From acea6852f32b8805e166d885ed7e9f0c7cd10d41 Mon Sep 17 00:00:00 2001 From: Dave Young Date: Mon, 21 Jan 2008 22:35:21 -0800 Subject: [PATCH 01/10] [BLUETOOTH]: Move children of connection device to NULL before connection down. The rfcomm tty device will possibly retain even when conn is down, and sysfs doesn't support zombie device moving, so this patch move the tty device before conn device is destroyed. For the bug refered please see : http://lkml.org/lkml/2007/12/28/87 Signed-off-by: Dave Young Signed-off-by: David S. Miller --- net/bluetooth/hci_sysfs.c | 17 +++++++++++++++++ net/bluetooth/rfcomm/tty.c | 3 ++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c index cad510309dcf..17f7fb720553 100644 --- a/net/bluetooth/hci_sysfs.c +++ b/net/bluetooth/hci_sysfs.c @@ -316,9 +316,26 @@ void hci_conn_add_sysfs(struct hci_conn *conn) schedule_work(&conn->work); } +static int __match_tty(struct device *dev, void *data) +{ + /* The rfcomm tty device will possibly retain even when conn + * is down, and sysfs doesn't support move zombie device, + * so we should move the device before conn device is destroyed. + * Due to the only child device of hci_conn dev is rfcomm + * tty_dev, here just return 1 + */ + return 1; +} + static void del_conn(struct work_struct *work) { + struct device *dev; struct hci_conn *conn = container_of(work, struct hci_conn, work); + + while (dev = device_find_child(&conn->dev, NULL, __match_tty)) { + device_move(dev, NULL); + put_device(dev); + } device_del(&conn->dev); put_device(&conn->dev); } diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c index a6a758dd1f7d..788c70321858 100644 --- a/net/bluetooth/rfcomm/tty.c +++ b/net/bluetooth/rfcomm/tty.c @@ -696,7 +696,8 @@ static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp) BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, dev->opened); if (--dev->opened == 0) { - device_move(dev->tty_dev, NULL); + if (dev->tty_dev->parent) + device_move(dev->tty_dev, NULL); /* Close DLC and dettach TTY */ rfcomm_dlc_close(dev->dlc, 0); From 4c93566e2a61b48ef071a8d8a8fa9904c83a668e Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Mon, 21 Jan 2008 23:20:58 -0800 Subject: [PATCH 02/10] [TULIP] DMFE: Fix SROM parsing regression. Changeset 16b110c3fd760620b4a787db6ed512fe531ab1b5 (dmfe warning fix) bothed up the offsets read from the SROM so that it doesn't read the same datums it used to. The change made transformations like turning: "srom + 34" into "(__le32 *)srom + 34/4" which doesn't work because 4 does not divide evenly into 34 so we're using a different pointer offset than in the original code. I've changed theses cases in dmfe_parse_srom() to consistently use "(type *)(srom + offset)" preserving the offsets from the original code. Signed-off-by: David S. Miller --- drivers/net/tulip/dmfe.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c index b4891caeae5a..656200472fa1 100644 --- a/drivers/net/tulip/dmfe.c +++ b/drivers/net/tulip/dmfe.c @@ -1909,7 +1909,7 @@ static void dmfe_parse_srom(struct dmfe_board_info * db) if ( ( (int) srom[18] & 0xff) == SROM_V41_CODE) { /* SROM V4.01 */ /* Get NIC support media mode */ - db->NIC_capability = le16_to_cpup((__le16 *)srom + 34/2); + db->NIC_capability = le16_to_cpup((__le16 *) (srom + 34)); db->PHY_reg4 = 0; for (tmp_reg = 1; tmp_reg < 0x10; tmp_reg <<= 1) { switch( db->NIC_capability & tmp_reg ) { @@ -1921,8 +1921,8 @@ static void dmfe_parse_srom(struct dmfe_board_info * db) } /* Media Mode Force or not check */ - dmfe_mode = le32_to_cpup((__le32 *)srom + 34/4) & - le32_to_cpup((__le32 *)srom + 36/4); + dmfe_mode = (le32_to_cpup((__le32 *) (srom + 34)) & + le32_to_cpup((__le32 *) (srom + 36))); switch(dmfe_mode) { case 0x4: dmfe_media_mode = DMFE_100MHF; break; /* 100MHF */ case 0x2: dmfe_media_mode = DMFE_10MFD; break; /* 10MFD */ From 1e34a11d55c9437775367d72ad03f9af99e78bd0 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Tue, 22 Jan 2008 23:44:31 -0800 Subject: [PATCH 03/10] [IPV4]: Add missing skb->truesize increment in ip_append_page(). And as noted by Takahiro Yasui, we thus need to bump the sk->sk_wmem_alloc at this spot as well. Signed-off-by: David S. Miller --- net/ipv4/ip_output.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index fd99fbd685ea..480469b92aa7 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1172,6 +1172,8 @@ ssize_t ip_append_page(struct sock *sk, struct page *page, skb->len += len; skb->data_len += len; + skb->truesize += len; + atomic_add(len, &sk->sk_wmem_alloc); offset += len; size -= len; } From a781cf94e6dcc09bf13e548298185d916d9ff3c8 Mon Sep 17 00:00:00 2001 From: Reinette Chatre Date: Mon, 21 Jan 2008 10:08:31 -0800 Subject: [PATCH 04/10] iwlwifi: fix possible read attempt on ucode that is not available This fixes a NULL pointer dereference that can occur when the ucode is not loaded at the time __iwl_up is called. The problem was reported at http://kerneloops.org/raw.php?rawid=2765&msgid= Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville --- drivers/net/wireless/iwlwifi/iwl3945-base.c | 5 +++++ drivers/net/wireless/iwlwifi/iwl4965-base.c | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c index 1a6b0e0edf6f..0b3ec7e4d93b 100644 --- a/drivers/net/wireless/iwlwifi/iwl3945-base.c +++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c @@ -6342,6 +6342,11 @@ static int __iwl_up(struct iwl_priv *priv) return 0; } + if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) { + IWL_ERROR("ucode not available for device bringup\n"); + return -EIO; + } + iwl_write32(priv, CSR_INT, 0xFFFFFFFF); rc = iwl_hw_nic_init(priv); diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c index 6cd57c220631..15a45f471710 100644 --- a/drivers/net/wireless/iwlwifi/iwl4965-base.c +++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c @@ -6698,6 +6698,11 @@ static int __iwl_up(struct iwl_priv *priv) return 0; } + if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) { + IWL_ERROR("ucode not available for device bringup\n"); + return -EIO; + } + iwl_write32(priv, CSR_INT, 0xFFFFFFFF); rc = iwl_hw_nic_init(priv); From ff4b950277b6534caab2b2b956dba6ce29757551 Mon Sep 17 00:00:00 2001 From: "Denis V. Lunev" Date: Tue, 22 Jan 2008 22:05:33 -0800 Subject: [PATCH 05/10] [NETNS]: Re-export init_net via EXPORT_SYMBOL. init_net is used added as a parameter to a lot of old API calls, f.e. ip_dev_find. These calls were exported as EXPORT_SYMBOL. So, export init_net as EXPORT_SYMBOL to keep networking API consistent. Signed-off-by: Denis V. Lunev Signed-off-by: David S. Miller --- net/core/net_namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index 383252b50411..ec936ae92458 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -18,7 +18,7 @@ static DEFINE_MUTEX(net_mutex); LIST_HEAD(net_namespace_list); struct net init_net; -EXPORT_SYMBOL_GPL(init_net); +EXPORT_SYMBOL(init_net); /* * setup_net runs the initializers for the network namespace object. From f945fa7ad9c12a3356a3de7fb2143ccc2f2c3bca Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Tue, 22 Jan 2008 22:39:26 -0800 Subject: [PATCH 06/10] [INET]: Fix truesize setting in ip_append_data As it is ip_append_data only counts page fragments to the skb that allocated it. As such it means that the first skb gets hit with a 4K charge even though it might have only used a fraction of it while all subsequent skb's that use the same page gets away with no charge at all. This bug was exposed by the UDP accounting patch. [ The wmem_alloc bumping needs to be moved with the truesize, noticed by Takahiro Yasui. -DaveM ] Signed-off-by: Herbert Xu Signed-off-by: David S. Miller --- net/ipv4/ip_output.c | 4 ++-- net/ipv6/ip6_output.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 480469b92aa7..bc9e57550e86 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1016,8 +1016,6 @@ int ip_append_data(struct sock *sk, skb_fill_page_desc(skb, i, page, 0, 0); frag = &skb_shinfo(skb)->frags[i]; - skb->truesize += PAGE_SIZE; - atomic_add(PAGE_SIZE, &sk->sk_wmem_alloc); } else { err = -EMSGSIZE; goto error; @@ -1030,6 +1028,8 @@ int ip_append_data(struct sock *sk, frag->size += copy; skb->len += copy; skb->data_len += copy; + skb->truesize += copy; + atomic_add(copy, &sk->sk_wmem_alloc); } offset += copy; length -= copy; diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6338a9c1aa14..3bef30e4a23d 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1316,8 +1316,6 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, skb_fill_page_desc(skb, i, page, 0, 0); frag = &skb_shinfo(skb)->frags[i]; - skb->truesize += PAGE_SIZE; - atomic_add(PAGE_SIZE, &sk->sk_wmem_alloc); } else { err = -EMSGSIZE; goto error; @@ -1330,6 +1328,8 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, frag->size += copy; skb->len += copy; skb->data_len += copy; + skb->truesize += copy; + atomic_add(copy, &sk->sk_wmem_alloc); } offset += copy; length -= copy; From ebc71647309539aaf9088f4e41b9f364cce8f7eb Mon Sep 17 00:00:00 2001 From: Francois Romieu Date: Tue, 4 Dec 2007 22:58:41 +0100 Subject: [PATCH 07/10] sis190: add cmos ram access code for the SiS19x/968 chipset pair More work is needed to handle correctly the PHY of the new devices when connected to a 10Mb link but this change already helps some users as is. Fix for: http://bugzilla.kernel.org/show_bug.cgi?id=9467 Signed-off-by: Francois Romieu Cc: K.M. Liu Cc: J. Gleacher Cc: Alexandre Penasso Teixeira Cc: Arliton Rocha Cc: Juan Jose Pablos Cc: Wipat Srutiprom --- drivers/net/sis190.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c index 7eab072ae792..c63f484f9072 100644 --- a/drivers/net/sis190.c +++ b/drivers/net/sis190.c @@ -1549,28 +1549,31 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev, } /** - * sis190_get_mac_addr_from_apc - Get MAC address for SiS965 model + * sis190_get_mac_addr_from_apc - Get MAC address for SiS96x model * @pdev: PCI device * @dev: network device to get address for * - * SiS965 model, use APC CMOS RAM to store MAC address. + * SiS96x model, use APC CMOS RAM to store MAC address. * APC CMOS RAM is accessed through ISA bridge. * MAC address is read into @net_dev->dev_addr. */ static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev, struct net_device *dev) { + static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 }; struct sis190_private *tp = netdev_priv(dev); struct pci_dev *isa_bridge; u8 reg, tmp8; - int i; + unsigned int i; net_probe(tp, KERN_INFO "%s: Read MAC address from APC.\n", pci_name(pdev)); - isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0965, NULL); - if (!isa_bridge) - isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0966, NULL); + for (i = 0; i < ARRAY_SIZE(ids); i++) { + isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, ids[i], NULL); + if (isa_bridge) + break; + } if (!isa_bridge) { net_probe(tp, KERN_INFO "%s: Can not find ISA bridge.\n", From 11913d30b9fb985b12835037281ae0483be59623 Mon Sep 17 00:00:00 2001 From: Francois Romieu Date: Sat, 17 Nov 2007 15:55:10 +0100 Subject: [PATCH 08/10] sis190: remove duplicate INIT_WORK It is already done in sis190_init_one. Signed-off-by: Francois Romieu Cc: K.M. Liu --- drivers/net/sis190.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c index c63f484f9072..92e0eb95ff8c 100644 --- a/drivers/net/sis190.c +++ b/drivers/net/sis190.c @@ -1041,8 +1041,6 @@ static int sis190_open(struct net_device *dev) if (rc < 0) goto err_free_rx_1; - INIT_WORK(&tp->phy_task, sis190_phy_task); - sis190_request_timer(dev); rc = request_irq(dev->irq, sis190_interrupt, IRQF_SHARED, dev->name, dev); From 7bf3f232f7c78efee8c4d14ad9af8a5a40304916 Mon Sep 17 00:00:00 2001 From: Francois Romieu Date: Sat, 17 Nov 2007 16:56:43 +0100 Subject: [PATCH 09/10] sis190: mdio operation failure is not correctly detected i ranges from 0 to 100 in the 'for' loop a few lines above. Reported by davem. Signed-off-by: Francois Romieu Cc: K.M. Liu --- drivers/net/sis190.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c index 92e0eb95ff8c..342a986214c8 100644 --- a/drivers/net/sis190.c +++ b/drivers/net/sis190.c @@ -372,7 +372,7 @@ static void __mdio_cmd(void __iomem *ioaddr, u32 ctl) msleep(1); } - if (i > 999) + if (i > 99) printk(KERN_ERR PFX "PHY command failed !\n"); } From b334349eb4c8562fd60bc8a8bd5ba6b42f22b8ac Mon Sep 17 00:00:00 2001 From: Francois Romieu Date: Sat, 17 Nov 2007 21:29:47 +0100 Subject: [PATCH 10/10] sis190: scheduling while atomic error sis190_tx_timeout -> sis190_hw_start -> sis190_soft_reset -> msleep *splat* PCI transactions are correctly flushed here. The msleep() is probably useless. Signed-off-by: Francois Romieu Cc: K.M. Liu --- drivers/net/sis190.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c index 342a986214c8..b570402f7fed 100644 --- a/drivers/net/sis190.c +++ b/drivers/net/sis190.c @@ -847,10 +847,8 @@ static void sis190_soft_reset(void __iomem *ioaddr) { SIS_W32(IntrControl, 0x8000); SIS_PCI_COMMIT(); - msleep(1); SIS_W32(IntrControl, 0x0); sis190_asic_down(ioaddr); - msleep(1); } static void sis190_hw_start(struct net_device *dev)