headers
John W. Linville | 1 Dec 01:23
Favicon

Re: pull request: wireless-2.6 2009-11-30 (security fixes too)

On Mon, Nov 30, 2009 at 02:08:21PM -0800, Linus Torvalds wrote:
> 
> 
> On Mon, 30 Nov 2009, John W. Linville wrote:
> > 
> > If a) you have already taken Dave's latest pull request; and, b) you
> > don't want to wait for his next one to get the mac80211 security fixes
> > from Johannes, then you can at your discretion pull from here:
> > 
> >   git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6.git security
> 
> Hmm. If I pull the 'security' branch, I get
> 
>  drivers/net/wireless/iwlwifi/iwl-tx.c |   10 +++++++++-
>  include/net/mac80211.h                |    6 ++++++
>  net/mac80211/agg-rx.c                 |    4 ----
>  net/mac80211/agg-tx.c                 |   17 ++++++++---------
>  net/mac80211/ht.c                     |    8 +++-----
>  net/mac80211/ieee80211_i.h            |    2 ++
>  6 files changed, 28 insertions(+), 19 deletions(-)
> 
> which does not match what you then descibe in the rest of the email 
> (changelog and diffstat).
> 
> What you describe seems to be the master branch. 
> 
> So I'm not going to pull either, and will wait for confirmation of exactly 
> what you wanted me to pull.

Ha!  I confused you... :-)
(Continue reading)

Permalink | Reply | 0 comments |
headers
Colin McCabe | 1 Dec 01:53
Picon
Gravatar

Re: [PATCH] libertas: remove internal buffers from GSPI driver

On Tue, Oct 27, 2009 at 3:51 PM, Andrey Yurovsky <andrey@...> wrote:
> This patch removes the internal command and data buffers that the GSPI driver
> maintained and instead relies on the Libertas core to synchronize access
> to the command and data ports as with the other interface drivers.

Hi all,

I'm glad to see you're improving stuff. Good catch with some of the
recent bugfixes.

However... it seems like you are headed for a "scheduling while
atomic" with this patch.

The original reason why if_spi_host_to_card copied the data into a
buffer, rather than simply calling spu_write and being done with it,
was that spu_write needed to sleep. spu_write invokes spi_sync, which
has a big comment that says "This call may only be used from a context
that may sleep."

Unfortunately, if_spi_host_to_card is called from contexts where we
hold a spinlock. For example, lbs_main does

spin_lock_irq(&priv->driver_lock);
if (!priv->dnld_sent && priv->tx_pending_len > 0) {
    int ret = priv->hw_host_to_card(priv, MVMS_DAT,

priv->tx_pending_buf,

priv->tx_pending_len);
...etc...
(Continue reading)

Permalink | Reply | 3 comments |
headers
Zhu Yi | 1 Dec 03:18
Picon
Favicon

[PATCH v4 1/2] wireless: add ieee80211_amsdu_to_8023s

Move the A-MSDU handling code from mac80211 to cfg80211 so that more
drivers can use it. The new created function ieee80211_amsdu_to_8023s
converts an A-MSDU frame to a list of 802.3 frames.

Cc: Johannes Berg <johannes@...>
Signed-off-by: Zhu Yi <yi.zhu@...>
---
V2: use __ version of sk_buff_head operations and mark addr const
V3: add parameter extra_headroom to ieee80211_amsdu_to_8023s
    consume the input skb in ieee80211_amsdu_to_8023s
V4: make ieee80211_amsdu_to_8023s void

 include/net/cfg80211.h |   22 +++++++++-
 net/mac80211/rx.c      |  106 +++++++++---------------------------------------
 net/wireless/util.c    |   99 +++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 137 insertions(+), 90 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 0884b9a..542a477 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1578,7 +1578,7 @@ unsigned int ieee80211_hdrlen(__le16 fc);
  * @addr: the device MAC address
  * @iftype: the virtual interface type
  */
-int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
+int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
 			   enum nl80211_iftype iftype);

 /**
(Continue reading)

Permalink | Reply | 2 comments |
headers
Zhu Yi | 1 Dec 03:18
Picon
Favicon

[PATCH v4 2/2] iwmc3200wifi: rx aggregation support

When the device receives an A-MSDU frame (indicated by flag
IWM_RX_TICKET_AMSDU_MSK), use ieee80211_amsdu_to_8023s to convert
it to a list of 802.3 frames and handled them to upper layer.

Cc: Johannes Berg <johannes@...>
Cc: Samuel Ortiz <samuel@...>
Signed-off-by: Zhu Yi <yi.zhu@...>
---
V2: use __ version of sk_buff_head operations
V3: pass 0 as parameter extra_headroom to ieee80211_amsdu_to_8023s
V4: set skb->protocol for every packet in the return list

 drivers/net/wireless/iwmc3200wifi/rx.c |   46 ++++++++++++++++++++++++++++---
 1 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 72c27a3..6bd253a 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -1534,6 +1534,33 @@ static void classify8023(struct sk_buff *skb)
 	}
 }

+static void iwm_rx_process_amsdu(struct iwm_priv *iwm, struct sk_buff *skb)
+{
+	struct wireless_dev *wdev = iwm_to_wdev(iwm);
+	struct net_device *ndev = iwm_to_ndev(iwm);
+	struct sk_buff_head list;
+	struct sk_buff *frame;
+
(Continue reading)

Permalink | Reply | 1 comment |
headers
Zhu Yi | 1 Dec 04:48
Picon
Favicon

[PATCH] iwmc3200wifi: fix NULL pointer dereference in pmkid update

When handling IWM_CMD_PMKID_FLUSH command, the bssid and
pmkid in pmksa are all NULL. Check it before memcpy.

Cc: Samuel Ortiz <sameo@...>
Signed-off-by: Zhu Yi <yi.zhu@...>
---
 drivers/net/wireless/iwmc3200wifi/commands.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index bd06307..89b33fa 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -970,8 +970,10 @@ int iwm_send_pmkid_update(struct iwm_priv *iwm,
 	memset(&update, 0, sizeof(struct iwm_umac_pmkid_update));

 	update.command = cpu_to_le32(command);
-	memcpy(&update.bssid, pmksa->bssid, ETH_ALEN);
-	memcpy(&update.pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
+	if (pmksa->bssid)
+		memcpy(&update.bssid, pmksa->bssid, ETH_ALEN);
+	if (pmksa->pmkid)
+		memcpy(&update.pmkid, pmksa->pmkid, WLAN_PMKID_LEN);

 	ret = iwm_send_wifi_if_cmd(iwm, &update,
 				   sizeof(struct iwm_umac_pmkid_update), 0);
--

-- 
1.6.0.4

--
(Continue reading)

Permalink | Reply | 1 comment |
headers
Kalle Valo | 1 Dec 08:01
Picon
Picon
Favicon

Re: [PATCH 1/2] cfg80211: add SM PS hooks

Johannes Berg <johannes@...> writes:

> Add spatial multiplexing power save configuration
> hooks to cfg80211/nl80211.

Is it really necessary to export this to user space, at least via
nl80211? If we add this to nl80211, we have to support this almost
forever.

Also how are planning to use this? What components will use the
interface and how?

My concern here is that we will end up having, yet again, complicated
user space interface for power save. The ideal situation would be that
kernel would configure all this automatically and we would have a
simple interface just to disable power save in cases where it doesn't
work (broken APs etc).

--

-- 
Kalle Valo
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@...
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Permalink | Reply | 2 comments |
headers
Luis R. Rodriguez | 1 Dec 08:24
Favicon

Re: [PATCH 08/13] Add compatibility macro for register_sysctl_table()

On Mon, Nov 23, 2009 at 6:25 PM, Arnaud Lacombe <lacombar@...> wrote:
> The API was changed on commit 0b4d4147. register_sysctl_table() lost its
> last
> argument.
>
> Signed-off-by: Arnaud Lacombe <lacombar@...>

Thanks, applied up to here fine the rest fail because your mailer line
wrapped after 70 something chars. Can you try resenting 9-on using git
send-email?

  Luis
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@...
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Permalink | Reply | 0 comments |
headers
David Pufer | 1 Dec 08:44
Picon
Favicon

Re: [RFC] API for setting ACK timeout

Lukáš Turek <8an@...> writes:

> 
> Hi,
> 
> we discussed this in ath5k-devel, but it involves a mac80211 extension, so I'm 
> bringing it here.
> 
> Although Wi-Fi was designed for outdoor use, it's also sometimes used for long 
> distance outdoor links. However, long distance links require longer ACK 
> timeout, as packets travel "only" at the speed of light and every kilometer 
> adds almost 7 microseconds to the roundtrip. So for a driver to be usable 
> outdoors it has to permit setting ACK timeout from userspace.
> 
> Currently this is supported only by out-of-tree Madwifi driver for Atheros 
> hardware. However, modification of ACK timeout is not an Atheros specific 
> feature. According to a quick skim over the source code in 
> drivers/net/wireless, besides ath5k and ath9k it's at least supported by 
> rt2x00, rtl818x and maybe zd1211.
> 
> I think the current hardware support is sufficient for a generic mac80211 
> solution. The exact interpretation of ACK timeout value is hardware specific, 
> so I propose a higher level API operating with link distance.
> 
> It consists of a new nl80211 parameter:
> [NL80211_ATTR_WIPHY_DISTANCE] = { .type = NLA_U32 },
> 
> The value of the parameter would be a link distance in meters, so after the 
> support is added to iw one could set the ACK timeout on a 3km link using:
> # iw phy0 set distance 3000
(Continue reading)

Permalink | Reply | 0 comments |
headers
Luis R. Rodriguez | 1 Dec 08:54
Picon
Gravatar

Re: 2.6.32-rc5-git1 -- BUG kmalloc-8192: Poison overwritten (ath9k implicated)

On Mon, Nov 23, 2009 at 1:47 PM, Luis R. Rodriguez <mcgrof@...> wrote:
> On Thu, Nov 19, 2009 at 3:19 PM, Luis R. Rodriguez <mcgrof@...> wrote:
>> On Mon, Nov 16, 2009 at 5:08 PM, Luis R. Rodriguez <mcgrof@...> wrote:
>>> On Mon, Nov 16, 2009 at 4:41 PM, Miles Lane <miles.lane@...> wrote:
>>>> On Mon, Nov 16, 2009 at 6:15 PM, Luis R. Rodriguez <mcgrof <at> gmail.com> wrote:
>>>>> On Tue, Oct 20, 2009 at 1:45 PM, Miles Lane
<miles.lane@...> wrote:
>>>>>> Let me know if you want my .config file.  I think this was triggered by
>>>>>> suspending my laptop.
>>>>>>
>>>>>> BUG kmalloc-8192: Poison overwritten
>>>>>
>>>>> Thanks for your report Miles.
>>>>>
>>>>> Are you using Linus' tree? Felix wrote some patches that got rid of
>>>>> the rate control private area which we kmalloc/kfree and at least one
>>>>> user reported that these patches fixed a memory leak. I'm curious if
>>>>> the same patches would resolve this issue.
>>>>>
>>>>> Only thing is these patches apply against wireless-testing and not
>>>>> 2.6.32. To test them you'd have to pull wireless-testing master to
>>>>> your tree and then apply the patches both before and after.
>>>>>
>>>>> Would you be up to try that?
>>>>
>>>> Yes, definitely.  Thanks.  I will try to accomplish this and let you
>>>> know if I get stuck.
>>>
>>> OK, not sure if a merge of wireless-testing will be clean so you may
>>> want to just clone fresh.. Anyway after you get wireless-testing bits
(Continue reading)

Permalink | Reply | 1 comment |
headers
Dan Williams | 1 Dec 09:19
Picon
Favicon

Re: [PATCH] libertas: remove internal buffers from GSPI driver

On Mon, 2009-11-30 at 16:53 -0800, Colin McCabe wrote:
> On Tue, Oct 27, 2009 at 3:51 PM, Andrey Yurovsky <andrey@...> wrote:
> > This patch removes the internal command and data buffers that the GSPI driver
> > maintained and instead relies on the Libertas core to synchronize access
> > to the command and data ports as with the other interface drivers.
> 
> Hi all,
> 
> I'm glad to see you're improving stuff. Good catch with some of the
> recent bugfixes.
> 
> However... it seems like you are headed for a "scheduling while
> atomic" with this patch.
> 
> The original reason why if_spi_host_to_card copied the data into a
> buffer, rather than simply calling spu_write and being done with it,
> was that spu_write needed to sleep. spu_write invokes spi_sync, which
> has a big comment that says "This call may only be used from a context
> that may sleep."
> 
> Unfortunately, if_spi_host_to_card is called from contexts where we
> hold a spinlock. For example, lbs_main does
> 
> spin_lock_irq(&priv->driver_lock);
> if (!priv->dnld_sent && priv->tx_pending_len > 0) {
>     int ret = priv->hw_host_to_card(priv, MVMS_DAT,
> 
> priv->tx_pending_buf,
> 
> priv->tx_pending_len);
(Continue reading)

Permalink | Reply | 0 comments |

Gmane