_priv *priv) CTCM_FUNTAIL); return NULL; } - dev->priv = priv; + dev->ml_priv = priv; priv->fsm = init_fsm("ctcmdev", dev_state_names, dev_event_names, CTCM_NR_DEV_STATES, CTCM_NR_DEV_EVENTS, dev_fsm, dev_fsm_len, GFP_KERNEL); diff --git a/drivers/s390/net/ctcm_main.h b/drivers/s390/net/ctcm_main.h index a72e0feeb27f..8e10ee86a5ee 100644 --- a/drivers/s390/net/ctcm_main.h +++ b/drivers/s390/net/ctcm_main.h @@ -229,14 +229,14 @@ void ctcm_remove_files(struct device *dev); */ static inline void ctcm_clear_busy_do(struct net_device *dev) { - clear_bit(0, &(((struct ctcm_priv *)dev->priv)->tbusy)); + clear_bit(0, &(((struct ctcm_priv *)dev->ml_priv)->tbusy)); netif_wake_queue(dev); } static inline void ctcm_clear_busy(struct net_device *dev) { struct mpc_group *grp; - grp = ((struct ctcm_priv *)dev->priv)->mpcg; + grp = ((struct ctcm_priv *)dev->ml_priv)->mpcg; if (!(grp && grp->in_sweep)) ctcm_clear_busy_do(dev); @@ -246,7 +246,8 @@ static inline void ctcm_clear_busy(struct net_device *dev) static inline int ctcm_test_and_set_busy(struct net_device *dev) { netif_stop_queue(dev); - return test_and_set_bit(0, &(((struct ctcm_priv *)dev->priv)->tbusy)); + return test_and_set_bit(0, + &(((struct ctcm_priv *)dev->ml_priv)->tbusy)); } extern int loglevel; @@ -292,7 +293,7 @@ struct mpc_group *ctcmpc_init_mpc_group(struct ctcm_priv *priv); #define IS_MPC(p) ((p)->protocol == CTCM_PROTO_MPC) /* test if struct ctcm_priv of struct net_device has MPC protocol setting */ -#define IS_MPCDEV(d) IS_MPC((struct ctcm_priv *)d->priv) +#define IS_MPCDEV(dev) IS_MPC((struct ctcm_priv *)dev->ml_priv) static inline gfp_t gfp_type(void) { diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c index 49ae1cd25caa..407f816f091b 100644 --- a/drivers/s390/net/ctcm_mpc.c +++ b/drivers/s390/net/ctcm_mpc.c @@ -313,10 +313,10 @@ static struct net_device *ctcmpc_get_dev(int port_num) CTCM_FUNTAIL, device); return NULL; } - priv = dev->priv; + priv = dev->ml_priv; if (priv == NULL) { CTCM_DBF_TEXT_(MPC_ERROR, CTC_DBF_ERROR, - "%s(%s): dev->priv is NULL", + "%s(%s): dev->ml_priv is NULL", CTCM_FUNTAIL, device); return NULL; } @@ -345,7 +345,7 @@ int ctc_mpc_alloc_channel(int port_num, void (*callback)(int, int)) dev = ctcmpc_get_dev(port_num); if (dev == NULL) return 1; - priv = dev->priv; + priv = dev->ml_priv; grp = priv->mpcg; grp->allochanfunc = callback; @@ -417,7 +417,7 @@ void ctc_mpc_establish_connectivity(int port_num, dev = ctcmpc_get_dev(port_num); if (dev == NULL) return; - priv = dev->priv; + priv = dev->ml_priv; grp = priv->mpcg; rch = priv->channel[READ]; wch = priv->channel[WRITE]; @@ -535,7 +535,7 @@ void ctc_mpc_dealloc_ch(int port_num) dev = ctcmpc_get_dev(port_num); if (dev == NULL) return; - priv = dev->priv; + priv = dev->ml_priv; grp = priv->mpcg; CTCM_DBF_TEXT_(MPC_SETUP, CTC_DBF_DEBUG, @@ -571,7 +571,7 @@ void ctc_mpc_flow_control(int port_num, int flowc) dev = ctcmpc_get_dev(port_num); if (dev == NULL) return; - priv = dev->priv; + priv = dev->ml_priv; grp = priv->mpcg; CTCM_DBF_TEXT_(MPC_TRACE, CTC_DBF_DEBUG, @@ -620,7 +620,7 @@ static void mpc_rcvd_sweep_resp(struct mpcg_info *mpcginfo) { struct channel *rch = mpcginfo->ch; struct net_device *dev = rch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct channel *ch = priv->channel[WRITE]; @@ -651,7 +651,7 @@ static void mpc_rcvd_sweep_resp(struct mpcg_info *mpcginfo) static void ctcmpc_send_sweep_resp(struct channel *rch) { struct net_device *dev = rch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; int rc = 0; struct th_sweep *header; @@ -713,7 +713,7 @@ static void mpc_rcvd_sweep_req(struct mpcg_info *mpcginfo) { struct channel *rch = mpcginfo->ch; struct net_device *dev = rch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct channel *ch = priv->channel[WRITE]; @@ -847,7 +847,7 @@ static int mpcg_fsm_len = ARRAY_SIZE(mpcg_fsm); static void mpc_action_go_ready(fsm_instance *fsm, int event, void *arg) { struct net_device *dev = arg; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; if (grp == NULL) { @@ -891,7 +891,7 @@ static void mpc_action_go_ready(fsm_instance *fsm, int event, void *arg) void mpc_group_ready(unsigned long adev) { struct net_device *dev = (struct net_device *)adev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct channel *ch = NULL; @@ -947,7 +947,7 @@ void mpc_group_ready(unsigned long adev) void mpc_channel_action(struct channel *ch, int direction, int action) { struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; if (grp == NULL) { @@ -1057,7 +1057,7 @@ done: static void ctcmpc_unpack_skb(struct channel *ch, struct sk_buff *pskb) { struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct pdu *curr_pdu; struct mpcg_info *mpcginfo; @@ -1255,7 +1255,7 @@ void ctcmpc_bh(unsigned long thischan) struct channel *ch = (struct channel *)thischan; struct sk_buff *skb; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; CTCM_PR_DEBUG("%s cp:%i enter: %s() %s\n", @@ -1377,7 +1377,7 @@ static void mpc_action_go_inop(fsm_instance *fi, int event, void *arg) BUG_ON(dev == NULL); CTCM_PR_DEBUG("Enter %s: %s\n", __func__, dev->name); - priv = dev->priv; + priv = dev->ml_priv; grp = priv->mpcg; grp->flow_off_called = 0; fsm_deltimer(&grp->timer); @@ -1483,7 +1483,7 @@ static void mpc_action_timeout(fsm_instance *fi, int event, void *arg) BUG_ON(dev == NULL); - priv = dev->priv; + priv = dev->ml_priv; grp = priv->mpcg; wch = priv->channel[WRITE]; rch = priv->channel[READ]; @@ -1521,7 +1521,7 @@ void mpc_action_discontact(fsm_instance *fi, int event, void *arg) if (ch) { dev = ch->netdev; if (dev) { - priv = dev->priv; + priv = dev->ml_priv; if (priv) { CTCM_DBF_TEXT_(MPC_TRACE, CTC_DBF_NOTICE, "%s: %s: %s\n", @@ -1569,7 +1569,7 @@ static int mpc_validate_xid(struct mpcg_info *mpcginfo) { struct channel *ch = mpcginfo->ch; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; struct xid2 *xid = mpcginfo->xid; int rc = 0; @@ -1866,7 +1866,7 @@ static void mpc_action_doxid0(fsm_instance *fsm, int event, void *arg) { struct channel *ch = arg; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; CTCM_PR_DEBUG("Enter %s: cp=%i ch=0x%p id=%s\n", @@ -1906,7 +1906,7 @@ static void mpc_action_doxid0(fsm_instance *fsm, int event, void *arg) static void mpc_action_doxid7(fsm_instance *fsm, int event, void *arg) { struct net_device *dev = arg; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = NULL; int direction; int send = 0; @@ -1983,7 +1983,7 @@ static void mpc_action_rcvd_xid0(fsm_instance *fsm, int event, void *arg) struct mpcg_info *mpcginfo = arg; struct channel *ch = mpcginfo->ch; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; CTCM_PR_DEBUG("%s: ch-id:%s xid2:%i xid7:%i xidt_p2:%i \n", @@ -2045,7 +2045,7 @@ static void mpc_action_rcvd_xid7(fsm_instance *fsm, int event, void *arg) struct mpcg_info *mpcginfo = arg; struct channel *ch = mpcginfo->ch; struct net_device *dev = ch->netdev; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; CTCM_PR_DEBUG("Enter %s: cp=%i ch=0x%p id=%s\n", @@ -2097,7 +2097,7 @@ static int mpc_send_qllc_discontact(struct net_device *dev) __u32 new_len = 0; struct sk_buff *skb; struct qllc *qllcptr; - struct ctcm_priv *priv = dev->priv; + struct ctcm_priv *priv = dev->ml_priv; struct mpc_group *grp = priv->mpcg; CTCM_PR_DEBUG("%s: GROUP STATE: %s\n", From 9b3b9ab6a7a43851ccb4633149d01239f99f275f Mon Sep 17 00:00:00 2001 From: "Klaus-D. Wacker" Date: Thu, 21 Aug 2008 17:10:25 +0200 Subject: [PATCH 45/73] LCS recovery dumps when cable reconnect LCS recovery dumps in irq routine when CCW address in Subchannel Status Word (SCSW) is zero. This occurs when recovery is driven after cable reconnect. Signed-off-by: Klaus-D. Wacker Signed-off-by: Ursula Braun Signed-off-by: Jeff Garzik --- drivers/s390/net/lcs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c index 6de28385b354..9bcfa04d863b 100644 --- a/drivers/s390/net/lcs.c +++ b/drivers/s390/net/lcs.c @@ -1412,7 +1412,8 @@ lcs_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb) } /* How far in the ccw chain have we processed? */ if ((channel->state != LCS_CH_STATE_INIT) && - (irb->scsw.cmd.fctl & SCSW_FCTL_START_FUNC)) { + (irb->scsw.cmd.fctl & SCSW_FCTL_START_FUNC) && + (irb->scsw.cmd.cpa != 0)) { index = (struct ccw1 *) __va((addr_t) irb->scsw.cmd.cpa) - channel->ccws; if ((irb->scsw.cmd.actl & SCSW_ACTL_SUSPENDED) || From f7a54c13c7b072d9426bd5cec1cdb8306df5ef55 Mon Sep 17 00:00:00 2001 From: Jarek Poplawski Date: Wed, 27 Aug 2008 02:22:07 -0700 Subject: [PATCH 46/73] pkt_sched: Use rcu_assign_pointer() to change dev_queue->qdisc These pointers are RCU protected, so proper primitives should be used. Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller --- net/sched/sch_api.c | 2 +- net/sched/sch_generic.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 341d558b6e39..ad9cda1b8c0a 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -635,7 +635,7 @@ static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue, if (qdisc == NULL) qdisc = &noop_qdisc; dev_queue->qdisc_sleeping = qdisc; - dev_queue->qdisc = &noop_qdisc; + rcu_assign_pointer(dev_queue->qdisc, &noop_qdisc); spin_unlock_bh(root_lock); diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 5f0ade7806a7..9634091ee2f0 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -634,7 +634,7 @@ static void dev_deactivate_queue(struct net_device *dev, if (!(qdisc->flags & TCQ_F_BUILTIN)) set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state); - dev_queue->qdisc = qdisc_default; + rcu_assign_pointer(dev_queue->qdisc, qdisc_default); qdisc_reset(qdisc); spin_unlock_bh(qdisc_lock(qdisc)); @@ -709,7 +709,7 @@ static void shutdown_scheduler_queue(struct net_device *dev, struct Qdisc *qdisc_default = _qdisc_default; if (qdisc) { - dev_queue->qdisc = qdisc_default; + rcu_assign_pointer(dev_queue->qdisc, qdisc_default); dev_queue->qdisc_sleeping = qdisc_default; qdisc_destroy(qdisc); From f6f9b93f1624206c802ac9162c9302edaf59bfd9 Mon Sep 17 00:00:00 2001 From: Jarek Poplawski Date: Wed, 27 Aug 2008 02:25:17 -0700 Subject: [PATCH 47/73] pkt_sched: Fix gen_estimator locks While passing a qdisc root lock to gen_new_estimator() and gen_replace_estimator() dev could be deactivated or even before grafting proper root qdisc as qdisc_sleeping (e.g. qdisc_create), so using qdisc_root_lock() is not enough. This patch adds qdisc_root_sleeping_lock() for this, plus additional checks, where necessary. Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller --- include/net/sch_generic.h | 8 ++++++++ net/sched/sch_api.c | 14 +++++++++++--- net/sched/sch_cbq.c | 4 ++-- net/sched/sch_hfsc.c | 4 ++-- net/sched/sch_htb.c | 4 ++-- 5 files changed, 25 insertions(+), 9 deletions(-) diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index b1d2cfea89c5..ef8a7e2e12e7 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -217,6 +217,14 @@ static inline spinlock_t *qdisc_root_lock(struct Qdisc *qdisc) return qdisc_lock(root); } +static inline spinlock_t *qdisc_root_sleeping_lock(struct Qdisc *qdisc) +{ + struct Qdisc *root = qdisc_root_sleeping(qdisc); + + ASSERT_RTNL(); + return qdisc_lock(root); +} + static inline struct net_device *qdisc_dev(struct Qdisc *qdisc) { return qdisc->dev_queue->dev; diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index ad9cda1b8c0a..506b709510b6 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -830,9 +830,16 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue, sch->stab = stab; } if (tca[TCA_RATE]) { + spinlock_t *root_lock; + + if ((sch->parent != TC_H_ROOT) && + !(sch->flags & TCQ_F_INGRESS)) + root_lock = qdisc_root_sleeping_lock(sch); + else + root_lock = qdisc_lock(sch); + err = gen_new_estimator(&sch->bstats, &sch->rate_est, - qdisc_root_lock(sch), - tca[TCA_RATE]); + root_lock, tca[TCA_RATE]); if (err) { /* * Any broken qdiscs that would require @@ -884,7 +891,8 @@ static int qdisc_change(struct Qdisc *sch, struct nlattr **tca) if (tca[TCA_RATE]) gen_replace_estimator(&sch->bstats, &sch->rate_est, - qdisc_root_lock(sch), tca[TCA_RATE]); + qdisc_root_sleeping_lock(sch), + tca[TCA_RATE]); return 0; } diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c index 8fa90d68ec6d..9b720adedead 100644 --- a/net/sched/sch_cbq.c +++ b/net/sched/sch_cbq.c @@ -1839,7 +1839,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t if (tca[TCA_RATE]) gen_replace_estimator(&cl->bstats, &cl->rate_est, - qdisc_root_lock(sch), + qdisc_root_sleeping_lock(sch), tca[TCA_RATE]); return 0; } @@ -1930,7 +1930,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t if (tca[TCA_RATE]) gen_new_estimator(&cl->bstats, &cl->rate_est, - qdisc_root_lock(sch), tca[TCA_RATE]); + qdisc_root_sleeping_lock(sch), tca[TCA_RATE]); *arg = (unsigned long)cl; return 0; diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c index c2b8d9cce3d2..c1e77da8cd09 100644 --- a/net/sched/sch_hfsc.c +++ b/net/sched/sch_hfsc.c @@ -1045,7 +1045,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, if (tca[TCA_RATE]) gen_replace_estimator(&cl->bstats, &cl->rate_est, - qdisc_root_lock(sch), + qdisc_root_sleeping_lock(sch), tca[TCA_RATE]); return 0; } @@ -1104,7 +1104,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, if (tca[TCA_RATE]) gen_new_estimator(&cl->bstats, &cl->rate_est, - qdisc_root_lock(sch), tca[TCA_RATE]); + qdisc_root_sleeping_lock(sch), tca[TCA_RATE]); *arg = (unsigned long)cl; return 0; } diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c index 0df0df202ed0..97d4761cc31e 100644 --- a/net/sched/sch_htb.c +++ b/net/sched/sch_htb.c @@ -1372,7 +1372,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, goto failure; gen_new_estimator(&cl->bstats, &cl->rate_est, - qdisc_root_lock(sch), + qdisc_root_sleeping_lock(sch), tca[TCA_RATE] ? : &est.nla); cl->refcnt = 1; cl->children = 0; @@ -1427,7 +1427,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, } else { if (tca[TCA_RATE]) gen_replace_estimator(&cl->bstats, &cl->rate_est, - qdisc_root_lock(sch), + qdisc_root_sleeping_lock(sch), tca[TCA_RATE]); sch_tree_lock(sch); } From fe439dd09d3e4da6a44d35df7371b9c6a2661b99 Mon Sep 17 00:00:00 2001 From: Jarek Poplawski Date: Wed, 27 Aug 2008 02:27:10 -0700 Subject: [PATCH 48/73] pkt_sched: Fix sch_tree_lock() Use new qdisc_root_sleeping_lock() instead of qdisc_root_lock() as sch_tree_lock() because this lock could be used while dev is deactivated, but we never need to use this with noop_qdisc as a root. Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller --- include/net/sch_generic.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index ef8a7e2e12e7..e5569625d2a5 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -232,12 +232,12 @@ static inline struct net_device *qdisc_dev(struct Qdisc *qdisc) static inline void sch_tree_lock(struct Qdisc *q) { - spin_lock_bh(qdisc_root_lock(q)); + spin_lock_bh(qdisc_root_sleeping_lock(q)); } static inline void sch_tree_unlock(struct Qdisc *q) { - spin_unlock_bh(qdisc_root_lock(q)); + spin_unlock_bh(qdisc_root_sleeping_lock(q)); } #define tcf_tree_lock(tp) sch_tree_lock((tp)->q) From 7982d5e1b350acb96aa156916c44c25ef87bb809 Mon Sep 17 00:00:00 2001 From: Philip Love Date: Wed, 27 Aug 2008 02:33:50 -0700 Subject: [PATCH 49/73] tcp: fix tcp header size miscalculation when window scale is unused The size of the TCP header is miscalculated when the window scale ends up being 0. Additionally, this can be induced by sending a SYN to a passive open port with a window scale option with value 0. Signed-off-by: Philip Love Signed-off-by: Adam Langley Signed-off-by: David S. Miller --- net/ipv4/tcp_output.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index a00532de2a8c..8165f5aa8c71 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -468,7 +468,8 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb, } if (likely(sysctl_tcp_window_scaling)) { opts->ws = tp->rx_opt.rcv_wscale; - size += TCPOLEN_WSCALE_ALIGNED; + if(likely(opts->ws)) + size += TCPOLEN_WSCALE_ALIGNED; } if (likely(sysctl_tcp_sack)) { opts->options |= OPTION_SACK_ADVERTISE; @@ -509,7 +510,8 @@ static unsigned tcp_synack_options(struct sock *sk, if (likely(ireq->wscale_ok)) { opts->ws = ireq->rcv_wscale; - size += TCPOLEN_WSCALE_ALIGNED; + if(likely(opts->ws)) + size += TCPOLEN_WSCALE_ALIGNED; } if (likely(doing_ts)) { opts->options |= OPTION_TS; From d994af0d50efc96b2077978fe9f066992639d525 Mon Sep 17 00:00:00 2001 From: Hugh Dickins Date: Wed, 27 Aug 2008 02:35:18 -0700 Subject: [PATCH 50/73] ipv4: mode 0555 in ipv4_skeleton vpnc on today's kernel says Cannot open "/proc/sys/net/ipv4/route/flush": d--------- 0 root root 0 2008-08-26 11:32 /proc/sys/net/ipv4/route d--------- 0 root root 0 2008-08-26 19:16 /proc/sys/net/ipv4/neigh Signed-off-by: Hugh Dickins Acked-by: Al Viro Signed-off-by: David S. Miller --- net/ipv4/route.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/route.c b/net/ipv4/route.c index e91bafeb32f4..6ee5354c9aa1 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -3121,9 +3121,9 @@ static struct ctl_table empty[1]; static struct ctl_table ipv4_skeleton[] = { { .procname = "route", .ctl_name = NET_IPV4_ROUTE, - .child = ipv4_route_table}, + .mode = 0555, .child = ipv4_route_table}, { .procname = "neigh", .ctl_name = NET_IPV4_NEIGH, - .child = empty}, + .mode = 0555, .child = empty}, { } }; From c22ce6d849423639b4b80d1b28edd383cb3048a9 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 20 Aug 2008 16:34:35 -0700 Subject: [PATCH 51/73] drivers/net/skfp/ess.c: fix compile warnings CC [M] drivers/net/skfp/ess.o drivers/net/skfp/ess.c: In function 'ess_send_response': drivers/net/skfp/ess.c:513: warning: cast from pointer to integer of different size drivers/net/skfp/ess.c: In function 'ess_send_alc_req': drivers/net/skfp/ess.c:609: warning: cast from pointer to integer of different size drivers/net/skfp/ess.c:639: warning: cast from pointer to integer of different size Signed-off-by: Takashi Iwai Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/skfp/ess.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/skfp/ess.c b/drivers/net/skfp/ess.c index 889f98724610..a85efcfd9d0e 100644 --- a/drivers/net/skfp/ess.c +++ b/drivers/net/skfp/ess.c @@ -510,7 +510,7 @@ static void ess_send_response(struct s_smc *smc, struct smt_header *sm, chg->path.para.p_type = SMT_P320B ; chg->path.para.p_len = sizeof(struct smt_p_320b) - PARA_LEN ; chg->path.mib_index = SBAPATHINDEX ; - chg->path.path_pad = (u_short)NULL ; + chg->path.path_pad = 0; chg->path.path_index = PRIMARY_RING ; /* set P320F */ @@ -606,7 +606,7 @@ static void ess_send_alc_req(struct s_smc *smc) req->path.para.p_type = SMT_P320B ; req->path.para.p_len = sizeof(struct smt_p_320b) - PARA_LEN ; req->path.mib_index = SBAPATHINDEX ; - req->path.path_pad = (u_short)NULL ; + req->path.path_pad = 0; req->path.path_index = PRIMARY_RING ; /* set P0017 */ @@ -636,7 +636,7 @@ static void ess_send_alc_req(struct s_smc *smc) /* set P19 */ req->a_addr.para.p_type = SMT_P0019 ; req->a_addr.para.p_len = sizeof(struct smt_p_0019) - PARA_LEN ; - req->a_addr.sba_pad = (u_short)NULL ; + req->a_addr.sba_pad = 0; req->a_addr.alloc_addr = null_addr ; /* set P1A */ From 17fc7004a3f552b52274b6b2fbbebd7ff76dc1d5 Mon Sep 17 00:00:00 2001 From: Alexander Duyck Date: Fri, 8 Aug 2008 16:51:26 -0700 Subject: [PATCH 52/73] igb: remove 82576 quad adapter Disable support for device 8086:10E8. Currently the result of loading the driver with the device present causes system instability. Signed-off-by: Alexander Duyck Signed-off-by: Jeff Kirsher Signed-off-by: Jeff Garzik --- drivers/net/igb/e1000_82575.c | 1 - drivers/net/igb/e1000_hw.h | 1 - drivers/net/igb/igb_ethtool.c | 9 --------- drivers/net/igb/igb_main.c | 11 ----------- 4 files changed, 22 deletions(-) diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c index bb823acc7443..f5e2e7235fcb 100644 --- a/drivers/net/igb/e1000_82575.c +++ b/drivers/net/igb/e1000_82575.c @@ -87,7 +87,6 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw) case E1000_DEV_ID_82576: case E1000_DEV_ID_82576_FIBER: case E1000_DEV_ID_82576_SERDES: - case E1000_DEV_ID_82576_QUAD_COPPER: mac->type = e1000_82576; break; default: diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h index a65ccc3095c3..99504a600a80 100644 --- a/drivers/net/igb/e1000_hw.h +++ b/drivers/net/igb/e1000_hw.h @@ -41,7 +41,6 @@ struct e1000_hw; #define E1000_DEV_ID_82576 0x10C9 #define E1000_DEV_ID_82576_FIBER 0x10E6 #define E1000_DEV_ID_82576_SERDES 0x10E7 -#define E1000_DEV_ID_82576_QUAD_COPPER 0x10E8 #define E1000_DEV_ID_82575EB_COPPER 0x10A7 #define E1000_DEV_ID_82575EB_FIBER_SERDES 0x10A9 #define E1000_DEV_ID_82575GB_QUAD_COPPER 0x10D6 diff --git a/drivers/net/igb/igb_ethtool.c b/drivers/net/igb/igb_ethtool.c index 3eb78a66f8b6..58906c984be9 100644 --- a/drivers/net/igb/igb_ethtool.c +++ b/drivers/net/igb/igb_ethtool.c @@ -1750,15 +1750,6 @@ static int igb_wol_exclusion(struct igb_adapter *adapter, /* return success for non excluded adapter ports */ retval = 0; break; - case E1000_DEV_ID_82576_QUAD_COPPER: - /* quad port adapters only support WoL on port A */ - if (!(adapter->flags & IGB_FLAG_QUAD_PORT_A)) { - wol->supported = 0; - break; - } - /* return success for non excluded adapter ports */ - retval = 0; - break; default: /* dual port cards only support WoL on port A from now on * unless it was enabled in the eeprom for port B diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c index e6eb13a303c0..634c4c9d87be 100644 --- a/drivers/net/igb/igb_main.c +++ b/drivers/net/igb/igb_main.c @@ -61,7 +61,6 @@ static struct pci_device_id igb_pci_tbl[] = { { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576), board_82575 }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_FIBER), board_82575 }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_SERDES), board_82575 }, - { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_QUAD_COPPER), board_82575 }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_82575EB_COPPER), board_82575 }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_82575EB_FIBER_SERDES), board_82575 }, { PCI_VDEVICE(INTEL, E1000_DEV_ID_82575GB_QUAD_COPPER), board_82575 }, @@ -1217,16 +1216,6 @@ static int __devinit igb_probe(struct pci_dev *pdev, if (rd32(E1000_STATUS) & E1000_STATUS_FUNC_1) adapter->eeprom_wol = 0; break; - case E1000_DEV_ID_82576_QUAD_COPPER: - /* if quad port adapter, disable WoL on all but port A */ - if (global_quad_port_a != 0) - adapter->eeprom_wol = 0; - else - adapter->flags |= IGB_FLAG_QUAD_PORT_A; - /* Reset for multiple quad port adapters */ - if (++global_quad_port_a == 4) - global_quad_port_a = 0; - break; } /* initialize the wol settings based on the eeprom settings */ From 50f684b900de431729d6f77e69c941560936f275 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= Date: Tue, 19 Aug 2008 10:32:06 +0300 Subject: [PATCH 53/73] atl1e: multistatement if missing braces MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Doesn't cause problems (yet) because err gets zeroed earlier. Signed-off-by: Ilpo Järvinen Signed-off-by: Jeff Garzik --- drivers/net/atl1e/atl1e_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/atl1e/atl1e_main.c b/drivers/net/atl1e/atl1e_main.c index 82d7be1655d3..7685b995ff9b 100644 --- a/drivers/net/atl1e/atl1e_main.c +++ b/drivers/net/atl1e/atl1e_main.c @@ -2232,10 +2232,11 @@ static int atl1e_resume(struct pci_dev *pdev) AT_WRITE_REG(&adapter->hw, REG_WOL_CTRL, 0); - if (netif_running(netdev)) + if (netif_running(netdev)) { err = atl1e_request_irq(adapter); if (err) return err; + } atl1e_reset_hw(&adapter->hw); From 82c26a9d117f0178b8c1b33429014b6d99c470f6 Mon Sep 17 00:00:00 2001 From: Jay Cliburn Date: Mon, 18 Aug 2008 19:28:13 -0500 Subject: [PATCH 54/73] atl1: disable TSO by default The atl1 driver is causing stalled connections and file corruption whenever TSO is enabled. Two examples are here: http://lkml.org/lkml/2008/7/15/325 http://lkml.org/lkml/2008/8/18/543 Disable TSO by default until we can determine the source of the problem. Signed-off-by: Jay Cliburn cc: stable@kernel.org Signed-off-by: Jeff Garzik --- drivers/net/atlx/atl1.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c index e6a7bb79d4df..e23ce77712f1 100644 --- a/drivers/net/atlx/atl1.c +++ b/drivers/net/atlx/atl1.c @@ -3022,7 +3022,6 @@ static int __devinit atl1_probe(struct pci_dev *pdev, netdev->features = NETIF_F_HW_CSUM; netdev->features |= NETIF_F_SG; netdev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX); - netdev->features |= NETIF_F_TSO; netdev->features |= NETIF_F_LLTX; /* From 95eacee870a521d2647f42c4f670cd65a145a6bd Mon Sep 17 00:00:00 2001 From: Denis Joseph Barrow Date: Tue, 19 Aug 2008 18:07:52 -0700 Subject: [PATCH 55/73] [netdrvr] hso: icon 322 detection fix Fixes Icon-322 detection. Signed-off-by: Denis Joseph Barrow Cc: Jeff Garzik Signed-off-by: Greg Kroah-Hartman Signed-off-by: Jeff Garzik --- drivers/net/usb/hso.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 1b7cac77159e..1131e10fb6ae 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -397,7 +397,7 @@ static const struct usb_device_id hso_ids[] = { {default_port_device(0x0af0, 0xc031)}, /* Icon-Edge */ {icon321_port_device(0x0af0, 0xd013)}, /* Module HSxPA */ {icon321_port_device(0x0af0, 0xd031)}, /* Icon-321 */ - {default_port_device(0x0af0, 0xd033)}, /* Icon-322 */ + {icon321_port_device(0x0af0, 0xd033)}, /* Icon-322 */ {USB_DEVICE(0x0af0, 0x7301)}, /* GE40x */ {USB_DEVICE(0x0af0, 0x7361)}, /* GE40x */ {USB_DEVICE(0x0af0, 0x7401)}, /* GI 0401 */ From c213f286f2cf6590f83f541f66a625ee8d20c6f4 Mon Sep 17 00:00:00 2001 From: Denis Joseph Barrow Date: Tue, 19 Aug 2008 18:07:55 -0700 Subject: [PATCH 56/73] [netdrvr] hso: dev_kfree_skb crash fix Fixes dev_kfree_skb happening too many times when hso_start_net_device is called from hso_resume. Signed-off-by: Denis Joseph Barrow Cc: Jeff Garzik Signed-off-by: Greg Kroah-Hartman Signed-off-by: Jeff Garzik --- drivers/net/usb/hso.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 1131e10fb6ae..6e42b5a8c22b 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -2613,6 +2613,7 @@ static int hso_resume(struct usb_interface *iface) "Transmitting lingering data\n"); hso_net_start_xmit(hso_net->skb_tx_buf, hso_net->net); + hso_net->skb_tx_buf = NULL; } result = hso_start_net_device(network_table[i]); if (result) From 45e15bb734e4e559ab32f26196e44d5cf1417f10 Mon Sep 17 00:00:00 2001 From: Santiago Leon Date: Wed, 20 Aug 2008 13:09:19 -0600 Subject: [PATCH 57/73] ibmveth: fix bad UDP checksums This patch fixes a ibmveth bug where bad UDP checksums are being transmitted when checksum offloading is enabled. The hypervisor does checksum offloading only on TCP packets, so ibmveth calls skb_checksum_help() for any other protocol. The bug happens because the packet is being modified after the DMA map, so we would need a memory barrier before making the hypervisor call. Reordering the code so that the DMA map happens after skb_checksum_help() has the additional advantage of fixing a DMA map leak if skb_checksum_help() where to fail. Signed-off-by: Santiago Leon Signed-off-by: Jeff Garzik --- drivers/net/ibmveth.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c index a03fe1fb61ca..c2d57f836088 100644 --- a/drivers/net/ibmveth.c +++ b/drivers/net/ibmveth.c @@ -904,8 +904,6 @@ static int ibmveth_start_xmit(struct sk_buff *skb, struct net_device *netdev) unsigned long data_dma_addr; desc.fields.flags_len = IBMVETH_BUF_VALID | skb->len; - data_dma_addr = dma_map_single(&adapter->vdev->dev, skb->data, - skb->len, DMA_TO_DEVICE); if (skb->ip_summed == CHECKSUM_PARTIAL && ip_hdr(skb)->protocol != IPPROTO_TCP && skb_checksum_help(skb)) { @@ -924,6 +922,8 @@ static int ibmveth_start_xmit(struct sk_buff *skb, struct net_device *netdev) buf[1] = 0; } + data_dma_addr = dma_map_single(&adapter->vdev->dev, skb->data, + skb->len, DMA_TO_DEVICE); if (dma_mapping_error(&adapter->vdev->dev, data_dma_addr)) { if (!firmware_has_feature(FW_FEATURE_CMO)) ibmveth_error_printk("tx: unable to map xmit buffer\n"); @@ -932,6 +932,7 @@ static int ibmveth_start_xmit(struct sk_buff *skb, struct net_device *netdev) desc.fields.address = adapter->bounce_buffer_dma; tx_map_failed++; used_bounce = 1; + wmb(); } else desc.fields.address = data_dma_addr; From 6fc30db563c57e383ca2ec836d8c9208c52d265a Mon Sep 17 00:00:00 2001 From: Jeff Garzik Date: Wed, 27 Aug 2008 05:54:30 -0400 Subject: [PATCH 58/73] [netdrvr] smc91x: fix resource removal (null ptr deref) Properly handle resource cleanup on unplug/exit. Spotted by Jonathan Cameron Signed-off-by: Jeff Garzik --- drivers/net/smc91x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c index 2040965d7724..24768c10cadb 100644 --- a/drivers/net/smc91x.c +++ b/drivers/net/smc91x.c @@ -2255,7 +2255,7 @@ static int smc_drv_remove(struct platform_device *pdev) res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "smc91x-regs"); if (!res) - platform_get_resource(pdev, IORESOURCE_MEM, 0); + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); release_mem_region(res->start, SMC_IO_EXTENT); free_netdev(ndev); From 8382cc1c2d0eb8918d3b71bf6cb8ac2e883f3e33 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Sat, 23 Aug 2008 22:02:23 +0200 Subject: [PATCH 59/73] net/usb/mcs7830: new device IDs This adds USB device IDs for MosChip 7730 and Sitecom LN030 to the mcs7830 driver. The IDs have been reported to work without further modifications. Signed-off-by: Arnd Bergmann Acked-by: David Brownell Cc: Viktor Horvath Cc: Robbert Wethmar Cc: Bart van der Klip Signed-off-by: Jeff Garzik --- drivers/net/usb/mcs7830.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c index c3d119f997f5..ebf1332abaa1 100644 --- a/drivers/net/usb/mcs7830.c +++ b/drivers/net/usb/mcs7830.c @@ -46,6 +46,10 @@ #define MCS7830_VENDOR_ID 0x9710 #define MCS7830_PRODUCT_ID 0x7830 +#define MCS7730_PRODUCT_ID 0x7730 + +#define SITECOM_VENDOR_ID 0x0DF6 +#define LN_030_PRODUCT_ID 0x0021 #define MCS7830_MII_ADVERTISE (ADVERTISE_PAUSE_CAP | ADVERTISE_100FULL | \ ADVERTISE_100HALF | ADVERTISE_10FULL | \ @@ -491,7 +495,16 @@ static int mcs7830_rx_fixup(struct usbnet *dev, struct sk_buff *skb) } static const struct driver_info moschip_info = { - .description = "MOSCHIP 7830 usb-NET adapter", + .description = "MOSCHIP 7830/7730 usb-NET adapter", + .bind = mcs7830_bind, + .rx_fixup = mcs7830_rx_fixup, + .flags = FLAG_ETHER, + .in = 1, + .out = 2, +}; + +static const struct driver_info sitecom_info = { + .description = "Sitecom LN-30 usb-NET adapter", .bind = mcs7830_bind, .rx_fixup = mcs7830_rx_fixup, .flags = FLAG_ETHER, @@ -504,6 +517,14 @@ static const struct usb_device_id products[] = { USB_DEVICE(MCS7830_VENDOR_ID, MCS7830_PRODUCT_ID), .driver_info = (unsigned long) &moschip_info, }, + { + USB_DEVICE(MCS7830_VENDOR_ID, MCS7730_PRODUCT_ID), + .driver_info = (unsigned long) &moschip_info, + }, + { + USB_DEVICE(SITECOM_VENDOR_ID, LN_030_PRODUCT_ID), + .driver_info = (unsigned long) &sitecom_info, + }, {}, }; MODULE_DEVICE_TABLE(usb, products); From 1025433147e635af9cd150676a097396cf666ddb Mon Sep 17 00:00:00 2001 From: Oliver Martin Date: Sat, 23 Aug 2008 22:08:47 +0200 Subject: [PATCH 60/73] net/usb/mcs7830: add set_mac_address Implement set_mac_address for mcs7830. This enables me to use it with my cable modem. Signed-off-by: Oliver Martin Signed-off-by: Arnd Bergmann Signed-off-by: Jeff Garzik --- drivers/net/usb/mcs7830.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c index ebf1332abaa1..ca9d00c1194e 100644 --- a/drivers/net/usb/mcs7830.c +++ b/drivers/net/usb/mcs7830.c @@ -446,6 +446,29 @@ static struct ethtool_ops mcs7830_ethtool_ops = { .nway_reset = usbnet_nway_reset, }; +static int mcs7830_set_mac_address(struct net_device *netdev, void *p) +{ + int ret; + struct usbnet *dev = netdev_priv(netdev); + struct sockaddr *addr = p; + + if (netif_running(netdev)) + return -EBUSY; + + if (!is_valid_ether_addr(addr->sa_data)) + return -EINVAL; + + memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len); + + ret = mcs7830_set_reg(dev, HIF_REG_ETHERNET_ADDR, ETH_ALEN, + netdev->dev_addr); + + if (ret < 0) + return ret; + + return 0; +} + static int mcs7830_bind(struct usbnet *dev, struct usb_interface *udev) { struct net_device *net = dev->net; @@ -459,6 +482,7 @@ static int mcs7830_bind(struct usbnet *dev, struct usb_interface *udev) net->ethtool_ops = &mcs7830_ethtool_ops; net->set_multicast_list = mcs7830_set_multicast; mcs7830_set_multicast(net); + net->set_mac_address = mcs7830_set_mac_address; /* reserve space for the status byte on rx */ dev->rx_urb_size = ETH_FRAME_LEN + 1; From edcfe5f7e307846e578fb88d69fa27051fded0ab Mon Sep 17 00:00:00 2001 From: Ayaz Abdulla Date: Wed, 20 Aug 2008 16:34:37 -0700 Subject: [PATCH 61/73] forcedeth: fix checksum flag Fix the checksum feature advertised in device flags. The hardware support TCP/UDP over IPv4 and TCP/UDP over IPv6 (without IPv6 extension headers). However, the kernel feature flags do not distinguish IPv6 with/without extension headers. Therefore, the driver needs to use NETIF_F_IP_CSUM instead of NETIF_F_HW_CSUM since the latter includes all IPv6 packets. A future patch can be created to check for extension headers and perform software checksum calculation. Signed-off-by: Ayaz Abdulla Cc: Jeff Garzik Cc: Manfred Spraul [2.6.25.x, 2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik --- drivers/net/forcedeth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c index 053971e5fc94..331b86b01fa9 100644 --- a/drivers/net/forcedeth.c +++ b/drivers/net/forcedeth.c @@ -5522,7 +5522,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i if (id->driver_data & DEV_HAS_CHECKSUM) { np->rx_csum = 1; np->txrxctl_bits |= NVREG_TXRXCTL_RXCHECK; - dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG; + dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG; dev->features |= NETIF_F_TSO; } @@ -5835,7 +5835,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i dev_printk(KERN_INFO, &pci_dev->dev, "%s%s%s%s%s%s%s%s%s%sdesc-v%u\n", dev->features & NETIF_F_HIGHDMA ? "highdma " : "", - dev->features & (NETIF_F_HW_CSUM | NETIF_F_SG) ? + dev->features & (NETIF_F_IP_CSUM | NETIF_F_SG) ? "csum " : "", dev->features & (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX) ? "vlan " : "", From ab9399059bb85a94758f42fb25607e440e926cc6 Mon Sep 17 00:00:00 2001 From: Sebastian Siewior Date: Tue, 19 Aug 2008 21:12:45 +0200 Subject: [PATCH 62/73] net: don't grab a mutex within a timer context in gianfar I got the following backtrace while network was unavailble: |NETDEV WATCHDOG: eth0: transmit timed out |BUG: sleeping function called from invalid context at /home/bigeasy/git/linux-2.6-powerpc/kernel/mutex.c:87 |in_atomic():1, irqs_disabled():0 |Call Trace: |[c0383d90] [c0006dd8] show_stack+0x48/0x184 (unreliable) |[c0383db0] [c001e938] __might_sleep+0xe0/0xf4 |[c0383dc0] [c025a43c] mutex_lock+0x24/0x3c |[c0383de0] [c019005c] phy_stop+0x20/0x70 |[c0383df0] [c018d4ec] stop_gfar+0x28/0xf4 |[c0383e10] [c018e8c4] gfar_timeout+0x30/0x60 |[c0383e20] [c01fe7c0] dev_watchdog+0xa8/0x144 |[c0383e30] [c002f93c] run_timer_softirq+0x148/0x1c8 |[c0383e60] [c002b084] __do_softirq+0x5c/0xc4 |[c0383e80] [c00046fc] do_softirq+0x3c/0x54 |[c0383e90] [c002ac60] irq_exit+0x3c/0x5c |[c0383ea0] [c000b378] timer_interrupt+0xe0/0xf8 |[c0383ec0] [c000e5ac] ret_from_except+0x0/0x18 |[c0383f80] [c000804c] cpu_idle+0xcc/0xdc |[c0383fa0] [c025c07c] etext+0x7c/0x90 |[c0383fc0] [c0338960] start_kernel+0x294/0x2a8 |[c0383ff0] [c00003dc] skpinv+0x304/0x340 |------------[ cut here ]------------ The phylock was once a spinlock but got changed into a mutex via commit 35b5f6b1a aka [PHYLIB: Locking fixes for PHY I/O potentially sleeping] Signed-off-by: Sebastian Siewior Signed-off-by: Jeff Garzik --- drivers/net/gianfar.c | 22 ++++++++++++++++++---- drivers/net/gianfar.h | 1 + 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c index 999d69168277..4320a983a588 100644 --- a/drivers/net/gianfar.c +++ b/drivers/net/gianfar.c @@ -105,6 +105,7 @@ const char gfar_driver_version[] = "1.3"; static int gfar_enet_open(struct net_device *dev); static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev); +static void gfar_reset_task(struct work_struct *work); static void gfar_timeout(struct net_device *dev); static int gfar_close(struct net_device *dev); struct sk_buff *gfar_new_skb(struct net_device *dev); @@ -209,6 +210,7 @@ static int gfar_probe(struct platform_device *pdev) spin_lock_init(&priv->txlock); spin_lock_init(&priv->rxlock); spin_lock_init(&priv->bflock); + INIT_WORK(&priv->reset_task, gfar_reset_task); platform_set_drvdata(pdev, dev); @@ -1212,6 +1214,7 @@ static int gfar_close(struct net_device *dev) napi_disable(&priv->napi); + cancel_work_sync(&priv->reset_task); stop_gfar(dev); /* Disconnect from the PHY */ @@ -1326,13 +1329,16 @@ static int gfar_change_mtu(struct net_device *dev, int new_mtu) return 0; } -/* gfar_timeout gets called when a packet has not been +/* gfar_reset_task gets scheduled when a packet has not been * transmitted after a set amount of time. * For now, assume that clearing out all the structures, and - * starting over will fix the problem. */ -static void gfar_timeout(struct net_device *dev) + * starting over will fix the problem. + */ +static void gfar_reset_task(struct work_struct *work) { - dev->stats.tx_errors++; + struct gfar_private *priv = container_of(work, struct gfar_private, + reset_task); + struct net_device *dev = priv->dev; if (dev->flags & IFF_UP) { stop_gfar(dev); @@ -1342,6 +1348,14 @@ static void gfar_timeout(struct net_device *dev) netif_tx_schedule_all(dev); } +static void gfar_timeout(struct net_device *dev) +{ + struct gfar_private *priv = netdev_priv(dev); + + dev->stats.tx_errors++; + schedule_work(&priv->reset_task); +} + /* Interrupt Handler for Transmit complete */ static int gfar_clean_tx_ring(struct net_device *dev) { diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h index d59df98bd636..f46e9b63af13 100644 --- a/drivers/net/gianfar.h +++ b/drivers/net/gianfar.h @@ -756,6 +756,7 @@ struct gfar_private { uint32_t msg_enable; + struct work_struct reset_task; /* Network Statistics */ struct gfar_extra_stats extra_stats; }; From e8296582783a9f3bf75dbeb98dfdae15fd45c008 Mon Sep 17 00:00:00 2001 From: Benjamin Herrenschmidt Date: Mon, 18 Aug 2008 07:29:23 +1000 Subject: [PATCH 63/73] ibm_newemac: Don't call dev_mc_add() before device is registered We must not call dev_mc_add() from within our HW configure which happens before we initialize and register the netdev. Do it in open() instead. Thanks to Sebastian Siewior for tracking it down. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Jeff Garzik --- drivers/net/ibm_newemac/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c index 2e720f26ca83..ccd9d9058f6d 100644 --- a/drivers/net/ibm_newemac/core.c +++ b/drivers/net/ibm_newemac/core.c @@ -663,9 +663,6 @@ static int emac_configure(struct emac_instance *dev) if (emac_phy_gpcs(dev->phy.mode)) emac_mii_reset_phy(&dev->phy); - /* Required for Pause packet support in EMAC */ - dev_mc_add(ndev, default_mcast_addr, sizeof(default_mcast_addr), 1); - return 0; } @@ -1150,6 +1147,9 @@ static int emac_open(struct net_device *ndev) } else netif_carrier_on(dev->ndev); + /* Required for Pause packet support in EMAC */ + dev_mc_add(ndev, default_mcast_addr, sizeof(default_mcast_addr), 1); + emac_configure(dev); mal_poll_add(dev->mal, &dev->commac); mal_enable_tx_channel(dev->mal, dev->mal_tx_chan); From 211cd45ac71dcd40d473fddf9a49cb1085173cb1 Mon Sep 17 00:00:00 2001 From: Ursula Braun Date: Fri, 15 Aug 2008 08:02:58 +0200 Subject: [PATCH 64/73] qeth: use -EOPNOTSUPP instead of -ENOTSUPP. return value -ENOTSUPP is not valid in userspace context, use -EOPNOTSUPP instead. Signed-off-by: Ursula Braun Signed-off-by: Frank Blaschka Signed-off-by: Jeff Garzik --- drivers/s390/net/qeth_l3_sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c index ac1993708ae9..210ddb639748 100644 --- a/drivers/s390/net/qeth_l3_sys.c +++ b/drivers/s390/net/qeth_l3_sys.c @@ -136,7 +136,7 @@ static ssize_t qeth_l3_dev_route6_store(struct device *dev, return -EINVAL; if (!qeth_is_supported(card, IPA_IPV6)) { - return -ENOTSUPP; + return -EOPNOTSUPP; } return qeth_l3_dev_route_store(card, &card->options.route6, From 7db2266a374d66f5ac85334c922cb37d76939cc5 Mon Sep 17 00:00:00 2001 From: Frank Blaschka Date: Fri, 15 Aug 2008 08:02:59 +0200 Subject: [PATCH 65/73] qeth: l2 write unicast list to hardware In case the netdev unicast list contains additional entries we have to register/deregister them. Signed-off-by: Frank Blaschka Signed-off-by: Jeff Garzik --- drivers/s390/net/qeth_core.h | 1 + drivers/s390/net/qeth_l2_main.c | 27 ++++++++++++++++++++++----- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h index 80971c21ea1a..bf8a75c92f28 100644 --- a/drivers/s390/net/qeth_core.h +++ b/drivers/s390/net/qeth_core.h @@ -689,6 +689,7 @@ struct qeth_mc_mac { struct list_head list; __u8 mc_addr[MAX_ADDR_LEN]; unsigned char mc_addrlen; + int is_vmac; }; struct qeth_card { diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c index b3cee032f578..3ac3cc1e03cc 100644 --- a/drivers/s390/net/qeth_l2_main.c +++ b/drivers/s390/net/qeth_l2_main.c @@ -177,9 +177,10 @@ static int qeth_l2_send_delgroupmac(struct qeth_card *card, __u8 *mac) qeth_l2_send_delgroupmac_cb); } -static void qeth_l2_add_mc(struct qeth_card *card, __u8 *mac) +static void qeth_l2_add_mc(struct qeth_card *card, __u8 *mac, int vmac) { struct qeth_mc_mac *mc; + int rc; mc = kmalloc(sizeof(struct qeth_mc_mac), GFP_ATOMIC); @@ -188,8 +189,16 @@ static void qeth_l2_add_mc(struct qeth_card *card, __u8 *mac) memcpy(mc->mc_addr, mac, OSA_ADDR_LEN); mc->mc_addrlen = OSA_ADDR_LEN; + mc->is_vmac = vmac; - if (!qeth_l2_send_setgroupmac(card, mac)) + if (vmac) { + rc = qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETVMAC, + NULL); + } else { + rc = qeth_l2_send_setgroupmac(card, mac); + } + + if (!rc) list_add_tail(&mc->list, &card->mc_list); else kfree(mc); @@ -201,7 +210,11 @@ static void qeth_l2_del_all_mc(struct qeth_card *card) spin_lock_bh(&card->mclock); list_for_each_entry_safe(mc, tmp, &card->mc_list, list) { - qeth_l2_send_delgroupmac(card, mc->mc_addr); + if (mc->is_vmac) + qeth_l2_send_setdelmac(card, mc->mc_addr, + IPA_CMD_DELVMAC, NULL); + else + qeth_l2_send_delgroupmac(card, mc->mc_addr); list_del(&mc->list); kfree(mc); } @@ -590,7 +603,7 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p) static void qeth_l2_set_multicast_list(struct net_device *dev) { struct qeth_card *card = dev->ml_priv; - struct dev_mc_list *dm; + struct dev_addr_list *dm; if (card->info.type == QETH_CARD_TYPE_OSN) return ; @@ -599,7 +612,11 @@ static void qeth_l2_set_multicast_list(struct net_device *dev) qeth_l2_del_all_mc(card); spin_lock_bh(&card->mclock); for (dm = dev->mc_list; dm; dm = dm->next) - qeth_l2_add_mc(card, dm->dmi_addr); + qeth_l2_add_mc(card, dm->da_addr, 0); + + for (dm = dev->uc_list; dm; dm = dm->next) + qeth_l2_add_mc(card, dm->da_addr, 1); + spin_unlock_bh(&card->mclock); if (!qeth_adp_supported(card, IPA_SETADP_SET_PROMISC_MODE)) return; From bd8774c841aa5162d1d6837b3d21f4dcee71f36a Mon Sep 17 00:00:00 2001 From: Frank Blaschka Date: Fri, 15 Aug 2008 08:03:00 +0200 Subject: [PATCH 66/73] qeth: preallocated header account offset When a preallocated header qdio buffer is filled we have to account the offset for the data length. Signed-off-by: Frank Blaschka Signed-off-by: Jeff Garzik --- drivers/s390/net/qeth_core_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c index bd420d1b9a0d..c7ab1b864516 100644 --- a/drivers/s390/net/qeth_core_main.c +++ b/drivers/s390/net/qeth_core_main.c @@ -3024,7 +3024,7 @@ static inline void __qeth_fill_buffer(struct sk_buff *skb, struct qdio_buffer *buffer, int is_tso, int *next_element_to_fill, int offset) { - int length = skb->len; + int length = skb->len - offset; int length_here; int element; char *data; From 17393dd67c06c3912ff47b31268b648929715336 Mon Sep 17 00:00:00 2001 From: Jiri Slaby Date: Thu, 14 Aug 2008 18:27:23 +0200 Subject: [PATCH 67/73] e100, fix iomap read There were 2 omitted readb's used on an iomap space. eliminate them by using ioread8 instead. Signed-off-by: Jiri Slaby Cc: Jeff Kirsher Cc: Jesse Brandeburg Cc: Bruce Allan Cc: PJ Waskiewicz Cc: John Ronciak Signed-off-by: Jeff Garzik --- drivers/net/e100.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/e100.c b/drivers/net/e100.c index 19d32a227be1..453115acaad2 100644 --- a/drivers/net/e100.c +++ b/drivers/net/e100.c @@ -1838,7 +1838,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx, if ((le16_to_cpu(rfd->command) & cb_el) && (RU_RUNNING == nic->ru_running)) - if (readb(&nic->csr->scb.status) & rus_no_res) + if (ioread8(&nic->csr->scb.status) & rus_no_res) nic->ru_running = RU_SUSPENDED; return -ENODATA; } @@ -1861,7 +1861,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx, if ((le16_to_cpu(rfd->command) & cb_el) && (RU_RUNNING == nic->ru_running)) { - if (readb(&nic->csr->scb.status) & rus_no_res) + if (ioread8(&nic->csr->scb.status) & rus_no_res) nic->ru_running = RU_SUSPENDED; } From f2455eb176ac87081bbfc9a44b21c7cd2bc1967e Mon Sep 17 00:00:00 2001 From: Eugene Teo Date: Wed, 27 Aug 2008 04:50:30 -0700 Subject: [PATCH 68/73] wan: Missing capability checks in sbni_ioctl() There are missing capability checks in the following code: 1300 static int 1301 sbni_ioctl( struct net_device *dev, struct ifreq *ifr, int cmd) 1302 { [...] 1319 case SIOCDEVRESINSTATS : 1320 if( current->euid != 0 ) /* root only */ 1321 return -EPERM; [...] 1336 case SIOCDEVSHWSTATE : 1337 if( current->euid != 0 ) /* root only */ 1338 return -EPERM; [...] 1357 case SIOCDEVENSLAVE : 1358 if( current->euid != 0 ) /* root only */ 1359 return -EPERM; [...] 1372 case SIOCDEVEMANSIPATE : 1373 if( current->euid != 0 ) /* root only */ 1374 return -EPERM; Here's my proposed fix: Missing capability checks. Signed-off-by: Eugene Teo Signed-off-by: David S. Miller --- drivers/net/wan/sbni.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/wan/sbni.c b/drivers/net/wan/sbni.c index e59255a155a9..6596cd0742b9 100644 --- a/drivers/net/wan/sbni.c +++ b/drivers/net/wan/sbni.c @@ -1317,7 +1317,7 @@ sbni_ioctl( struct net_device *dev, struct ifreq *ifr, int cmd ) break; case SIOCDEVRESINSTATS : - if( current->euid != 0 ) /* root only */ + if (!capable(CAP_NET_ADMIN)) return -EPERM; memset( &nl->in_stats, 0, sizeof(struct sbni_in_stats) ); break; @@ -1334,7 +1334,7 @@ sbni_ioctl( struct net_device *dev, struct ifreq *ifr, int cmd ) break; case SIOCDEVSHWSTATE : - if( current->euid != 0 ) /* root only */ + if (!capable(CAP_NET_ADMIN)) return -EPERM; spin_lock( &nl->lock ); @@ -1355,7 +1355,7 @@ sbni_ioctl( struct net_device *dev, struct ifreq *ifr, int cmd ) #ifdef CONFIG_SBNI_MULTILINE case SIOCDEVENSLAVE : - if( current->euid != 0 ) /* root only */ + if (!capable(CAP_NET_ADMIN)) return -EPERM; if (copy_from_user( slave_name, ifr->ifr_data, sizeof slave_name )) @@ -1370,7 +1370,7 @@ sbni_ioctl( struct net_device *dev, struct ifreq *ifr, int cmd ) return enslave( dev, slave_dev ); case SIOCDEVEMANSIPATE : - if( current->euid != 0 ) /* root only */ + if (!capable(CAP_NET_ADMIN)) return -EPERM; return emancipate( dev ); From 328fc47ea0bcc27d9afa69c3ad6e52431cadd76c Mon Sep 17 00:00:00 2001 From: Vlad Yasevich Date: Wed, 27 Aug 2008 16:08:54 -0700 Subject: [PATCH 69/73] sctp: correct bounds check in sctp_setsockopt_auth_key The bonds check to prevent buffer overlflow was not exactly right. It still allowed overflow of up to 8 bytes which is sizeof(struct sctp_authkey). Since optlen is already checked against the size of that struct, we are guaranteed not to cause interger overflow either. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller --- net/sctp/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index afa952e726d7..9b9b2c31dd15 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -3144,7 +3144,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk, goto out; } - if (authkey->sca_keylength > optlen) { + if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) { ret = -EINVAL; goto out; } From d97240552cd98c4b07322f30f66fd9c3ba4171de Mon Sep 17 00:00:00 2001 From: Vlad Yasevich Date: Wed, 27 Aug 2008 16:09:49 -0700 Subject: [PATCH 70/73] sctp: fix random memory dereference with SCTP_HMAC_IDENT option. The number of identifiers needs to be checked against the option length. Also, the identifier index provided needs to be verified to make sure that it doesn't exceed the bounds of the array. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller --- net/sctp/auth.c | 3 +++ net/sctp/socket.c | 6 ++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/net/sctp/auth.c b/net/sctp/auth.c index 1fcb4cf2f4c9..52db5f60daa0 100644 --- a/net/sctp/auth.c +++ b/net/sctp/auth.c @@ -786,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep, for (i = 0; i < hmacs->shmac_num_idents; i++) { id = hmacs->shmac_idents[i]; + if (id > SCTP_AUTH_HMAC_ID_MAX) + return -EOPNOTSUPP; + if (SCTP_AUTH_HMAC_ID_SHA1 == id) has_sha1 = 1; diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 9b9b2c31dd15..5ffb9dec1c3f 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -3086,6 +3086,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, int optlen) { struct sctp_hmacalgo *hmacs; + u32 idents; int err; if (!sctp_auth_enable) @@ -3103,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, goto out; } - if (hmacs->shmac_num_idents == 0 || - hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) { + idents = hmacs->shmac_num_idents; + if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS || + (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) { err = -EINVAL; goto out; } From 3cc76caa98b092a8fb3e7b4303c70f847db0651f Mon Sep 17 00:00:00 2001 From: Yang Hongyang Date: Fri, 29 Aug 2008 14:06:51 -0700 Subject: [PATCH 71/73] ipv6: When we droped a packet, we should return NET_RX_DROP instead of 0 Signed-off-by: Yang Hongyang Signed-off-by: David S. Miller --- net/ipv6/raw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index 01d47674f7e5..e53e493606c5 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -377,14 +377,14 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb) skb_checksum_complete(skb)) { atomic_inc(&sk->sk_drops); kfree_skb(skb); - return 0; + return NET_RX_DROP; } /* Charge it to the socket. */ if (sock_queue_rcv_skb(sk,skb)<0) { atomic_inc(&sk->sk_drops); kfree_skb(skb); - return 0; + return NET_RX_DROP; } return 0; @@ -429,7 +429,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb) if (skb_checksum_complete(skb)) { atomic_inc(&sk->sk_drops); kfree_skb(skb); - return 0; + return NET_RX_DROP; } } From 102396ae65108b026e4e1868e30fa013f45a169e Mon Sep 17 00:00:00 2001 From: Jarek Poplawski Date: Fri, 29 Aug 2008 14:21:52 -0700 Subject: [PATCH 72/73] pkt_sched: Fix locking of qdisc_root with qdisc_root_sleeping_lock() Use qdisc_root_sleeping_lock() instead of qdisc_root_lock() where appropriate. The only difference is while dev is deactivated, when currently we can use a sleeping qdisc with the lock of noop_qdisc. This shouldn't be dangerous since after deactivation root lock could be used only by gen_estimator code, but looks wrong anyway. Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller --- net/sched/cls_api.c | 2 +- net/sched/cls_route.c | 2 +- net/sched/sch_api.c | 8 ++++---- net/sched/sch_cbq.c | 2 +- net/sched/sch_htb.c | 4 ++-- net/sched/sch_netem.c | 2 +- net/sched/sch_teql.c | 2 +- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 5cafdd4c8018..8eb79e92e94c 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -205,7 +205,7 @@ replay: } } - root_lock = qdisc_root_lock(q); + root_lock = qdisc_root_sleeping_lock(q); if (tp == NULL) { /* Proto-tcf does not exist, create new one */ diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c index 481260a4f10f..e3d8455eebc2 100644 --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c @@ -75,7 +75,7 @@ static __inline__ int route4_fastmap_hash(u32 id, int iif) static inline void route4_reset_fastmap(struct Qdisc *q, struct route4_head *head, u32 id) { - spinlock_t *root_lock = qdisc_root_lock(q); + spinlock_t *root_lock = qdisc_root_sleeping_lock(q); spin_lock_bh(root_lock); memset(head->fastmap, 0, sizeof(head->fastmap)); diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 506b709510b6..1122c952aa99 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1169,8 +1169,8 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid, if (q->stab && qdisc_dump_stab(skb, q->stab) < 0) goto nla_put_failure; - if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS, - TCA_XSTATS, qdisc_root_lock(q), &d) < 0) + if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS, TCA_XSTATS, + qdisc_root_sleeping_lock(q), &d) < 0) goto nla_put_failure; if (q->ops->dump_stats && q->ops->dump_stats(q, &d) < 0) @@ -1461,8 +1461,8 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q, if (cl_ops->dump && cl_ops->dump(q, cl, skb, tcm) < 0) goto nla_put_failure; - if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS, - TCA_XSTATS, qdisc_root_lock(q), &d) < 0) + if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS, TCA_XSTATS, + qdisc_root_sleeping_lock(q), &d) < 0) goto nla_put_failure; if (cl_ops->dump_stats && cl_ops->dump_stats(q, cl, &d) < 0) diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c index 9b720adedead..8b06fa900482 100644 --- a/net/sched/sch_cbq.c +++ b/net/sched/sch_cbq.c @@ -1754,7 +1754,7 @@ static void cbq_put(struct Qdisc *sch, unsigned long arg) if (--cl->refcnt == 0) { #ifdef CONFIG_NET_CLS_ACT - spinlock_t *root_lock = qdisc_root_lock(sch); + spinlock_t *root_lock = qdisc_root_sleeping_lock(sch); struct cbq_sched_data *q = qdisc_priv(sch); spin_lock_bh(root_lock); diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c index 97d4761cc31e..d14f02056ae6 100644 --- a/net/sched/sch_htb.c +++ b/net/sched/sch_htb.c @@ -1043,7 +1043,7 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt) static int htb_dump(struct Qdisc *sch, struct sk_buff *skb) { - spinlock_t *root_lock = qdisc_root_lock(sch); + spinlock_t *root_lock = qdisc_root_sleeping_lock(sch); struct htb_sched *q = qdisc_priv(sch); struct nlattr *nest; struct tc_htb_glob gopt; @@ -1075,7 +1075,7 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb, struct tcmsg *tcm) { struct htb_class *cl = (struct htb_class *)arg; - spinlock_t *root_lock = qdisc_root_lock(sch); + spinlock_t *root_lock = qdisc_root_sleeping_lock(sch); struct nlattr *nest; struct tc_htb_opt opt; diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index fb0294d0b55e..3781e55046d0 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -341,7 +341,7 @@ static int get_dist_table(struct Qdisc *sch, const struct nlattr *attr) for (i = 0; i < n; i++) d->table[i] = data[i]; - root_lock = qdisc_root_lock(sch); + root_lock = qdisc_root_sleeping_lock(sch); spin_lock_bh(root_lock); d = xchg(&q->delay_dist, d); diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c index 2c35c678563b..d35ef059abb1 100644 --- a/net/sched/sch_teql.c +++ b/net/sched/sch_teql.c @@ -161,7 +161,7 @@ teql_destroy(struct Qdisc* sch) txq = netdev_get_tx_queue(master->dev, 0); master->slaves = NULL; - root_lock = qdisc_root_lock(txq->qdisc); + root_lock = qdisc_root_sleeping_lock(txq->qdisc); spin_lock_bh(root_lock); qdisc_reset(txq->qdisc); spin_unlock_bh(root_lock); From 7c19a3d280297d43ef5ff7c6b205dc208a16d3d1 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Fri, 29 Aug 2008 14:37:23 -0700 Subject: [PATCH 73/73] net: Unbreak userspace usage of linux/mroute.h Nothing in linux/pim.h should be exported to userspace. This should fix the XORP build failure reported by Jose Calhariz, the debain package maintainer. Nothing originally in linux/mroute.h was exported to userspace ever, but some of this stuff started to be when it was moved into this new linux/pim.h, and that was wrong. If we didn't provide these definitions for 10 years we can reasonably expect that applications defined this stuff locally or used GLIBC headers providing the protocol definitions. And as such the only result of this can be conflict and userland build breakage. Signed-off-by: David S. Miller --- include/linux/Kbuild | 1 - include/linux/mroute.h | 2 +- include/linux/mroute6.h | 1 + include/linux/pim.h | 18 ------------------ 4 files changed, 2 insertions(+), 20 deletions(-) diff --git a/include/linux/Kbuild b/include/linux/Kbuild index 7d970678f940..59391250d51c 100644 --- a/include/linux/Kbuild +++ b/include/linux/Kbuild @@ -297,7 +297,6 @@ unifdef-y += parport.h unifdef-y += patchkey.h unifdef-y += pci.h unifdef-y += personality.h -unifdef-y += pim.h unifdef-y += pktcdvd.h unifdef-y += pmu.h unifdef-y += poll.h diff --git a/include/linux/mroute.h b/include/linux/mroute.h index 07112ee9293a..8a455694d682 100644 --- a/include/linux/mroute.h +++ b/include/linux/mroute.h @@ -6,7 +6,6 @@ #ifdef __KERNEL__ #include #endif -#include /* * Based on the MROUTING 3.5 defines primarily to keep @@ -130,6 +129,7 @@ struct igmpmsg */ #ifdef __KERNEL__ +#include #include #ifdef CONFIG_IP_MROUTE diff --git a/include/linux/mroute6.h b/include/linux/mroute6.h index 5cf50473a10f..6f4c180179e2 100644 --- a/include/linux/mroute6.h +++ b/include/linux/mroute6.h @@ -115,6 +115,7 @@ struct sioc_mif_req6 #ifdef __KERNEL__ +#include #include /* for struct sk_buff_head */ #ifdef CONFIG_IPV6_MROUTE diff --git a/include/linux/pim.h b/include/linux/pim.h index 236ffd317394..1ba0661561a4 100644 --- a/include/linux/pim.h +++ b/include/linux/pim.h @@ -3,22 +3,6 @@ #include -#ifndef __KERNEL__ -struct pim { -#if defined(__LITTLE_ENDIAN_BITFIELD) - __u8 pim_type:4, /* PIM message type */ - pim_ver:4; /* PIM version */ -#elif defined(__BIG_ENDIAN_BITFIELD) - __u8 pim_ver:4; /* PIM version */ - pim_type:4; /* PIM message type */ -#endif - __u8 pim_rsv; /* Reserved */ - __be16 pim_cksum; /* Checksum */ -}; - -#define PIM_MINLEN 8 -#endif - /* Message types - V1 */ #define PIM_V1_VERSION __constant_htonl(0x10000000) #define PIM_V1_REGISTER 1 @@ -27,7 +11,6 @@ struct pim { #define PIM_VERSION 2 #define PIM_REGISTER 1 -#if defined(__KERNEL__) #define PIM_NULL_REGISTER __constant_htonl(0x40000000) /* PIMv2 register message header layout (ietf-draft-idmr-pimvsm-v2-00.ps */ @@ -42,4 +25,3 @@ struct pimreghdr struct sk_buff; extern int pim_rcv_v1(struct sk_buff *); #endif -#endif