From 066a3b5b2346febf9a655b444567b7138e3bb939 Mon Sep 17 00:00:00 2001 From: Jarek Poplawski Date: Mon, 14 Apr 2008 15:10:42 -0700 Subject: [NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop TC_H_MAJ(parentid) for root classes is the same as for ingress, and if ingress qdisc is created qdisc_lookup() returns its pointer (without ingress NULL is returned). After this all qdisc_lookups give the same, and we get endless loop. (I don't know how this could hide for so long - it should trigger with every leaf class deleted if it's qdisc isn't empty.) After this fix qdisc_lookup() is omitted both for ingress and root parents, but looking for root is only wasting a little time here... Many thanks to Enrico Demarin for finding a test for catching this bug, which probably bothered quite a lot of admins. Reported-by: Enrico Demarin , Signed-off-by: Jarek Poplawski Acked-by: Patrick McHardy Signed-off-by: David S. Miller --- net/sched/sch_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 7e3c048ba9b1..fc8708a0a25e 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -386,6 +386,9 @@ void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n) if (n == 0) return; while ((parentid = sch->parent)) { + if (TC_H_MAJ(parentid) == TC_H_MAJ(TC_H_INGRESS)) + return; + sch = qdisc_lookup(sch->dev, TC_H_MAJ(parentid)); if (sch == NULL) { WARN_ON(parentid != TC_H_ROOT); -- cgit v1.2.3-59-g8ed1b From b000cd3707e7b25d76745f9c0e261c23d21fa578 Mon Sep 17 00:00:00 2001 From: Vitaliy Gusev Date: Tue, 15 Apr 2008 00:33:38 -0700 Subject: [TCP]: Fix never pruned tcp out-of-order queue. tcp_prune_queue() doesn't prune an out-of-order queue at all. Therefore sk_rmem_schedule() can fail but the out-of-order queue isn't pruned . This can lead to tcp deadlock state if the next two conditions are held: 1. There are a sequence hole between last received in order segment and segments enqueued to the out-of-order queue. 2. Size of all segments in the out-of-order queue is more than tcp_mem[2]. Signed-off-by: Vitaliy Gusev Signed-off-by: David S. Miller --- net/ipv4/tcp_input.c | 72 +++++++++++++++++++++++++++++++++------------------- 1 file changed, 46 insertions(+), 26 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 5119856017ab..61db7b1eb995 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3841,8 +3841,26 @@ static void tcp_ofo_queue(struct sock *sk) } } +static void tcp_prune_ofo_queue(struct sock *sk); static int tcp_prune_queue(struct sock *sk); +static inline int tcp_try_rmem_schedule(struct sock *sk, unsigned int size) +{ + if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || + !sk_rmem_schedule(sk, size)) { + + if (tcp_prune_queue(sk) < 0) + return -1; + + if (!sk_rmem_schedule(sk, size)) { + tcp_prune_ofo_queue(sk); + if (!sk_rmem_schedule(sk, size)) + return -1; + } + } + return 0; +} + static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) { struct tcphdr *th = tcp_hdr(skb); @@ -3892,12 +3910,9 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) if (eaten <= 0) { queue_and_out: if (eaten < 0 && - (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || - !sk_rmem_schedule(sk, skb->truesize))) { - if (tcp_prune_queue(sk) < 0 || - !sk_rmem_schedule(sk, skb->truesize)) - goto drop; - } + tcp_try_rmem_schedule(sk, skb->truesize)) + goto drop; + skb_set_owner_r(skb, sk); __skb_queue_tail(&sk->sk_receive_queue, skb); } @@ -3966,12 +3981,8 @@ drop: TCP_ECN_check_ce(tp, skb); - if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || - !sk_rmem_schedule(sk, skb->truesize)) { - if (tcp_prune_queue(sk) < 0 || - !sk_rmem_schedule(sk, skb->truesize)) - goto drop; - } + if (tcp_try_rmem_schedule(sk, skb->truesize)) + goto drop; /* Disable header prediction. */ tp->pred_flags = 0; @@ -4198,6 +4209,28 @@ static void tcp_collapse_ofo_queue(struct sock *sk) } } +/* + * Purge the out-of-order queue. + */ +static void tcp_prune_ofo_queue(struct sock *sk) +{ + struct tcp_sock *tp = tcp_sk(sk); + + if (!skb_queue_empty(&tp->out_of_order_queue)) { + NET_INC_STATS_BH(LINUX_MIB_OFOPRUNED); + __skb_queue_purge(&tp->out_of_order_queue); + + /* Reset SACK state. A conforming SACK implementation will + * do the same at a timeout based retransmit. When a connection + * is in a sad state like this, we care only about integrity + * of the connection not performance. + */ + if (tp->rx_opt.sack_ok) + tcp_sack_reset(&tp->rx_opt); + sk_mem_reclaim(sk); + } +} + /* Reduce allocated memory if we can, trying to get * the socket within its memory limits again. * @@ -4231,20 +4264,7 @@ static int tcp_prune_queue(struct sock *sk) /* Collapsing did not help, destructive actions follow. * This must not ever occur. */ - /* First, purge the out_of_order queue. */ - if (!skb_queue_empty(&tp->out_of_order_queue)) { - NET_INC_STATS_BH(LINUX_MIB_OFOPRUNED); - __skb_queue_purge(&tp->out_of_order_queue); - - /* Reset SACK state. A conforming SACK implementation will - * do the same at a timeout based retransmit. When a connection - * is in a sad state like this, we care only about integrity - * of the connection not performance. - */ - if (tcp_is_sack(tp)) - tcp_sack_reset(&tp->rx_opt); - sk_mem_reclaim(sk); - } + tcp_prune_ofo_queue(sk); if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) return 0; -- cgit v1.2.3-59-g8ed1b From d5d52273b92913399e78fc4877f89d38ef8b367a Mon Sep 17 00:00:00 2001 From: Paul Bolle Date: Tue, 15 Apr 2008 00:40:48 -0700 Subject: MAINTAINERS: isdn4linux@listserv.isdn4linux.de is subscribers-only https://www.isdn4linux.de/mailman/listinfo/isdn4linux: "To prevent spamming, you have to subscribe first. Mails from non-members are silently ignored!" Signed-off-by: Paul Bolle Signed-off-by: David S. Miller --- MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index 90dcbbcad91c..23e1799c512f 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2197,7 +2197,7 @@ S: Maintained ISDN SUBSYSTEM P: Karsten Keil M: kkeil@suse.de -L: isdn4linux@listserv.isdn4linux.de +L: isdn4linux@listserv.isdn4linux.de (subscribers-only) W: http://www.isdn4linux.de T: git kernel.org:/pub/scm/linux/kernel/kkeil/isdn-2.6.git S: Maintained @@ -2205,7 +2205,7 @@ S: Maintained ISDN SUBSYSTEM (Eicon active card driver) P: Armin Schindler M: mac@melware.de -L: isdn4linux@listserv.isdn4linux.de +L: isdn4linux@listserv.isdn4linux.de (subscribers-only) W: http://www.melware.de S: Maintained -- cgit v1.2.3-59-g8ed1b From 56690c2151d33534f0537fd03c533eda81d96f0f Mon Sep 17 00:00:00 2001 From: Oliver Hartkopp Date: Tue, 15 Apr 2008 00:46:38 -0700 Subject: [CAN]: Update documentation of struct sockaddr_can The struct sockaddr_can has been simplified in the code review process. This patch updates this simplification also in the associated documentation in can.txt . Signed-off-by: Oliver Hartkopp Signed-off-by: David S. Miller --- Documentation/networking/can.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Documentation/networking/can.txt b/Documentation/networking/can.txt index f1b2de170929..641d2afacffa 100644 --- a/Documentation/networking/can.txt +++ b/Documentation/networking/can.txt @@ -281,10 +281,10 @@ solution for a couple of reasons: sa_family_t can_family; int can_ifindex; union { - struct { canid_t rx_id, tx_id; } tp16; - struct { canid_t rx_id, tx_id; } tp20; - struct { canid_t rx_id, tx_id; } mcnet; - struct { canid_t rx_id, tx_id; } isotp; + /* transport protocol class address info (e.g. ISOTP) */ + struct { canid_t rx_id, tx_id; } tp; + + /* reserved for future CAN protocols address information */ } can_addr; }; -- cgit v1.2.3-59-g8ed1b From 0517deed78be9cc9ce9799bf15da58fd0d2078bb Mon Sep 17 00:00:00 2001 From: Michael Ellerman Date: Tue, 15 Apr 2008 00:49:04 -0700 Subject: netconsole: only set CON_PRINTBUFFER if the user specifies a netconsole Since 0bcc1816188e570bde1d56a208996660f2633ae0 (netconsole: Support dynamic reconfiguration using configfs), the netconsole is always registered, regardless of whether the user actually specified a netconsole configuration on the command line. However because netconsole has CON_PRINTBUFFER set, when it is registered it causes the printk buffer to be replayed to all consoles. When there is no netconsole configured this is a) pointless, and b) somewhat annoying for the user of the existing console. So instead we should only set CON_PRINTBUFFER if there is a netconsole configuration found on the command line. This retains the existing behaviour if a netconsole is setup by the user, and avoids spamming other consoles when we're only registering for the dynamic netconsole case. Signed-off-by: Michael Ellerman Signed-off-by: David S. Miller --- drivers/net/netconsole.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index 501e451be911..665341e43055 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -730,7 +730,7 @@ static void write_msg(struct console *con, const char *msg, unsigned int len) static struct console netconsole = { .name = "netcon", - .flags = CON_ENABLED | CON_PRINTBUFFER, + .flags = CON_ENABLED, .write = write_msg, }; @@ -749,6 +749,9 @@ static int __init init_netconsole(void) err = PTR_ERR(nt); goto fail; } + /* Dump existing printks when we register */ + netconsole.flags |= CON_PRINTBUFFER; + spin_lock_irqsave(&target_list_lock, flags); list_add(&nt->list, &target_list); spin_unlock_irqrestore(&target_list_lock, flags); -- cgit v1.2.3-59-g8ed1b From aa979a6acbb468b0ebe8cf36dc782a5b3cc1e28d Mon Sep 17 00:00:00 2001 From: Herton Ronaldo Krzesinski Date: Wed, 9 Apr 2008 16:38:31 -0300 Subject: rtl8187: Add missing priv->vif assignments This adds missing priv->vif assignments after "mac80211: don't use interface indices in drivers" change. As rtl8180, rtl8187 also needs priv->vif to be set, as without this an oops can happen in rtl8187_tx function (priv->vif is passed to ieee80211_rts_duration). Signed-off-by: Herton Ronaldo Krzesinski Acked-by: Pavel Roskin Signed-off-by: John W. Linville --- drivers/net/wireless/rtl8187_dev.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c index f44505994a0e..133b3f39eeb6 100644 --- a/drivers/net/wireless/rtl8187_dev.c +++ b/drivers/net/wireless/rtl8187_dev.c @@ -509,6 +509,8 @@ static int rtl8187_add_interface(struct ieee80211_hw *dev, return -EOPNOTSUPP; } + priv->vif = conf->vif; + rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG); for (i = 0; i < ETH_ALEN; i++) rtl818x_iowrite8(priv, &priv->map->MAC[i], @@ -523,6 +525,7 @@ static void rtl8187_remove_interface(struct ieee80211_hw *dev, { struct rtl8187_priv *priv = dev->priv; priv->mode = IEEE80211_IF_TYPE_MNTR; + priv->vif = NULL; } static int rtl8187_config(struct ieee80211_hw *dev, struct ieee80211_conf *conf) -- cgit v1.2.3-59-g8ed1b From 385f848a986b4677bc91e5f5f9033449a876819d Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Sun, 6 Apr 2008 17:10:53 +0200 Subject: b43legacy: fix initvals loading on bcm4303 This allows for the correct initial values to be uploaded to bcm4303 devices. It should be correct, but I can't reliably test this as I suspect there's something going wrong with an hardware rfkill switch on my laptop. Please test. Signed-off-by: Stefano Brivio Signed-off-by: John W. Linville --- drivers/net/wireless/b43legacy/main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c index 5f3f34e1dbfd..0f7a6e7bd96a 100644 --- a/drivers/net/wireless/b43legacy/main.c +++ b/drivers/net/wireless/b43legacy/main.c @@ -1488,6 +1488,7 @@ static int b43legacy_request_firmware(struct b43legacy_wldev *dev) } if (!fw->initvals) { switch (dev->phy.type) { + case B43legacy_PHYTYPE_B: case B43legacy_PHYTYPE_G: if ((rev >= 5) && (rev <= 10)) filename = "b0g0initvals5"; @@ -1505,6 +1506,7 @@ static int b43legacy_request_firmware(struct b43legacy_wldev *dev) } if (!fw->initvals_band) { switch (dev->phy.type) { + case B43legacy_PHYTYPE_B: case B43legacy_PHYTYPE_G: if ((rev >= 5) && (rev <= 10)) filename = "b0g0bsinitvals5"; -- cgit v1.2.3-59-g8ed1b From 2d4543fdb487b1301ae48703dea3e66ead2d3c75 Mon Sep 17 00:00:00 2001 From: Reinette Chatre Date: Thu, 10 Apr 2008 13:16:27 -0700 Subject: MAINTAINERS: move to generic repository for iwlwifi Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 23e1799c512f..eeacfc56b35d 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2116,7 +2116,7 @@ M: reinette.chatre@intel.com L: linux-wireless@vger.kernel.org L: ipw3945-devel@lists.sourceforge.net W: http://intellinuxwireless.org -T: git git://git.kernel.org/pub/scm/linux/kernel/git/rchatre/iwlwifi-2.6.git +T: git kernel.org:/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-2.6.git S: Supported IOC3 ETHERNET DRIVER -- cgit v1.2.3-59-g8ed1b From 4ac58469f13028e1eb97f8bc7b0fca5072591d8d Mon Sep 17 00:00:00 2001 From: Michael Buesch Date: Fri, 11 Apr 2008 11:59:00 +0200 Subject: ssb: Fix usage of struct device used for DMAing This fixes DMA on architectures where DMA is nontrivial, like PPC64. We must use the host-device's (PCI) struct device for any DMA operation instead of the SSB device. For this we add a new struct device pointer to the SSB device structure that will always point to the right device for DMAing. Without this patch b43 and b44 drivers won't work on complex-DMA architectures, that for example need dev->archdata for DMA operations. Signed-off-by: Michael Buesch Signed-off-by: John W. Linville --- drivers/net/b44.c | 52 +++++++++++++++++++++--------------------- drivers/net/wireless/b43/dma.c | 27 +++++++++++----------- drivers/ssb/main.c | 14 +++++++----- include/linux/ssb/ssb.h | 4 ++++ 4 files changed, 52 insertions(+), 45 deletions(-) diff --git a/drivers/net/b44.c b/drivers/net/b44.c index 25f1337cd02c..59dce6aa0865 100644 --- a/drivers/net/b44.c +++ b/drivers/net/b44.c @@ -148,7 +148,7 @@ static inline void b44_sync_dma_desc_for_device(struct ssb_device *sdev, unsigned long offset, enum dma_data_direction dir) { - dma_sync_single_range_for_device(sdev->dev, dma_base, + dma_sync_single_range_for_device(sdev->dma_dev, dma_base, offset & dma_desc_align_mask, dma_desc_sync_size, dir); } @@ -158,7 +158,7 @@ static inline void b44_sync_dma_desc_for_cpu(struct ssb_device *sdev, unsigned long offset, enum dma_data_direction dir) { - dma_sync_single_range_for_cpu(sdev->dev, dma_base, + dma_sync_single_range_for_cpu(sdev->dma_dev, dma_base, offset & dma_desc_align_mask, dma_desc_sync_size, dir); } @@ -613,7 +613,7 @@ static void b44_tx(struct b44 *bp) BUG_ON(skb == NULL); - dma_unmap_single(bp->sdev->dev, + dma_unmap_single(bp->sdev->dma_dev, rp->mapping, skb->len, DMA_TO_DEVICE); @@ -653,7 +653,7 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked) if (skb == NULL) return -ENOMEM; - mapping = dma_map_single(bp->sdev->dev, skb->data, + mapping = dma_map_single(bp->sdev->dma_dev, skb->data, RX_PKT_BUF_SZ, DMA_FROM_DEVICE); @@ -663,19 +663,19 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked) mapping + RX_PKT_BUF_SZ > DMA_30BIT_MASK) { /* Sigh... */ if (!dma_mapping_error(mapping)) - dma_unmap_single(bp->sdev->dev, mapping, + dma_unmap_single(bp->sdev->dma_dev, mapping, RX_PKT_BUF_SZ, DMA_FROM_DEVICE); dev_kfree_skb_any(skb); skb = __netdev_alloc_skb(bp->dev, RX_PKT_BUF_SZ, GFP_ATOMIC|GFP_DMA); if (skb == NULL) return -ENOMEM; - mapping = dma_map_single(bp->sdev->dev, skb->data, + mapping = dma_map_single(bp->sdev->dma_dev, skb->data, RX_PKT_BUF_SZ, DMA_FROM_DEVICE); if (dma_mapping_error(mapping) || mapping + RX_PKT_BUF_SZ > DMA_30BIT_MASK) { if (!dma_mapping_error(mapping)) - dma_unmap_single(bp->sdev->dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE); + dma_unmap_single(bp->sdev->dma_dev, mapping, RX_PKT_BUF_SZ,DMA_FROM_DEVICE); dev_kfree_skb_any(skb); return -ENOMEM; } @@ -750,7 +750,7 @@ static void b44_recycle_rx(struct b44 *bp, int src_idx, u32 dest_idx_unmasked) dest_idx * sizeof(dest_desc), DMA_BIDIRECTIONAL); - dma_sync_single_for_device(bp->sdev->dev, le32_to_cpu(src_desc->addr), + dma_sync_single_for_device(bp->sdev->dma_dev, le32_to_cpu(src_desc->addr), RX_PKT_BUF_SZ, DMA_FROM_DEVICE); } @@ -772,7 +772,7 @@ static int b44_rx(struct b44 *bp, int budget) struct rx_header *rh; u16 len; - dma_sync_single_for_cpu(bp->sdev->dev, map, + dma_sync_single_for_cpu(bp->sdev->dma_dev, map, RX_PKT_BUF_SZ, DMA_FROM_DEVICE); rh = (struct rx_header *) skb->data; @@ -806,7 +806,7 @@ static int b44_rx(struct b44 *bp, int budget) skb_size = b44_alloc_rx_skb(bp, cons, bp->rx_prod); if (skb_size < 0) goto drop_it; - dma_unmap_single(bp->sdev->dev, map, + dma_unmap_single(bp->sdev->dma_dev, map, skb_size, DMA_FROM_DEVICE); /* Leave out rx_header */ skb_put(skb, len + RX_PKT_OFFSET); @@ -966,24 +966,24 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev) goto err_out; } - mapping = dma_map_single(bp->sdev->dev, skb->data, len, DMA_TO_DEVICE); + mapping = dma_map_single(bp->sdev->dma_dev, skb->data, len, DMA_TO_DEVICE); if (dma_mapping_error(mapping) || mapping + len > DMA_30BIT_MASK) { struct sk_buff *bounce_skb; /* Chip can't handle DMA to/from >1GB, use bounce buffer */ if (!dma_mapping_error(mapping)) - dma_unmap_single(bp->sdev->dev, mapping, len, + dma_unmap_single(bp->sdev->dma_dev, mapping, len, DMA_TO_DEVICE); bounce_skb = __dev_alloc_skb(len, GFP_ATOMIC | GFP_DMA); if (!bounce_skb) goto err_out; - mapping = dma_map_single(bp->sdev->dev, bounce_skb->data, + mapping = dma_map_single(bp->sdev->dma_dev, bounce_skb->data, len, DMA_TO_DEVICE); if (dma_mapping_error(mapping) || mapping + len > DMA_30BIT_MASK) { if (!dma_mapping_error(mapping)) - dma_unmap_single(bp->sdev->dev, mapping, + dma_unmap_single(bp->sdev->dma_dev, mapping, len, DMA_TO_DEVICE); dev_kfree_skb_any(bounce_skb); goto err_out; @@ -1082,7 +1082,7 @@ static void b44_free_rings(struct b44 *bp) if (rp->skb == NULL) continue; - dma_unmap_single(bp->sdev->dev, rp->mapping, RX_PKT_BUF_SZ, + dma_unmap_single(bp->sdev->dma_dev, rp->mapping, RX_PKT_BUF_SZ, DMA_FROM_DEVICE); dev_kfree_skb_any(rp->skb); rp->skb = NULL; @@ -1094,7 +1094,7 @@ static void b44_free_rings(struct b44 *bp) if (rp->skb == NULL) continue; - dma_unmap_single(bp->sdev->dev, rp->mapping, rp->skb->len, + dma_unmap_single(bp->sdev->dma_dev, rp->mapping, rp->skb->len, DMA_TO_DEVICE); dev_kfree_skb_any(rp->skb); rp->skb = NULL; @@ -1117,12 +1117,12 @@ static void b44_init_rings(struct b44 *bp) memset(bp->tx_ring, 0, B44_TX_RING_BYTES); if (bp->flags & B44_FLAG_RX_RING_HACK) - dma_sync_single_for_device(bp->sdev->dev, bp->rx_ring_dma, + dma_sync_single_for_device(bp->sdev->dma_dev, bp->rx_ring_dma, DMA_TABLE_BYTES, DMA_BIDIRECTIONAL); if (bp->flags & B44_FLAG_TX_RING_HACK) - dma_sync_single_for_device(bp->sdev->dev, bp->tx_ring_dma, + dma_sync_single_for_device(bp->sdev->dma_dev, bp->tx_ring_dma, DMA_TABLE_BYTES, DMA_TO_DEVICE); @@ -1144,24 +1144,24 @@ static void b44_free_consistent(struct b44 *bp) bp->tx_buffers = NULL; if (bp->rx_ring) { if (bp->flags & B44_FLAG_RX_RING_HACK) { - dma_unmap_single(bp->sdev->dev, bp->rx_ring_dma, + dma_unmap_single(bp->sdev->dma_dev, bp->rx_ring_dma, DMA_TABLE_BYTES, DMA_BIDIRECTIONAL); kfree(bp->rx_ring); } else - dma_free_coherent(bp->sdev->dev, DMA_TABLE_BYTES, + dma_free_coherent(bp->sdev->dma_dev, DMA_TABLE_BYTES, bp->rx_ring, bp->rx_ring_dma); bp->rx_ring = NULL; bp->flags &= ~B44_FLAG_RX_RING_HACK; } if (bp->tx_ring) { if (bp->flags & B44_FLAG_TX_RING_HACK) { - dma_unmap_single(bp->sdev->dev, bp->tx_ring_dma, + dma_unmap_single(bp->sdev->dma_dev, bp->tx_ring_dma, DMA_TABLE_BYTES, DMA_TO_DEVICE); kfree(bp->tx_ring); } else - dma_free_coherent(bp->sdev->dev, DMA_TABLE_BYTES, + dma_free_coherent(bp->sdev->dma_dev, DMA_TABLE_BYTES, bp->tx_ring, bp->tx_ring_dma); bp->tx_ring = NULL; bp->flags &= ~B44_FLAG_TX_RING_HACK; @@ -1187,7 +1187,7 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp) goto out_err; size = DMA_TABLE_BYTES; - bp->rx_ring = dma_alloc_coherent(bp->sdev->dev, size, &bp->rx_ring_dma, gfp); + bp->rx_ring = dma_alloc_coherent(bp->sdev->dma_dev, size, &bp->rx_ring_dma, gfp); if (!bp->rx_ring) { /* Allocation may have failed due to pci_alloc_consistent insisting on use of GFP_DMA, which is more restrictive @@ -1199,7 +1199,7 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp) if (!rx_ring) goto out_err; - rx_ring_dma = dma_map_single(bp->sdev->dev, rx_ring, + rx_ring_dma = dma_map_single(bp->sdev->dma_dev, rx_ring, DMA_TABLE_BYTES, DMA_BIDIRECTIONAL); @@ -1214,7 +1214,7 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp) bp->flags |= B44_FLAG_RX_RING_HACK; } - bp->tx_ring = dma_alloc_coherent(bp->sdev->dev, size, &bp->tx_ring_dma, gfp); + bp->tx_ring = dma_alloc_coherent(bp->sdev->dma_dev, size, &bp->tx_ring_dma, gfp); if (!bp->tx_ring) { /* Allocation may have failed due to dma_alloc_coherent insisting on use of GFP_DMA, which is more restrictive @@ -1226,7 +1226,7 @@ static int b44_alloc_consistent(struct b44 *bp, gfp_t gfp) if (!tx_ring) goto out_err; - tx_ring_dma = dma_map_single(bp->sdev->dev, tx_ring, + tx_ring_dma = dma_map_single(bp->sdev->dma_dev, tx_ring, DMA_TABLE_BYTES, DMA_TO_DEVICE); diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c index 948eb1fe916b..48e912487b16 100644 --- a/drivers/net/wireless/b43/dma.c +++ b/drivers/net/wireless/b43/dma.c @@ -373,10 +373,10 @@ static inline dma_addr_t dmaaddr; if (tx) { - dmaaddr = dma_map_single(ring->dev->dev->dev, + dmaaddr = dma_map_single(ring->dev->dev->dma_dev, buf, len, DMA_TO_DEVICE); } else { - dmaaddr = dma_map_single(ring->dev->dev->dev, + dmaaddr = dma_map_single(ring->dev->dev->dma_dev, buf, len, DMA_FROM_DEVICE); } @@ -388,9 +388,10 @@ static inline dma_addr_t addr, size_t len, int tx) { if (tx) { - dma_unmap_single(ring->dev->dev->dev, addr, len, DMA_TO_DEVICE); + dma_unmap_single(ring->dev->dev->dma_dev, + addr, len, DMA_TO_DEVICE); } else { - dma_unmap_single(ring->dev->dev->dev, + dma_unmap_single(ring->dev->dev->dma_dev, addr, len, DMA_FROM_DEVICE); } } @@ -400,7 +401,7 @@ static inline dma_addr_t addr, size_t len) { B43_WARN_ON(ring->tx); - dma_sync_single_for_cpu(ring->dev->dev->dev, + dma_sync_single_for_cpu(ring->dev->dev->dma_dev, addr, len, DMA_FROM_DEVICE); } @@ -409,7 +410,7 @@ static inline dma_addr_t addr, size_t len) { B43_WARN_ON(ring->tx); - dma_sync_single_for_device(ring->dev->dev->dev, + dma_sync_single_for_device(ring->dev->dev->dma_dev, addr, len, DMA_FROM_DEVICE); } @@ -425,7 +426,7 @@ static inline static int alloc_ringmemory(struct b43_dmaring *ring) { - struct device *dev = ring->dev->dev->dev; + struct device *dma_dev = ring->dev->dev->dma_dev; gfp_t flags = GFP_KERNEL; /* The specs call for 4K buffers for 30- and 32-bit DMA with 4K @@ -439,7 +440,7 @@ static int alloc_ringmemory(struct b43_dmaring *ring) */ if (ring->type == B43_DMA_64BIT) flags |= GFP_DMA; - ring->descbase = dma_alloc_coherent(dev, B43_DMA_RINGMEMSIZE, + ring->descbase = dma_alloc_coherent(dma_dev, B43_DMA_RINGMEMSIZE, &(ring->dmabase), flags); if (!ring->descbase) { b43err(ring->dev->wl, "DMA ringmemory allocation failed\n"); @@ -452,9 +453,9 @@ static int alloc_ringmemory(struct b43_dmaring *ring) static void free_ringmemory(struct b43_dmaring *ring) { - struct device *dev = ring->dev->dev->dev; + struct device *dma_dev = ring->dev->dev->dma_dev; - dma_free_coherent(dev, B43_DMA_RINGMEMSIZE, + dma_free_coherent(dma_dev, B43_DMA_RINGMEMSIZE, ring->descbase, ring->dmabase); } @@ -854,7 +855,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev, goto err_kfree_meta; /* test for ability to dma to txhdr_cache */ - dma_test = dma_map_single(dev->dev->dev, + dma_test = dma_map_single(dev->dev->dma_dev, ring->txhdr_cache, b43_txhdr_size(dev), DMA_TO_DEVICE); @@ -869,7 +870,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev, if (!ring->txhdr_cache) goto err_kfree_meta; - dma_test = dma_map_single(dev->dev->dev, + dma_test = dma_map_single(dev->dev->dma_dev, ring->txhdr_cache, b43_txhdr_size(dev), DMA_TO_DEVICE); @@ -883,7 +884,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev, } } - dma_unmap_single(dev->dev->dev, + dma_unmap_single(dev->dev->dma_dev, dma_test, b43_txhdr_size(dev), DMA_TO_DEVICE); } diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c index 72017bf2e577..8003a9e55ac4 100644 --- a/drivers/ssb/main.c +++ b/drivers/ssb/main.c @@ -436,15 +436,18 @@ static int ssb_devices_register(struct ssb_bus *bus) #ifdef CONFIG_SSB_PCIHOST sdev->irq = bus->host_pci->irq; dev->parent = &bus->host_pci->dev; + sdev->dma_dev = &bus->host_pci->dev; #endif break; case SSB_BUSTYPE_PCMCIA: #ifdef CONFIG_SSB_PCMCIAHOST sdev->irq = bus->host_pcmcia->irq.AssignedIRQ; dev->parent = &bus->host_pcmcia->dev; + sdev->dma_dev = &bus->host_pcmcia->dev; #endif break; case SSB_BUSTYPE_SSB: + sdev->dma_dev = dev; break; } @@ -1018,15 +1021,14 @@ EXPORT_SYMBOL(ssb_dma_translation); int ssb_dma_set_mask(struct ssb_device *ssb_dev, u64 mask) { - struct device *dev = ssb_dev->dev; + struct device *dma_dev = ssb_dev->dma_dev; #ifdef CONFIG_SSB_PCIHOST - if (ssb_dev->bus->bustype == SSB_BUSTYPE_PCI && - !dma_supported(dev, mask)) - return -EIO; + if (ssb_dev->bus->bustype == SSB_BUSTYPE_PCI) + return dma_set_mask(dma_dev, mask); #endif - dev->coherent_dma_mask = mask; - dev->dma_mask = &dev->coherent_dma_mask; + dma_dev->coherent_dma_mask = mask; + dma_dev->dma_mask = &dma_dev->coherent_dma_mask; return 0; } diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h index 20add65215af..db53defde5ee 100644 --- a/include/linux/ssb/ssb.h +++ b/include/linux/ssb/ssb.h @@ -129,6 +129,10 @@ struct ssb_device { const struct ssb_bus_ops *ops; struct device *dev; + /* Pointer to the device that has to be used for + * any DMA related operation. */ + struct device *dma_dev; + struct ssb_bus *bus; struct ssb_device_id id; -- cgit v1.2.3-59-g8ed1b From cdbbe3d1f53086ece706674d3bf4f6d148083694 Mon Sep 17 00:00:00 2001 From: Michael Buesch Date: Fri, 11 Apr 2008 12:16:36 +0200 Subject: b43legacy: Fix usage of struct device used for DMAing This fixes b43legacy for the SSB DMA API change. Signed-off-by: Michael Buesch Cc: Stefano Brivio Signed-off-by: John W. Linville --- drivers/net/wireless/b43legacy/dma.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c index e87b427d5e43..59300486f48e 100644 --- a/drivers/net/wireless/b43legacy/dma.c +++ b/drivers/net/wireless/b43legacy/dma.c @@ -393,11 +393,11 @@ dma_addr_t map_descbuffer(struct b43legacy_dmaring *ring, dma_addr_t dmaaddr; if (tx) - dmaaddr = dma_map_single(ring->dev->dev->dev, + dmaaddr = dma_map_single(ring->dev->dev->dma_dev, buf, len, DMA_TO_DEVICE); else - dmaaddr = dma_map_single(ring->dev->dev->dev, + dmaaddr = dma_map_single(ring->dev->dev->dma_dev, buf, len, DMA_FROM_DEVICE); @@ -411,11 +411,11 @@ void unmap_descbuffer(struct b43legacy_dmaring *ring, int tx) { if (tx) - dma_unmap_single(ring->dev->dev->dev, + dma_unmap_single(ring->dev->dev->dma_dev, addr, len, DMA_TO_DEVICE); else - dma_unmap_single(ring->dev->dev->dev, + dma_unmap_single(ring->dev->dev->dma_dev, addr, len, DMA_FROM_DEVICE); } @@ -427,7 +427,7 @@ void sync_descbuffer_for_cpu(struct b43legacy_dmaring *ring, { B43legacy_WARN_ON(ring->tx); - dma_sync_single_for_cpu(ring->dev->dev->dev, + dma_sync_single_for_cpu(ring->dev->dev->dma_dev, addr, len, DMA_FROM_DEVICE); } @@ -438,7 +438,7 @@ void sync_descbuffer_for_device(struct b43legacy_dmaring *ring, { B43legacy_WARN_ON(ring->tx); - dma_sync_single_for_device(ring->dev->dev->dev, + dma_sync_single_for_device(ring->dev->dev->dma_dev, addr, len, DMA_FROM_DEVICE); } @@ -458,9 +458,9 @@ void free_descriptor_buffer(struct b43legacy_dmaring *ring, static int alloc_ringmemory(struct b43legacy_dmaring *ring) { - struct device *dev = ring->dev->dev->dev; + struct device *dma_dev = ring->dev->dev->dma_dev; - ring->descbase = dma_alloc_coherent(dev, B43legacy_DMA_RINGMEMSIZE, + ring->descbase = dma_alloc_coherent(dma_dev, B43legacy_DMA_RINGMEMSIZE, &(ring->dmabase), GFP_KERNEL); if (!ring->descbase) { b43legacyerr(ring->dev->wl, "DMA ringmemory allocation" @@ -474,9 +474,9 @@ static int alloc_ringmemory(struct b43legacy_dmaring *ring) static void free_ringmemory(struct b43legacy_dmaring *ring) { - struct device *dev = ring->dev->dev->dev; + struct device *dma_dev = ring->dev->dev->dma_dev; - dma_free_coherent(dev, B43legacy_DMA_RINGMEMSIZE, + dma_free_coherent(dma_dev, B43legacy_DMA_RINGMEMSIZE, ring->descbase, ring->dmabase); } @@ -886,7 +886,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, goto err_kfree_meta; /* test for ability to dma to txhdr_cache */ - dma_test = dma_map_single(dev->dev->dev, ring->txhdr_cache, + dma_test = dma_map_single(dev->dev->dma_dev, ring->txhdr_cache, sizeof(struct b43legacy_txhdr_fw3), DMA_TO_DEVICE); @@ -900,7 +900,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, if (!ring->txhdr_cache) goto err_kfree_meta; - dma_test = dma_map_single(dev->dev->dev, + dma_test = dma_map_single(dev->dev->dma_dev, ring->txhdr_cache, sizeof(struct b43legacy_txhdr_fw3), DMA_TO_DEVICE); @@ -910,7 +910,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, goto err_kfree_txhdr_cache; } - dma_unmap_single(dev->dev->dev, + dma_unmap_single(dev->dev->dma_dev, dma_test, sizeof(struct b43legacy_txhdr_fw3), DMA_TO_DEVICE); } -- cgit v1.2.3-59-g8ed1b From 89796f64a20d31e74ee0051df2e26812c852e734 Mon Sep 17 00:00:00 2001 From: Carlos Corbacho Date: Sat, 12 Apr 2008 16:39:47 +0100 Subject: rfkill: Fix device type check when toggling states rfkill_switch_all() is supposed to only switch all the interfaces of a given type, but does not actually do this; instead, it just switches everything currently in the same state. Add the necessary type check in. (This fixes a bug I've been seeing while developing an rfkill laptop driver, with both bluetooth and wireless simultaneously changing state after only pressing either KEY_WLAN or KEY_BLUETOOTH). Signed-off-by: Carlos Corbacho Signed-off-by: John W. Linville --- net/rfkill/rfkill.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c index 140a0a8c6b02..4e10a95de832 100644 --- a/net/rfkill/rfkill.c +++ b/net/rfkill/rfkill.c @@ -92,7 +92,7 @@ void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state) rfkill_states[type] = state; list_for_each_entry(rfkill, &rfkill_list, node) { - if (!rfkill->user_claim) + if ((!rfkill->user_claim) && (rfkill->type == type)) rfkill_toggle_radio(rfkill, state); } -- cgit v1.2.3-59-g8ed1b From e089764596ccde1037f2849fcee002c68986e67c Mon Sep 17 00:00:00 2001 From: Ivo van Doorn Date: Sat, 12 Apr 2008 19:23:55 +0200 Subject: Add rfkill to MAINTAINERS file I have been acting as the maintainer since the rfkill introduction, so lets make it official by adding a rfkill entry in the MAINTAINERS file. Signed-off-by: Ivo van Doorn Signed-off-by: John W. Linville --- MAINTAINERS | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index eeacfc56b35d..f5b7d0b47c2d 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -3342,6 +3342,13 @@ L: reiserfs-devel@vger.kernel.org W: http://www.namesys.com S: Supported +RFKILL +P: Ivo van Doorn +M: IvDoorn@gmail.com +L: netdev@vger.kernel.org +S: Maintained +F: net/rfkill + ROCKETPORT DRIVER P: Comtrol Corp. W: http://www.comtrol.com -- cgit v1.2.3-59-g8ed1b From 2dd0f69222c481574baf6a4affb9256a7c7410e7 Mon Sep 17 00:00:00 2001 From: Ivo van Doorn Date: Sat, 12 Apr 2008 19:25:00 +0200 Subject: Update rt2x00 MAINTAINERS entry Add the tree entry for rt2x00 to inform people about the rt2x00.git tree. Signed-off-by: Ivo van Doorn Signed-off-by: John W. Linville --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index f5b7d0b47c2d..e46775868019 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -3280,6 +3280,7 @@ L: linux-wireless@vger.kernel.org L: rt2400-devel@lists.sourceforge.net W: http://rt2x00.serialmonkey.com/ S: Maintained +T: git kernel.org:/pub/scm/linux/kernel/git/ivd/rt2x00.git F: drivers/net/wireless/rt2x00/ RAMDISK RAM BLOCK DEVICE DRIVER -- cgit v1.2.3-59-g8ed1b From b3fc9c6c58c986f7a24fd8b0794d1e0794935a28 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Sun, 13 Apr 2008 10:12:47 +0200 Subject: mac80211: remove message on receiving unexpected unencrypted frames Some people are getting this message a lot, and we have traced it to broken access points that much too often send completely empty frames (all bytes zeroed, which they shouldn't do at all.) Since we cannot do anything about such frames in any case except the special case where we're debugging an AP, just remove the message. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville --- net/mac80211/rx.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 535407d07fa4..a8a40aba846b 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1050,12 +1050,9 @@ ieee80211_drop_unencrypted(struct ieee80211_txrx_data *rx) if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) && (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA && (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC && - (rx->key || rx->sdata->drop_unencrypted))) { - if (net_ratelimit()) - printk(KERN_DEBUG "%s: RX non-WEP frame, but expected " - "encryption\n", rx->dev->name); + (rx->key || rx->sdata->drop_unencrypted))) return -EACCES; - } + return 0; } -- cgit v1.2.3-59-g8ed1b From dc4ae1f46dbbcd08b3b5e23ad5ef87bf4bb41adf Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Mon, 14 Apr 2008 00:59:49 +0200 Subject: b43legacy: fix DMA mapping leakage This fixes a DMA mapping leakage in the case where we reject a DMA buffer because of its address. The patch by Michael Buesch has been ported to b43legacy. Signed-off-by: Stefano Brivio Cc: Christian Casteyde Signed-off-by: John W. Linville --- drivers/net/wireless/b43legacy/dma.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c index 59300486f48e..c990f87b107a 100644 --- a/drivers/net/wireless/b43legacy/dma.c +++ b/drivers/net/wireless/b43legacy/dma.c @@ -585,8 +585,9 @@ static int b43legacy_dmacontroller_tx_reset(struct b43legacy_wldev *dev, /* Check if a DMA mapping address is invalid. */ static bool b43legacy_dma_mapping_error(struct b43legacy_dmaring *ring, - dma_addr_t addr, - size_t buffersize) + dma_addr_t addr, + size_t buffersize, + bool dma_to_device) { if (unlikely(dma_mapping_error(addr))) return 1; @@ -594,11 +595,11 @@ static bool b43legacy_dma_mapping_error(struct b43legacy_dmaring *ring, switch (ring->type) { case B43legacy_DMA_30BIT: if ((u64)addr + buffersize > (1ULL << 30)) - return 1; + goto address_error; break; case B43legacy_DMA_32BIT: if ((u64)addr + buffersize > (1ULL << 32)) - return 1; + goto address_error; break; case B43legacy_DMA_64BIT: /* Currently we can't have addresses beyond 64 bits in the kernel. */ @@ -607,6 +608,12 @@ static bool b43legacy_dma_mapping_error(struct b43legacy_dmaring *ring, /* The address is OK. */ return 0; + +address_error: + /* We can't support this address. Unmap it again. */ + unmap_descbuffer(ring, addr, buffersize, dma_to_device); + + return 1; } static int setup_rx_descbuffer(struct b43legacy_dmaring *ring, @@ -626,7 +633,7 @@ static int setup_rx_descbuffer(struct b43legacy_dmaring *ring, return -ENOMEM; dmaaddr = map_descbuffer(ring, skb->data, ring->rx_buffersize, 0); - if (b43legacy_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize)) { + if (b43legacy_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) { /* ugh. try to realloc in zone_dma */ gfp_flags |= GFP_DMA; @@ -639,7 +646,7 @@ static int setup_rx_descbuffer(struct b43legacy_dmaring *ring, ring->rx_buffersize, 0); } - if (b43legacy_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize)) { + if (b43legacy_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) { dev_kfree_skb_any(skb); return -EIO; } @@ -891,7 +898,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, DMA_TO_DEVICE); if (b43legacy_dma_mapping_error(ring, dma_test, - sizeof(struct b43legacy_txhdr_fw3))) { + sizeof(struct b43legacy_txhdr_fw3), 1)) { /* ugh realloc */ kfree(ring->txhdr_cache); ring->txhdr_cache = kcalloc(nr_slots, @@ -906,7 +913,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, DMA_TO_DEVICE); if (b43legacy_dma_mapping_error(ring, dma_test, - sizeof(struct b43legacy_txhdr_fw3))) + sizeof(struct b43legacy_txhdr_fw3), 1)) goto err_kfree_txhdr_cache; } @@ -1235,7 +1242,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring, meta_hdr->dmaaddr = map_descbuffer(ring, (unsigned char *)header, sizeof(struct b43legacy_txhdr_fw3), 1); if (b43legacy_dma_mapping_error(ring, meta_hdr->dmaaddr, - sizeof(struct b43legacy_txhdr_fw3))) { + sizeof(struct b43legacy_txhdr_fw3), 1)) { ring->current_slot = old_top_slot; ring->used_slots = old_used_slots; return -EIO; @@ -1254,7 +1261,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring, meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1); /* create a bounce buffer in zone_dma on mapping failure. */ - if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len)) { + if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) { bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA); if (!bounce_skb) { ring->current_slot = old_top_slot; @@ -1268,7 +1275,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring, skb = bounce_skb; meta->skb = skb; meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1); - if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len)) { + if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) { ring->current_slot = old_top_slot; ring->used_slots = old_used_slots; err = -EIO; -- cgit v1.2.3-59-g8ed1b From b358492cd2a9c67bff352c5a60d86e7fc9627477 Mon Sep 17 00:00:00 2001 From: Masakazu Mokuno Date: Mon, 14 Apr 2008 18:07:21 +0900 Subject: PS3: gelic: fix the oops on the broken IE returned from the hypervisor This fixes the bug that the driver would try to over-scan the memory if the sum of the length field of every IEs does not match the length returned from the hypervisor. Signed-off-by: Masakazu Mokuno Signed-off-by: John W. Linville --- drivers/net/ps3_gelic_wireless.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c index ddbc6e475e28..c16de5129a71 100644 --- a/drivers/net/ps3_gelic_wireless.c +++ b/drivers/net/ps3_gelic_wireless.c @@ -512,13 +512,18 @@ static void gelic_wl_parse_ie(u8 *data, size_t len, data, len); memset(ie_info, 0, sizeof(struct ie_info)); - while (0 < data_left) { + while (2 <= data_left) { item_id = *pos++; item_len = *pos++; + data_left -= 2; + + if (data_left < item_len) + break; switch (item_id) { case MFIE_TYPE_GENERIC: - if (!memcmp(pos, wpa_oui, OUI_LEN) && + if ((OUI_LEN + 1 <= item_len) && + !memcmp(pos, wpa_oui, OUI_LEN) && pos[OUI_LEN] == 0x01) { ie_info->wpa.data = pos - 2; ie_info->wpa.len = item_len + 2; @@ -535,7 +540,7 @@ static void gelic_wl_parse_ie(u8 *data, size_t len, break; } pos += item_len; - data_left -= item_len + 2; + data_left -= item_len; } pr_debug("%s: wpa=%p,%d wpa2=%p,%d\n", __func__, ie_info->wpa.data, ie_info->wpa.len, -- cgit v1.2.3-59-g8ed1b From 56f367bbfd5a7439961499ca6a2f0822d2074d83 Mon Sep 17 00:00:00 2001 From: Vitaliy Gusev Date: Tue, 15 Apr 2008 20:26:34 -0700 Subject: [TCP]: Add return value indication to tcp_prune_ofo_queue(). Returns non-zero if tp->out_of_order_queue was seen non-empty. This allows tcp_try_rmem_schedule() to return early. Signed-off-by: Vitaliy Gusev Signed-off-by: David S. Miller --- net/ipv4/tcp_input.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 61db7b1eb995..bbb7d88a16b4 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3841,7 +3841,7 @@ static void tcp_ofo_queue(struct sock *sk) } } -static void tcp_prune_ofo_queue(struct sock *sk); +static int tcp_prune_ofo_queue(struct sock *sk); static int tcp_prune_queue(struct sock *sk); static inline int tcp_try_rmem_schedule(struct sock *sk, unsigned int size) @@ -3853,7 +3853,9 @@ static inline int tcp_try_rmem_schedule(struct sock *sk, unsigned int size) return -1; if (!sk_rmem_schedule(sk, size)) { - tcp_prune_ofo_queue(sk); + if (!tcp_prune_ofo_queue(sk)) + return -1; + if (!sk_rmem_schedule(sk, size)) return -1; } @@ -4211,10 +4213,12 @@ static void tcp_collapse_ofo_queue(struct sock *sk) /* * Purge the out-of-order queue. + * Return true if queue was pruned. */ -static void tcp_prune_ofo_queue(struct sock *sk) +static int tcp_prune_ofo_queue(struct sock *sk) { struct tcp_sock *tp = tcp_sk(sk); + int res = 0; if (!skb_queue_empty(&tp->out_of_order_queue)) { NET_INC_STATS_BH(LINUX_MIB_OFOPRUNED); @@ -4228,7 +4232,9 @@ static void tcp_prune_ofo_queue(struct sock *sk) if (tp->rx_opt.sack_ok) tcp_sack_reset(&tp->rx_opt); sk_mem_reclaim(sk); + res = 1; } + return res; } /* Reduce allocated memory if we can, trying to get -- cgit v1.2.3-59-g8ed1b