The following patch (based on a patch from Stephen Hemminger
<shemminger@linux-foundation.org>) removes use after free conditions in
the unregister path for the bonding master. Without this patch, an
operation of the form "echo -bond0 > /sys/class/net/bonding_masters"
would trigger a NULL pointer dereference in sysfs. I was not able to
induce the failure with the non-sysfs code path, but for consistency I
updated that code as well.
I also did some testing of the bonding /proc file being open
while the bond is being deleted, and didn't see any problems there.
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
It doesn't look like spidernet hardware can really checksum all protocols,
the code looks like it does IPV4 only. If so, it should use NETIF_F_IP_CSUM
instead of NETIF_F_HW_CSUM.
The driver doesn't need it's own get/set for ethtool tx csum, and it
should use the standard ethtool_op_get_link.
Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
At some point, the transmit descriptor chain end interrupt (TXDCEINT)
was turned on. This is a mistake; and it damages small packet
transmit performance, as it results in a huge storm of interrupts.
Turn it off.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Although the previous patch resolved issues with hangs when the
RX ram full interrupt is encountered, there are still situations
where lots of RX ramfull interrupts arrive, resulting in a noisy
log in syslog. There is no need for this.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
The terminated RX ring will cause trouble during the RX ram full
conditions, leading to a hung driver, as the hardware can't find
the next descr. There is no real reason to terminate the RX ring;
it doesn't make the operation any smooother, and it does
require an extra sync. So don't do it.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
This patch fixes a rare deadlock that can occur when the kernel
is not able to empty out the RX ring quickly enough. Below follows
a detailed description of the bug and the fix.
As long as the OS can empty out the RX buffers at a rate faster than
the hardware can fill them, there is no problem. If, for some reason,
the OS fails to empty the RX ring fast enough, the hardware GDACTDPA
pointer will catch up to the head, notice the not-empty condition,
ad stop. However, RX packets may still continue arriving on the wire.
The spidernet chip can save some limited number of these in local RAM.
When this local ram fills up, the spider chip will issue an interrupt
indicating this (GHIINT0STS will show ERRINT, and the GRMFLLINT bit
will be set in GHIINT1STS). When te RX ram full condition occurs,
a certain bug/feature is triggered that has to be specially handled.
This section describes the special handling for this condition.
When the OS finally has a chance to run, it will empty out the RX ring.
In particular, it will clear the descriptor on which the hardware had
stopped. However, once the hardware has decided that a certain
descriptor is invalid, it will not restart at that descriptor; instead
it will restart at the next descr. This potentially will lead to a
deadlock condition, as the tail pointer will be pointing at this descr,
which, from the OS point of view, is empty; the OS will be waiting for
this descr to be filled. However, the hardware has skipped this descr,
and is filling the next descrs. Since the OS doesn't see this, there
is a potential deadlock, with the OS waiting for one descr to fill,
while the hardware is waiting for a differen set of descrs to become
empty.
A call to show_rx_chain() at this point indicates the nature of the
problem. A typical print when the network is hung shows the following:
net eth1: Spider RX RAM full, incoming packets might be discarded!
net eth1: Total number of descrs=256
net eth1: Chain tail located at descr=255
net eth1: Chain head is at 255
net eth1: HW curr desc (GDACTDPA) is at 0
net eth1: Have 1 descrs with stat=xa0800000
net eth1: HW next desc (GDACNEXTDA) is at 1
net eth1: Have 127 descrs with stat=x40800101
net eth1: Have 1 descrs with stat=x40800001
net eth1: Have 126 descrs with stat=x40800101
net eth1: Last 1 descrs with stat=xa0800000
Both the tail and head pointers are pointing at descr 255, which is
marked xa... which is "empty". Thus, from the OS point of view, there
is nothing to be done. In particular, there is the implicit assumption
that everything in front of the "empty" descr must surely also be empty,
as explained in the last section. The OS is waiting for descr 255 to
become non-empty, which, in this case, will never happen.
The HW pointer is at descr 0. This descr is marked 0x4.. or "full".
Since its already full, the hardware can do nothing more, and thus has
halted processing. Notice that descrs 0 through 254 are all marked
"full", while descr 254 and 255 are empty. (The "Last 1 descrs" is
descr 254, since tail was at 255.) Thus, the system is deadlocked,
and there can be no forward progress; the OS thinks there's nothing
to do, and the hardware has nowhere to put incoming data.
This bug/feature is worked around with the spider_net_resync_head_ptr()
routine. When the driver receives RX interrupts, but an examination
of the RX chain seems to show it is empty, then it is probable that
the hardware has skipped a descr or two (sometimes dozens under heavy
network conditions). The spider_net_resync_head_ptr() subroutine will
search the ring for the next full descr, and the driver will resume
operations there. Since this will leave "holes" in the ring, there
is also a spider_net_resync_tail_ptr() that will skip over such holes.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Avoid kernel crash in mm/slab.c due to double-free of pointer.
If the ethernet interface is brought down while there is still
RX traffic in flight, the device shutdown routine can end up
trying to double-free an skb, leading to a crash in mm/slab.c
Avoid the double-free by nulling out the skb pointer.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
IB/mlx4: Make sure inline data segments don't cross a 64 byte boundary
IB/mlx4: Handle FW command interface rev 3
IB/mlx4: Handle buffer wraparound in __mlx4_ib_cq_clean()
IB/mlx4: Get rid of max_inline_data calculation
IB/mlx4: Handle new FW requirement for send request prefetching
IB/mlx4: Fix warning in rounding up queue sizes
IB/mlx4: Fix handling of wq->tail for send completions
For some platforms it's definitions may conflict. So that's the one-liner.
The rest is 10 square kilometers of collateral damage fixup this include
used to paper over.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Upcoming firmware introduces command interface revision 3, which
changes the way port capabilities are queried and set. Update the
driver to handle both the new and old command interfaces by adding a
new MLX4_FLAG_OLD_PORT_CMDS that it is set after querying the firmware
interface revision and then using the correct interface based on the
setting of the flag.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
New ConnectX firmware introduces FW command interface revision 2,
which requires that for each QP, a chunk of send queue entries (the
"headroom") is kept marked as invalid, so that the HCA doesn't get
confused if it prefetches entries that haven't been posted yet. Add
code to the driver to do this, and also update the user ABI so that
userspace can request that the prefetcher be turned off for userspace
QPs (we just leave the prefetcher on for all kernel QPs).
Unfortunately, marking send queue entries this way is confuses older
firmware, so we change the driver to allow only FW command interface
revisions 2. This means that users will have to update their firmware
to work with the new driver, but the firmware is changing quickly and
the old firmware has lots of other bugs anyway, so this shouldn't be too
big a deal.
Based on a patch from Jack Morgenstein <jackm@dev.mellanox.co.il>.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/cooloney/blackfin-2.6: (30 commits)
Blackfin SMC91X ethernet supporting driver: SMC91C111 LEDs are note drived in the kernel like in uboot
Blackfin SPI driver: fix bug SPI DMA incomplete transmission
Blackfin SPI driver: tweak spi cleanup function to match newer kernel changes
Blackfin RTC drivers: update MAINTAINERS information
Blackfin serial driver: decouple PARODD and CMSPAR checking from PARENB
Blackfin serial driver: actually implement the break_ctl() function
Blackfin serial driver: ignore framing and parity errors
Blackfin serial driver: hook up our UARTs STP bit with userspaces CMSPAR
Blackfin arch: move HI/LO macros into blackfin.h and punt the rest of macros.h as it includes VDSP macros we never use
Blackfin arch: redo our linker script a bit
Blackfin arch: make sure we initialize our L1 Data B section properly based on the linked kernel
Blackfin arch: fix bug can not wakeup from sleep via push buttons
Blackfin arch: add support for Alon Bar-Lev's dynamic kernel command-line
Blackfin arch: add missing gpio.h header to fix compiling in some pm configurations
Blackfin arch: As Mike pointed out range goes form m..MAX_BLACKFIN_GPIO -1
Blackfin arch: fix spelling typo in output
Blackfin arch: try to split up functions like this into smaller units according to LKML review
Blackfin arch: add proper ENDPROC()
Blackfin arch: move more of our startup code to .init so it can be freed once we are up and running
Blackfin arch: unify differences between our diff head.S files -- no functional changes
...
* master.kernel.org:/pub/scm/linux/kernel/git/kyle/parisc-2.6: (30 commits)
[PARISC] remove global_ack_eiem
[PARISC] Fix kernel panic in check_ivt
[PARISC] Fix bug when syscall nr is __NR_Linux_syscalls
[PARISC] be more defensive in process.c::get_wchan
[PARISC] fix "reduce size of task_struct on 64-bit machines" fallout
[PARISC] fix null ptr deref in unwind.c
[PARISC] fix trivial spelling nit in asm/linkage.h
[PARISC] remove remnants of parisc-specific softirq code
[PARISC] fix section mismatch in smp.c
[PARISC] fix "ENTRY" macro redefinition
[PARISC] Wire up utimensat/signalfd/timerfd/eventfd syscalls
[PARISC] fix section mismatch in superio serial drivers
[PARISC] fix section mismatch in parisc eisa driver
[PARISC] fix section mismatches in arch/parisc/kernel
[PARISC] fix section mismatch in ccio-dma
[PARISC] fix section mismatch in parisc STI video drivers
[PARISC] fix section mismatch in parport_gsc
[PARISC] fix lasi_82596 build
[PARISC] Build fixes for power.c
[PARISC] kobject is embedded in subsys, not kset
...
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[IPV6] addrconf: Fix IPv6 on tuntap tunnels
[TCP]: Add missing break to TCP option parsing code
[SCTP] Don't disable PMTU discovery when mtu is small
[SCTP] Flag a pmtu change request
[SCTP] Update pmtu handling to be similar to tcp
[SCTP] Fix leak in sctp_getsockopt_local_addrs when copy_to_user fails
[SCTP]: Allow unspecified port in sctp_bindx()
[SCTP]: Correctly set daddr for IPv6 sockets during peeloff
[TCP]: Set initial_ssthresh default to zero in Cubic and BIC.
[TCP]: Fix left_out setting during FRTO
[TCP]: Disable TSO if MD5SIG is enabled.
[PPP_MPPE]: Fix "osize too small" check.
[PATCH] mac80211: Don't stop tx queue on master device while scanning.
[PATCH] mac80211: fix debugfs tx power reduction output
[PATCH] cfg80211: fix signed macaddress in sysfs
[IrDA]: f-timer reloading when sending rejected frames.
[IrDA]: Fix Rx/Tx path race.
Since Myri-10G boards may also run in Myrinet mode instead of Ethernet,
add a message when we detect that the link partner is not running in the
right mode.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Limit the number of recoveries from a NIC hw watchdog reset to 1 by default.
It enables detection of defective NICs immediately since these memory parity
errors are expected to happen very rarely (less than once per century*NIC).
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
NetXen: Fix incorrect link status even with switch turned OFF.
NetXen driver failed to accurately indicate when a link is up or down.
This was encountered during failover testing, when the first port
indicated that the link was up even when the 10G switch it was assigned
to in the Bladecenter was turned off completely.
Signed-off by: Wen Xiong <wenxiong@us.ibm.com>
Signed-off by: Mithlesh Thukral <mithlesh@netxen.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
This reverts commit d52df4a35a.
This patch attempted to fix e100 for non-cache coherent memory
architectures by using the cb style code that eepro100 had and using
the EL and s bits from the RFD list. Unfortunately the hardware
doesn't work exactly like this and therefore this patch actually
breaks e100. Reverting the change brings it back to the previously
known good state for 2.6.22. The pending rewrite in progress to this
code can then be safely merged later.
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Prevent mppe_decompress() from generating "osize too small" errors when
checking for output buffer size. When receiving a packet of mru size the
output buffer for decrypted data is 1 byte too small since
mppe_decompress() tries to account for possible PFC, however later in code
it is assumed no PFC.
Adjusting the check prevented these errors from occurring.
Signed-off-by: Konstantin Sharlaimov <konstantin.sharlaimov@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
With firmware 5.220.11.p5, this allows to specify the anycast addresses the
device will listen to.
The anycast address range is C0:27:C0:27:C0:XX where XX goes from 00 to 1F (or
0 to 31 in dec). The value to write on anycast_mask will specify which
addresses the device listens to. Bits in a 32 bit int are numbered from 0
(least significative bit) to 31. A specific address ending in YY will be
listened to if bit YY in the value is set to one.
Examples:
0x00000000 : do not listen to any anycast address
0xFFFFFFFF : listen to every anycast address from :00 to :1F
0x00000013 : listen to anycast addresses :00, :01 and :04
Signed-off-by: Luis Carlos Cobo <luisca@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This avoids channel mismatch between driver and firmware in case we change
channel while associated to an AP.
Signed-off-by: Luis Carlos Cobo Rus <luisca@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
IB/mlx4: Make sure RQ allocation is always valid
RDMA/cma: Fix initialization of next_port
IB/mlx4: Fix zeroing of rnr_retry value in ib_modify_qp()
mlx4_core: Don't set MTT address in dMPT entries with PA set
mlx4_core: Check firmware command interface revision
IB/mthca, mlx4_core: Fix typo in comment
mlx4_core: Free catastrophic error MSI-X interrupt with correct dev_id
mlx4_core: Initialize ctx_list and ctx_lock earlier
mlx4_core: Fix CQ context layout
Kill mixed case function names from scan.c/scan.h.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Replace WLAN_802_11_SSID with direct 'ssid' and 'ssid_len' members
like ieee80211. In the process, remove private libertas_escape_essid
and depend on the ieee80211 implementation of escape_essid instead.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Byte-swapping length fields and then passing them to memcpy() considered
harmful.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Now we finally get connectivity. For a while, before something else dies...
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Now it at least manages to load the firmware.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Separate wireless handlers of mshX and ethX. ethX remains as before.
For mshX, it has been disabled set/get essid, wap and set mode. Get mode always
returns "Repeater" and by now we use the Nickname to show if the mesh is active
("Mesh") or not (empty). The rest remains as before.
Signed-off-by: Luis Carlos Cobo Rus <luisca@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Fix some wording and blinding table command options, clarify argument list for
fwt_add and fwt_list, simplify fwt_list_route
Signed-off-by: Luis Carlos Cobo Rus <luisca@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Fix WPA so it works up through the supplicant 4-Way handshake process.
Doesn't successfully pass traffic yet; may be problems installing
the GTK to the firmware.
- RSN needs to be enabled before the association command is sent
- Use keys from the association request not the adapter structure
- cmd_act_mac_strict_protection_enable != IW_AUTH_DROP_UNENCRYPTED
- Fix network filtering logic in is_network_compatible() WPA helpers
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Any time the driver gets new scan results, even from partial scans,
it should send the scan event to userspace.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Previously if a fixed channel was specified along with an SSID,
the channel request would be ignored during the association
process. Instead, when searching for an adhoc or infrastructure
network to join, allow filtering results based on channel so
that the driver doesn't pick a BSS on a different channel than
requested.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Inadvertently removed on a previous commit; causes the first
adhoc start to fail if a channel has not been set or no
other association has been made.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Update signal quality before the locked scan result translation loop,
because calling libertas_prepare_and_send_command() with the
'waitforrsp' option grabs adapter->lock in the command return processing,
leading to the deadlock.
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
