tcp: fix premature termination of FIN_WAIT2 time-wait sockets

There is a race condition in the time-wait sockets code that can lead
to premature termination of FIN_WAIT2 and, subsequently, to RST
generation when the FIN,ACK from the peer finally arrives:

Time     TCP header
0.000000 30755 > http [SYN] Seq=0 Win=2920 Len=0 MSS=1460 TSV=282912 TSER=0
0.000008 http > 30755 aSYN, ACK] Seq=0 Ack=1 Win=2896 Len=0 MSS=1460 TSV=...
0.136899 HEAD /1b.html?n1Lg=v1 HTTP/1.0 [Packet size limited during capture]
0.136934 HTTP/1.0 200 OK [Packet size limited during capture]
0.136945 http > 30755 [FIN, ACK] Seq=187 Ack=207 Win=2690 Len=0 TSV=270521...
0.136974 30755 > http [ACK] Seq=207 Ack=187 Win=2734 Len=0 TSV=283049 TSER=...
0.177983 30755 > http [ACK] Seq=207 Ack=188 Win=2733 Len=0 TSV=283089 TSER=...
0.238618 30755 > http [FIN, ACK] Seq=207 Ack=188 Win=2733 Len=0 TSV=283151...
0.238625 http > 30755 [RST] Seq=188 Win=0 Len=0

Say twdr->slot = 1 and we are running inet_twdr_hangman and in this
instance inet_twdr_do_twkill_work returns 1. At that point we will
mark slot 1 and schedule inet_twdr_twkill_work. We will also make
twdr->slot = 2.

Next, a connection is closed and tcp_time_wait(TCP_FIN_WAIT2, timeo)
is called which will create a new FIN_WAIT2 time-wait socket and will
place it in the last to be reached slot, i.e. twdr->slot = 1.

At this point say inet_twdr_twkill_work will run which will start
destroying the time-wait sockets in slot 1, including the just added
TCP_FIN_WAIT2 one.

To avoid this issue we increment the slot only if all entries in the
slot have been purged.

This change may delay the slots cleanup by a time-wait death row
period but only if the worker thread didn't had the time to run/purge
the current slot in the next period (6 seconds with default sysctl
settings). However, on such a busy system even without this change we
would probably see delays...

Signed-off-by: Octavian Purdila <opurdila@ixiacom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

fib_trie: resize rework

Here is rework and cleanup of the resize function.

Some bugs we had. We were using ->parent when we should use
node_parent(). Also we used ->parent which is not assigned by
inflate in inflate loop.

Also a fix to set thresholds to power 2 to fit halve
and double strategy.

max_resize is renamed to max_work which better indicates
it's function.

Reaching max_work is not an error, so warning is removed.
max_work only limits amount of work done per resize.
(limits CPU-usage, outstanding memory etc).

The clean-up makes it relatively easy to add fixed sized
root-nodes if we would like to decrease the memory pressure
on routers with large routing tables and dynamic routing.
If we'll need that...

Its been tested with 280k routes.

Work done together with Robert Olsson.

Signed-off-by: Jens Låås <jens.laas@its.uu.se>
Signed-off-by: Robert Olsson <robert.olsson@its.uu.se>
Signed-off-by: David S. Miller <davem@davemloft.net>

sit: allow ip fragmentation when using nopmtudisc to fix package loss

if tunnel parameters have frag_off set to IP_DF, pmtudisc on the ipv4 link
will be performed by deriving the mtu from the ipv4 link and setting the
DF-Flag of the encapsulating IPv4 Header. If fragmentation is needed on the
way, the IPv4 pmtu gets adjusted, the ipv6 package will be resent eventually,
using the new and lower mtu and everyone is happy.

If the frag_off parameter is unset, the mtu for the tunnel will be derived
from the tunnel device or the ipv6 pmtu, which might be higher than the ipv4
pmtu. In that case we must allow the fragmentation of the IPv4 packet because
the IPv6 mtu wouldn't 'learn' from the adjusted IPv4 pmtu, resulting in
frequent icmp_frag_needed and package loss on the IPv6 layer.

This patch allows fragmentation when tunnel was created with parameter
nopmtudisc, like in ipip/gre tunnels.

Signed-off-by: Sascha Hlusiak <contact@saschahlusiak.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

net: ip_rt_send_redirect() optimization

While doing some forwarding benchmarks, I noticed
ip_rt_send_redirect() is rather expensive, even if send_redirects is
false for the device.

Fix is to avoid two atomic ops, we dont really need to take a
reference on in_dev

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

tcp: keepalive cleanups

Introduce keepalive_probes(tp) helper, and use it, like
keepalive_time_when(tp) and keepalive_intvl_when(tp)

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

cnic: Put uio init in separate function.

This will allow the 10G iSCSI code to reuse the function.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

cnic: Put rx/tx ring allocation in separate function.

This will allow the 10G iSCSI code to reuse the function.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

ipv4: af_inet.c cleanups

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: use proc_create_data()

It looks like after rename device proc entry is unusable,
because of no ->read_proc or ->proc_fops.

And create_proc_entry() is deprecated.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: increase version

Increase module version, and cleanup module info.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: cleanup checkpatch warnings

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: use common idle routine

Simpler to have one place that spins and accounts for delays,
this will also make the last packet be detected faster for more
repeatable timing.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: spin using hrtimer

This changes how the pktgen thread spins/waits between
packets if delay is configured. It uses a high res timer to
wait for time to arrive.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: convert to use ktime_t

The kernel ktime_t is a nice generic infrastructure for mananging
high resolution times, as is done in pktgen.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: avoid calling gettimeofday

If not using delay then no need to update next_tx after
each packet sent. This allows pktgen to send faster especially
on systems with slower clock sources.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: reorganize transmit loop

Handle standard (and non-standard) return values in a switch.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: use netdev_alloc_skb

netdev_alloc_skb is NUMA node aware.
Also, don't exhaust atomic emergency pool. Don't want pktgen
to cause OOM behaviour.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: cleanup clone count test

The if statement to test for "should a new packet be used"
can be simplified.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: xmit logic reorganization

Do some reorganization of transmit logic path:
   * move transmit queue full idle to separate routine
   * add a cpu_relax()
   * eliminate some of the uneeded goto's
   * if queue is still stopped, go back to main thread loop.
   * don't give up transmitting if quantum is exhausted (be greedy)

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: stop_device cleanup

All the callers were freeing skb after stopping device.
Remove unneeded forward decl.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: mark read-only/mostly variables

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: change inlining

Don't force inlining where not needed. Gcc does better job
of deciding to inline local functions.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

pktgen: minor cleanup

A couple of minor functions can be written more compactly.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

qlge: Move TX completions from workqueue to NAPI.

TX completions were running in a workqueue queued by the ISR.  This
patch moves the processing of TX completions to an existing RSS NAPI
context.
Now each irq vector runs NAPI for one RSS ring and one or more TX
completion rings.

Signed-off-by: Ron Mercer <ron.mercer@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

qlge: Allow running MSIx with fewer vectors.

Currently we downshift to MSI/Legacy if we don't get enough vectors for
cpu_count RSS rings plus cpu_count TX completion rings.  This patch
allows running MSIX with the vector count that the platform provides.

Signed-off-by: Ron Mercer <ron.mercer@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

qlge: Get rid of 'default' rx_ring type.

Currently we have three types of RX rings.

1) Default ring - services rx_ring for broadcast/multicast, handles
firmware events, and errors.

2) TX completion ring - handles only outbound completions.

3) RSS ring - handles only inbound completions.

This patch gets rid of the default ring type and moves it's functionality
into the first RSS ring.  This makes better use of MSIX vectors since
they are a limited resource on some platforms.

Signed-off-by: Ron Mercer <ron.mercer@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-next-2.6

bonding: Have bond_check_dev_link examine netif_running

bonding: Have bond_check_dev_link examine netif_running

Some network devices do not call netif_carrier_off when they
are set administratively down.  Have the bonding link check function
also inspect the netif_running state.  Ignore netif_running if the
bond_check_dev_link function is called with "reporting" set, as in that
case it's inspecting the capabilities of the non-netif_carrier device
driver.

Signed-off-by: Petri Gynther <pgynther@google.com>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

bonding: Fix useless test: int > INT_MAX

max_bonds is of type int and cannot be greater than INT_MAX.

Signed-off-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

bonding: use compare_ether_addr

Bonding can use compare_ether_addr() in bond_release.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

bonding: propogate vlan_features to bonding master

Propogate the vlan_features of the slave devices to the bonding
master device, using the same logic as for regular features.

Tested by Or Gerlitz <ogerlitz@voltaire.com>, who also removed
the debug logic from the original test patch.

Signed-off-by: Or Gerlitz <ogerlitz@voltaire.com>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

libertas: add NULL check on return value of get_zeroed_page

Most of the places in debugfs.c are missing a NULL check on the return value of
get_zeroed_page API call. Added required NULL check at appropriate places.

Signed-off-by: Kiran Divekar <kirandivekar@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: use cfg80211_wext_handler

Now that cfg80211 functions are added and wext converted to use wext-compat
functions, remove wext structures and disabled code.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: disable IWEVPMKIDCAND wireless event

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: convert mic failure wireless event to cfg80211

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: remove unneeded SIOCSIWCOMMIT

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: rename wireless stats worker to device poller

Stats worker no longer poll stats from device anymore. It's still
needed to poll device control channel for connect/disconnect events,
so rename stats worker as device poller.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: add cfg80211 dump_station

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: add cfg80211 get_station

Add cfg80211 get_station and convert SIOCGIWRATE and get_wireless_stats
to cfg80211.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: add cfg80211 key handling

Add cfg80211 add_key/del_key/set_default_key and convert wext to use theim.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: add cfg80211 set_channel

Add cfg80211 set_channel and convert wext to use it.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: add cfg80211 connect, disconnect, join_ibss and leave_ibss

Add cfg80211 connect functions for station and ad-hoc modes and
convert wext to use theim.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: enable infrastructure before setting random essid

Random essid must be set to turn on radio when not connected. If device is
in ad-hoc mode, this results 'media connect' indications with the random
essid which should be ignored.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: set ieee80211_ptr->iftype in rndis_change_virtual_intf

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: use is_zero_ether_addr() and is_broadcast_ether_addr()

Use is_zero_ether_addr() and is_broadcast_ether_addr() instead of
memcmp against ffff_bssid/zero_bssid.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: move link up/down work to separate functions

Move link up/down work to separate functions and use local array
for allocating memory for info structure instead of kzmalloc.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: increase scan timer delay

Increase scan delay from 1 sec to 6 sec. Spec says that scan by
OID_802_11_BSSID_LIST_SCAN completes in 6 seconds.
Before rfkill patch too short delay was not problem as device was
always active (radio on) and performing background scanning.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: resize bssid list if too small

Buffer used for bssid list might be too small. Change rndis_query_oid()
to return required buffer length to caller and make rndis_check_bssid_list()
resize buffer when needed.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: get bssid scan list before new scan

OID_802_11_BSSID_LIST_SCAN clears device's bssid list, so retrieve
current bssid list from device before issuing new scan.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: ignore OID_802_11_ADD_KEY triggered media connect indications

Setting WPA keys with OID_802_11_ADD_KEY sometimes trigger
instant media connect indication. These indications are extranous and
should be ignored, as otherwise driver would send reassociation event to
userspace which in this case is not needed.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: Implement antenna diversity support for LP-PHY

The A/G-PHY changes are fallout fixes from the enum change,
which in turn allows the LP-PHY code to be much simpler.
The antenna_to_phyctl change is a fix for a potential
existing bug that this patch may otherwise trigger.

Signed-off-by: Gábor Stefanik <netrolller.3d@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: Enable LP-PHY support by default and remove Kconfig warning

The most common LP-PHY device, BCM4312, is now fully functional.
So, no need to say "probably won't work for you" anymore.
It's also not "for debuggers and developers only", as it is
perfectly usable for end-users now (at least for BCM4312).

Signed-off-by: Gábor Stefanik <netrolller.3d@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: don't use PCI ID to find the chip revision

AR5K_SREV is available even if the chip has been put to sleep.  Relying
on the chip register allows binding non-standard PCI IDs by

echo VENDOR_ID PRODUCT_ID >/sys/bus/pci/drivers/ath5k/new_id

without having to specify the driver data as well.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Acked-by: Bob Copeland <me@bobcopeland.com>
Acked-by: Nick Kossifidis <mickflemm@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: fix uninitialized value use in ath5k_eeprom_read_turbo_modes()

The `val' variable in ath5k_eeprom_read_turbo_modes() is used
uninitialized.  gcc 4.4.1 with -fno-inline-functions-called-once reports
it:

eeprom.c: In function 'ath5k_eeprom_read_turbo_modes':
eeprom.c:441: warning: 'val' may be used uninitialized in this function

Comparing the code to the Atheros HAL, it's clear that the split between
ath5k_eeprom_read_modes() and ath5k_eeprom_read_turbo_modes() was
incorrect.

The Atheros HAL reads both turbo and non-turbo data from EEPROM in one
function.  Some turbo mode parameters are derived from the same EEPROM
values as non-turbo parameters, just from different bits.

Merge ath5k_eeprom_read_turbo_modes() into ath5k_eeprom_read_modes() to
fix the warning.  The actual values and offsets have been cross-checked
against Atheros HAL.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Acked-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: clarify srev comparison for CCMP check

As Pavel Roskin noted, the check for mac version as copied from
legacy_hal made no sense.  This replaces it with the equivalent
and makes up a suitable #define for the mac version legacy_hal
checked.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: LP-PHY: Revert to the original PHY register write routine

After some discussion on IRC about the PHY register write change,
I am not sure anymore if this is the right thing to do.

Signed-off-by: Gábor Stefanik <netrolller.3d@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

iwlwifi: fix ICT irq table endianness

The ICT IRQ table is a set of __le32 values, not u32 values,
so when reading it we need to take into account that it has
to be converted to CPU endianness. This was causing a lot of
trouble on my powerpc box where various things would simply
not work for no apparent reason with 5xxx cards, but worked
with 4965 -- which doesn't use the ICT table.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Acked-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rt2x00: Cleanup rt2x00mac_bss_info_changed()

Since patch "rt2x00: bss_info_changed() callback is allowed to sleep" the
variable delayed wasn't used anymore. This means it can be removed
along with the call to schedule_work which depended on that variable.

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ssb: Implement PMU LDO control and use it in b43

Implement the "PMU LDO set voltage" and "PMU LDO PA ref enable"
functions, and use them during LP-PHY baseband init in b43.

Signed-off-by: Gábor Stefanik <netrolller.3d@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: Fix and update LP-PHY code

-Fix a few nasty typos (b43_phy_* operations instead of b43_radio_*)
 in the channel tune routines.
-Fix some typos & spec errors found by MMIO tracing.
-Optimize b43_phy_write & b43_phy_mask/set/maskset to use
 only the minimal number of MMIO accesses. (Write is possible
 using a single 32-bit MMIO write, while set/mask/maskset can
 be done in 3 16-bit MMIOs).
-Set the default channel back to 1, as the bug forcing us to use
 channel 7 is now fixed.

With this, the device comes up, scans, associates, transmits,
receives, monitors and injects on all channels - in other words,
it's fully functional. Sensitivity and TX power are still sub-optimal,
due to the lack of calibration (that's next on my list).

Signed-off-by: Gábor Stefanik <netrolller.3d@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: LP-PHY: Fix and simplify Qdiv roundup

The Qdiv roundup routine is essentially a fixed-point
division algorithm, using only integer math.
However, the version in the specs had a major error
that has been recently fixed (a missing quotient++).

Replace Qdiv roundup with a rewritten, simplified version.

Signed-off-by: Gábor Stefanik <netrolller.3d@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtl8187: Implement rfkill support

This change implements rfkill support for RTL8187B and RTL8187L devices,
using new cfg80211 rfkill API.

Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Tested-by: Hin-Tak Leung <htl10@users.sourceforge.net>
Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtl8187: fix circular locking (rtl8187_stop/rtl8187_work)

Larry Finger reports following lockdep warning:

[ INFO: possible circular locking dependency detected ]
2.6.31-rc6-wl #201
-------------------------------------------------------
rfkill/30578 is trying to acquire lock:
 (&(&priv->work)->work#2){+.+...}, at: [<ffffffff81051215>]
__cancel_work_timer+0xd9/0x222

but task is already holding lock:
 (&priv->conf_mutex#2){+.+.+.}, at: [<ffffffffa064a024>]
rtl8187_stop+0x31/0x364 [rtl8187]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&priv->conf_mutex#2){+.+.+.}:
       [<ffffffff81065957>] __lock_acquire+0x12d0/0x1614
       [<ffffffff81065d54>] lock_acquire+0xb9/0xdd
       [<ffffffff8127c32f>] mutex_lock_nested+0x56/0x2a8
       [<ffffffffa064a392>] rtl8187_work+0x3b/0xf2 [rtl8187]
       [<ffffffff81050758>] worker_thread+0x1fa/0x30a
       [<ffffffff81054ca5>] kthread+0x8f/0x97
       [<ffffffff8100cb7a>] child_rip+0xa/0x20
       [<ffffffffffffffff>] 0xffffffffffffffff

-> #0 (&(&priv->work)->work#2){+.+...}:
       [<ffffffff8106568c>] __lock_acquire+0x1005/0x1614
       [<ffffffff81065d54>] lock_acquire+0xb9/0xdd
       [<ffffffff8105124e>] __cancel_work_timer+0x112/0x222
       [<ffffffff8105136b>] cancel_delayed_work_sync+0xd/0xf
       [<ffffffffa064a33f>] rtl8187_stop+0x34c/0x364 [rtl8187]
       [<ffffffffa0242866>] ieee80211_stop_device+0x29/0x61 [mac80211]
       [<ffffffffa0239194>] ieee80211_stop+0x476/0x530 [mac80211]
       [<ffffffff8120ce15>] dev_close+0x8a/0xac
       [<ffffffffa01d9fa7>] cfg80211_rfkill_set_block+0x4a/0x7a [cfg80211]
       [<ffffffffa01bf4f0>] rfkill_set_block+0x84/0xd9 [rfkill]
       [<ffffffffa01bfc31>] rfkill_fop_write+0xda/0x124 [rfkill]
       [<ffffffff810cf286>] vfs_write+0xae/0x14a
       [<ffffffff810cf3e6>] sys_write+0x47/0x6e
       [<ffffffff8100ba6b>] system_call_fastpath+0x16/0x1b
       [<ffffffffffffffff>] 0xffffffffffffffff

The problem here is that rtl8187_stop, while helding priv->conf_mutex,
runs cancel_delayed_work_sync on an workqueue that runs rtl8187_work,
which also takes priv->conf_mutex lock. Move cancel_delayed_work_sync
out of rtl8187_stop priv->conf_mutex locking region.

Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add Bluetooth Coexistence 3-wire support

This patch adds 3-wire bluetooth coex support for AR9285.
This support can be enabled through btcoex_enable modparam.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add infrastructure for generic hw timers

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Remove hw capability bit meant for btcoex

We don't need a hw cap bit for btcoex anymore as btcoex scheme type
is enough to do this.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Determine btcoex scheme type based on chip version

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move btcoex related data to a separate struct

Also define macros for wlanactive and btactive (5 & 6) gpios.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Configure btcoex register during every reset

Make sure btcoex register configured with appropriate values
after it is initialized with the default values from initvals.h
during reset.

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Move btcoex stuff from hw.[ch] to new btcoex.[ch]

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Split ath9k_hw_btcoex_enable() into two logical pieces

This function currently does initialization + enable the
btcoex support. Split it into two logical functions which
does the above operations separately. Btcoex initialization
is done during attach time and enabling this feature is done
in start(). Also, add code to disable btcoex support in stop().

Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rndis_wlan: set cipher suites for cfg80211

rndis_wlan does not set cipher suites list for cfg80211 which causes
wext-compat-range to report rndis_wlan not supporting WPA. Patch adds
cipher suites list and fixes NetworkManager not being able to connect to
WPA encrypted APs.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Wrap DMA dump function with PS wakeup/restore

When dumping register contents, HW has to be awake.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Update INITVALs for AR9285

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Handle PA cal usage properly

PA Calibration is not needed for high power solutions.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix bugs in programming registers during PA CAL

* First PA driver (PDPADRV1) was not powered down properly.
* Compensation capacitor for dynamic PA was programmed incorrectly.

Also, remove a stray REG_READ.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Reduce the frequency of PA offset calibration

PA calibration need not be done if the offset is not varying.
The current logic does PA calibration even if the offset is the
same.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

libipw: initiate cfg80211 API conversion

Initiate the conversion of libipw to the new cfg80211 configuration API.

For now, leave CONFIG_IPW2200_PROMISCUOUS stuff alone.  Eventually
migrate it to cfg80211 when the add/del/change_virtual_intf methods
are implemented.

Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix read buffer overflow

Prevent a read of powInfo[-1] in the first iteration.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: Check pending scan request after having processed mgd work

When the queued management work items are processed in
ieee80211_sta_work() an item could be removed. This could change the
anybusy from true to false, so we better check whether we can start a
new scan only after having processed the pending work first.

Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: fix scan cancel on ifdown

When an interface is taken down while a scan is
pending -- i.e. a scan request was accepted but
not yet acted upon due to other work being in
progress -- we currently do not properly cancel
that scan and end up getting stuck. Fix this by
doing better checks when an interface is taken
down.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: LP-PHY: Fix a few typos in the RC calibration code

The RC calibration code has some typos - fix them.
Also, make the default channel 7, as channel 1 is still
broken (only channels 7 and 8, and occasionally 9 work).

Signed-off-by: Gábor Stefanik <netrolller.3d@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

PRISM54: fix compilation warning

CC [M]  drivers/net/wireless/prism54/islpci_eth.o
drivers/net/wireless/prism54/islpci_eth.c: In function ‘islpci_eth_cleanup_transmit’:
drivers/net/wireless/prism54/islpci_eth.c:53: warning: cast from pointer to integer of different size
drivers/net/wireless/prism54/islpci_eth.c: In function ‘islpci_eth_receive’:
drivers/net/wireless/prism54/islpci_eth.c:453: warning: cast from pointer to integer of different size

Signed-off-by: Jaswinder Singh Rajput <jaswinderrajput@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: add hardware CCMP encyption support

Recent ath5k hardware is capable of doing CCMP acceleration.
Enable it for the cards that support it.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: use the skb->cb directly for RX status

Save a memcpy by just storing updates directly in the skb
control block.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: add led pin configuration for compaq c700 laptop

With this patch, a compaq c700 can turn on the wifi led.
The array of compatible devices now includes the hardware
present in this computer, as well as the led pin and
polarity.

Signed-off-by: Marcos Chaparro <nitrousnrg@gmail.com>
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: clean up filter flags setting

The maze of if() statements in configure_filter is confusing.
Reorganizing it as a switch statement makes it more apparent what
is going on and reveals several suspicious settings.  This has no
functional changes, though it does remove some redundant flags
that are set earlier.

Also now that we can sleep, protect sc->filter_flags with the
sc lock.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: Fix output of minstrels rc_stats

An integer overflow in the minstrel debug code prevented the
throughput to be displayed correctly. This patch fixes that,
by permutating operations like proposed by Pavel Roskin.

Signed-off-by: Arnd Hannemann <hannemann@nets.rwth-aachen.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwl8k: separate driver and device info reporting during probe

Only print the driver version once, and condense all per-PHY
information to a single line.

Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwl8k: missing endian conversion when printing firmware command result

Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwl8k: fix pci dma mapping leak in mwl8k_post_cmd() error path

Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mwl8k: fix inverted error test in mwl8k_bss_info_changed()

Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: fix RX skb leaks

In mac80211's RX path some of the warnings that
warn about drivers passing invalid status values
leak the skb, fix that by refactoring the code.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

nl80211: jump to out_err upon unsupported iftype

Jump to out_err when the iftype is not supported.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ar9170: remove unnecessary call to ar9170_set_beacon_timers

Signed-off-by: Joerg Albert <jal2@gmx.de>
Acked-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ar9170: cleanup of bss_info_changed and beacon config

Add beacon control by BSS_CHANGED_BEACON_ENABLED and
bss_conf->enable_beacon from mac80211.

Signed-off-by: Joerg Albert <jal2@gmx.de>
Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

MAINTAINERS: Update ipw2x00 and iwlwifi entries

Update MAINTAINERS file to reflect current maintenance status of ipw2x00
drivers. We remove James's name as he is not involved with this project
anymore. We also update the Status to "Odd Fixes". This has been true for a
while now, we have to make it official. There is also a new email address
with which all relevant people can be reached. The same email address
should be used for iwlwifi.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Cc: James Ketrenos <jketreno@linux.intel.com>
Acked-by: James Ketrenos <jketreno@linux.intel.com>
Acked-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ipw2x00: update contact information

Intel Linux wireless folks can be reached via this address.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Acked-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

iwlwifi: fix unloading driver while scanning

If NetworkManager is busy scanning when user
tries to unload the module, the driver can not be unloaded
because HW still scanning.

Make sure driver sends abort scan host command to uCode if it
is in the middle of scanning during driver unload.

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

iwlwifi: fix remove key error

Fix following error by sending synchronous command and waiting for the command
to complete.

mac80211-phy0: failed to remove key (0, ff:ff:ff:ff:ff:ff) from hardware (-16).

-16 is EBUSY error. The asynchronous command tests for STATUS_EXIT_PENDING
while interface is getting down and it returns -EBUSY error if set.
Changing the host command from asynchronous call to synchronous call
enables command to be run while interface is going down.

Signed-off-by: Abhijeet Kolekar <abhijeet.kolekar@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>