Suppose that several linear skbs of the same flow were received by GRO. They
were thus merged into one skb with a frag_list. Then a new skb of the same flow
arrives, but it is a paged skb with data starting in its frags[].
Before adding the skb to the frag_list skb_gro_receive() will of course adjust
the skb to throw away the headers. It correctly modifies the page_offset and
size of the frag, but it leaves incorrect information in the skb:
->data_len is not decreased at all.
->len is decreased only by headlen, as if no change were done to the frag.
Later in a receiving process this causes skb_copy_datagram_iovec() to return
-EFAULT and this is seen in userspace as the result of the recv() syscall.
In practice the bug can be reproduced with the sfc driver. By default the
driver uses an adaptive scheme when it switches between using
napi_gro_receive() (with skbs) and napi_gro_frags() (with pages). The bug is
reproduced when under rx load with enough successful GRO merging the driver
decides to switch from the former to the latter.
Manual control is also possible, so reproducing this is easy with netcat:
- on machine1 (with sfc): nc -l 12345 > /dev/null
- on machine2: nc machine1 12345 < /dev/zero
- on machine1:
echo 1 > /sys/module/sfc/parameters/rx_alloc_method # use skbs
echo 2 > /sys/module/sfc/parameters/rx_alloc_method # use pages
- See that nc has quit suddenly.
[v2: Modified by Eric Dumazet to avoid advancing skb->data past the end
and to use a temporary variable.]
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
In arch/x86/kernel/dumpstack_64.c::dump_trace() we have this code:
...
if (!stack) {
unsigned long dummy;
stack = &dummy;
if (task && task != current)
stack = (unsigned long *)task->thread.sp;
}
bp = stack_frame(task, regs);
/*
* Print function call entries in all stacks, starting at the
* current stack address. If the stacks consist of nested
* exceptions
*/
tinfo = task_thread_info(task);
for (;;) {
char *id;
unsigned long *estack_end;
estack_end = in_exception_stack(cpu, (unsigned long)stack,
&used, &id);
...
You'll notice that we assign to 'stack' the address of the variable
'dummy' which is only in-scope inside the 'if (!stack)'. So when we later
access stack (at the end of the above, and assuming we did not take the
'if (task && task != current)' branch) we'll be using the address of a
variable that is no longer in scope. I believe this patch is the proper
fix, but I freely admit that I'm not 100% certain.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
LKML-Reference: <alpine.LNX.2.00.1101242232590.10252@swampdragon.chaosbits.net>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
The auto-arp feature sometimes has unexpected side effects (e.g. firmware
crashes, no ARP replies, etc.)
disable it until it will be solved.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
The passive scan channel dwell time currently used is 30-60TU. A typical
beacon interval for AP's is 100TU. This leads to a ~30% worst-case probability
of finding an AP via passive scanning.
For 5GHz bands for DFS frequencies passive scanning is the only scanning
option. Hence for these, the probability of finding an AP is very low.
To fix this, increase the passive channel scan dwell times (also the early
leave value, as 5GHz channels are still typically very silent.) Use a value
of 100TU, because that covers most typical AP configurations.
Based on testing the probability of finding an AP (100TU beacon interval) on
a single scan round are as follows (based on 100 iterations):
dwell min/max (TU) | probability
---------------------+------------
30/60 | 35%
60/60 | 56%
80/80 | 77%
100/100 | 100%
Total scan times now and after the change:
Region | Before (s) | After (s)
-------+------------+----------
00 | 0.77 | 1.48
FI | 0.95 | 2.01
US | 0.91 | 1.76
Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Commit 941666c2e3 "net: RCU conversion of dev_getbyhwaddr() and
arp_ioctl()" introduced a regression, reported by Jamie Heilman.
"arp -Ds 192.168.2.41 eth0 pub" triggered the ASSERT_RTNL() assert
in pneigh_lookup()
Removing RTNL requirement from arp_ioctl() was a mistake, just revert
that part.
Reported-by: Jamie Heilman <jamie@audible.transient.net>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Return values were assigned to incorrect var / weren't assigned.
fix it, and defer mutex_lock after the sanity checks.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Add new ampdu_action ops to support receiver BA.
The BA initiator session management in FW independently.
Signed-off-by: Shahar Levi <shahar_levi@ti.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Add 80211n BA initiator session support wl1271 driver.
Include BA supported FW version auto detection mechanism.
BA initiator session management included in FW independently.
Signed-off-by: Shahar Levi <shahar_levi@ti.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Channel 14 is only supported in Japan (JP country code in regdb). The
FW limits tranmissions to CCK only on this channel.
Tested in both STA and AP modes to work correctly.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
In wl12xx cards AP-mode requires a separate FW file. Add this file to
the module info.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
This patch adds several new device ids to the r8712u staging driver.
The new ids were retrieved from latest vendor driver (v2.6.6.0.20101111)
downloadable from www.realtek.com.tw
Signed-off-by: Axel Koellhofer <AxelKoellhofer@web.de>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@kernel.org> [2.6.37]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
iprange_ipv6_sub was substracting 2 unsigned ints and then casting
the result to int to find out whether they are lt, eq or gt each
other, this doesn't work if the full 32 bits of each part
can be used in IPv6 addresses. Patch should remedy that without
significant performance penalties. Also number of ntohl
calls can be reduced this way (Jozsef Kadlecsik).
Signed-off-by: Thomas Jacob <jacob@internet24.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
PLT mode start/stop is controlled from userspace. When removing module, the
PLT mode state is however not checked, and not cleared. There is the possibility
of some unwanted state to left linger and there is even the possiblity of a
kernel crash if for instance IRQ work is running when the module is removed.
Fix this by stopping PLT mode on module removal, if still running.
Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
The wl12xx chips do the AMDPU aggregation work in the firmware, but it
supports a maximum of 8 frames per block. Configure the mac80211 hw
structure accordingly.
Signed-off-by: Luciano Coelho <coelho@ti.com>
Tested-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
changed the visibility of the debug_level module parameter
in the filesystem to be readable and writable to the root user.
It is now accessible under /sys/module/wl12xx/parameters
removed the debug_level debugfs file that was created under
/sys/kernel/debug/...
Signed-off-by: Guy Eilam <guy@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
We were calling ieee80211_find_sta() and the sta returned by it
without locking the RCU, which is required by mac80211.
Fix this and reorganize slightly the area of the code where the sta is
used.
Reported-by: Jonathan DE CESCO <jonathanc@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
When 11a is not supported, we were modifying the global structure that
contains the bands supported by the driver. This causes problems when
having more one wl12xx device in the same system because they all use
the same global. This also causes problems when the wl12xx_sdio
module is removed and the wl12xx module remains.
Fix this problem by copying the band structure into the wl12xx
instance.
Reported-by: Arik Nemtsov <arik@wizery.com>
Reported-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Luciano Coelho <coelho@ti.com>
wl12xx "rejoins" upon every BSS_CHANGED_BSSID notification.
However, there is no need to rejoin after disassociation, so just
filter out the case when the new bssid is 00:00:00:00:00:00.
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Indicate support for the NL80211_IFTYPE_AP interface mode to enable AP
mode operation.
Disable 11a when operating in AP-mode (unsupported for now).
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Try to read the MAC address from the on-disk NVS file.
A non-zero MAC address is required to add an AP interface.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
AP and STA modes use different firmwares.
Differentiate the firmware files by name and fetch the appropriate one
when add_interface is called by mac80211. The STA firmware is chosen for
PLT mode.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Encryption key configuration is different for AP/STA modes.
AP encryption keys are recorded when the BSS is not started. On BSS
start they are propagated to the AP (in wl1271_ap_init_hwenc).
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Record TX configuration settings in the "conf" member of our global
structure (struct wl1271) if conf_tx is called when the firmware is
not loaded.
Later on when the firmware is loaded, we apply the tx conf as part of
the init sequence.
Important for AP mode since conf_tx is called before add_interface
(where the firmware is initialized).
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
When in AP mode set appropriate HLID and rate policy for each skb.
Respond to supported-rates related changes in op_tx only when acting
as STA.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Allocate and free host link IDs (HLIDs) for each link. A per-STA
data structure keeps the HLID of each STA.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Do not configure a group address table in AP mode
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Separate configuration according to mode. AP has different rate
set configuration and no handling of idle-state.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Configure AP-specific beacon and probe response templates.
Start the AP when beaconing is enabled.
The wl1271_bss_info_changed() function has been split into AP/STA
specific handlers.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Change structures in a non-destructive manner. This means no
changes in size or location of existing members used by STA.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Set filters according to the mode of operation.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Split HW init sequence into AP/STA specific parts
The AP specific init sequence includes configuration of templates, rate
classes, power mode, etc. Also unmask AP specific events in the event mbox.
Separate the differences between AP and STA init into mode
specific functions called from wl1271_hw_init. The first is called after
radio configuration and the second after memory configuration.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Sometimes an event indicating station removal is not sent up by
firmware. We work around this by always indicating success in when
a wait for the event timeouts.
Temporary workaround until a FW fix is introduced.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Add commands to start/stop BSS, add/remove STA and configure encryption
keys. Split the encryption commands "set key" and "set default key" into
AP and STA specific versions.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Rate class configuration has been split up for AP and STA modes.
Template related configuration likewise separated.
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Note that wl1271_write32() calls cpu_to_le32() by itself, so calling
wl1271_write32(addr, cpu_to_le32(val)) is in fact a bug on BE systems.
Fix the following sparse warnings:
drivers/net/wireless/wl12xx/cmd.c:662:16: warning: incorrect type in assignment (different base types)
drivers/net/wireless/wl12xx/cmd.c:662:16: expected unsigned short [unsigned] [addressable] [usertype] llc_type
drivers/net/wireless/wl12xx/cmd.c:662:16: got restricted __be16 [usertype] <noident>
drivers/net/wireless/wl12xx/cmd.c:674:17: warning: incorrect type in assignment (different base types)
drivers/net/wireless/wl12xx/cmd.c:674:17: expected unsigned int [unsigned] [addressable] [usertype] sender_ip
drivers/net/wireless/wl12xx/cmd.c:674:17: got restricted __be32 [usertype] ip_addr
drivers/net/wireless/wl12xx/rx.c:202:4: warning: incorrect type in argument 3 (different base types)
drivers/net/wireless/wl12xx/rx.c:202:4: expected unsigned int [unsigned] [usertype] val
drivers/net/wireless/wl12xx/rx.c:202:4: got restricted __le32 [usertype] <noident>
drivers/net/wireless/wl12xx/acx.c:1247:23: warning: incorrect type in assignment (different base types)
drivers/net/wireless/wl12xx/acx.c:1247:23: expected restricted __le32 [usertype] ht_capabilites
drivers/net/wireless/wl12xx/acx.c:1247:23: got unsigned long
drivers/net/wireless/wl12xx/acx.c:1250:24: warning: invalid assignment: |=
drivers/net/wireless/wl12xx/acx.c:1250:24: left side has type restricted __le32
drivers/net/wireless/wl12xx/acx.c:1250:24: right side has type unsigned long
drivers/net/wireless/wl12xx/acx.c:1253:24: warning: invalid assignment: |=
drivers/net/wireless/wl12xx/acx.c:1253:24: left side has type restricted __le32
drivers/net/wireless/wl12xx/acx.c:1253:24: right side has type unsigned long
drivers/net/wireless/wl12xx/acx.c:1256:24: warning: invalid assignment: |=
drivers/net/wireless/wl12xx/acx.c:1256:24: left side has type restricted __le32
drivers/net/wireless/wl12xx/acx.c:1256:24: right side has type unsigned long
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
If debugging is turned on, then wl1271_dump() dereferences a freed
variable.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Upon rmmod, the <debugfs>/ieee80211/phyX dir is being removed.
later, we try to remove <debugfs>/ieee80211/phyX/wl12xx, which
might result in NULL dereference.
Remove the excessive debugfs_remove_recursive() call.
(consequently, there is no more need to save wl->rootdir)
Reported-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Fix a shutdown regression caused by 2a2d31c8dc ("intel_idle: open
broadcast clock event"). The clockevent framework can automatically
shutdown broadcast timers for hotremove CPUs. And we get a shutdown
regression when we shutdown broadcast timer for hot remove CPU, so just
delete some code.
Also fix some section mismatch.
Reported-by: Ari Savolainen <ari.m.savolainen@gmail.com>
Signed-off-by: Shaohua Li <shaohua.li@intel.com>
Tested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6:
omap: DMA: clear interrupt status correctly
OMAP3: Devkit8000: Fix tps65930 pullup/pulldown configuration
arm: omap3: cm-t3517: minor comment fix
arm: omap3: cm-t3517: rtc fix
omap1: Fix sched_clock implementation when both MPU timer and 32K timer are used
omap1: Fix booting for 15xx and 730 with omap1_defconfig
omap1: Fix sched_clock for the MPU timer
OMAP: PRCM: remove duplicated headers
OMAP4: clockdomain: bypass unimplemented wake-up dependency functions on OMAP4
OMAP: counter_32k: init clocksource as part of machine timer init
* 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
perf tools: Fix time function double declaration with glibc
perf tools: Fix build by checking if extra warnings are supported
perf tools: Fix build when using gcc 3.4.6
perf tools: Add missing header, fixes build
perf tools: Fix 64 bit integer format strings
perf test: Fix build on older glibcs
perf: perf_event_exit_task_context: s/rcu_dereference/rcu_dereference_raw/
perf test: Use cpu_map->[cpu] when setting affinity
perf symbols: Fix annotation of thumb code
perf: Annotate cpuctx->ctx.mutex to avoid a lockdep splat
powerpc, perf: Fix frequency calculation for overflowing counters (FSL version)
perf: Fix perf_event_init_task()/perf_event_free_task() interaction
perf: Fix find_get_context() vs perf_event_exit_task() race
* 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
sched: Fix poor interactivity on UP systems due to group scheduler nice tune bug
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86: Fix jump label with RO/NX module protection crash
x86, hotplug: Fix powersavings with offlined cores on AMD
x86, mcheck, therm_throt.c: Export symbol platform_thermal_notify to allow coretemp to handler intr
x86: Use asm-generic/cacheflush.h
x86: Update CPU cache attributes table descriptors
