summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2009-06-11wimax/i2400m: don't reset device on i2400m_dev_shutdown()Inaky Perez-Gonzalez
i2400m_dev_shutdown() tried to reset the device to put it in a known state before shutting down. But that turned out to be pointless. We reach this case in two paths: 1 - when the device resets, to clean up state 2 - when the driver is unloaded, for the same however, in both cases it is pointless; in (1) the device is already reset, why do it again? in (2) we can't -- the USB stack, for example, doesn't allow communicating with the device when the driver is being unbound and if the device is disconnected, the device is gone already. So just remove it. Leave the function as a placeholder for future cleanups that will be done from data allocated by the driver during device operation. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
2009-06-11wimax/i2400m: fix panic due to missed corner cases on tail_room calculationInaky Perez-Gonzalez
i2400m_tx_skip_tail() needs to handle the special case of being called when the tail room that is left over in the FIFO is zero. This happens when a TX message header was opened at the very end of the FIFO (without payloads). The i2400m_tx_close() code already marked said TX message (header) to be skipped and this function should be doing nothing. It is called anyway because it is part of a common "corner case" path handling which takes care of more cases than only this one. The tail room computation was also improved to take care of the case when tx_in is at the end of the buffer boundary; tail_room has to be modded (%) to the buffer size. To do that in a single well-documented place, __i2400m_tx_tail_room() is introduced and used. Treat i2400m->tx_in == 0 as a corner case and handle it accordingly. Found and diagnosed by Cindy H. Kao. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
2009-06-11wimax/i2400m: fix panic/warnings caused by missed check on empty TX messageInaky Perez-Gonzalez
In some situations, when a new TX message header is started, there might be no space for data payloads. In this case the message is left with zero payloads and the i2400m_tx_close() function has just to mark it as "to skip". If it tries to go ahead it will overwrite things because there is no space to add padding as defined by the bus-specific layer. This can cause buffer overruns and in some stress cases, panics. Found and diagnosed by Cindy H. Kao. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
2009-06-11wimax/i2400m: rename misleading I2400M_PL_PAD to I2400M_PL_ALIGNInaky Perez-Gonzalez
The constant is being use as an alignment factor, not as a padding factor; made reading/reviewing the code quite confusing. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
2009-06-11wimax/i2400m/sdio: Implement I2400M_RT_BUS reset typeDirk Brandewie
This reset type causes the WiMAX function to be disabled and re-enabled, which will force the WiMAX device to reset and enter boot mode. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com> Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com>
2009-06-11wimax/i2400m: Change d_printf() level for secure boot messagesDirk Brandewie
Changing debug level of print out to support validation engineers getting the messages they need. Signed-off-by: <dirk.j.brandewie@intel.com>
2009-06-11wimax/i2400m: i2400m_schedule_work() doesn't need i2400m->work_queueInaky Perez-Gonzalez
By mistake, the BUG_ON() check was left in there and it will fail when called if i2400m->work_queue is still not setup. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
2009-06-11wimax/i2400m: i2400m's work queue should be initialized before RX supportInaky Perez-Gonzalez
RX support is the only user of the work-queue, to process reports/notifications from the device. Thus, it needs the work queue to be initialized first. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
2009-06-11wimax/i2400m: don't call netif_start_queue() in _tx_msg_sent()Inaky Perez-Gonzalez
Reported and fixed by Cindy H Kao. When the device is stopped __i2400m_dev_stop() stops the network queue. However, when this is done in the middle of heavy network operation, when the bus-specific subdriver is still wrapping up and it reports a sent TX transaction with _tx_msg_sent() right after the device was stopped, the queue was being started again, which was causing a stream of oopsen and finally a panic. In any case, said call has no place there. It's a left over from an early implementation that was discarded later on. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
2009-06-11wimax/i2400m: introduce module parameter to disable entering power saveInaky Perez-Gonzalez
The i2400m driver waits for the device to report being ready for entering power save before asking it to do so. This module parameter allows control of said operation; if disabled, the driver won't ask the device to enter power save mode. This is useful in setups where power saving is not so important or when the overhead imposed by network reentry after power save is not acceptable; by combining this with parameter 'idle_mode_disabled', the driver will always maintain both the connection and the device in active state. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
2009-06-11atl1c: WAKE_MCAST tested twice, not WAKE_UCASTRoel Kluin
The WAKE_MCAST bit is tested twice, the first should be WAKE_UCAST. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Cc: Jie Yang <jie.yang@atheros.com> Cc: Jay Cliburn <jcliburn@gmail.com> Cc: Chris Snook <csnook@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-11de2104x: support for systems lacking cache coherenceRisto Suominen
Add a configurable Descriptor Skip Length for systems that lack cache coherence. (akpm: I think this should be done as a module parameter, not a compile-tinme option) Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com> Cc: Grant Grundler <grundler@parisc-linux.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-11drivers/net/macvlan.c: fix cloning of tagged VLAN interfacessg.tweak@gmail.com
Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13348 akpm: the reporter disappeared, so I typed it in again. It is not possible to make clone of tagged VLAN interface to be used as mac-based vlan interfave. How reproducible: Use any 802.1q tagged vlan interface, e.g. eth2.700 and clone it: ip link add link eth2.700 address 00:04:75:cb:38:09 macvlan0 type macvlan ip link set dev macvlan0 up ip addr add 10.195.1.1/24 dev macvlan0 So far, so good. Now try to ping anything via macvlan0: ping 10.195.1.2 Actual results: For every attempted packet tx kernel writes to console: ------------[ cut here ]------------ WARNING: at net/8021q/vlan_dev.c:254 vlan_dev_hard_header+0x36/0x126 [8021q]() Hardware name: M22ES Modules linked in: arptable_filter arp_tables bridge veth macvlan arc4 ecb ppp_mppe ppp_async crc_ccitt ppp_generic slhc autofs4 sunrpc 8021q garp stp ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack xt_tcpudp x_tables dm_mirror dm_region_hash dm_log dm_multipath dm_mod sbs sbshc lp floppy snd_intel8x0 joydev snd_seq_dummy snd_intel8x0m snd_ac97_codec ide_cd_mod ac97_bus snd_seq_oss cdrom snd_seq_midi_event serio_raw snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss parport_pc snd_pcm parport battery 8139cp snd_timer i2c_sis96x ac button snd rtc_cmos rtc_core 8139too soundcore rtc_lib mii i2c_core pcspkr snd_page_alloc pata_sis libata sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd [last unloaded: ip_tables] Pid: 0, comm: swapper Tainted: G W 2.6.29.3 #1 Call Trace: [<c0425f48>] warn_slowpath+0x60/0x9f [<c0425f6f>] warn_slowpath+0x87/0x9f [<dffb850d>] vlan_dev_hard_header+0x0/0x126 [8021q] [<dffb8543>] vlan_dev_hard_header+0x36/0x126 [8021q] [<dffb850d>] vlan_dev_hard_header+0x0/0x126 [8021q] [<df83155d>] macvlan_hard_header+0x3c/0x47 [macvlan] [<df831521>] macvlan_hard_header+0x0/0x47 [macvlan] [<c062bf3f>] arp_create+0xef/0x1ff [<c062c08c>] arp_send+0x3d/0x54 [<c062c916>] arp_solicit+0x16c/0x177 [<c05fadd2>] neigh_timer_handler+0x227/0x269 [<c05fabab>] neigh_timer_handler+0x0/0x269 [<c042ce4d>] run_timer_softirq+0xf0/0x141 [<c0429e5a>] __do_softirq+0x76/0xf8 [<c0429de4>] __do_softirq+0x0/0xf8 <IRQ> [<c044fb67>] handle_level_irq+0x0/0xad [<c0429db7>] irq_exit+0x35/0x62 [<c04046bb>] do_IRQ+0xdf/0xf4 [<c04035a7>] common_interrupt+0x27/0x2c [<c04079c5>] default_idle+0x2a/0x3d [<c0401bb6>] cpu_idle+0x57/0x70 Macvlan driver always uses standard ethernet header length for all types of interface to which it is linked. This patch fixes this problem. Reported-by: <sg.tweak@gmail.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: "Rafael J. Wysocki" <rjw@sisk.pl> Cc: "David S. Miller" <davem@davemloft.net> Cc: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-11e100: add non-MII PHY supportAndreas Mohr
Restore support for cards with MII-lacking PHYs as compared to removed pre-2.6.29 eepro100 driver: use full low-level MII I/O access abstraction by providing clean PHY-specific mdio_ctrl() functions for either standard MII-compliant cards, slightly special ones or non-MII PHY ones. We now have another netdev_priv member for mdio_ctrl(), thus we have some array indirection, but we save some additional opcodes for specific phy_82552_v handling in the common case. [akpm@linux-foundation.org: cleanups] Signed-off-by: Andreas Mohr <andi@lisas.de> Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Cc: Jesse Brandeburg <jesse.brandeburg@intel.com> Cc: Bruce Allan <bruce.w.allan@intel.com> Cc: PJ Waskiewicz <peter.p.waskiewicz.jr@intel.com> Cc: John Ronciak <john.ronciak@intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-11ieee802154: Use '%Zu' printf format for size_t.David S. Miller
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-10Merge branch 'master' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6
2009-06-10cfg80211: fix rfkill locking problemJohannes Berg
rfkill currently requires a global lock within the rfkill_register() function, and holds that lock over calls to the set_block() methods. This means that we cannot hold a lock around rfkill_register() that we also require in set_block(), directly or indirectly. Fix cfg80211 to register rfkill outside the block locked by its global lock. Much of what cfg80211 does in the locked block doesn't need to be locked anyway. Reported-by: Vasanthakumar Thiagarajan <vasanth@atheros.com> Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10mac80211: disable PS while probing APJohannes Berg
When associated, but probing the AP because we detected beacon loss, we need to disable powersave to be able to receive the probe response. Change the code to do that by checking whether we're trying to probe when determining the possibility of going into PS, and recalculate the PS ability at the necessary spots. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10mac80211: disable moving between PS modes during scanLuis R. Rodriguez
We don't want to trigger moving between PS mode during scan, because then we will sometimes end up sending nullfunc frames during scan. We're supposed to only send one prior to scan and after scan. This fixes an oops which occured due to an assert in ath9k: http://marc.info/?l=linux-wireless&m=124277331319024 The assert was happening because the rate control algorithm figures it should find at least one valid dual stream or single stream rate. Since we allow mac80211 to send nullfunc frames during scan and dynamic PS was enabled at times we ended up trying to send nullfunc frames for the target sta on the wrong band for which we have no valid rate to communicate with it. This breaks the assumptions in rate control. We determine we also need to disable moving between PS modes when not associated so lets just add that now as well, and we should not have a ps_sdata when that interface cannot actually go into PS because it's not associated. Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10ath5k: minor rfkill cleanupBob Copeland
Always enable rfkill since the ifdefs in the code is not really worth the Kconfig option. Also fix a few code style things, and remove the usage of the ah_gpio[] array so we can remove it later. Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10mac80211: clean up return value of __ieee80211_parse_tx_radiotapJohannes Berg
The return type has more than two values, but it can validly only ever return TX_DROP and TX_CONTINUE, so use a bool instead of ieee80211_tx_result. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10mac80211: don't use master netdev nameJohannes Berg
Always use the wiphy name instead. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10ath9k: Fix tx stuck when connected to aggr disabled HT APVasanthakumar Thiagarajan
This patch along with my previous patch in mac80211 "Fix the way ADDBA count..", fixes hang in tx when connected to an HT AP which rejects/times out on addba req. AGGR_ADDBA_PROGRESS should be cleared in aggr state when addba negotiation is terminated due to either addba response is timed out or addba is denied by the AP. With out clearing this bit, all frames are queued onto s/w queue for getting tx'd as aggr and will never be scheduled onto hw queue. Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10mac80211: Fix the way ADDBA request count being modifiedVasanthakumar Thiagarajan
addba_req_num[tid] is supposed to have the count of consecutive addba request attempts on 'tid' which failed. This count is checked against a retry threshold (3 times) before starting the addba negotiation. This patch fixes the way this addba count is incremented/reset and thereby avoids indefinite addba attempts. Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10cfg80211: fix for duplicate response for driver reg requestLuis R. Rodriguez
As Pavel puts userspace can be stupid and should not cause kernel crashes. In this case Pavel was able to find a crash here but unable to reproduce. Either way lets deal with this. This should fix: ------------[ cut here ]------------ kernel BUG at /home/proski/src/linux-2.6/net/wireless/reg.c:2132! Oops: Exception in kernel mode, sig: 5 [#1] PowerMac Modules linked in: ath5k ath [last unloaded: scsi_wait_scan] NIP: c02f3eac LR: c02f3d08 CTR: 00000000 REGS: ef107aa0 TRAP: 0700 Not tainted (2.6.30-rc8-wl) MSR: 00029032 <EE,ME,CE,IR,DR> CR: 88002442 XER: 20000000 TASK = ef84acb0[834] 'crda' THREAD: ef106000 GPR00: ef953840 ef107b50 ef84acb0 ef1380bc 00000006 c035a5c8 ef107b90 c035a5c8 GPR08: 00080005 efb68980 c0445628 ef130004 28002422 10019ce0 10012d3c 00000001 GPR16: 1070b2ac 00000005 48023558 1070b380 4802304c 00000000 ef107ddc c035a5c8 GPR24: ef107b78 c0443350 ef8bcb00 00000005 ef138080 c04a6a70 c04a0000 ef8bcb00 NIP [c02f3eac] set_regdom+0x4c4/0x4ec LR [c02f3d08] set_regdom+0x320/0x4ec Call Trace: [ef107b50] [c02f3d08] set_regdom+0x320/0x4ec (unreliable) [ef107b70] [c02f9d10] nl80211_set_reg+0x140/0x2d0 [ef107bc0] [c02aa2b8] genl_rcv_msg+0x204/0x228 [ef107c10] [c02a97cc] netlink_rcv_skb+0xe8/0x10c [ef107c30] [c02aa094] genl_rcv+0x3c/0x5c [ef107c40] [c02a9050] netlink_unicast+0x308/0x36c [ef107c80] [c02a92bc] netlink_sendmsg+0x208/0x2f0 [ef107cd0] [c0282048] sock_sendmsg+0xac/0xe4 [ef107db0] [c02822b4] sys_sendmsg+0x234/0x2d8 [ef107f00] [c0283a88] sys_socketcall+0x108/0x258 [ef107f40] [c0012790] ret_from_syscall+0x0/0x38 Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10b43: Add fw capabilitiesMichael Buesch
Add automagic feature flags, so the firmware can tell the driver about supported features and the driver can switch features on/off as needed. Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> Tested-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10rfkill: don't impose global states on resume (just restore the previous states)Alan Jenkins
Once rfkill-input is disabled, the "global" states will only be used as default initial states. Since the states will always be the same after resume, we shouldn't generate events on resume. Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10sony-laptop: no need to unblock rfkill on loadAlan Jenkins
The re-written rfkill core ensures rfkill devices are initialized to the system default state. The core calls set_block after registration so the driver shouldn't need to. Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10rfkill: remove set_global_sw_stateAlan Jenkins
rfkill_set_global_sw_state() (previously rfkill_set_default()) will no longer be exported by the rewritten rfkill core. Instead, platform drivers which can provide persistent soft-rfkill state across power-down/reboot should indicate their initial state by calling rfkill_set_sw_state() before registration. Otherwise, they will be initialized to a default value during registration by a set_block call. We remove existing calls to rfkill_set_sw_state() which happen before registration, since these had no effect in the old model. If these drivers do have persistent state, the calls can be put back (subject to testing :-). This affects hp-wmi and acer-wmi. Drivers with persistent state will affect the global state only if rfkill-input is enabled. This is required, otherwise booting with wireless soft-blocked and pressing the wireless-toggle key once would have no apparent effect. This special case will be removed in future along with rfkill-input, in favour of a more flexible userspace daemon (see Documentation/feature-removal-schedule.txt). Now rfkill_global_states[n].def is only used to preserve global states over EPO, it is renamed to ".sav". Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk> Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10mac80211: do not pass PS frames out of mac80211 againJohannes Berg
In order to handle powersave frames properly we had needed to pass these out to the device queues again, and introduce the skb->requeue bit. This, however, also has unnecessary overhead by needing to 'clean up' already tried frames, and this clean-up code is also buggy when software encryption is used. Instead of sending the frames via the master netdev queue again, simply put them into the pending queue. This also fixes a problem where frames for that particular station could be reordered when some were still on the software queues and older ones are re-injected into the software queue after them. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10sony: fix rfkill codeJohannes Berg
During the rfkill conversion I added code to call sony_nc_rfkill_set with the wrong argument, causing a segfault Reinette reported. The compiler could not catch that because the argument is, and needs to be, void *. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Reported-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10rfkill: remove input KconfigJohannes Berg
Now that we added the ioctl, there's no need to ask the user to configure this. We will keep it enabled for now, and eventually swap the default to n. Also let embedded users select it only if they need it. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10b43/legacy: port to cfg80211 rfkillJohannes Berg
This ports the b43/legacy rfkill code to the new API offered by cfg80211 and thus removes a lot of useless stuff. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Cc: Michael Buesch <mb@bu3sch.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10ath5k: added cfg80211 based rfkill supportTobias Doerffel
This patch introduces initial rfkill support for the ath5k driver based on rfkill support in the cfg80211 framework. All rfkill related code is separated into newly created rfkill.c. Changes to existing code are minimal: * added a new data structure ath5k_rfkill to the ath5k_softc structure * inserted calls to HW rfkill init/deinit routines * ath5k_intr() has been extended to handle AR5K_INT_GPIO interrupts Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10rfkill: print events when input handler is disabled/enabledJohannes Berg
It is useful for debugging when we know if something disabled the in-kernel rfkill input handler. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10ar9170: xmit code revampChristian Lamparter
This patch is a back-port from aggregation testing code. In the past, we didn't limit the amount of active tx urbs. However, ar9170 only has a limited buffer reserved for pending data frames. This wasn't much of a problem with the slower 802.11b/g. We simply stopped the full queue and moved on to something different in the mean time. But - as you guessed it - this simple approach stands in way for a decent aggregation implementation. Signed-off-by: Christian Lamparter <chunkeey@web.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10ar9170: interpret firmware debug commandsJohannes Berg
This adds new commands that the original firmware will not send but we can use them to debug firmware. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10mac80211 : fix unaligned rx skbmatthieu castet
mac80211 is checking is the skb is aligned on 32 bit boundary. But it is checking against ethernet header, whereas Linux expect IP header aligned. And ethernet ether size is 6*2+2=14, so aligning ethernet header make IP header unaligned. Signed-off-by: Matthieu CASTET <castet.matthieu@free.fr> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10b43: Fix possible unaligned u32 accessMatthieu CASTET
Fix possible unaligned u32 access in b43_generate_plcp_hdr(). Unaligned data is read/write with a u32 pointer instead of using the packed structure. Some versions of gcc ignore the "packed" attribute, if the structure element is accessed through a local pointer. Signed-off-by: Matthieu CASTET <castet.matthieu@free.fr> Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10mac80211: fix minstrel single-rate memory corruptionBob Copeland
The minstrel rate controller periodically looks up rate indexes in a sampling table. When accessing a specific row and column, minstrel correctly does a bounds check which, on the surface, appears to handle the case where mi->n_rates < 2. However, mi->sample_idx is actually defined as an unsigned, so the right hand side is taken to be a huge positive number when negative, and the check will always fail. Consequently, the RC will overrun the array and cause random memory corruption when communicating with a peer that has only a single rate. The max value of mi->sample_idx is around 25 so casting to int should have no ill effects. Without the change, uptime is a few minutes under load with an AP that has a single hard-coded rate, and both the AP and STA could potentially crash. With the change, both lasted 12 hours with a steady load. Thanks to Ognjen Maric for providing the single-rate clue so I could reproduce this. This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000). Cc: stable@kernel.org Reported-by: Sergey S. Kostyliov <rathamahata@gmail.com> Reported-by: Ognjen Maric <ognjen.maric@gmail.com> Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10net/libertas: remove GPIO-CS handling in SPI interface codeSebastian Andrzej Siewior
This removes the dependency on GPIO framework and lets the SPI host driver handle the chip select. The SPI host driver is required to keep the CS active for the entire message unless cs_change says otherwise. This patch collects the two/three single SPI transfers into a message. Also the delay in read path in case use_dummy_writes are not used is moved into the SPI host driver. Tested-by: Mike Rapoport <mike@compulab.co.il> Tested-by: Andrey Yurovsky <andrey@cozybit.com> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Acked-by: Dan Williams <dcbw@redhat.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10rndis_wlan: cleanup: rename all rndis_wext* objects to rndis_wlan*Jussi Kivilinna
Driver used to be named rndis_wext before inclusion to upstream. Since rndis_wlan is being converted to cfg80211, use of rndis_wext* names can be confusing. So rename all rndis_wext to rndis_wlan (as should have been when driver was renamed). Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10rndis_wlan: cleanup: capitalize enum labelsJussi Kivilinna
Capitalize enum labels as told in Documents/CodingStyle. Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10iwlwifi: port to cfg80211 rfkillJohannes Berg
This ports the iwlwifi rfkill code to the new API offered by cfg80211 and thus removes a lot of useless stuff. The soft- rfkill is completely removed since that is now handled by setting the interfaces down. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Tested-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-06-10can: sja1000_of_platform: fix build problems with printk formatWolfgang Grandegger
According to "Documentation/printk-formats.txt", if the type is dependent on a config option for its size, like resource_size_t, we should use a format specifier of its largest possible type and explicitly cast to it. Signed-off-by: Wolfgang Grandegger <wg@grandegger.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-10sunrpc/auth_gss: Call rcu_barrier() on module unload.Jesper Dangaard Brouer
As the module uses rcu_call() we should make sure that all rcu callback has been completed before removing the code. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-10sctp: protocol.c call rcu_barrier() on unload.Jesper Dangaard Brouer
On module unload call rcu_barrier(), this is needed as synchronize_rcu() is not strong enough. The kmem_cache_destroy() does invoke synchronize_rcu() but it does not provide same protection. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-10can: af_can.c use rcu_barrier() on module unload.Jesper Dangaard Brouer
This module uses rcu_call() thus it should use rcu_barrier() on module unload. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Acked-by: Oliver Hartkopp <oliver@hartkopp.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-10nfnetlink_queue: Use rcu_barrier() on module unload.Jesper Dangaard Brouer
This module uses rcu_call() thus it should use rcu_barrier() on module unload. Also fixed a trivial typo 'nfetlink' -> 'nfnetlink' in comment. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-06-108021q: Vlan driver should use rcu_barrier() on unload instead of ↵Jesper Dangaard Brouer
syncronize_net() The VLAN 8021q driver needs to call rcu_barrier() when unloading the module, instead of syncronize_net(). This is needed to make sure that outstanding call_rcu() callbacks have completed, before the callback function code is removed on module unload. Signed-off-by: Jesper Dangaard Brouer <hawk@comx.dk> Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Acked-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>