The minstrel rate controller periodically looks up rate indexes in
a sampling table.  When accessing a specific row and column, minstrel
correctly does a bounds check which, on the surface, appears to handle
the case where mi->n_rates < 2.  However, mi->sample_idx is actually
defined as an unsigned, so the right hand side is taken to be a huge
positive number when negative, and the check will always fail.

Consequently, the RC will overrun the array and cause random memory
corruption when communicating with a peer that has only a single rate.
The max value of mi->sample_idx is around 25 so casting to int should
have no ill effects.

Without the change, uptime is a few minutes under load with an AP
that has a single hard-coded rate, and both the AP and STA could
potentially crash.  With the change, both lasted 12 hours with a
steady load.

Thanks to Ognjen Maric for providing the single-rate clue so I could
reproduce this.

This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the
regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000).

Cc: stable@kernel.org
Reported-by: NSergey S. Kostyliov <rathamahata@gmail.com>
Reported-by: NOgnjen Maric <ognjen.maric@gmail.com>
Signed-off-by: NBob Copeland <me@bobcopeland.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This removes the dependency on GPIO framework and lets the SPI host
driver handle the chip select. The SPI host driver is required to keep
the CS active for the entire message unless cs_change says otherwise.
This patch collects the two/three single SPI transfers into a message.
Also the delay in read path in case use_dummy_writes are not used is
moved into the SPI host driver.
Tested-by: NMike Rapoport <mike@compulab.co.il>
Tested-by: NAndrey Yurovsky <andrey@cozybit.com>
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: NDan Williams <dcbw@redhat.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Driver used to be named rndis_wext before inclusion to upstream. Since
rndis_wlan is being converted to cfg80211, use of rndis_wext* names
can be confusing. So rename all rndis_wext to rndis_wlan (as should
have been when driver was renamed).
Signed-off-by: NJussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Capitalize enum labels as told in Documents/CodingStyle.
Signed-off-by: NJussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

This ports the iwlwifi rfkill code to the new API offered by
cfg80211 and thus removes a lot of useless stuff. The soft-
rfkill is completely removed since that is now handled by
setting the interfaces down.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Tested-by: NReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Since we use ERR_PTR and similar macros, we need to include
linux/err.h.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

There is no need to check if a pointer is NULL before calling
vfree(), since vfree() function already check for it.
Signed-off-by: NBreno Leitão <leitao@linux.vnet.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Include offloaded FCoE data into total rx/tx statistics for 82599 so they
are properly reflected by ethtool or ifconfig.
Signed-off-by: NYi Zou <yi.zou@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Ethtool is a standard way of getting information about
ethernet interfaces.  We enhance ethtool kernel interface
& e1000e to make the MDI-X status readable via ethtool in
userspace.
Signed-off-by: NChaitanya Lala <clala@riverbed.com>
Signed-off-by: NArthur Jones <ajones@riverbed.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

e1000e_config_collision_dist() sets tctl, but subsequently tctl is
overwritten.  It seems to me that as things stand the call to
e1000e_config_collision_dist() has no effect and should either be
removed or moved down a little bit.  This kernel patch takes the latter
option.
Signed-off-by: NSimon Horman <horms@verge.net.au>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Phy corruption has been observed on 2-port 82571 adapters, and is root-caused
to lack of synchronization between the 2 driver instances, which conflict
when attempting to access the phy via the single MDIC register.
A semaphore exists for this purpose, and is now used on these designs. Because
PXE &/or EFI boot code (which we cannot expect to be built with this fix) may
leave the inter-instance semaphore in an invalid initial state when the driver
first loads, this fix also includes a one-time (per driver load) fix-up of the
semaphore initial state.
Signed-off-by: Ndave graham <david.graham@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

fakehard is a really simple driver implementing only necessary
callbacks and serves the role of an example of driver for HardMAC
IEEE 802.15.4 device.
Signed-off-by: NDmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: NSergey Lapin <slapin@ossfans.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add MAINTAINERS entry and a small text describing our stack interfaces,
how to hook the drivers, etc.
Signed-off-by: NDmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: NSergey Lapin <slapin@ossfans.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add a netlink interface for configuration of IEEE 802.15.4 device. Also this
interface specifies events notification sent by devices towards higher layers.
Signed-off-by: NDmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: NSergey Lapin <slapin@ossfans.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add support for communication over IEEE 802.15.4 networks. This implementation
is neither certified nor complete, but aims to that goal. This commit contains
only the socket interface for communication over IEEE 802.15.4 networks.
One can either send RAW datagrams or use SOCK_DGRAM to encapsulate data
inside normal IEEE 802.15.4 packets.

Configuration interface, drivers and software MAC 802.15.4 implementation will
follow.

Initial implementation was done by Maxim Gorbachyov, Maxim Osipov and Pavel
Smolensky as a research project at Siemens AG. Later the stack was heavily
reworked to better suit the linux networking model, and is now maitained
as an open project partially sponsored by Siemens.
Signed-off-by: NDmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: NSergey Lapin <slapin@ossfans.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

IEEE 802.15.4 stack requires several constants to be defined/adjusted.
Signed-off-by: NDmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: NSergey Lapin <slapin@ossfans.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Change PSCHED_SHIFT from 10 to 6 to increase schedulers time
resolution. This will increase 16x a number of (internal) ticks per
nanosecond, and is needed to improve accuracy of schedulers based on
rate tables, like HTB, TBF or CBQ, with rates above 100Mbit. It is
assumed this change is safe for 32bit accounting of time diffs up
to 2 minutes, which should be enough for common use (extremely low
rate values may overflow, so get inaccurate instead). To make full
use of this change an updated iproute2 will be needed. (But using
older iproute2 should be safe too.)

This change breaks ticks - microseconds similarity, so some minor code
fixes might be needed. It is also planned to change naming adequately
eg. to PSCHED_TICKS2NS() etc. in the near future.
Reported-by: NAntonio Almeida <vexwek@gmail.com>
Tested-by: NAntonio Almeida <vexwek@gmail.com>
Signed-off-by: NJarek Poplawski <jarkao2@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Use PSCHED_SHIFT constant instead of '10' in PSCHED_US2NS() and
PSCHED_NS2US() macros to enable changing this value later.

Additionally use PSCHED_SHIFT in sch_hfsc SM_SHIFT and ISM_SHIFT
definitions. This part of the patch is based on feedback from
Patrick McHardy <kaber@trash.net>.
Reported-by: NAntonio Almeida <vexwek@gmail.com>
Tested-by: NAntonio Almeida <vexwek@gmail.com>
Signed-off-by: NJarek Poplawski <jarkao2@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

commit f001fde5
(net: introduce a list of device addresses dev_addr_list (v6))
added one regression Vegard Nossum found in its testings.

With kmemcheck help, Vegard found some uninitialized memory
was read and reported to user, potentialy leaking kernel data.
( thread can be found on http://lkml.org/lkml/2009/5/30/177 )

dev_addr_init() incorrectly uses sizeof() operator. We were
initializing one byte instead of MAX_ADDR_LEN bytes.
Reported-by: NVegard Nossum <vegard.nossum@gmail.com>
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Acked-by: NJiri Pirko <jpirko@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This driver does not indicate support for frag lists.

Furthermore, even if it did, the code is walking the frag
lists incorrectly.  The idiom is:

	for (iter = skb_shinfo(skb)->frag_list; iter; iter = iter->next)

but it's doing:

	for (iter = skb_shinfo(skb)->frag_list; iter;
	     iter = skb_shinfo(iter)->frag_list)

which would never work.  And this proves that this driver never
saw an SKB with active frag lists.

So just remove the code altogether and the driver TX path becomes
much simpler.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDavid S. Miller <davem@davemloft.net>

With the hope that these can be used to eliminate direct
references to the frag list implementation.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Furthermore, it twiddles with the details of SKB list handling
directly, which we're trying to eliminate.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

A driver overhaul on 29 Feb 2000 (!) broke locking around fiddling with 
the tx descriptor ring in start_xmit(); a follow-on "fix" removed the 
broken remnants altogether.  Here's a patch to restore proper locking in 
the function -- the complement in the interrupt handler has been correct 
all the time.

 This *may* have been the reason for the occasional confusion of the chip 
-- triggering a tx timeout followed by a chip reset sequence -- seen on 
R4k-based DECstations with the onboard Ethernet interface.  Another theory 
is the confusion is due to an unindentified problem -- perhaps a silicon 
erratum -- associated with the variation of the MT ASIC used to interface 
the R4k CPU to the rest of the system on these computers; with its 
aggressive write-back buffering the design is particularly weakly ordered 
when it comes to MMIO (in the absence of ordering barriers uncached reads 
are allowed to bypass earlier uncached writes, even if to the same 
location), which may trigger all kinds of corner cases in peripheral 
hardware as well as software.

Either way this piece of code is buggy.
Signed-off-by: NMaciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Clarify calling context and return codes of callback methods, and
add a description of the _cmsg structure and helper functions.

Impact: documentation
Signed-off-by: NTilman Schmidt <tilman@imap.cc>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The dereferencing of the private pointer cmsg->m in capi_cmsg2str() may
cause an Oops in case of an error, which is particularly inconvenient
as that function is typically used to format an error message. Add a
NULL pointer check to avoid this.

Impact: error handling improvement
Signed-off-by: NTilman Schmidt <tilman@imap.cc>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add kerneldoc comments for the exported funtions in capiutil.c.

Impact: documentation
Signed-off-by: NTilman Schmidt <tilman@imap.cc>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Change the name of the Kernel CAPI exported function capi_ctr_reseted()
to something representing its purpose better.

Impact: renaming, no functional change
Signed-off-by: NTilman Schmidt <tilman@imap.cc>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

It is possible for tun_chr_close to race with dellink on the
a tun device.  In which case if __tun_get runs before dellink
but dellink runs before tun_chr_close calls unregister_netdevice
we will attempt to unregister the netdevice after it is already
gone.  

The two cases are already serialized on the rtnl_lock, so I have
gone for the cheap simple fix of moving rtnl_lock to cover __tun_get
in tun_chr_close.  Eliminating the possibility of the tun device
being unregistered between __tun_get and unregister_netdevice in
tun_chr_close.
Signed-off-by: NEric W. Biederman <ebiederm@aristanetworks.com>
Tested-by: NDavid Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>