David S. Miller [Mon, 20 May 2013 21:05:22 +0000 (14:05 -0700)]
Merge branch 'for-davem' of git://git./linux/kernel/git/linville/wireless
John W. Linville says:
====================
This pull request is intended for the 3.10 series. It contains a
variety of fixes for problems discovered during the merge window and
after 3.10-rc1.
For the mac80211 bits, Johannes says the following:
"This is what I have:
* a patch from Felix to fix RCU usage in his rate table code
* a patch from Ilan to add the wdev id to some notifications so they can
actually be used by userspace
* Sasha Levin found an issue in how hwsim handles devices
* a fix for a bug in the wiphy_register() error path that's been there forever
* three fixes for WoWLAN
* AP mode frame matching was erroneously giving frames to all virtual AP
interfaces (reported by Jouni)
* a fix for HT handling in my CSA changes, found by Sujith
* a fix for some locking simplifications gone wrong
* Ben Greear found more cfg80211/mac80211 state confusion
* and a fix for another bug found by Jouni: local state changes need to be
reported by mac80211 to cfg80211 so it disconnects properly."
And for the iwlwifi bits, he says:
"I have fixes for a firmware crash during resume, multicast RX,
aggregation and a workaround for a firmware scanning bug."
Along with those...
Albert Pool adds a USB ID to the rtl8192cu driver.
Arend van Spriel restores a driver option support flag that had been
removed from 3.9 due to a bug in that version of the driver.
Felix Fietkau fixes a trio of ath9k issues with a series of small
patches.
Geert Uytterhoeven provides a Kconfig fix for ath9k (which you also
merged, so it isn't in the diff here).
Larry Finger gives us a fix for a build warning on big-endian systems
for rtlwifi.
Rafał Miłecki adds some core IDs to the bcma driver.
Sujith Manoharan fixes a module unloading crash in ath9k, and corrects
some calibration settings for AR9485.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
stephen hemminger [Mon, 20 May 2013 06:54:43 +0000 (06:54 +0000)]
8139cp: reset BQL when ring tx ring cleared
This patch cures transmit timeout's with DHCP observed
while running under KVM. When the transmit ring is cleaned out,
the Byte Queue Limit values need to be reset.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Petko Manolov [Sun, 19 May 2013 23:08:47 +0000 (23:08 +0000)]
drivers: net: usb: rtl8150: concurrent URB bugfix
This patch fixes a potential race with concurrently running asynchronous
write requests. The values for device's RX control register are now
stored in dynamically allocated buffers so each URB submission has it's
own copy. Doing it the old way is data clobbering prone.
This patch is against latest 'net' tree.
Signed-off-by: Petko Manolov <petkan@nucleusys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Carpenter [Sun, 19 May 2013 08:36:36 +0000 (08:36 +0000)]
isdn/kcapi: fix a small underflow
In get_capi_ctr_by_nr() and get_capi_appl_by_nr() the parameter comes
from skb->data. The current code can underflow to one space before the
start of the array.
The sanity check isn't needed in __get_capi_appl_by_nr() but I changed
it to match the others.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
John W. Linville [Mon, 20 May 2013 19:19:01 +0000 (15:19 -0400)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless into for-davem
Yuval Mintz [Sun, 19 May 2013 04:41:01 +0000 (04:41 +0000)]
bnx2x: Fix GSO for 57710/57711 chips
Starting with commit
91226790bbe2dbfbba48dd79d49f2b38ef10eb97
`bnx2x: use FW 7.8.17', the bnx2x driver no longer requests the FW to perform
IP checksums for IPv4 packets.
This behaviour needs to be revised for 57710/57711 chips -
when using GSO, if the driver will not set the IP checksum flag then packets
will be transmitted by the chip without a valid IP checksum, resulting in
a drop of all such packets on the receiver-side.
Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Sat, 18 May 2013 08:36:03 +0000 (08:36 +0000)]
ip_gre: fix a possible crash in ipgre_err()
Another fix needed in ipgre_err(), as parse_gre_header() might change
skb->head.
Bug added in commit
c54419321455 (GRE: Refactor GRE tunneling code.)
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
françois romieu [Sat, 18 May 2013 01:24:46 +0000 (01:24 +0000)]
r8169: fix offloaded tx checksum for small packets.
8168evl offloaded checksums are wrong since commit
e5195c1f31f399289347e043d6abf3ffa80f0005 ("r8169: fix 8168evl frame padding.")
pads small packets to 60 bytes (without ethernet checksum). Typical symptoms
appear as UDP checksums which are wrong by the count of added bytes.
It isn't worth compensating. Let the driver checksum.
Due to the skb length changes, TSO code is moved before the Tx descriptor gets
written.
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Tested-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nikolay@redhat.com [Sat, 18 May 2013 01:18:31 +0000 (01:18 +0000)]
bonding: fix multiple 3ad mode sysfs race conditions
When bond_3ad_get_active_agg_info() is used in all show_ad_ functions
it is not protected against slave manipulation and since it walks over
the slaves and uses them, this can easily result in NULL pointer
dereference or use of freed memory. Both the new wrapper and the
internal function are exported to the bonding as they're needed in
different places.
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nikolay@redhat.com [Sat, 18 May 2013 01:18:30 +0000 (01:18 +0000)]
bonding: arp_ip_count and arp_targets can be wrong
When getting arp_ip_targets if we encounter a bad IP, arp_ip_count still
gets increased and all the targets after the wrong one will not be probed
if arp_interval is enabled after that (unless a new IP target is added
through sysfs) because of the zero entry, in this case reading
arp_ip_target through sysfs will show valid targets even if there's a
zero entry.
Example: 1.2.3.4,4.5.6.7,blah,5.6.7.8
When retrieving the list from arp_ip_target the output would be:
1.2.3.4,4.5.6.7,5.6.7.8
but there will be a 0 entry between 4.5.6.7 and 5.6.7.8. If arp_interval
is enabled after that 5.6.7.8 will never be checked because of that.
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nikolay@redhat.com [Sat, 18 May 2013 01:18:29 +0000 (01:18 +0000)]
bonding: replace %x with %pI4 for IPv4 addresses
There're few pr_debug() places that can provide the IPv4 address in
dotted decimal format instead which is more helpful.
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nikolay@redhat.com [Sat, 18 May 2013 01:18:28 +0000 (01:18 +0000)]
bonding: fix set mode race conditions
Changing the mode without any locking can result in multiple races (e.g.
upping a bond, enslaving/releasing). Depending on which race is hit the
impact can vary from incosistent bond state to kernel crash.
Use RTNL to synchronize the mode setting with the dangerous races.
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Chen Gang [Thu, 16 May 2013 23:13:04 +0000 (23:13 +0000)]
net: irda: using kzalloc() instead of kmalloc() to avoid strncpy() issue.
'discovery->data.info' length is 22, NICKNAME_MAX_LEN is 21, so the
strncpy() will always left the last byte of 'discovery->data.info'
uninitialized.
When 'text' length is longer than 21 (NICKNAME_MAX_LEN), if still left
the last byte of 'discovery->data.info' uninitialized, the next
strlen() will cause issue.
Also 'discovery->data' is 'struct irda_device_info' which defined in
"include/uapi/...", it may copy to user mode, so need whole initialized.
All together, need use kzalloc() instead of kmalloc() to initialize all
members firstly.
Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Paul Moore [Fri, 17 May 2013 09:08:50 +0000 (09:08 +0000)]
netlabel: improve domain mapping validation
The net/netlabel/netlabel_domainhash.c:netlbl_domhsh_add() function
does not properly validate new domain hash entries resulting in
potential problems when an administrator attempts to add an invalid
entry. One such problem, as reported by Vlad Halilov, is a kernel
BUG (found in netlabel_domainhash.c:netlbl_domhsh_audit_add()) when
adding an IPv6 outbound mapping with a CIPSO configuration.
This patch corrects this problem by adding the necessary validation
code to netlbl_domhsh_add() via the newly created
netlbl_domhsh_validate() function.
Ideally this patch should also be pushed to the currently active
-stable trees.
Reported-by: Vlad Halilov <vlad.halilov@gmail.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Fri, 17 May 2013 04:53:13 +0000 (04:53 +0000)]
ipv6: fix possible crashes in ip6_cork_release()
commit
0178b695fd6b4 ("ipv6: Copy cork options in ip6_append_data")
added some code duplication and bad error recovery, leading to potential
crash in ip6_cork_release() as kfree() could be called with garbage.
use kzalloc() to make sure this wont happen.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: Neal Cardwell <ncardwell@google.com>
Sridhar Samudrala [Fri, 17 May 2013 06:39:07 +0000 (06:39 +0000)]
vxlan: Update vxlan fdb 'used' field after each usage
Fix some instances where vxlan fdb 'used' field is not updated after the entry
is used.
v2: rename vxlan_find_mac() as __vxlan_find_mac() and create a new vxlan_find_mac()
that also updates ->used field.
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Wei Yongjun [Thu, 16 May 2013 22:25:34 +0000 (22:25 +0000)]
gianfar: add missing iounmap() on error in gianfar_ptp_probe()
Add the missing iounmap() before return from gianfar_ptp_probe()
in the error handling case.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Felix Fietkau [Fri, 17 May 2013 10:58:26 +0000 (12:58 +0200)]
ath9k: fix draining aggregation tid buffers
After a tx attempt, an A-MPDU subframe can still have fi->retries at 0
(if the retry count wasn't incremented due to powersave).
In that case it is still tracked as part of the block ack window, so
when draining the tid queue, its sequence number needs to be cleared
from the pending frame bitmap.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Felix Fietkau [Fri, 17 May 2013 10:58:25 +0000 (12:58 +0200)]
ath9k: fix rate handling/reporting
This patch fixes some issues introduced in the rate control API rework.
When not running aggregation, copy bf->rates into info->control.rates
before applying the rate control status to it.
In ath_lookup_rate, the rates need to be pulled from bf->rates, not the
tx info.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Felix Fietkau [Fri, 17 May 2013 10:58:24 +0000 (12:58 +0200)]
ath9k: fix aggregation stop/flush handling
When aggregation stop is requested, don't run the mac80211 aggregation
stop callback yet, while the session is still blocked.
Also, when aggregation flush is requested, don't run the callback at all.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Sujith Manoharan [Thu, 16 May 2013 17:17:34 +0000 (22:47 +0530)]
ath9k_hw: Enable manual peak calibration for AR9485
Manual peak calibration is currently enabled only for
AR9462 and AR9565. This is also required for AR9485.
The initvals are also modified to disable HW peak calibration.
Cc: <stable@vger.kernel.org>
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Albert Pool [Wed, 15 May 2013 15:03:16 +0000 (10:03 -0500)]
rtlwifi: rtl8192cu: Add new USB ID
This adds the USB ID of the On Networks N300MA, clone of Netgear WNA3100M.
Signed-off-by: Albert Pool <albertpool@solcon.nl>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Reported-by: Ana Rey <Anazul77@hotmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Arend van Spriel [Tue, 14 May 2013 18:52:36 +0000 (20:52 +0200)]
brcmfmac: announce P2P_DEVICE support in wiphy structure
P2P_DEVICE support was removed from brcmfmac for v3.9 kernel with
the commit below:
commit
1527c343c12f3a2aae532aa881d12c6fbf8749f4
Author: Arend van Spriel <arend@broadcom.com>
Date: Thu Apr 4 12:10:11 2013 +0200
brcmfmac: remove advertising P2P device support
However, it got merged into wireless-next. But for 3.10 brcmfmac does
support P2P device. Putting it back with this commit.
Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Larry Finger [Mon, 13 May 2013 02:43:46 +0000 (21:43 -0500)]
rtlwifi: rtl8188ee: Fix warning when building on big-endian systems
In http://lkml.indiana.edu/hypermail/linux/kernel/1305.1/index.html,
Geert Uytterhoeven reports a new warning when building 3.10-rc1 in
this driver. This is caused by using a "#if" test to see if __LITTLE_ENDIAN
is set, which fails for all big-endian systems. Change to "ifdef".
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Sujith Manoharan [Fri, 10 May 2013 13:11:06 +0000 (18:41 +0530)]
ath9k: Fix crash on module unload
Make sure that any open relayfs files are closed before
unregistering with mac80211, otherwise this crash is seen:
[ 1331.097846] BUG: unable to handle kernel paging request at
6b6b6b8b
[ 1331.098170] IP: [<
c063d0d6>] debugfs_remove+0x26/0x80
[ 1331.098170] *pdpt =
000000002f9aa001 *pde =
0000000000000000
[ 1331.098170] Oops: 0000 [#1] PREEMPT SMP
[ 1331.098170] Modules linked in: iptable_raw xt_CT nf_conntrack_ipv4 nf_defrag]
[ 1331.098170] Pid: 4794, comm: rmmod Tainted: G WC 3.9.1+ #5 To Be Fi.
[ 1331.098170] EIP: 0060:[<
c063d0d6>] EFLAGS:
00010202 CPU: 0
[ 1331.098170] EIP is at debugfs_remove+0x26/0x80
[ 1331.098170] EAX:
f2f3acd0 EBX:
f2f3acd0 ECX:
00000006 EDX:
f8622348
[ 1331.098170] ESI:
6b6b6b6b EDI:
00000001 EBP:
ee251e14 ESP:
ee251e0c
[ 1331.098170] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 1331.098170] CR0:
8005003b CR2:
6b6b6b8b CR3:
2e7b7000 CR4:
000007e0
[ 1331.098170] DR0:
00000000 DR1:
00000000 DR2:
00000000 DR3:
00000000
[ 1331.098170] DR6:
ffff0ff0 DR7:
00000400
[ 1331.098170] Process rmmod (pid: 4794, ti=
ee250000 task=
efaa2560 task.ti=ee25)
[ 1331.098170] Stack:
[ 1331.098170]
f241e170 0000000a ee251e1c f861394d ee251e28 c04e3088 f241e170 4
[ 1331.098170]
c04e30fe f45482b0 ee251e54 c04e3187 f25e86b0 ee251e54 f8618748 0
[ 1331.098170]
0000000a 00000001 ee251e68 f860065b f2509e20 f25085a0 f5b6e8a4 8
[ 1331.098170] Call Trace:
[ 1331.098170] [<
f861394d>] remove_buf_file_handler+0xd/0x20 [ath9k]
[ 1331.098170] [<
c04e3088>] relay_remove_buf+0x18/0x30
[ 1331.098170] [<
c04e30fe>] relay_close_buf+0x2e/0x40
[ 1331.098170] [<
c04e3187>] relay_close+0x77/0xf0
[ 1331.098170] [<
f8618748>] ? dpd_exit+0x38/0x40 [ath9k]
[ 1331.098170] [<
f860065b>] ath9k_deinit_softc+0x8b/0xa0 [ath9k]
[ 1331.098170] [<
f86006b8>] ath9k_deinit_device+0x48/0x60 [ath9k]
[ 1331.098170] [<
f86107f1>] ath_pci_remove+0x31/0x50 [ath9k]
[ 1331.098170] [<
c06dbff8>] pci_device_remove+0x38/0xc0
[ 1331.098170] [<
c079daa4>] __device_release_driver+0x64/0xc0
[ 1331.098170] [<
c079db97>] driver_detach+0x97/0xa0
[ 1331.098170] [<
c079cacc>] bus_remove_driver+0x6c/0xe0
[ 1331.098170] [<
c079c197>] ? bus_put+0x17/0x20
[ 1331.098170] [<
c079cae3>] ? bus_remove_driver+0x83/0xe0
[ 1331.098170] [<
c079e709>] driver_unregister+0x49/0x80
[ 1331.098170] [<
c06dc138>] pci_unregister_driver+0x18/0x80
[ 1331.098170] [<
f8610602>] ath_pci_exit+0x12/0x20 [ath9k]
[ 1331.098170] [<
f8619ce0>] ath9k_exit+0x17/0x337 [ath9k]
[ 1331.098170] [<
c09e537d>] ? mutex_unlock+0xd/0x10
[ 1331.098170] [<
c04bd36c>] sys_delete_module+0x17c/0x250
[ 1331.098170] [<
c0540dc4>] ? do_munmap+0x244/0x2d0
[ 1331.098170] [<
c0540e96>] ? vm_munmap+0x46/0x60
[ 1331.098170] [<
c09e8dc4>] ? restore_all+0xf/0xf
[ 1331.098170] [<
c09ebf50>] ? __do_page_fault+0x4c0/0x4c0
[ 1331.098170] [<
c04b18e4>] ? trace_hardirqs_on_caller+0xf4/0x180
[ 1331.098170] [<
c09ef28d>] sysenter_do_call+0x12/0x38
[ 1331.098170] Code: 90 8d 74 26 00 55 89 e5 83 ec 08 89 1c 24 89 74 24 04 3e 82
[ 1331.098170] EIP: [<
c063d0d6>] debugfs_remove+0x26/0x80 SS:ESP 0068:
ee251e0c
[ 1331.098170] CR2:
000000006b6b6b8b
[ 1331.727971] ---[ end trace
b5bb9f2066cef7f9 ]---
Cc: <stable@vger.kernel.org>
Acked-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Tested-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Geert Uytterhoeven [Thu, 9 May 2013 21:04:47 +0000 (23:04 +0200)]
net/wireless: ATH9K should depend on HAS_DMA
If NO_DMA=y:
drivers/built-in.o: In function `ath9k_beacon_generate':
drivers/net/wireless/ath/ath9k/beacon.c:146: undefined reference to `dma_unmap_single'
drivers/net/wireless/ath/ath9k/beacon.c:174: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/beacon.c:176: undefined reference to `dma_mapping_error'
drivers/built-in.o: In function `ath9k_beacon_remove_slot':
drivers/net/wireless/ath/ath9k/beacon.c:252: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_descdma_setup':
drivers/net/wireless/ath/ath9k/init.c:382: undefined reference to `dmam_alloc_coherent'
drivers/built-in.o: In function `ath_edma_get_buffers':
drivers/net/wireless/ath/ath9k/recv.c:616: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_get_next_rx_buf':
drivers/net/wireless/ath/ath9k/recv.c:740: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_rx_edma_cleanup':
drivers/net/wireless/ath/ath9k/recv.c:176: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_rx_cleanup':
drivers/net/wireless/ath/ath9k/recv.c:340: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_rx_edma_buf_link':
drivers/net/wireless/ath/ath9k/recv.c:122: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_rx_tasklet':
drivers/net/wireless/ath/ath9k/recv.c:1275: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/recv.c:1277: undefined reference to `dma_mapping_error'
drivers/net/wireless/ath/ath9k/recv.c:1283: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_rx_edma_init':
drivers/net/wireless/ath/ath9k/recv.c:226: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/recv.c:229: undefined reference to `dma_mapping_error'
drivers/built-in.o: In function `ath_rx_init':
drivers/net/wireless/ath/ath9k/recv.c:303: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/recv.c:306: undefined reference to `dma_mapping_error'
drivers/built-in.o: In function `ath_tx_complete_buf':
drivers/net/wireless/ath/ath9k/xmit.c:2088: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_txstatus_setup':
drivers/net/wireless/ath/ath9k/xmit.c:2344: undefined reference to `dmam_alloc_coherent'
drivers/built-in.o: In function `ath_tx_set_retry':
drivers/net/wireless/ath/ath9k/xmit.c:307: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_tx_setup_buffer':
drivers/net/wireless/ath/ath9k/xmit.c:1887: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/xmit.c:1889: undefined reference to `dma_mapping_error'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Cc: John W. Linville <linville@tuxdriver.com>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rafał Miłecki [Thu, 9 May 2013 19:24:24 +0000 (21:24 +0200)]
bcma: add more core IDs
PCIe and ARM CR4 cores were found on 14e4:43b1 AKA BCM4352.
Reported-by: Gabriel Thörnblad <gabriel@thornblad.com>
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Denis Efremov [Thu, 9 May 2013 09:19:39 +0000 (13:19 +0400)]
iwlegacy: remove inline marking of EXPORT_SYMBOL functions
EXPORT_SYMBOL and inline directives are contradictory to each other.
The patch fixes this inconsistency.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Denis Efremov <yefremov.denis@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
John W. Linville [Fri, 17 May 2013 18:22:17 +0000 (14:22 -0400)]
Merge branch 'for-john' of git://git./linux/kernel/git/iwlwifi/iwlwifi-fixes
David S. Miller [Fri, 17 May 2013 08:32:20 +0000 (01:32 -0700)]
Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge
Included changes:
- fix global protection fault by avoiding double call_rcu
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Lüssing [Mon, 15 Apr 2013 13:43:29 +0000 (21:43 +0800)]
batman-adv: Fix rcu_barrier() miss due to double call_rcu() in TT code
rcu_barrier() only waits for the currently scheduled rcu functions
to finish - it won't wait for any function scheduled via another
call_rcu() within an rcu scheduled function.
Unfortunately our batadv_tt_orig_list_entry_free_ref() does just that,
via a batadv_orig_node_free_ref() call, leading to our rcu_barrier()
call potentially missing such a batadv_orig_node_free_ref().
This patch fixes this issue by calling the batadv_orig_node_free_rcu()
directly from the rcu callback, removing the unnecessary, additional
call_rcu() layer here.
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Acked-by: Antonio Quartulli <ordex@autistici.org>
Eric Dumazet [Thu, 16 May 2013 07:34:53 +0000 (07:34 +0000)]
bonding: allow TSO being set on bonding master
In some situations, we need to disable TSO on bonding slaves.
bonding device automatically unset TSO in bond_fix_features(), and
performance is not good because :
1) We consume more cpu cycles.
2) GSO segmentation has some bugs leading to out of order TCP packets
if this segmentation is done before virtual device. This particular
problem will be addressed in a separate patch.
This patch allows TSO being set/unset on the bonding master,
so that GSO segmentation is done after bonding layer.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Michał Mirosław <mirqus@gmail.com>
Cc: Jay Vosburgh <fubar@us.ibm.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Russell King [Thu, 16 May 2013 06:31:42 +0000 (06:31 +0000)]
NET: mv643xx_eth: avoid lockdep dump on interface down
When the interface is shutdown, the mv643xx_eth driver hits the following
lockdep dump:
=================================
[ INFO: inconsistent lock state ]
3.8.0+ #303 Not tainted
---------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
NetworkManager/3449 [HC0[0]:SC0[0]:HE1:SE1] takes:
(_xmit_ETHER#2){+.?...}, at: [<
c02828e4>] txq_reclaim+0x60/0x230
{IN-SOFTIRQ-W} state was registered at:
[<
c007e93c>] mark_irqflags+0xf8/0x1c4
[<
c007ee60>] __lock_acquire+0x458/0x9a4
[<
c007f8b0>] lock_acquire+0x60/0x74
[<
c03ea914>] _raw_spin_lock+0x40/0x50
[<
c0334040>] sch_direct_xmit+0xa4/0x2e4
[<
c0320880>] dev_queue_xmit+0x174/0x508
[<
c03953b0>] ip6_finish_output2+0xd0/0x3c4
[<
c03b15bc>] mld_sendpack+0x190/0x368
[<
c03b3204>] mld_ifc_timer_expire+0xc/0x58
[<
c005133c>] call_timer_fn+0x6c/0xe0
[<
c0051588>] run_timer_softirq+0x1d8/0x210
[<
c004c004>] __do_softirq+0xe0/0x1b4
[<
c004c448>] irq_exit+0x64/0x6c
[<
c000f1e0>] handle_IRQ+0x34/0x84
[<
c000e0d0>] __irq_usr+0x30/0x80
irq event stamp: 160603
hardirqs last enabled at (160603): [<
c00c736c>] kfree+0xa8/0xe8
hardirqs last disabled at (160602): [<
c00c72e0>] kfree+0x1c/0xe8
softirqs last enabled at (160304): [<
c028260c>] mib_counters_update+0x5ec/0x60c
softirqs last disabled at (160302): [<
c03eab8c>] _raw_spin_lock_bh+0x14/0x54
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(_xmit_ETHER#2);
<Interrupt>
lock(_xmit_ETHER#2);
*** DEADLOCK ***
1 lock held by NetworkManager/3449:
#0: (rtnl_mutex){+.+.+.}, at: [<
c032e664>] rtnetlink_rcv+0xc/0x24
stack backtrace:
[<
c0013e34>] (unwind_backtrace+0x0/0xf8) from [<
c007e12c>] (print_usage_bug+0x150/0x1d4)
[<
c007e12c>] (print_usage_bug+0x150/0x1d4) from [<
c007e3f8>] (mark_lock_irq+0x248/0x290)
[<
c007e3f8>] (mark_lock_irq+0x248/0x290) from [<
c007e598>] (mark_lock+0x158/0x404)
[<
c007e598>] (mark_lock+0x158/0x404) from [<
c007e97c>] (mark_irqflags+0x138/0x1c4)
[<
c007e97c>] (mark_irqflags+0x138/0x1c4) from [<
c007ee60>] (__lock_acquire+0x458/0x9a4)
[<
c007ee60>] (__lock_acquire+0x458/0x9a4) from [<
c007f8b0>] (lock_acquire+0x60/0x74)
[<
c007f8b0>] (lock_acquire+0x60/0x74) from [<
c03ea914>] (_raw_spin_lock+0x40/0x50)
[<
c03ea914>] (_raw_spin_lock+0x40/0x50) from [<
c02828e4>] (txq_reclaim+0x60/0x230)
[<
c02828e4>] (txq_reclaim+0x60/0x230) from [<
c0282ad8>] (txq_deinit+0x24/0xcc)
[<
c0282ad8>] (txq_deinit+0x24/0xcc) from [<
c0282d28>] (mv643xx_eth_stop+0x1a8/0x1bc)
[<
c0282d28>] (mv643xx_eth_stop+0x1a8/0x1bc) from [<
c031e314>] (__dev_close_many+0x88/0xcc)
[<
c031e314>] (__dev_close_many+0x88/0xcc) from [<
c031e380>] (__dev_close+0x28/0x3c)
[<
c031e380>] (__dev_close+0x28/0x3c) from [<
c0320fa0>] (__dev_change_flags+0x7c/0x134)
[<
c0320fa0>] (__dev_change_flags+0x7c/0x134) from [<
c03210e0>] (dev_change_flags+0x10/0x48)
[<
c03210e0>] (dev_change_flags+0x10/0x48) from [<
c032da1c>] (do_setlink+0x1a0/0x730)
[<
c032da1c>] (do_setlink+0x1a0/0x730) from [<
c032f524>] (rtnl_newlink+0x304/0x4b0)
[<
c032f524>] (rtnl_newlink+0x304/0x4b0) from [<
c032ef8c>] (rtnetlink_rcv_msg+0x25c/0x2a0)
[<
c032ef8c>] (rtnetlink_rcv_msg+0x25c/0x2a0) from [<
c03383a0>] (netlink_rcv_skb+0xbc/0xd8)
[<
c03383a0>] (netlink_rcv_skb+0xbc/0xd8) from [<
c032e674>] (rtnetlink_rcv+0x1c/0x24)
[<
c032e674>] (rtnetlink_rcv+0x1c/0x24) from [<
c03361d8>] (netlink_unicast_kernel+0x88/0xd4)
[<
c03361d8>] (netlink_unicast_kernel+0x88/0xd4) from [<
c0337dd0>] (netlink_unicast+0x138/0x180)
[<
c0337dd0>] (netlink_unicast+0x138/0x180) from [<
c0338020>] (netlink_sendmsg+0x208/0x32c)
[<
c0338020>] (netlink_sendmsg+0x208/0x32c) from [<
c030ab48>] (sock_sendmsg+0x84/0xa4)
[<
c030ab48>] (sock_sendmsg+0x84/0xa4) from [<
c030aef4>] (__sys_sendmsg+0x2ac/0x2c4)
[<
c030aef4>] (__sys_sendmsg+0x2ac/0x2c4) from [<
c030c8ec>] (sys_sendmsg+0x3c/0x68)
[<
c030c8ec>] (sys_sendmsg+0x3c/0x68) from [<
c000e2e0>] (ret_fast_syscall+0x0/0x3c)
It seems that txq_reclaim() takes the netif tx lock:
__netif_tx_lock(nq, smp_processor_id());
in a context outside of softirq context, and thus is susceptible to
deadlock should an interrupt occur.
Use __netif_tx_lock_bh()/__netif_tx_unlock_bh() instead.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Wed, 15 May 2013 15:38:01 +0000 (15:38 +0000)]
tcp: gso: do not generate out of order packets
GSO TCP handler has following issues :
1) ooo_okay from original GSO packet is duplicated to all segments
2) segments (but the last one) are orphaned, so transmit path can not
get transmit queue number from the socket. This happens if GSO
segmentation is done before stacked device for example.
Result is we can send packets from a given TCP flow to different TX
queues (if using multiqueue NICS). This generates OOO problems and
spurious SACK & retransmits.
Fix this by keeping socket pointer set for all segments.
This means that every segment must also have a destructor, and the
original gso skb truesize must be split on all segments, to keep
precise sk->sk_wmem_alloc accounting.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Thu, 16 May 2013 21:32:42 +0000 (14:32 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/pablo/nf
Pablo Neira Ayuso says:
====================
The following patchset contains three Netfilter fixes and update
for the MAINTAINER file for your net tree, they are:
* Fix crash if nf_log_packet is called from conntrack, in that case
both interfaces are NULL, from Hans Schillstrom. This bug introduced
with the logging netns support in the previous merge window.
* Fix compilation of nf_log and nf_queue without CONFIG_PROC_FS,
from myself. This bug was introduced in the previous merge window
with the new netns support for the netfilter logging infrastructure.
* Fix possible crash in xt_TCPOPTSTRIP due to missing sanity
checkings to validate that the TCP header is well-formed, from
myself. I can find this bug in 2.6.25, probably it's been there
since the beginning. I'll pass this to -stable.
* Update MAINTAINER file to point to new nf trees at git.kernel.org,
remove Harald and use M: instead of P: (now obsolete tag) to
keep Jozsef in the list of people.
Please, consider pulling this. Thanks!
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Emmanuel Grumbach [Tue, 7 May 2013 11:08:24 +0000 (14:08 +0300)]
iwlwifi: mvm: fix aggregation drain flow
Move the counter for non-AMPDU frames to mvm. It is needed
for the drain flow which happens once the ieee80211_sta has
been freed, so keeping it in iwl_mvm_sta which is embed into
ieee80211_sta is not a good idea.
Also, since its purpose it to remove the STA in the fw only
after all the frames for this station have exited the shared
Tx queues, we need to decrement it in the reclaim flow. This
flow can happen after ieee80211_sta has been removed, which
means that we have no iwl_mvm_sta there. So we can't know
what is the vif type. Hence, we know audit these frames for
all the vif types.
In order to avoid spawning sta_drained_wk all the time, we
now check that we are in a flow in which draining might
happen - only when mvmsta is NULL. This is better than
previous code that would spawn sta_drained_wk all the time
in AP mode.
Cc: stable@vger.kernel.org [3.9]
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Alexander Bondar [Thu, 2 May 2013 13:34:48 +0000 (16:34 +0300)]
iwlwifi: mvm: Prevent setting assoc flag in MAC_CONTEXT_CMD
In the normal flow first MAC_CONTEXT_CMD for particular interface is
never sent while associated. The exception is fw restart flow when
resuming from suspend when WoWLAN is enabled. In this case successive
"add" and "modify" MAC_CONTEXT_CMD commands may be sent with assoc flag
set what cause FW mal functioning. To prevent this never set assoc flag
in MAC_CONTEXT_CMD with action "add".
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Emmanuel Grumbach [Thu, 2 May 2013 12:01:24 +0000 (15:01 +0300)]
iwlwifi: mvm: tell firmware to let multicast frames in
Without this command, the firmware will filter out all the
multicast frames. Let them all in as for now. Later we will
want to optimize this to save power.
Cc: stable@vger.kernel.org
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Ilan Peer [Sun, 28 Apr 2013 05:18:28 +0000 (08:18 +0300)]
iwlwifi: mvm: Always use SCAN_TYPE_FORCED
The FW AUX framework does not handle well cases where time events
fail to be scheduled (and as a result issues assert 0x3330). Until
a proper fix is in place, WA this by always setting the scan type to
SCAN_TYPE_FORCED.
Cc: stable@vger.kernel.org
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Thu, 16 May 2013 08:24:28 +0000 (10:24 +0200)]
cfg80211: fix sending WoWLAN TCP wakeup settings
The code sending the current WoWLAN TCP wakeup settings in
nl80211_send_wowlan_tcp() is not closing the nested attribute,
thus causing the parser to get confused on the receiver side
in userspace (iw). Fix this.
Cc: stable@vger.kernel.org [3.9]
Reported-by: Deepak Arora <deepakx.arora@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Tue, 14 May 2013 07:39:02 +0000 (09:39 +0200)]
mac80211: report deauth to cfg80211 for local state change
Even if the frame isn't transmitted to the AP, we need to
report it to cfg80211 so the state there can be updated
correctly.
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Tue, 14 May 2013 07:19:53 +0000 (09:19 +0200)]
cfg80211: fix interface down/disconnect state handling
When the interface goes down, there's no need to call
cfg80211_mlme_down() after __cfg80211_disconnect() as
the latter will call the former (if appropriate.)
Also, in __cfg80211_disconnect(), if the cfg80211 SME
isn't used, __cfg80211_disconnected() may still need
to be called (depending on the current state) so that
the SME state gets cleared.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Mon, 13 May 2013 14:42:40 +0000 (16:42 +0200)]
mac80211: fix AP-mode frame matching
In AP mode, ignore frames with mis-matched BSSID that aren't
multicast or sent to the correct destination. This fixes
reporting public action frames to userspace multiple times
on multiple virtual AP interfaces.
Cc: stable@vger.kernel.org
Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Ilan Peer [Wed, 8 May 2013 13:35:55 +0000 (16:35 +0300)]
nl80211: Add wdev identifier to some nl80211 notifications
Adding the attributes fixes an issue with P2P Device not
working properly for management frame TX.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Mon, 6 May 2013 13:54:58 +0000 (15:54 +0200)]
mac80211: use just spin_lock() in ieee80211_get_tkip_p2k()
ieee80211_get_tkip_p2k() may be called with interrupts
disabled, so spin_unlock_bh() isn't safe and leads to
warnings. Since it's always called with BHs disabled
already, just use spin_lock().
Cc: stable@vger.kernel.org
Reported-by: Milan Kocian <milon@wq.cz>
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Felix Fietkau [Fri, 3 May 2013 08:01:03 +0000 (10:01 +0200)]
mac80211: fix spurious RCU warning and update documentation
Document rx vs tx status concurrency requirements.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Fri, 3 May 2013 07:35:35 +0000 (09:35 +0200)]
mac80211: fix HT beacon-based channel switch handling
When an HT AP is advertising channel switch in a beacon, it
doesn't (and shouldn't, according to 802.11-2012 Table 8-20)
include a secondary channel offset element. The only possible
interpretation is that the previous secondary channel offset
remains valid, so use that when switching channel based only
on beacon information.
VHT requires the Wide Bandwidth Channel Switch subelement to
be present in the Channel Switch Wrapper element, so the code
for that is probably ok (see 802.11ac Draft 4, 8.4.2.165.)
Reported-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Mon, 29 Apr 2013 12:57:44 +0000 (14:57 +0200)]
mac80211: fix IEEE80211_SDATA_DISCONNECT_RESUME
Since commit
12e7f517029dad819c45eca9ca01fdb9ba57616b,
IEEE80211_SDATA_DISCONNECT_RESUME no longer worked as
it would simply never be tested. Restore a bit of the
code removed there and in
9b7d72c1041ec5b20b24af487a9
to make it work again.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Mon, 29 Apr 2013 10:09:14 +0000 (12:09 +0200)]
cfg80211: fix WoWLAN wakeup tracing
If the device reports a non-wireless wakeup reason, the
tracing code crashes trying to dereference a NULL pointer.
Fix this by checking the pointer on all accesses and also
add a non_wireless tag to the event.
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Sasha Levin [Wed, 24 Apr 2013 04:40:05 +0000 (00:40 -0400)]
mac80211_hwsim: correctly register the platform driver
Not registering a platform_driver would make us access garbage
when the platform callbacks under driver_register() kicks in.
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Tested-By: Martin Pitt <martin.pitt@ubuntu.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Fri, 10 May 2013 17:23:40 +0000 (19:23 +0200)]
cfg80211: fix wiphy_register error path
If rfkill_register() fails in wiphy_register() the struct device
is unregistered but everything else isn't (regulatory, debugfs)
and we even leave the wiphy instance on all internal lists even
though it will likely be freed soon, which is clearly a problem.
Fix this by cleaning up properly.
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Pablo Neira Ayuso [Tue, 7 May 2013 01:22:18 +0000 (03:22 +0200)]
netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary
This target assumes that tcph->doff is well-formed, that may be well
not the case. Add extra sanity checkings to avoid possible crash due
to read/write out of the real packet boundary. After this patch, the
default action on malformed TCP packets is to drop them. Moreover,
fragments are skipped.
Reported-by: Rafal Kupka <rkupka@telemetry.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Florian Fainelli [Wed, 15 May 2013 08:00:25 +0000 (08:00 +0000)]
broadcom: add include guards to include/linux/brcmphy.h
include/linux/brcmphy.h is currently not protected against double
inclusion, add ifdefs guard to fix that.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Fabio Estevam [Wed, 15 May 2013 07:06:27 +0000 (07:06 +0000)]
fec: Invert the order of function calls in fec_restart()
commit
54309fa6 ("net: fec: fix kernel oops when plug/unplug cable many times")
introduced the following 'if' block in the beginning of fec_start():
if (netif_running(ndev)) {
netif_device_detach(ndev);
napi_disable(&fep->napi);
netif_stop_queue(ndev);
netif_tx_lock_bh(ndev);
}
Then later in the end of fec_restart() there is another block that calls the
opposite of each one of these functions.
The correct approach would be to also call them with in the reverse order, so
that we have as result:
if (netif_running(ndev)) {
netif_tx_unlock_bh(ndev);
netif_wake_queue(ndev);
napi_enable(&fep->napi);
netif_device_attach(ndev);
}
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Fabio Estevam [Wed, 15 May 2013 07:06:26 +0000 (07:06 +0000)]
fec: Fix inconsistent lock state
fec_restart() runs in softirq context and we should use the
netif_tx_lock_bh/netif_tx_unlock_bh() variants to avoid the following warning
that happens since commit
54309fa6 ("net: fec: fix kernel oops when plug/unplug
cable many times"):
[ 9.753168] =================================
[ 9.757540] [ INFO: inconsistent lock state ]
[ 9.761921] 3.10.0-rc1-next-
20130514 #13 Not tainted
[ 9.766897] ---------------------------------
[ 9.771264] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[ 9.777288] swapper/0 [HC0[0]:SC1[3]:HE1:SE0] takes:
[ 9.782261] (_xmit_ETHER#2){+.?...}, at: [<
c03c24a4>] sch_direct_xmit+0xa0/0x2d4
[ 9.789879] {SOFTIRQ-ON-W} state was registered at:
[ 9.794769] [<
c0059c60>] __lock_acquire+0x528/0x1bc0
[ 9.799953] [<
c005b838>] lock_acquire+0xa0/0x108
[ 9.804780] [<
c0441320>] _raw_spin_lock+0x28/0x38
[ 9.809702] [<
c02f9fc8>] fec_restart+0x5d0/0x664
[ 9.814542] [<
c02fa738>] fec_enet_adjust_link+0xa8/0xc0
[ 9.819978] [<
c02f7a28>] phy_state_machine+0x2fc/0x370
[ 9.825323] [<
c0035ee0>] process_one_work+0x1c0/0x4a0
[ 9.830589] [<
c0036594>] worker_thread+0x138/0x394
[ 9.835587] [<
c003c620>] kthread+0xa4/0xb0
[ 9.839890] [<
c000e820>] ret_from_fork+0x14/0x34
[ 9.844728] irq event stamp: 185984
[ 9.848226] hardirqs last enabled at (185984): [<
c00232b0>] local_bh_enable_ip+0x84/0xf0
[ 9.856450] hardirqs last disabled at (185983): [<
c0023270>] local_bh_enable_ip+0x44/0xf0
[ 9.864667] softirqs last enabled at (185966): [<
c0023470>] irq_enter+0x64/0x68
[ 9.872099] softirqs last disabled at (185967): [<
c0023510>] irq_exit+0x9c/0xd8
[ 9.879440]
[ 9.879440] other info that might help us debug this:
[ 9.885981] Possible unsafe locking scenario:
[ 9.885981]
[ 9.891912] CPU0
[ 9.894364] ----
[ 9.896814] lock(_xmit_ETHER#2);
[ 9.900259] <Interrupt>
[ 9.902884] lock(_xmit_ETHER#2);
[ 9.906500]
[ 9.906500] *** DEADLOCK ***
Reported-by: Shawn Guo <shawn.guo@linaro.org>
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Carpenter [Tue, 14 May 2013 21:20:02 +0000 (21:20 +0000)]
ipg: fix an unsigned widening cast of '~' truncation issue
The bug here is this code from ipg_nic_hard_start_xmit():
txfd->tfc &= cpu_to_le64(~IPG_TFC_TFDDONE);
IPG_TFC_TFDDONE is 0x0000000080000000 so it's an unsigned int. The
negated value is 0x7fffffff but 0xffffffff7fffffff was intended.
The other values in this file don't need to be changed but I did it for
consistency.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Hans Schillstrom [Wed, 15 May 2013 01:23:45 +0000 (01:23 +0000)]
netfilter: log: netns NULL ptr bug when calling from conntrack
Since (
69b34fb netfilter: xt_LOG: add net namespace support
for xt_LOG), we hit this:
[ 4224.708977] BUG: unable to handle kernel NULL pointer dereference at
0000000000000388
[ 4224.709074] IP: [<
ffffffff8147f699>] ipt_log_packet+0x29/0x270
when callling log functions from conntrack both in and out
are NULL i.e. the net pointer is invalid.
Adding struct net *net in call to nf_logfn() will secure that
there always is a vaild net ptr.
Reported as netfilter's bugzilla bug 818:
https://bugzilla.netfilter.org/show_bug.cgi?id=818
Reported-by: Ronald <ronald645@gmail.com>
Signed-off-by: Hans Schillstrom <hans@schillstrom.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Nicolas Ferre [Tue, 14 May 2013 03:00:16 +0000 (03:00 +0000)]
net/macb: fix ISR clear-on-write behavior only for some SoC
Commit
749a2b6 (net/macb: clear tx/rx completion flags in ISR)
introduces clear-on-write on ISR register. This behavior is not always
implemented when using Cadence MACB/GEM and is breaking other platforms.
We are using the Design Configuration Register 1 information and a capability
property to actually activate this clear-on-write behavior on ISR.
Reported-by: Hein Tibosch <hein_tibosch@yahoo.es>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Tested-by: Hein Tibosch <hein_tibosch@yahoo.es>
Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Mon, 13 May 2013 02:24:11 +0000 (02:24 +0000)]
net/802/mrp: fix lockdep splat
commit
fb745e9a037895 ("net/802/mrp: fix possible race condition when
calling mrp_pdu_queue()") introduced a lockdep splat.
[ 19.735147] =================================
[ 19.735235] [ INFO: inconsistent lock state ]
[ 19.735324] 3.9.2-build-0063 #4 Not tainted
[ 19.735412] ---------------------------------
[ 19.735500] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
[ 19.735592] rmmod/1840 [HC0[0]:SC0[0]:HE1:SE1] takes:
[ 19.735682] (&(&app->lock)->rlock#2){+.?...}, at: [<
f862bb5b>]
mrp_uninit_applicant+0x69/0xba [mrp]
app->lock is normally taken under softirq context, so disable BH to
avoid the splat.
Reported-by: Denys Fedoryshchenko <denys@visp.net.lb>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Ward <david.ward@ll.mit.edu>
Cc: Cong Wang <amwang@redhat.com>
Tested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Andrew Lunn [Mon, 13 May 2013 23:54:20 +0000 (23:54 +0000)]
mv643xx_eth: fix NAPI weight being > 64
3.10-rc1 issues the following warning:
netif_napi_add() called with weight 128 on device eth%d
This patch reduce the weight to 64, using NAPI_POLL_WEIGHT.
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Mon, 13 May 2013 21:25:52 +0000 (21:25 +0000)]
tcp: fix tcp_md5_hash_skb_data()
TCP md5 communications fail [1] for some devices, because sg/crypto code
assume page offsets are below PAGE_SIZE.
This was discovered using mlx4 driver [2], but I suspect loopback
might trigger the same bug now we use order-3 pages in tcp_sendmsg()
[1] Failure is giving following messages.
huh, entered softirq 3 NET_RX
ffffffff806ad230 preempt_count
00000100,
exited with
00000101?
[2] mlx4 driver uses order-2 pages to allocate RX frags
Reported-by: Matt Schnall <mischnal@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Bernhard Beck <bbeck@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Sarveshwar Bandi [Mon, 13 May 2013 20:28:20 +0000 (20:28 +0000)]
be2net: Avoid double insertion of vlan tags.
Fix to avoid double insertion of vlan tags into the packet while
handling an asic workaroud (issue introduced by net next Commit
bc0c340)
Signed-off-by: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ben Hutchings [Mon, 13 May 2013 12:01:22 +0000 (12:01 +0000)]
sfc: Reduce RX scatter buffer size, and reduce alignment if appropriate
efx_start_datapath() asserts that we can fit 2 RX scatter buffers plus
a software structure, each appropriately aligned, into a single page.
Where L1_CACHE_BYTES == 256 and PAGE_SIZE == 4096, which is the case
on s390, this assertion fails.
The current scatter buffer size is also not a multiple of 64 or 128,
which are more common cache line sizes. If we can make both the start
and end of a scatter buffer cache-aligned, this will reduce the need
for read-modify-write operations on inter- processor links.
Fix the alignment by reducing EFX_RX_USR_BUF_SIZE to 2048 - 256 ==
1792. (We could use 2048 - L1_CACHE_BYTES, but EFX_RX_USR_BUF_SIZE
also affects user-level networking where a larger amount of
housekeeping data may be needed. Although this version of the driver
does not support user-level networking, I prefer to keep scattering
behaviour consistent with the out-of-tree version.)
This still doesn't fix the s390 build because like most architectures
it has NET_IP_ALIGN == 2. When NET_IP_ALIGN != 0 we cannot achieve
cache line alignment at either the start or end of a scatter buffer,
so there is actually no point in padding the buffers to a multiple of
the cache line size. All we need is 4-byte alignment of the network
header, so do that.
Adjust the assertions accordingly.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Ben Hutchings [Mon, 13 May 2013 11:58:31 +0000 (11:58 +0000)]
sfc: Delete EFX_PAGE_IP_ALIGN, equivalent to NET_IP_ALIGN
The two architectures that define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
(powerpc and x86) now both define NET_IP_ALIGN as 0, so there is no
need for this optimisation any more.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Michael Chan [Mon, 13 May 2013 11:04:16 +0000 (11:04 +0000)]
tg3: Fix data corruption on 5725 with TSO
The 5725 family of devices (asic rev 5762), corrupts TSO packets where
the buffer is within MSS bytes of a 4G boundary (4G, 8G etc.). Detect
this condition and trigger the workaround path.
Cc: <stable@vger.kernel.org>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Nithin Sujir [Mon, 13 May 2013 11:04:15 +0000 (11:04 +0000)]
tg3: Skip powering down function 0 on certain serdes devices
On the 5718, 5719 and 5720 serdes devices, powering down function 0
results in all the other ports being powered down. Add code to skip
function 0 power down.
v2:
- Modify tg3_phy_power_bug() function to use a switch instead of a
complicated if statement. Suggested by Joe Perches.
Cc: <stable@vger.kernel.org>
Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Mon, 13 May 2013 20:25:36 +0000 (13:25 -0700)]
Merge git://git./linux/kernel/git/davem/net
Pull networking fixes from David Miller:
"Several small bug fixes all over:
1) be2net driver uses wrong payload length when submitting MAC list
get requests to the chip. From Sathya Perla.
2) Fix mwifiex memory leak on driver unload, from Amitkumar Karwar.
3) Prevent random memory access in batman-adv, from Marek Lindner.
4) batman-adv doesn't check for pskb_trim_rcsum() errors, also from
Marek Lindner.
5) Fix fec crashes on rapid link up/down, from Frank Li.
6) Fix inner protocol grovelling in GSO, from Pravin B Shelar.
7) Link event validation fix in qlcnic from Rajesh Borundia.
8) Not all FEC chips can support checksum offload, fix from Shawn
Guo.
9) EXPORT_SYMBOL + inline doesn't make any sense, from Denis Efremov.
10) Fix race in passthru mode during device removal in macvlan, from
Jiri Pirko.
11) Fix RCU hash table lookup socket state race in ipv6, leading to
NULL pointer derefs, from Eric Dumazet.
12) Add several missing HAS_DMA kconfig dependencies, from Geert
Uyttterhoeven.
13) Fix bogus PCI resource management in 3c59x driver, from Sergei
Shtylyov.
14) Fix info leak in ipv6 GRE tunnel driver, from Amerigo Wang.
15) Fix device leak in ipv6 IPSEC policy layer, from Cong Wang.
16) DMA mapping leak fix in qlge from Thadeu Lima de Souza Cascardo.
17) Missing iounmap on probe failure in bna driver, from Wei Yongjun."
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (40 commits)
bna: add missing iounmap() on error in bnad_init()
qlge: fix dma map leak when the last chunk is not allocated
xfrm6: release dev before returning error
ipv6,gre: do not leak info to user-space
virtio_net: use default napi weight by default
emac: Fix EMAC soft reset on 460EX/GT
3c59x: fix PCI resource management
caif: CAIF_VIRTIO should depend on HAS_DMA
net/ethernet: MACB should depend on HAS_DMA
net/ethernet: ARM_AT91_ETHER should depend on HAS_DMA
net/wireless: ATH9K should depend on HAS_DMA
net/ethernet: STMMAC_ETH should depend on HAS_DMA
net/ethernet: NET_CALXEDA_XGMAC should depend on HAS_DMA
ipv6: do not clear pinet6 field
macvlan: fix passthru mode race between dev removal and rx path
ipv4: ip_output: remove inline marking of EXPORT_SYMBOL functions
net/mlx4: Strengthen VLAN tags/priorities enforcement in VST mode
net/mlx4_core: Add missing report on VST and spoof-checking dev caps
net: fec: enable hardware checksum only on imx6q-fec
qlcnic: Fix validation of link event command.
...
Wei Yongjun [Mon, 13 May 2013 04:26:06 +0000 (04:26 +0000)]
bna: add missing iounmap() on error in bnad_init()
Add the missing iounmap() before return from bnad_init()
in the error handling case.
Introduced by commit
01b54b1451853593739816a392485c4e2bee7dda
(bna: tx rx cleanup fix).
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Thadeu Lima de Souza Cascardo [Sat, 11 May 2013 09:15:37 +0000 (09:15 +0000)]
qlge: fix dma map leak when the last chunk is not allocated
qlge allocates chunks from a page that it maps and unmaps that page when
the last chunk is released. When the driver is unloaded or the card is
removed, all chunks are released and the page is unmapped for the last
chunk.
However, when the last chunk of a page is not allocated and the device
is removed, that page is not unmapped. In fact, its last reference is
not put and there's also a page leak. This bug prevents a device from
being properly hotplugged.
When the DMA API debug option is enabled, the following messages show
the pending DMA allocation after we remove the driver.
This patch fixes the bug by unmapping and putting the page from the ring
if its last chunk has not been allocated.
pci 0005:98:00.0: DMA-API: device driver has pending DMA allocations while released from device [count=1]
One of leaked entries details: [device address=0x0000000060a80000] [size=65536 bytes] [mapped with DMA_FROM_DEVICE] [mapped as page]
------------[ cut here ]------------
WARNING: at lib/dma-debug.c:746
Modules linked in: qlge(-) rpadlpar_io rpaphp pci_hotplug fuse [last unloaded: qlge]
NIP:
c0000000003fc3ec LR:
c0000000003fc3e8 CTR:
c00000000054de60
REGS:
c0000003ee9c74e0 TRAP: 0700 Tainted: G O (3.7.2)
MSR:
8000000000029032 <SF,EE,ME,IR,DR,RI> CR:
28002424 XER:
00000001
SOFTE: 1
CFAR:
c0000000007a39c8
TASK =
c0000003ee8d5c90[8406] 'rmmod' THREAD:
c0000003ee9c4000 CPU: 31
GPR00:
c0000000003fc3e8 c0000003ee9c7760 c000000000c789f8 00000000000000ee
GPR04:
0000000000000000 00000000000000ef 0000000000004000 0000000000010000
GPR08:
00000000000000be c000000000b22088 c000000000c4c218 00000000007c0000
GPR12:
0000000028002422 c00000000ff26c80 0000000000000000 000001001b0f1b40
GPR16:
00000000100cb9d8 0000000010093088 c000000000cdf910 0000000000000001
GPR20:
0000000000000000 c000000000dbfc00 0000000000000000 c000000000dbfb80
GPR24:
c0000003fafc9d80 0000000000000001 000000000001ff80 c0000003f38f7888
GPR28:
c000000000ddfc00 0000000000000400 c000000000bd7790 c000000000ddfb80
NIP [
c0000000003fc3ec] .dma_debug_device_change+0x22c/0x2b0
LR [
c0000000003fc3e8] .dma_debug_device_change+0x228/0x2b0
Call Trace:
[
c0000003ee9c7760] [
c0000000003fc3e8] .dma_debug_device_change+0x228/0x2b0 (unreliable)
[
c0000003ee9c7840] [
c00000000079a098] .notifier_call_chain+0x78/0xf0
[
c0000003ee9c78e0] [
c0000000000acc20] .__blocking_notifier_call_chain+0x70/0xb0
[
c0000003ee9c7990] [
c0000000004a9580] .__device_release_driver+0x100/0x140
[
c0000003ee9c7a20] [
c0000000004a9708] .driver_detach+0x148/0x150
[
c0000003ee9c7ac0] [
c0000000004a8144] .bus_remove_driver+0xc4/0x150
[
c0000003ee9c7b60] [
c0000000004aa58c] .driver_unregister+0x8c/0xe0
[
c0000003ee9c7bf0] [
c0000000004090b4] .pci_unregister_driver+0x34/0xf0
[
c0000003ee9c7ca0] [
d000000002231194] .qlge_exit+0x1c/0x34 [qlge]
[
c0000003ee9c7d20] [
c0000000000e36d8] .SyS_delete_module+0x1e8/0x290
[
c0000003ee9c7e30] [
c0000000000098d4] syscall_exit+0x0/0x94
Instruction dump:
7f26cb78 e818003a e87e81a0 e8f80028 e9180030 796b1f24 78001f24 7d6a5a14
7d2a002a e94b0020 483a7595 60000000 <
0fe00000>
2fb80000 40de0048 80120050
---[ end trace
4294f9abdb01031d ]---
Mapped at:
[<
d000000002222f54>] .ql_update_lbq+0x384/0x580 [qlge]
[<
d000000002227bd0>] .ql_clean_inbound_rx_ring+0x300/0xc60 [qlge]
[<
d0000000022288cc>] .ql_napi_poll_msix+0x39c/0x5a0 [qlge]
[<
c0000000006b3c50>] .net_rx_action+0x170/0x300
[<
c000000000081840>] .__do_softirq+0x170/0x300
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Acked-by: Jitendra Kalsaria <Jitendra.kalsaria@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Mon, 13 May 2013 15:12:18 +0000 (08:12 -0700)]
Merge tag 'spi-v3.10-rc1' of git://git./linux/kernel/git/broonie/spi
Pull spi updates from Mark Brown:
"A few driver specific fixes plus improved error handling in the
generic DT GPIO chipselect handling - not exciting but useful."
* tag 'spi-v3.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi/spi-atmel: BUG: fix doesn' support 16 bits transfers using PIO
spi/davinci: fix module build error
spi: Return error from of_spi_register_master on bad "cs-gpios" property
spi: Initialize cs_gpio and cs_gpios with -ENOENT
spi/atmel: fix speed_hz check in atmel_spi_transfer()
Linus Torvalds [Mon, 13 May 2013 14:59:59 +0000 (07:59 -0700)]
Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
"Just a few straggling fixes I hoovered up, and an intel fixes pull
from Daniel which fixes some regressions, and some mgag200 fixes from
Matrox."
* 'drm-next' of git://people.freedesktop.org/~airlied/linux:
drm/mgag200: Fix framebuffer base address programming
drm/mgag200: Convert counter delays to jiffies
drm/mgag200: Fix writes into MGA1064_PIX_CLK_CTL register
drm/mgag200: Don't change unrelated registers during modeset
drm: Only print a debug message when the polled connector has changed
drm: Make the HPD status updates debug logs more readable
drm: Use names of ioctls in debug traces
drm: Remove pointless '-' characters from drm_fb_helper documentation
drm: Add kernel-doc for drm_fb_helper_funcs->initial_config
drm: refactor call to request_module
drm: Don't prune modes loudly when a connector is disconnected
drm: Add missing break in the command line mode parsing code
drm/i915: clear the stolen fb before resuming
Revert "drm/i915: Calculate correct stolen size for GEN7+"
drm/i915: hsw: fix link training for eDP on port-A
Revert "drm/i915: revert eDP bpp clamping code changes"
drm: don't check modeset locks in panic handler
drm/i915: Fix pipe enabled mask for pipe C in WM calculations
drm/mm: fix dump table BUG
drm/i915: Always normalize return timeout for wait_timeout_ioctl
Linus Torvalds [Mon, 13 May 2013 14:59:08 +0000 (07:59 -0700)]
Merge tag 'fixes-for-linus' of git://git./linux/kernel/git/rusty/linux
Pull virtio/lguest fixes from Rusty Russell:
"Missing license tag and some fallout from the lguest pagetable rework"
* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
lguest: clear cached last cpu when guest_set_pgd() called.
Add missing module license tag to vring helpers.
Mark Brown [Mon, 13 May 2013 14:27:18 +0000 (18:27 +0400)]
Merge remote-tracking branch 'spi/fix/grant' into spi-linus
Mark Brown [Mon, 13 May 2013 14:27:16 +0000 (18:27 +0400)]
Merge remote-tracking branch 'spi/fix/atmel' into spi-linus
Christopher Harvey [Wed, 8 May 2013 19:10:38 +0000 (19:10 +0000)]
drm/mgag200: Fix framebuffer base address programming
Higher bits of the base address of framebuffers weren't being
programmed properly. This caused framebuffers that didn't happen to be
allocated at a low enough address to not be displayed properly.
Signed-off-by: Christopher Harvey <charvey@matrox.com>
Signed-off-by: Mathieu Larouche <mathieu.larouche@matrox.com>
Acked-by: Julia Lemire <jlemire@matrox.com>
Tested-by: Julia Lemire <jlemire@matrox.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Christopher Harvey [Mon, 6 May 2013 15:56:17 +0000 (15:56 +0000)]
drm/mgag200: Convert counter delays to jiffies
Signed-off-by: Christopher Harvey <charvey@matrox.com>
Acked-by: Julia Lemire <jlemire@matrox.com>
Tested-by: Julia Lemire <jlemire@matrox.com>
Acked-by: Mathieu Larouche <mathieu.larouche@matrox.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Christopher Harvey [Fri, 12 Apr 2013 22:24:05 +0000 (22:24 +0000)]
drm/mgag200: Fix writes into MGA1064_PIX_CLK_CTL register
The original line,
WREG_DAC(MGA1064_PIX_CLK_CTL_CLK_DIS, tmp);
wrote tmp into MGA1064_PIX_CLK_CTL_CLK_DIS, where
MGA1064_PIX_CLK_CTL_CLK_DIS is an offset into
MGA1064_PIX_CLK_CTL. Change the line to write properly into
MGA1064_PIX_CLK_CTL. There were other chunks of code nearby that use
the same pattern (but work correctly), so this patch updates them all
to use this new (slightly more efficient) write pattern. The WREG_DAC
macro was causing the DAC_INDEX register to be set to the same value
twice. WREG8(DAC_DATA, foo) takes advantage of the fact that DAC_INDEX
is already at the value we want.
Signed-off-by: Christopher Harvey <charvey@matrox.com>
Acked-by: Julia Lemire <jlemire@matrox.com>
Tested-by: Julia Lemire <jlemire@matrox.com>
Acked-by: Mathieu Larouche <mathieu.larouche@matrox.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Christopher Harvey [Fri, 12 Apr 2013 20:42:19 +0000 (20:42 +0000)]
drm/mgag200: Don't change unrelated registers during modeset
Registers in indices below 0x18 are totally unrelated to modesetting,
so don't write 0's, or anything else into them on modeset. Most of
these registers are hardware cursor related, so this existing code
interferes with hardware cursor development.
Signed-off-by: Christopher Harvey <charvey@matrox.com>
Tested-by: Julia Lemire <jlemire@matrox.com>
Acked-by: Julia Lemire <jlemire@matrox.com>
Acked-by: Mathieu Larouche <mathieu.larouche@matrox.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Lespiau, Damien [Fri, 10 May 2013 12:36:44 +0000 (12:36 +0000)]
drm: Only print a debug message when the polled connector has changed
Suggested-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Lespiau, Damien [Fri, 10 May 2013 12:36:42 +0000 (12:36 +0000)]
drm: Make the HPD status updates debug logs more readable
Instead of just printing "status updated from 1 to 2", make those enum
numbers immediately readable.
v2: Also patch output_poll_execute() (Daniel Vetter)
v3: Use drm_get_connector_status_name (Ville Syrjälä)
Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org> (for v1)
Signed-off-by: Dave Airlie <airlied@redhat.com>
Cong Wang [Thu, 9 May 2013 22:40:00 +0000 (22:40 +0000)]
xfrm6: release dev before returning error
We forget to call dev_put() on error path in xfrm6_fill_dst(),
its caller doesn't handle this.
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <amwang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Amerigo Wang [Thu, 9 May 2013 21:56:37 +0000 (21:56 +0000)]
ipv6,gre: do not leak info to user-space
There is a hole in struct ip6_tnl_parm2, so we have to
zero the struct on stack before copying it to user-space.
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <amwang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Amerigo Wang [Thu, 9 May 2013 19:50:51 +0000 (19:50 +0000)]
virtio_net: use default napi weight by default
Since commit
82dc3c63c692b1e1d5937 ("net: introduce NAPI_POLL_WEIGHT")
we warn drivers when they use napi weight higher than NAPI_POLL_WEIGHT,
but virtio_net still uses 128 by default. This patch makes its default
value to NAPI_POLL_WEIGHT.
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <amwang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Petri Gynther [Thu, 9 May 2013 16:50:00 +0000 (16:50 +0000)]
emac: Fix EMAC soft reset on 460EX/GT
Fix EMAC soft reset on 460EX/GT to select the right PHY clock source
before and after the soft reset.
EMAC with PHY should use the clock from PHY during soft reset.
EMAC without PHY should use the internal clock during soft reset.
PPC460EX/GT Embedded Processor Advanced User's Manual
section 28.10.1 Mode Register 0 (EMACx_MR0) states:
Note: The PHY must provide a TX Clk in order to perform a soft reset
of the EMAC. If none is present, select the internal clock
(SDR0_ETH_CFG[EMACx_PHY_CLK] = 1).
After a soft reset, select the external clock.
Without the fix, 460EX/GT-based boards with RGMII PHYs attached to
EMACs experience EMAC interrupt storm and system watchdog reset when
issuing "ifconfig eth0 down" + "ifconfig eth0 up" a few times.
The system enters endless loop of serving emac_irq() with EMACx_ISR
register stuck at value 0x10000000 (Rx parity error).
With the fix, the above issue is no longer observed.
Signed-off-by: Petri Gynther <pgynther@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Sergei Shtylyov [Thu, 9 May 2013 11:14:07 +0000 (11:14 +0000)]
3c59x: fix PCI resource management
The driver wrongly claimed I/O ports at an address returned by pci_iomap() --
even if it was passed an MMIO address. Fix this by claiming/releasing all PCI
resources in the PCI driver's probe()/remove() methods instead and get rid of
'must_free_region' flag weirdness (why would Cardbus claim anything for us?).
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Sun, 12 May 2013 00:14:08 +0000 (17:14 -0700)]
Linux 3.10-rc1
Linus Torvalds [Sun, 12 May 2013 00:04:59 +0000 (17:04 -0700)]
Merge tag 'trace-fixes-v3.10' of git://git./linux/kernel/git/rostedt/linux-trace
Pull tracing/kprobes update from Steven Rostedt:
"The majority of these changes are from Masami Hiramatsu bringing
kprobes up to par with the latest changes to ftrace (multi buffering
and the new function probes).
He also discovered and fixed some bugs in doing so. When pulling in
his patches, I also found a few minor bugs as well and fixed them.
This also includes a compile fix for some archs that select the ring
buffer but not tracing.
I based this off of the last patch you took from me that fixed the
merge conflict error, as that was the commit that had all the changes
I needed for this set of changes."
* tag 'trace-fixes-v3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
tracing/kprobes: Support soft-mode disabling
tracing/kprobes: Support ftrace_event_file base multibuffer
tracing/kprobes: Pass trace_probe directly from dispatcher
tracing/kprobes: Increment probe hit-count even if it is used by perf
tracing/kprobes: Use bool for retprobe checker
ftrace: Fix function probe when more than one probe is added
ftrace: Fix the output of enabled_functions debug file
ftrace: Fix locking in register_ftrace_function_probe()
tracing: Add helper function trace_create_new_event() to remove duplicate code
tracing: Modify soft-mode only if there's no other referrer
tracing: Indicate enabled soft-mode in enable file
tracing/kprobes: Fix to increment return event probe hit-count
ftrace: Cleanup regex_lock and ftrace_lock around hash updating
ftrace, kprobes: Fix a deadlock on ftrace_regex_lock
ftrace: Have ftrace_regex_write() return either read or error
tracing: Return error if register_ftrace_function_probe() fails for event_enable_func()
tracing: Don't succeed if event_enable_func did not register anything
ring-buffer: Select IRQ_WORK
Geert Uytterhoeven [Thu, 9 May 2013 11:04:52 +0000 (11:04 +0000)]
caif: CAIF_VIRTIO should depend on HAS_DMA
If NO_DMA=y:
drivers/built-in.o: In function `cfv_destroy_genpool':
drivers/net/caif/caif_virtio.c:364: undefined reference to `dma_free_coherent'
drivers/built-in.o: In function `cfv_create_genpool':
drivers/net/caif/caif_virtio.c:397: undefined reference to `dma_alloc_coherent'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
Cc: David S. Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Geert Uytterhoeven [Thu, 9 May 2013 11:04:50 +0000 (11:04 +0000)]
net/ethernet: MACB should depend on HAS_DMA
If NO_DMA=y:
drivers/built-in.o: In function `macb_free_consistent':
drivers/net/ethernet/cadence/macb.c:878: undefined reference to `dma_free_coherent'
drivers/net/ethernet/cadence/macb.c:883: undefined reference to `dma_free_coherent'
drivers/net/ethernet/cadence/macb.c:888: undefined reference to `dma_free_coherent'
drivers/built-in.o: In function `macb_alloc_consistent':
drivers/net/ethernet/cadence/macb.c:905: undefined reference to `dma_alloc_coherent'
drivers/built-in.o: In function `macb_tx_interrupt':
drivers/net/ethernet/cadence/macb.c:515: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `macb_tx_error_task':
drivers/net/ethernet/cadence/macb.c:457: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `macb_start_xmit':
drivers/net/ethernet/cadence/macb.c:838: undefined reference to `dma_map_single'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Geert Uytterhoeven [Thu, 9 May 2013 11:04:49 +0000 (11:04 +0000)]
net/ethernet: ARM_AT91_ETHER should depend on HAS_DMA
If NO_DMA=y:
drivers/built-in.o: In function `at91ether_start':
drivers/net/ethernet/cadence/at91_ether.c:49: undefined reference to `dma_alloc_coherent'
drivers/net/ethernet/cadence/at91_ether.c:60: undefined reference to `dma_free_coherent'
drivers/built-in.o: In function `at91ether_interrupt':
drivers/net/ethernet/cadence/at91_ether.c:250: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `at91ether_start_xmit':
drivers/net/ethernet/cadence/at91_ether.c:169: undefined reference to `dma_map_single'
drivers/built-in.o: In function `at91ether_close':
drivers/net/ethernet/cadence/at91_ether.c:145: undefined reference to `dma_free_coherent'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Geert Uytterhoeven [Thu, 9 May 2013 11:04:47 +0000 (11:04 +0000)]
net/wireless: ATH9K should depend on HAS_DMA
If NO_DMA=y:
drivers/built-in.o: In function `ath9k_beacon_generate':
drivers/net/wireless/ath/ath9k/beacon.c:146: undefined reference to `dma_unmap_single'
drivers/net/wireless/ath/ath9k/beacon.c:174: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/beacon.c:176: undefined reference to `dma_mapping_error'
drivers/built-in.o: In function `ath9k_beacon_remove_slot':
drivers/net/wireless/ath/ath9k/beacon.c:252: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_descdma_setup':
drivers/net/wireless/ath/ath9k/init.c:382: undefined reference to `dmam_alloc_coherent'
drivers/built-in.o: In function `ath_edma_get_buffers':
drivers/net/wireless/ath/ath9k/recv.c:616: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_get_next_rx_buf':
drivers/net/wireless/ath/ath9k/recv.c:740: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_rx_edma_cleanup':
drivers/net/wireless/ath/ath9k/recv.c:176: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_rx_cleanup':
drivers/net/wireless/ath/ath9k/recv.c:340: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_rx_edma_buf_link':
drivers/net/wireless/ath/ath9k/recv.c:122: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_rx_tasklet':
drivers/net/wireless/ath/ath9k/recv.c:1275: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/recv.c:1277: undefined reference to `dma_mapping_error'
drivers/net/wireless/ath/ath9k/recv.c:1283: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_rx_edma_init':
drivers/net/wireless/ath/ath9k/recv.c:226: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/recv.c:229: undefined reference to `dma_mapping_error'
drivers/built-in.o: In function `ath_rx_init':
drivers/net/wireless/ath/ath9k/recv.c:303: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/recv.c:306: undefined reference to `dma_mapping_error'
drivers/built-in.o: In function `ath_tx_complete_buf':
drivers/net/wireless/ath/ath9k/xmit.c:2088: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `ath_txstatus_setup':
drivers/net/wireless/ath/ath9k/xmit.c:2344: undefined reference to `dmam_alloc_coherent'
drivers/built-in.o: In function `ath_tx_set_retry':
drivers/net/wireless/ath/ath9k/xmit.c:307: undefined reference to `dma_sync_single_for_cpu'
drivers/built-in.o: In function `ath_tx_setup_buffer':
drivers/net/wireless/ath/ath9k/xmit.c:1887: undefined reference to `dma_map_single'
drivers/net/wireless/ath/ath9k/xmit.c:1889: undefined reference to `dma_mapping_error'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Cc: John W. Linville <linville@tuxdriver.com>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Geert Uytterhoeven [Thu, 9 May 2013 11:04:46 +0000 (11:04 +0000)]
net/ethernet: STMMAC_ETH should depend on HAS_DMA
If NO_DMA=y:
drivers/built-in.o: In function `dma_free_tx_skbufs':
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:1141: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `dma_free_rx_skbufs':
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:1120: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `free_dma_desc_resources':
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:1159: undefined reference to `dma_free_coherent'
drivers/built-in.o: In function `stmmac_init_rx_buffers':
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:980: undefined reference to `dma_map_single'
drivers/built-in.o: In function `init_dma_desc_rings':
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:1015: undefined reference to `dma_alloc_coherent'
drivers/built-in.o: In function `stmmac_tx_clean':
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:1250: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `stmmac_rx':
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:2044: undefined reference to `dma_unmap_single'
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:2082: undefined reference to `dma_unmap_single'
drivers/built-in.o: In function `stmmac_rx_refill':
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:1967: undefined reference to `dma_map_single'
drivers/built-in.o: In function `stmmac_xmit':
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:1845: undefined reference to `dma_map_single'
drivers/built-in.o: In function `skb_frag_dma_map':
include/linux/skbuff.h:2184: undefined reference to `dma_map_page'
drivers/built-in.o: In function `stmmac_jumbo_frm':
drivers/net/ethernet/stmicro/stmmac/ring_mode.c:40: undefined reference to `dma_map_single'
drivers/built-in.o: In function `stmmac_jumbo_frm':
drivers/net/ethernet/stmicro/stmmac/chain_mode.c:48: undefined reference to `dma_map_single'
drivers/net/ethernet/stmicro/stmmac/chain_mode.c:55: undefined reference to `dma_map_single'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Geert Uytterhoeven [Thu, 9 May 2013 11:04:45 +0000 (11:04 +0000)]
net/ethernet: NET_CALXEDA_XGMAC should depend on HAS_DMA
If NO_DMA=y:
drivers/built-in.o: In function `xgmac_xmit':
drivers/net/ethernet/calxeda/xgmac.c:1102: undefined reference to `dma_mapping_error'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Rob Herring <rob.herring@calxeda.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Thu, 9 May 2013 10:28:16 +0000 (10:28 +0000)]
ipv6: do not clear pinet6 field
We have seen multiple NULL dereferences in __inet6_lookup_established()
After analysis, I found that inet6_sk() could be NULL while the
check for sk_family == AF_INET6 was true.
Bug was added in linux-2.6.29 when RCU lookups were introduced in UDP
and TCP stacks.
Once an IPv6 socket, using SLAB_DESTROY_BY_RCU is inserted in a hash
table, we no longer can clear pinet6 field.
This patch extends logic used in commit
fcbdf09d9652c891
("net: fix nulls list corruptions in sk_prot_alloc")
TCP/UDP/UDPLite IPv6 protocols provide their own .clear_sk() method
to make sure we do not clear pinet6 field.
At socket clone phase, we do not really care, as cloning the parent (non
NULL) pinet6 is not adding a fatal race.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jiri Pirko [Thu, 9 May 2013 04:23:40 +0000 (04:23 +0000)]
macvlan: fix passthru mode race between dev removal and rx path
Currently, if macvlan in passthru mode is created and data are rxed and
you remove this device, following panic happens:
NULL pointer dereference at
0000000000000198
IP: [<
ffffffffa0196058>] macvlan_handle_frame+0x153/0x1f7 [macvlan]
I'm using following script to trigger this:
<script>
while [ 1 ]
do
ip link add link e1 name macvtap0 type macvtap mode passthru
ip link set e1 up
ip link set macvtap0 up
IFINDEX=`ip link |grep macvtap0 | cut -f 1 -d ':'`
cat /dev/tap$IFINDEX >/dev/null &
ip link del dev macvtap0
done
</script>
I run this script while "ping -f" is running on another machine to send
packets to e1 rx.
Reason of the panic is that list_first_entry() is blindly called in
macvlan_handle_frame() even if the list was empty. vlan is set to
incorrect pointer which leads to the crash.
I'm fixing this by protecting port->vlans list by rcu and by preventing
from getting incorrect pointer in case the list is empty.
Introduced by: commit
eb06acdc85585f2 "macvlan: Introduce 'passthru' mode to takeover the underlying device"
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Sat, 11 May 2013 23:23:44 +0000 (16:23 -0700)]
Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge
Included changes:
- fix parsing of user typed protocol string to avoid random memory access in
some cases
- check pskb_trim_rcsum() return value
- prevent DAT from sending ARP replies when not needed
- reorder the main clean up routine to prevent race conditions
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Sat, 11 May 2013 23:19:30 +0000 (16:19 -0700)]
Merge tag 'stable/for-linus-3.10-rc0-tag-two' of git://git./linux/kernel/git/konrad/xen
Pull Xen bug-fixes from Konrad Rzeszutek Wilk:
- More fixes in the vCPU PVHVM hotplug path.
- Add more documentation.
- Fix various ARM related issues in the Xen generic drivers.
- Updates in the xen-pciback driver per Bjorn's updates.
- Mask the x2APIC feature for PV guests.
* tag 'stable/for-linus-3.10-rc0-tag-two' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
xen/pci: Used cached MSI-X capability offset
xen/pci: Use PCI_MSIX_TABLE_BIR, not PCI_MSIX_FLAGS_BIRMASK
xen: clear IRQ_NOAUTOEN and IRQ_NOREQUEST
xen: mask x2APIC feature in PV
xen: SWIOTLB is only used on x86
xen/spinlock: Fix check from greater than to be also be greater or equal to.
xen/smp/pvhvm: Don't point per_cpu(xen_vpcu, 33 and larger) to shared_info
xen/vcpu: Document the xen_vcpu_info and xen_vcpu
xen/vcpu/pvhvm: Fix vcpu hotplugging hanging.
Denis Efremov [Wed, 8 May 2013 23:19:42 +0000 (23:19 +0000)]
ipv4: ip_output: remove inline marking of EXPORT_SYMBOL functions
EXPORT_SYMBOL and inline directives are contradictory to each other.
The patch fixes this inconsistency.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Denis Efremov <yefremov.denis@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Rony Efraim [Wed, 8 May 2013 22:22:35 +0000 (22:22 +0000)]
net/mlx4: Strengthen VLAN tags/priorities enforcement in VST mode
Make sure that the following steps are taken:
- drop packets sent by the VF with vlan tag
- block packets with vlan tag which are steered to the VF
- drop/block tagged packets when the policy is priority-tagged
- make sure VLAN stripping for received packets is set
- make sure force UP bit for the VF QP is set
Use enum values for all the above instead of numerical bit offsets.
Signed-off-by: Rony Efraim <ronye@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Or Gerlitz [Wed, 8 May 2013 22:22:34 +0000 (22:22 +0000)]
net/mlx4_core: Add missing report on VST and spoof-checking dev caps
Commits
e6b6a23 "net/mlx4: Add VF MAC spoof checking support" and
3f7fb021 "net/mlx4: Add set VF default vlan ID and priority support"
missed reporting in the device capabilities dump when these features
are actually supported. Also two too noisy debug messages which produce
message on every QP opened by a VF, were left in the code, fix that.
Signed-off-by: Rony Efraim <ronye@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / log