kernel.git/drivers/net/e1000, branch linux-2.6.30.y

e1000: add missing length check to e1000 receive routine

2009-06-02T08:29:58Z

Patch to fix bad length checking in e1000. E1000 by default does two things: 1) Spans rx descriptors for packets that don't fit into 1 skb on recieve 2) Strips the crc from a frame by subtracting 4 bytes from the length prior to doing an skb_put Since the e1000 driver isn't written to support receiving packets that span multiple rx buffers, it checks the End of Packet bit of every frame, and discards it if its not set. This places us in a situation where, if we have a spanning packet, the first part is discarded, but the second part is not (since it is the end of packet, and it passes the EOP bit test). If the second part of the frame is small (4 bytes or less), we subtract 4 from it to remove its crc, underflow the length, and wind up in skb_over_panic, when we try to skb_put a huge number of bytes into the skb. This amounts to a remote DOS attack through careful selection of frame size in relation to interface MTU. The fix for this is already in the e1000e driver, as well as the e1000 sourceforge driver, but no one ever pushed it to e1000. This is lifted straight from e1000e, and prevents small frames from causing the underflow described above Signed-off-by: Neil Horman Tested-by: Andy Gospodarek Signed-off-by: David S. Miller

e1000: fix virtualization bug

2009-05-05T04:28:13Z

a recent fix to e1000 (commit 15b2bee2) caused KVM/QEMU/VMware based virtualized e1000 interfaces to begin failing when resetting. This is because the driver in a virtual environment doesn't get to run instructions *AT ALL* when an interrupt is asserted. The interrupt code runs immediately and this recent bug fix allows an interrupt to be possible when the interrupt handler will reject it (due to the new code), when being called from any path in the driver that holds the E1000_RESETTING flag. the driver should use the __E1000_DOWN flag instead of the __E1000_RESETTING flag to prevent interrupt execution while reconfiguring the hardware. Signed-off-by: Jesse Brandeburg Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller

e1000: fix transmit routine exit bug

2009-04-17T08:09:59Z

If the e1000 transmit cleanup inner loop exited early, then cleaned might not be true. This could cause tx hangs or other badness. Use count to track the total number of descriptors cleaned instead of basing a tx queue restart off of a temporary working state variable. This code now makes the flow the same for e1000/e1000e/igb/ixgbe Signed-off-by: Jesse Brandeburg Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller

NET/e1000: Fix powering off during shutdown

2009-04-16T09:15:22Z

Prevent e1000 from putting the adapter into D3 during shutdown except when we're going to power off the system, since doing that may generally cause problems with kexec to happen (such problems were observed for igb and forcedeth). For this purpose seperate e1000_shutdown() from e1000_suspend() and use the appropriate PCI PM callbacks in both of them. Signed-off-by: "Rafael J. Wysocki" Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller

e1000/e1000: fix compile warning

2009-04-14T23:38:49Z

e1000/e1000e compile report a possible unused variable, fix that for now. Shortly after this a small refactor and bug fix will follow in the same code. Signed-off-by: Jesse Brandeburg Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07T15:31:11Z

Replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32) Signed-off-by: Yang Hongyang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

dma-mapping: replace all DMA_64BIT_MASK macro with DMA_BIT_MASK(64)

2009-04-07T15:31:10Z

Replace all DMA_64BIT_MASK macro with DMA_BIT_MASK(64) Signed-off-by: Yang Hongyang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

e1000: fix loss of multicast packets

2009-04-04T23:36:53Z

e1000 (and e1000e, igb, ixgbe, ixgb) all do a series of operations each time a multicast address is added. The flow goes something like 1) stack adds one multicast address 2) stack passes whole current list of unicast and multicast addresses to driver 3) driver clears entire list in hardware 4) driver programs each multicast address using iomem in a loop This was causing multicast packets to be lost during the reprogramming process. reference with test program: http://kerneltrap.org/mailarchive/linux-netdev/2009/3/14/5160514/thread Thanks to Dave Boutcher for his report and test program. This driver fix prepares an array all at once in memory and programs it in one shot to the hardware, not requiring an "erase" cycle. Signed-off-by: Jesse Brandeburg Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller

e1000: fix close race with interrupt

2009-03-26T08:00:55Z

this is in regards to http://bugzilla.kernel.org/show_bug.cgi?id=12876 where it appears that e1000 can leave its interrupt enabled after exiting the driver. Fix the bug by making the interrupt enable paths more aware of the driver exiting. Thanks to Alan Cox for the poke and initial investigation. CC: Alan Cox Signed-off-by: Jesse Brandeburg Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller

e1000: cleanup clean_tx_irq routine so that it completely cleans ring

2009-03-26T08:00:54Z

The tx cleanup routine was stopping after 64 packets and this was causing issues resulting in the ring not being completely cleaned. This change updates the driver to clean the entire ring and if it doesn't it then will retry on the next pass. Signed-off-by: Alexander Duyck Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller