Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

+2

Documentation/devicetree/bindings/net/smsc-lan91c111.txt

··· 11 11 are supported on the device. Valid value for SMSC LAN91c111 are 12 12 1, 2 or 4. If it's omitted or invalid, the size would be 2 meaning 13 13 16-bit access only. 14 + - power-gpios: GPIO to control the PWRDWN pin 15 + - reset-gpios: GPIO to control the RESET pin

+33

Documentation/ptp/testptp.mk

··· 1 + # PTP 1588 clock support - User space test program 2 + # 3 + # Copyright (C) 2010 OMICRON electronics GmbH 4 + # 5 + # This program is free software; you can redistribute it and/or modify 6 + # it under the terms of the GNU General Public License as published by 7 + # the Free Software Foundation; either version 2 of the License, or 8 + # (at your option) any later version. 9 + # 10 + # This program is distributed in the hope that it will be useful, 11 + # but WITHOUT ANY WARRANTY; without even the implied warranty of 12 + # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 + # GNU General Public License for more details. 14 + # 15 + # You should have received a copy of the GNU General Public License 16 + # along with this program; if not, write to the Free Software 17 + # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 18 + 19 + CC = $(CROSS_COMPILE)gcc 20 + INC = -I$(KBUILD_OUTPUT)/usr/include 21 + CFLAGS = -Wall $(INC) 22 + LDLIBS = -lrt 23 + PROGS = testptp 24 + 25 + all: $(PROGS) 26 + 27 + testptp: testptp.o 28 + 29 + clean: 30 + rm -f testptp.o 31 + 32 + distclean: clean 33 + rm -f $(PROGS)

+2

arch/arm/boot/dts/omap3-n900.dts

··· 668 668 bank-width = <2>; 669 669 pinctrl-names = "default"; 670 670 pinctrl-0 = <&ethernet_pins>; 671 + power-gpios = <&gpio3 22 GPIO_ACTIVE_HIGH>; /* gpio86 */ 672 + reset-gpios = <&gpio6 4 GPIO_ACTIVE_HIGH>; /* gpio164 */ 671 673 gpmc,device-width = <2>; 672 674 gpmc,sync-clk-ps = <0>; 673 675 gpmc,cs-on-ns = <0>;

-3

arch/arm/mach-omap2/pdata-quirks.c

··· 252 252 platform_device_register(&omap3_rom_rng_device); 253 253 254 254 } 255 - 256 - /* Only on some development boards */ 257 - gpio_request_one(164, GPIOF_OUT_INIT_LOW, "smc91x reset"); 258 255 } 259 256 260 257 static void __init omap3_tao3530_legacy_init(void)

+3 -2

drivers/bcma/host_pci.c

··· 275 275 static const struct pci_device_id bcma_pci_bridge_tbl[] = { 276 276 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) }, 277 277 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4313) }, 278 - { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) }, 278 + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) }, /* 0xa8d8 */ 279 279 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) }, 280 280 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) }, 281 281 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4357) }, ··· 285 285 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) }, 286 286 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) }, 287 287 { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) }, 288 - { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) }, /* 0xA8DB */ 288 + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) }, /* 0xa8db, BCM43217 (sic!) */ 289 + { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43228) }, /* 0xa8dc */ 289 290 { 0, }, 290 291 }; 291 292 MODULE_DEVICE_TABLE(pci, bcma_pci_bridge_tbl);

+1 -1

drivers/bcma/main.c

··· 132 132 return false; 133 133 } 134 134 135 - #ifdef CONFIG_OF 135 + #if defined(CONFIG_OF) && defined(CONFIG_OF_ADDRESS) 136 136 static struct device_node *bcma_of_find_child_device(struct platform_device *parent, 137 137 struct bcma_device *core) 138 138 {

+8 -2

drivers/infiniband/hw/mlx4/main.c

··· 1173 1173 err = __mlx4_ib_create_flow(qp, flow_attr, domain, type[i], 1174 1174 &mflow->reg_id[i]); 1175 1175 if (err) 1176 - goto err_free; 1176 + goto err_create_flow; 1177 1177 i++; 1178 1178 } 1179 1179 1180 1180 if (i < ARRAY_SIZE(type) && flow_attr->type == IB_FLOW_ATTR_NORMAL) { 1181 1181 err = mlx4_ib_tunnel_steer_add(qp, flow_attr, &mflow->reg_id[i]); 1182 1182 if (err) 1183 - goto err_free; 1183 + goto err_create_flow; 1184 + i++; 1184 1185 } 1185 1186 1186 1187 return &mflow->ibflow; 1187 1188 1189 + err_create_flow: 1190 + while (i) { 1191 + (void)__mlx4_ib_destroy_flow(to_mdev(qp->device)->dev, mflow->reg_id[i]); 1192 + i--; 1193 + } 1188 1194 err_free: 1189 1195 kfree(mflow); 1190 1196 return ERR_PTR(err);

+2

drivers/net/Kconfig

··· 135 135 config MACVTAP 136 136 tristate "MAC-VLAN based tap driver" 137 137 depends on MACVLAN 138 + depends on INET 138 139 help 139 140 This adds a specialized tap character device driver that is based 140 141 on the MAC-VLAN network interface, called macvtap. A macvtap device ··· 201 200 202 201 config TUN 203 202 tristate "Universal TUN/TAP device driver support" 203 + depends on INET 204 204 select CRC32 205 205 ---help--- 206 206 TUN/TAP provides packet reception and transmission for user space

+1 -1

drivers/net/dsa/mv88e6171.c

··· 395 395 } 396 396 397 397 struct dsa_switch_driver mv88e6171_switch_driver = { 398 - .tag_protocol = DSA_TAG_PROTO_DSA, 398 + .tag_protocol = DSA_TAG_PROTO_EDSA, 399 399 .priv_size = sizeof(struct mv88e6xxx_priv_state), 400 400 .probe = mv88e6171_probe, 401 401 .setup = mv88e6171_setup,

+13 -9

drivers/net/ethernet/amd/xgbe/xgbe-drv.c

··· 1465 1465 { 1466 1466 struct xgbe_prv_data *pdata = netdev_priv(netdev); 1467 1467 struct xgbe_hw_if *hw_if = &pdata->hw_if; 1468 - unsigned int rxcsum, rxvlan, rxvlan_filter; 1468 + netdev_features_t rxcsum, rxvlan, rxvlan_filter; 1469 1469 1470 1470 rxcsum = pdata->netdev_features & NETIF_F_RXCSUM; 1471 1471 rxvlan = pdata->netdev_features & NETIF_F_HW_VLAN_CTAG_RX; ··· 1598 1598 struct skb_shared_hwtstamps *hwtstamps; 1599 1599 unsigned int incomplete, error, context_next, context; 1600 1600 unsigned int len, put_len, max_len; 1601 - int received = 0; 1601 + unsigned int received = 0; 1602 + int packet_count = 0; 1602 1603 1603 1604 DBGPR("-->xgbe_rx_poll: budget=%d\n", budget); 1604 1605 ··· 1609 1608 1610 1609 rdata = XGBE_GET_DESC_DATA(ring, ring->cur); 1611 1610 packet = &ring->packet_data; 1612 - while (received < budget) { 1611 + while (packet_count < budget) { 1613 1612 DBGPR(" cur = %d\n", ring->cur); 1614 1613 1615 1614 /* First time in loop see if we need to restore state */ ··· 1663 1662 if (packet->errors) 1664 1663 DBGPR("Error in received packet\n"); 1665 1664 dev_kfree_skb(skb); 1666 - continue; 1665 + goto next_packet; 1667 1666 } 1668 1667 1669 1668 if (!context) { ··· 1678 1677 } 1679 1678 1680 1679 dev_kfree_skb(skb); 1681 - continue; 1680 + goto next_packet; 1682 1681 } 1683 1682 memcpy(skb_tail_pointer(skb), rdata->skb->data, 1684 1683 put_len); ··· 1695 1694 1696 1695 /* Stray Context Descriptor? */ 1697 1696 if (!skb) 1698 - continue; 1697 + goto next_packet; 1699 1698 1700 1699 /* Be sure we don't exceed the configured MTU */ 1701 1700 max_len = netdev->mtu + ETH_HLEN; ··· 1706 1705 if (skb->len > max_len) { 1707 1706 DBGPR("packet length exceeds configured MTU\n"); 1708 1707 dev_kfree_skb(skb); 1709 - continue; 1708 + goto next_packet; 1710 1709 } 1711 1710 1712 1711 #ifdef XGMAC_ENABLE_RX_PKT_DUMP ··· 1740 1739 1741 1740 netdev->last_rx = jiffies; 1742 1741 napi_gro_receive(&pdata->napi, skb); 1742 + 1743 + next_packet: 1744 + packet_count++; 1743 1745 } 1744 1746 1745 1747 /* Check if we need to save state before leaving */ ··· 1756 1752 rdata->state.error = error; 1757 1753 } 1758 1754 1759 - DBGPR("<--xgbe_rx_poll: received = %d\n", received); 1755 + DBGPR("<--xgbe_rx_poll: packet_count = %d\n", packet_count); 1760 1756 1761 - return received; 1757 + return packet_count; 1762 1758 } 1763 1759 1764 1760 static int xgbe_poll(struct napi_struct *napi, int budget)

+7 -9

drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c

··· 124 124 { 125 125 struct net_device *ndev = p->ndev; 126 126 u32 data; 127 - int i; 127 + int i = 0; 128 128 129 129 xgene_enet_wr_diag_csr(p, ENET_CFG_MEM_RAM_SHUTDOWN_ADDR, 0); 130 - for (i = 0; i < 10 && data != ~0U ; i++) { 130 + do { 131 131 usleep_range(100, 110); 132 132 data = xgene_enet_rd_diag_csr(p, ENET_BLOCK_MEM_RDY_ADDR); 133 - } 133 + if (data == ~0U) 134 + return 0; 135 + } while (++i < 10); 134 136 135 - if (data != ~0U) { 136 - netdev_err(ndev, "Failed to release memory from shutdown\n"); 137 - return -ENODEV; 138 - } 139 - 140 - return 0; 137 + netdev_err(ndev, "Failed to release memory from shutdown\n"); 138 + return -ENODEV; 141 139 } 142 140 143 141 static void xgene_enet_config_ring_if_assoc(struct xgene_enet_pdata *p)

+5 -6

drivers/net/ethernet/broadcom/bcmsysport.c

··· 1397 1397 /* Enable NAPI */ 1398 1398 napi_enable(&priv->napi); 1399 1399 1400 + /* Enable RX interrupt and TX ring full interrupt */ 1401 + intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL); 1402 + 1400 1403 phy_start(priv->phydev); 1401 1404 1402 1405 /* Enable TX interrupts for the 32 TXQs */ ··· 1501 1498 ret = rdma_enable_set(priv, 1); 1502 1499 if (ret) 1503 1500 goto out_free_rx_ring; 1504 - 1505 - /* Enable RX interrupt and TX ring full interrupt */ 1506 - intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL); 1507 1501 1508 1502 /* Turn on TDMA */ 1509 1503 ret = tdma_enable_set(priv, 1); ··· 1858 1858 if (!netif_running(dev)) 1859 1859 return 0; 1860 1860 1861 + umac_reset(priv); 1862 + 1861 1863 /* We may have been suspended and never received a WOL event that 1862 1864 * would turn off MPD detection, take care of that now 1863 1865 */ ··· 1886 1884 } 1887 1885 1888 1886 netif_device_attach(dev); 1889 - 1890 - /* Enable RX interrupt and TX ring full interrupt */ 1891 - intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL); 1892 1887 1893 1888 /* RX pipe enable */ 1894 1889 topctrl_writel(priv, 0, RX_FLUSH_CNTL);

+1 -4

drivers/net/ethernet/broadcom/cnic.c

··· 382 382 if (l5_cid >= MAX_CM_SK_TBL_SZ) 383 383 break; 384 384 385 - rcu_read_lock(); 386 385 if (!rcu_access_pointer(cp->ulp_ops[CNIC_ULP_L4])) { 387 386 rc = -ENODEV; 388 - rcu_read_unlock(); 389 387 break; 390 388 } 391 389 csk = &cp->csk_tbl[l5_cid]; ··· 412 414 } 413 415 } 414 416 csk_put(csk); 415 - rcu_read_unlock(); 416 417 rc = 0; 417 418 } 418 419 } ··· 612 615 cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL); 613 616 614 617 mutex_lock(&cnic_lock); 615 - if (rcu_dereference(cp->ulp_ops[ulp_type])) { 618 + if (rcu_access_pointer(cp->ulp_ops[ulp_type])) { 616 619 RCU_INIT_POINTER(cp->ulp_ops[ulp_type], NULL); 617 620 cnic_put(dev); 618 621 } else {

+51 -4

drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c

··· 60 60 dcb->dcb_version = FW_PORT_DCB_VER_AUTO; 61 61 } 62 62 63 + static void cxgb4_dcb_cleanup_apps(struct net_device *dev) 64 + { 65 + struct port_info *pi = netdev2pinfo(dev); 66 + struct adapter *adap = pi->adapter; 67 + struct port_dcb_info *dcb = &pi->dcb; 68 + struct dcb_app app; 69 + int i, err; 70 + 71 + /* zero priority implies remove */ 72 + app.priority = 0; 73 + 74 + for (i = 0; i < CXGB4_MAX_DCBX_APP_SUPPORTED; i++) { 75 + /* Check if app list is exhausted */ 76 + if (!dcb->app_priority[i].protocolid) 77 + break; 78 + 79 + app.protocol = dcb->app_priority[i].protocolid; 80 + 81 + if (dcb->dcb_version == FW_PORT_DCB_VER_IEEE) { 82 + app.selector = dcb->app_priority[i].sel_field + 1; 83 + err = dcb_ieee_setapp(dev, &app); 84 + } else { 85 + app.selector = !!(dcb->app_priority[i].sel_field); 86 + err = dcb_setapp(dev, &app); 87 + } 88 + 89 + if (err) { 90 + dev_err(adap->pdev_dev, 91 + "Failed DCB Clear %s Application Priority: sel=%d, prot=%d, , err=%d\n", 92 + dcb_ver_array[dcb->dcb_version], app.selector, 93 + app.protocol, -err); 94 + break; 95 + } 96 + } 97 + } 98 + 63 99 /* Finite State machine for Data Center Bridging. 64 100 */ 65 101 void cxgb4_dcb_state_fsm(struct net_device *dev, ··· 116 80 /* we're going to use Host DCB */ 117 81 dcb->state = CXGB4_DCB_STATE_HOST; 118 82 dcb->supported = CXGB4_DCBX_HOST_SUPPORT; 119 - dcb->enabled = 1; 120 83 break; 121 84 } 122 85 ··· 180 145 * state. We need to reset back to a ground state 181 146 * of incomplete. 182 147 */ 148 + cxgb4_dcb_cleanup_apps(dev); 183 149 cxgb4_dcb_state_init(dev); 184 150 dcb->state = CXGB4_DCB_STATE_FW_INCOMPLETE; 185 151 dcb->supported = CXGB4_DCBX_FW_SUPPORT; ··· 384 348 static u8 cxgb4_setstate(struct net_device *dev, u8 enabled) 385 349 { 386 350 struct port_info *pi = netdev2pinfo(dev); 351 + 352 + /* If DCBx is host-managed, dcb is enabled by outside lldp agents */ 353 + if (pi->dcb.state == CXGB4_DCB_STATE_HOST) { 354 + pi->dcb.enabled = enabled; 355 + return 0; 356 + } 387 357 388 358 /* Firmware doesn't provide any mechanism to control the DCB state. 389 359 */ ··· 875 833 876 834 /* Return whether IEEE Data Center Bridging has been negotiated. 877 835 */ 878 - static inline int cxgb4_ieee_negotiation_complete(struct net_device *dev) 836 + static inline int 837 + cxgb4_ieee_negotiation_complete(struct net_device *dev, 838 + enum cxgb4_dcb_fw_msgs dcb_subtype) 879 839 { 880 840 struct port_info *pi = netdev2pinfo(dev); 881 841 struct port_dcb_info *dcb = &pi->dcb; 842 + 843 + if (dcb_subtype && !(dcb->msgs & dcb_subtype)) 844 + return 0; 882 845 883 846 return (dcb->state == CXGB4_DCB_STATE_FW_ALLSYNCED && 884 847 (dcb->supported & DCB_CAP_DCBX_VER_IEEE)); ··· 897 850 { 898 851 int prio; 899 852 900 - if (!cxgb4_ieee_negotiation_complete(dev)) 853 + if (!cxgb4_ieee_negotiation_complete(dev, CXGB4_DCB_FW_APP_ID)) 901 854 return -EINVAL; 902 855 if (!(app->selector && app->protocol)) 903 856 return -EINVAL; ··· 919 872 { 920 873 int ret; 921 874 922 - if (!cxgb4_ieee_negotiation_complete(dev)) 875 + if (!cxgb4_ieee_negotiation_complete(dev, CXGB4_DCB_FW_APP_ID)) 923 876 return -EINVAL; 924 877 if (!(app->selector && app->protocol)) 925 878 return -EINVAL;

+6 -1

drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c

··· 694 694 #ifdef CONFIG_CHELSIO_T4_DCB 695 695 struct port_info *pi = netdev_priv(dev); 696 696 697 - return pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED; 697 + if (!pi->dcb.enabled) 698 + return 0; 699 + 700 + return ((pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED) || 701 + (pi->dcb.state == CXGB4_DCB_STATE_HOST)); 698 702 #else 699 703 return 0; 700 704 #endif ··· 6614 6610 6615 6611 spin_lock_init(&adapter->stats_lock); 6616 6612 spin_lock_init(&adapter->tid_release_lock); 6613 + spin_lock_init(&adapter->win0_lock); 6617 6614 6618 6615 INIT_WORK(&adapter->tid_release_task, process_tid_release_list); 6619 6616 INIT_WORK(&adapter->db_full_task, process_db_full);

+8 -8

drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c

··· 2929 2929 CH_DEVICE(0x480d), /* T480-cr */ 2930 2930 CH_DEVICE(0x480e), /* T440-lp-cr */ 2931 2931 CH_DEVICE(0x4880), 2932 - CH_DEVICE(0x4880), 2933 - CH_DEVICE(0x4880), 2934 - CH_DEVICE(0x4880), 2935 - CH_DEVICE(0x4880), 2936 - CH_DEVICE(0x4880), 2937 - CH_DEVICE(0x4880), 2938 - CH_DEVICE(0x4880), 2939 - CH_DEVICE(0x4880), 2932 + CH_DEVICE(0x4881), 2933 + CH_DEVICE(0x4882), 2934 + CH_DEVICE(0x4883), 2935 + CH_DEVICE(0x4884), 2936 + CH_DEVICE(0x4885), 2937 + CH_DEVICE(0x4886), 2938 + CH_DEVICE(0x4887), 2939 + CH_DEVICE(0x4888), 2940 2940 CH_DEVICE(0x5801), /* T520-cr */ 2941 2941 CH_DEVICE(0x5802), /* T522-cr */ 2942 2942 CH_DEVICE(0x5803), /* T540-cr */

+6 -6

drivers/net/ethernet/cisco/enic/enic_clsf.c

··· 86 86 int i; 87 87 88 88 enic_rfs_timer_stop(enic); 89 - spin_lock(&enic->rfs_h.lock); 89 + spin_lock_bh(&enic->rfs_h.lock); 90 90 enic->rfs_h.free = 0; 91 91 for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) { 92 92 struct hlist_head *hhead; ··· 100 100 kfree(n); 101 101 } 102 102 } 103 - spin_unlock(&enic->rfs_h.lock); 103 + spin_unlock_bh(&enic->rfs_h.lock); 104 104 } 105 105 106 106 struct enic_rfs_fltr_node *htbl_fltr_search(struct enic *enic, u16 fltr_id) ··· 128 128 bool res; 129 129 int j; 130 130 131 - spin_lock(&enic->rfs_h.lock); 131 + spin_lock_bh(&enic->rfs_h.lock); 132 132 for (j = 0; j < ENIC_CLSF_EXPIRE_COUNT; j++) { 133 133 struct hlist_head *hhead; 134 134 struct hlist_node *tmp; ··· 148 148 } 149 149 } 150 150 } 151 - spin_unlock(&enic->rfs_h.lock); 151 + spin_unlock_bh(&enic->rfs_h.lock); 152 152 mod_timer(&enic->rfs_h.rfs_may_expire, jiffies + HZ/4); 153 153 } 154 154 ··· 183 183 return -EPROTONOSUPPORT; 184 184 185 185 tbl_idx = skb_get_hash_raw(skb) & ENIC_RFS_FLW_MASK; 186 - spin_lock(&enic->rfs_h.lock); 186 + spin_lock_bh(&enic->rfs_h.lock); 187 187 n = htbl_key_search(&enic->rfs_h.ht_head[tbl_idx], &keys); 188 188 189 189 if (n) { /* entry already present */ ··· 277 277 } 278 278 279 279 ret_unlock: 280 - spin_unlock(&enic->rfs_h.lock); 280 + spin_unlock_bh(&enic->rfs_h.lock); 281 281 return res; 282 282 } 283 283

+2 -2

drivers/net/ethernet/cisco/enic/enic_main.c

··· 1674 1674 1675 1675 enic_dev_disable(enic); 1676 1676 1677 - local_bh_disable(); 1678 1677 for (i = 0; i < enic->rq_count; i++) { 1679 1678 napi_disable(&enic->napi[i]); 1679 + local_bh_disable(); 1680 1680 while (!enic_poll_lock_napi(&enic->rq[i])) 1681 1681 mdelay(1); 1682 + local_bh_enable(); 1682 1683 } 1683 - local_bh_enable(); 1684 1684 1685 1685 netif_carrier_off(netdev); 1686 1686 netif_tx_disable(netdev);

+2 -1

drivers/net/ethernet/freescale/fec_main.c

··· 1581 1581 complete(&fep->mdio_done); 1582 1582 } 1583 1583 1584 - fec_ptp_check_pps_event(fep); 1584 + if (fep->ptp_clock) 1585 + fec_ptp_check_pps_event(fep); 1585 1586 1586 1587 return ret; 1587 1588 }

+3

drivers/net/ethernet/freescale/fs_enet/mac-fec.c

··· 341 341 FC(fecp, x_cntrl, FEC_TCNTRL_FDEN); /* FD disable */ 342 342 } 343 343 344 + /* Restore multicast and promiscuous settings */ 345 + set_multicast_list(dev); 346 + 344 347 /* 345 348 * Enable interrupts we wish to service. 346 349 */

+3

drivers/net/ethernet/freescale/fs_enet/mac-scc.c

··· 355 355 if (fep->phydev->duplex) 356 356 S16(sccp, scc_psmr, SCC_PSMR_LPB | SCC_PSMR_FDE); 357 357 358 + /* Restore multicast and promiscuous settings */ 359 + set_multicast_list(dev); 360 + 358 361 S32(sccp, scc_gsmrl, SCC_GSMRL_ENR | SCC_GSMRL_ENT); 359 362 } 360 363

+4 -1

drivers/net/ethernet/intel/e1000/e1000_main.c

··· 1075 1075 NETIF_F_HW_CSUM | 1076 1076 NETIF_F_SG); 1077 1077 1078 - netdev->priv_flags |= IFF_UNICAST_FLT; 1078 + /* Do not set IFF_UNICAST_FLT for VMWare's 82545EM */ 1079 + if (hw->device_id != E1000_DEV_ID_82545EM_COPPER || 1080 + hw->subsystem_vendor_id != PCI_VENDOR_ID_VMWARE) 1081 + netdev->priv_flags |= IFF_UNICAST_FLT; 1079 1082 1080 1083 adapter->en_mng_pt = e1000_enable_mng_pass_thru(hw); 1081 1084

+2 -2

drivers/net/ethernet/intel/i40e/i40e_main.c

··· 6151 6151 I40E_GL_MDET_TX_PF_NUM_SHIFT; 6152 6152 u8 vf_num = (reg & I40E_GL_MDET_TX_VF_NUM_MASK) >> 6153 6153 I40E_GL_MDET_TX_VF_NUM_SHIFT; 6154 - u8 event = (reg & I40E_GL_MDET_TX_EVENT_SHIFT) >> 6154 + u8 event = (reg & I40E_GL_MDET_TX_EVENT_MASK) >> 6155 6155 I40E_GL_MDET_TX_EVENT_SHIFT; 6156 6156 u8 queue = (reg & I40E_GL_MDET_TX_QUEUE_MASK) >> 6157 6157 I40E_GL_MDET_TX_QUEUE_SHIFT; ··· 6165 6165 if (reg & I40E_GL_MDET_RX_VALID_MASK) { 6166 6166 u8 func = (reg & I40E_GL_MDET_RX_FUNCTION_MASK) >> 6167 6167 I40E_GL_MDET_RX_FUNCTION_SHIFT; 6168 - u8 event = (reg & I40E_GL_MDET_RX_EVENT_SHIFT) >> 6168 + u8 event = (reg & I40E_GL_MDET_RX_EVENT_MASK) >> 6169 6169 I40E_GL_MDET_RX_EVENT_SHIFT; 6170 6170 u8 queue = (reg & I40E_GL_MDET_RX_QUEUE_MASK) >> 6171 6171 I40E_GL_MDET_RX_QUEUE_SHIFT;

+5 -1

drivers/net/ethernet/intel/igb/igb_main.c

··· 6537 6537 if (unlikely(page_to_nid(page) != numa_node_id())) 6538 6538 return false; 6539 6539 6540 + if (unlikely(page->pfmemalloc)) 6541 + return false; 6542 + 6540 6543 #if (PAGE_SIZE < 8192) 6541 6544 /* if we are only owner of page we can reuse it */ 6542 6545 if (unlikely(page_count(page) != 1)) ··· 6606 6603 memcpy(__skb_put(skb, size), va, ALIGN(size, sizeof(long))); 6607 6604 6608 6605 /* we can reuse buffer as-is, just make sure it is local */ 6609 - if (likely(page_to_nid(page) == numa_node_id())) 6606 + if (likely((page_to_nid(page) == numa_node_id()) && 6607 + !page->pfmemalloc)) 6610 6608 return true; 6611 6609 6612 6610 /* this page cannot be reused so discard it */

+4

drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c

··· 342 342 if (old == advertised) 343 343 return err; 344 344 /* this sets the link speed and restarts auto-neg */ 345 + while (test_and_set_bit(__IXGBE_IN_SFP_INIT, &adapter->state)) 346 + usleep_range(1000, 2000); 347 + 345 348 hw->mac.autotry_restart = true; 346 349 err = hw->mac.ops.setup_link(hw, advertised, true); 347 350 if (err) { 348 351 e_info(probe, "setup link failed with code %d\n", err); 349 352 hw->mac.ops.setup_link(hw, old, true); 350 353 } 354 + clear_bit(__IXGBE_IN_SFP_INIT, &adapter->state); 351 355 } else { 352 356 /* in this case we currently only support 10Gb/FULL */ 353 357 u32 speed = ethtool_cmd_speed(ecmd);

+1 -1

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c

··· 4321 4321 IXGBE_CB(skb)->page_released = false; 4322 4322 } 4323 4323 dev_kfree_skb(skb); 4324 + rx_buffer->skb = NULL; 4324 4325 } 4325 - rx_buffer->skb = NULL; 4326 4326 if (rx_buffer->dma) 4327 4327 dma_unmap_page(dev, rx_buffer->dma, 4328 4328 ixgbe_rx_pg_size(rx_ring),

+5 -2

drivers/net/ethernet/mellanox/mlx4/en_tx.c

··· 836 836 * whether LSO is used */ 837 837 tx_desc->ctrl.srcrb_flags = priv->ctrl_flags; 838 838 if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) { 839 - tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM | 840 - MLX4_WQE_CTRL_TCP_UDP_CSUM); 839 + if (!skb->encapsulation) 840 + tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM | 841 + MLX4_WQE_CTRL_TCP_UDP_CSUM); 842 + else 843 + tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM); 841 844 ring->tx_csum++; 842 845 } 843 846

+1

drivers/net/ethernet/mellanox/mlx4/eq.c

··· 1026 1026 pr_cont("\n"); 1027 1027 } 1028 1028 } 1029 + synchronize_irq(eq->irq); 1029 1030 1030 1031 mlx4_mtt_cleanup(dev, &eq->mtt); 1031 1032 for (i = 0; i < npages; ++i)

+4

drivers/net/ethernet/mellanox/mlx4/mcg.c

··· 955 955 cur->ib.dst_gid_msk); 956 956 break; 957 957 958 + case MLX4_NET_TRANS_RULE_ID_VXLAN: 959 + len += snprintf(buf + len, BUF_SIZE - len, 960 + "VNID = %d ", be32_to_cpu(cur->vxlan.vni)); 961 + break; 958 962 case MLX4_NET_TRANS_RULE_ID_IPV6: 959 963 break; 960 964

+1

drivers/net/ethernet/mellanox/mlx5/core/eq.c

··· 420 420 if (err) 421 421 mlx5_core_warn(dev, "failed to destroy a previously created eq: eqn %d\n", 422 422 eq->eqn); 423 + synchronize_irq(table->msix_arr[eq->irqn].vector); 423 424 mlx5_buf_free(dev, &eq->buf); 424 425 425 426 return err;

-4

drivers/net/ethernet/sfc/tx.c

··· 343 343 unsigned short dma_flags; 344 344 int i = 0; 345 345 346 - EFX_BUG_ON_PARANOID(tx_queue->write_count > tx_queue->insert_count); 347 - 348 346 if (skb_shinfo(skb)->gso_size) 349 347 return efx_enqueue_skb_tso(tx_queue, skb); 350 348 ··· 1255 1257 1256 1258 /* Find the packet protocol and sanity-check it */ 1257 1259 state.protocol = efx_tso_check_protocol(skb); 1258 - 1259 - EFX_BUG_ON_PARANOID(tx_queue->write_count > tx_queue->insert_count); 1260 1260 1261 1261 rc = tso_start(&state, efx, skb); 1262 1262 if (rc)

+58

drivers/net/ethernet/smsc/smc91x.c

··· 81 81 #include <linux/workqueue.h> 82 82 #include <linux/of.h> 83 83 #include <linux/of_device.h> 84 + #include <linux/of_gpio.h> 84 85 85 86 #include <linux/netdevice.h> 86 87 #include <linux/etherdevice.h> ··· 2189 2188 {}, 2190 2189 }; 2191 2190 MODULE_DEVICE_TABLE(of, smc91x_match); 2191 + 2192 + /** 2193 + * of_try_set_control_gpio - configure a gpio if it exists 2194 + */ 2195 + static int try_toggle_control_gpio(struct device *dev, 2196 + struct gpio_desc **desc, 2197 + const char *name, int index, 2198 + int value, unsigned int nsdelay) 2199 + { 2200 + struct gpio_desc *gpio = *desc; 2201 + int res; 2202 + 2203 + gpio = devm_gpiod_get_index(dev, name, index); 2204 + if (IS_ERR(gpio)) { 2205 + if (PTR_ERR(gpio) == -ENOENT) { 2206 + *desc = NULL; 2207 + return 0; 2208 + } 2209 + 2210 + return PTR_ERR(gpio); 2211 + } 2212 + res = gpiod_direction_output(gpio, !value); 2213 + if (res) { 2214 + dev_err(dev, "unable to toggle gpio %s: %i\n", name, res); 2215 + devm_gpiod_put(dev, gpio); 2216 + gpio = NULL; 2217 + return res; 2218 + } 2219 + if (nsdelay) 2220 + usleep_range(nsdelay, 2 * nsdelay); 2221 + gpiod_set_value_cansleep(gpio, value); 2222 + *desc = gpio; 2223 + 2224 + return 0; 2225 + } 2192 2226 #endif 2193 2227 2194 2228 /* ··· 2272 2236 if (match) { 2273 2237 struct device_node *np = pdev->dev.of_node; 2274 2238 u32 val; 2239 + 2240 + /* Optional pwrdwn GPIO configured? */ 2241 + ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio, 2242 + "power", 0, 0, 100); 2243 + if (ret) 2244 + return ret; 2245 + 2246 + /* 2247 + * Optional reset GPIO configured? Minimum 100 ns reset needed 2248 + * according to LAN91C96 datasheet page 14. 2249 + */ 2250 + ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio, 2251 + "reset", 0, 0, 100); 2252 + if (ret) 2253 + return ret; 2254 + 2255 + /* 2256 + * Need to wait for optional EEPROM to load, max 750 us according 2257 + * to LAN91C96 datasheet page 55. 2258 + */ 2259 + if (lp->reset_gpio) 2260 + usleep_range(750, 1000); 2275 2261 2276 2262 /* Combination of IO widths supported, default to 16-bit */ 2277 2263 if (!of_property_read_u32(np, "reg-io-width", &val)) {

+3

drivers/net/ethernet/smsc/smc91x.h

··· 298 298 struct sk_buff *pending_tx_skb; 299 299 struct tasklet_struct tx_task; 300 300 301 + struct gpio_desc *power_gpio; 302 + struct gpio_desc *reset_gpio; 303 + 301 304 /* version/revision of the SMC91x chip */ 302 305 int version; 303 306

+7

drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c

··· 33 33 static void stmmac_default_data(void) 34 34 { 35 35 memset(&plat_dat, 0, sizeof(struct plat_stmmacenet_data)); 36 + 36 37 plat_dat.bus_id = 1; 37 38 plat_dat.phy_addr = 0; 38 39 plat_dat.interface = PHY_INTERFACE_MODE_GMII; ··· 48 47 dma_cfg.pbl = 32; 49 48 dma_cfg.burst_len = DMA_AXI_BLEN_256; 50 49 plat_dat.dma_cfg = &dma_cfg; 50 + 51 + /* Set default value for multicast hash bins */ 52 + plat_dat.multicast_filter_bins = HASH_TABLE_SIZE; 53 + 54 + /* Set default value for unicast filter entries */ 55 + plat_dat.unicast_filter_entries = 1; 51 56 } 52 57 53 58 /**

+32 -16

drivers/net/ethernet/ti/cpsw.c

··· 591 591 if (enable) { 592 592 unsigned long timeout = jiffies + HZ; 593 593 594 - /* Disable Learn for all ports */ 595 - for (i = 0; i < priv->data.slaves; i++) { 594 + /* Disable Learn for all ports (host is port 0 and slaves are port 1 and up */ 595 + for (i = 0; i <= priv->data.slaves; i++) { 596 596 cpsw_ale_control_set(ale, i, 597 597 ALE_PORT_NOLEARN, 1); 598 598 cpsw_ale_control_set(ale, i, ··· 616 616 cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1); 617 617 dev_dbg(&ndev->dev, "promiscuity enabled\n"); 618 618 } else { 619 - /* Flood All Unicast Packets to Host port */ 619 + /* Don't Flood All Unicast Packets to Host port */ 620 620 cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 0); 621 621 622 - /* Enable Learn for all ports */ 623 - for (i = 0; i < priv->data.slaves; i++) { 622 + /* Enable Learn for all ports (host is port 0 and slaves are port 1 and up */ 623 + for (i = 0; i <= priv->data.slaves; i++) { 624 624 cpsw_ale_control_set(ale, i, 625 625 ALE_PORT_NOLEARN, 0); 626 626 cpsw_ale_control_set(ale, i, ··· 638 638 if (ndev->flags & IFF_PROMISC) { 639 639 /* Enable promiscuous mode */ 640 640 cpsw_set_promiscious(ndev, true); 641 + cpsw_ale_set_allmulti(priv->ale, IFF_ALLMULTI); 641 642 return; 642 643 } else { 643 644 /* Disable promiscuous mode */ 644 645 cpsw_set_promiscious(ndev, false); 645 646 } 647 + 648 + /* Restore allmulti on vlans if necessary */ 649 + cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI); 646 650 647 651 /* Clear all mcast from ALE */ 648 652 cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port); ··· 1153 1149 const int port = priv->host_port; 1154 1150 u32 reg; 1155 1151 int i; 1152 + int unreg_mcast_mask; 1156 1153 1157 1154 reg = (priv->version == CPSW_VERSION_1) ? CPSW1_PORT_VLAN : 1158 1155 CPSW2_PORT_VLAN; ··· 1163 1158 for (i = 0; i < priv->data.slaves; i++) 1164 1159 slave_write(priv->slaves + i, vlan, reg); 1165 1160 1161 + if (priv->ndev->flags & IFF_ALLMULTI) 1162 + unreg_mcast_mask = ALE_ALL_PORTS; 1163 + else 1164 + unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2; 1165 + 1166 1166 cpsw_ale_add_vlan(priv->ale, vlan, ALE_ALL_PORTS << port, 1167 1167 ALE_ALL_PORTS << port, ALE_ALL_PORTS << port, 1168 - (ALE_PORT_1 | ALE_PORT_2) << port); 1168 + unreg_mcast_mask << port); 1169 1169 } 1170 1170 1171 1171 static void cpsw_init_host_port(struct cpsw_priv *priv) ··· 1630 1620 unsigned short vid) 1631 1621 { 1632 1622 int ret; 1623 + int unreg_mcast_mask; 1624 + 1625 + if (priv->ndev->flags & IFF_ALLMULTI) 1626 + unreg_mcast_mask = ALE_ALL_PORTS; 1627 + else 1628 + unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2; 1633 1629 1634 1630 ret = cpsw_ale_add_vlan(priv->ale, vid, 1635 1631 ALE_ALL_PORTS << priv->host_port, 1636 1632 0, ALE_ALL_PORTS << priv->host_port, 1637 - (ALE_PORT_1 | ALE_PORT_2) << priv->host_port); 1633 + unreg_mcast_mask << priv->host_port); 1638 1634 if (ret != 0) 1639 1635 return ret; 1640 1636 ··· 2022 2006 parp = of_get_property(slave_node, "phy_id", &lenp); 2023 2007 if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) { 2024 2008 dev_err(&pdev->dev, "Missing slave[%d] phy_id property\n", i); 2025 - return -EINVAL; 2009 + goto no_phy_slave; 2026 2010 } 2027 2011 mdio_node = of_find_node_by_phandle(be32_to_cpup(parp)); 2028 2012 phyid = be32_to_cpup(parp+1); ··· 2035 2019 snprintf(slave_data->phy_id, sizeof(slave_data->phy_id), 2036 2020 PHY_ID_FMT, mdio->name, phyid); 2037 2021 2022 + slave_data->phy_if = of_get_phy_mode(slave_node); 2023 + if (slave_data->phy_if < 0) { 2024 + dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n", 2025 + i); 2026 + return slave_data->phy_if; 2027 + } 2028 + 2029 + no_phy_slave: 2038 2030 mac_addr = of_get_mac_address(slave_node); 2039 2031 if (mac_addr) { 2040 2032 memcpy(slave_data->mac_addr, mac_addr, ETH_ALEN); ··· 2054 2030 return ret; 2055 2031 } 2056 2032 } 2057 - 2058 - slave_data->phy_if = of_get_phy_mode(slave_node); 2059 - if (slave_data->phy_if < 0) { 2060 - dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n", 2061 - i); 2062 - return slave_data->phy_if; 2063 - } 2064 - 2065 2033 if (data->dual_emac) { 2066 2034 if (of_property_read_u32(slave_node, "dual_emac_res_vlan", 2067 2035 &prop)) {

+29

drivers/net/ethernet/ti/cpsw_ale.c

··· 443 443 return 0; 444 444 } 445 445 446 + void cpsw_ale_set_allmulti(struct cpsw_ale *ale, int allmulti) 447 + { 448 + u32 ale_entry[ALE_ENTRY_WORDS]; 449 + int type, idx; 450 + int unreg_mcast = 0; 451 + 452 + /* Only bother doing the work if the setting is actually changing */ 453 + if (ale->allmulti == allmulti) 454 + return; 455 + 456 + /* Remember the new setting to check against next time */ 457 + ale->allmulti = allmulti; 458 + 459 + for (idx = 0; idx < ale->params.ale_entries; idx++) { 460 + cpsw_ale_read(ale, idx, ale_entry); 461 + type = cpsw_ale_get_entry_type(ale_entry); 462 + if (type != ALE_TYPE_VLAN) 463 + continue; 464 + 465 + unreg_mcast = cpsw_ale_get_vlan_unreg_mcast(ale_entry); 466 + if (allmulti) 467 + unreg_mcast |= 1; 468 + else 469 + unreg_mcast &= ~1; 470 + cpsw_ale_set_vlan_unreg_mcast(ale_entry, unreg_mcast); 471 + cpsw_ale_write(ale, idx, ale_entry); 472 + } 473 + } 474 + 446 475 struct ale_control_info { 447 476 const char *name; 448 477 int offset, port_offset;

+2

drivers/net/ethernet/ti/cpsw_ale.h

··· 27 27 struct cpsw_ale_params params; 28 28 struct timer_list timer; 29 29 unsigned long ageout; 30 + int allmulti; 30 31 }; 31 32 32 33 enum cpsw_ale_control { ··· 104 103 int cpsw_ale_add_vlan(struct cpsw_ale *ale, u16 vid, int port, int untag, 105 104 int reg_mcast, int unreg_mcast); 106 105 int cpsw_ale_del_vlan(struct cpsw_ale *ale, u16 vid, int port); 106 + void cpsw_ale_set_allmulti(struct cpsw_ale *ale, int allmulti); 107 107 108 108 int cpsw_ale_control_get(struct cpsw_ale *ale, int port, int control); 109 109 int cpsw_ale_control_set(struct cpsw_ale *ale, int port,

+1

drivers/net/hyperv/netvsc_drv.c

··· 550 550 do_send: 551 551 /* Start filling in the page buffers with the rndis hdr */ 552 552 rndis_msg->msg_len += rndis_msg_size; 553 + packet->total_data_buflen = rndis_msg->msg_len; 553 554 packet->page_buf_cnt = init_page_array(rndis_msg, rndis_msg_size, 554 555 skb, &packet->page_buf[0]); 555 556

+8 -2

drivers/net/macvlan.c

··· 272 272 struct sk_buff *skb; 273 273 struct sk_buff_head list; 274 274 275 - skb_queue_head_init(&list); 275 + __skb_queue_head_init(&list); 276 276 277 277 spin_lock_bh(&port->bc_queue.lock); 278 278 skb_queue_splice_tail_init(&port->bc_queue, &list); ··· 1082 1082 { 1083 1083 struct macvlan_port *port = macvlan_port_get_rtnl(dev); 1084 1084 1085 - cancel_work_sync(&port->bc_work); 1086 1085 dev->priv_flags &= ~IFF_MACVLAN_PORT; 1087 1086 netdev_rx_handler_unregister(dev); 1087 + 1088 + /* After this point, no packet can schedule bc_work anymore, 1089 + * but we need to cancel it and purge left skbs if any. 1090 + */ 1091 + cancel_work_sync(&port->bc_work); 1092 + __skb_queue_purge(&port->bc_queue); 1093 + 1088 1094 kfree_rcu(port, rcu); 1089 1095 } 1090 1096

+8 -8

drivers/net/macvtap.c

··· 16 16 #include <linux/idr.h> 17 17 #include <linux/fs.h> 18 18 19 + #include <net/ipv6.h> 19 20 #include <net/net_namespace.h> 20 21 #include <net/rtnetlink.h> 21 22 #include <net/sock.h> ··· 66 65 static const struct proto_ops macvtap_socket_ops; 67 66 68 67 #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \ 69 - NETIF_F_TSO6 | NETIF_F_UFO) 68 + NETIF_F_TSO6) 70 69 #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO) 71 70 #define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG) 72 71 ··· 570 569 gso_type = SKB_GSO_TCPV6; 571 570 break; 572 571 case VIRTIO_NET_HDR_GSO_UDP: 572 + pr_warn_once("macvtap: %s: using disabled UFO feature; please fix this program\n", 573 + current->comm); 573 574 gso_type = SKB_GSO_UDP; 575 + if (skb->protocol == htons(ETH_P_IPV6)) 576 + ipv6_proxy_select_ident(skb); 574 577 break; 575 578 default: 576 579 return -EINVAL; ··· 619 614 vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4; 620 615 else if (sinfo->gso_type & SKB_GSO_TCPV6) 621 616 vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6; 622 - else if (sinfo->gso_type & SKB_GSO_UDP) 623 - vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP; 624 617 else 625 618 BUG(); 626 619 if (sinfo->gso_type & SKB_GSO_TCP_ECN) ··· 953 950 if (arg & TUN_F_TSO6) 954 951 feature_mask |= NETIF_F_TSO6; 955 952 } 956 - 957 - if (arg & TUN_F_UFO) 958 - feature_mask |= NETIF_F_UFO; 959 953 } 960 954 961 955 /* tun/tap driver inverts the usage for TSO offloads, where ··· 963 963 * When user space turns off TSO, we turn off GSO/LRO so that 964 964 * user-space will not receive TSO frames. 965 965 */ 966 - if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_UFO)) 966 + if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6)) 967 967 features |= RX_OFFLOADS; 968 968 else 969 969 features &= ~RX_OFFLOADS; ··· 1064 1064 case TUNSETOFFLOAD: 1065 1065 /* let the user check for future flags */ 1066 1066 if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 | 1067 - TUN_F_TSO_ECN | TUN_F_UFO)) 1067 + TUN_F_TSO_ECN)) 1068 1068 return -EINVAL; 1069 1069 1070 1070 rtnl_lock();

+19

drivers/net/phy/marvell.c

··· 50 50 #define MII_M1011_PHY_SCR 0x10 51 51 #define MII_M1011_PHY_SCR_AUTO_CROSS 0x0060 52 52 53 + #define MII_M1145_PHY_EXT_SR 0x1b 53 54 #define MII_M1145_PHY_EXT_CR 0x14 54 55 #define MII_M1145_RGMII_RX_DELAY 0x0080 55 56 #define MII_M1145_RGMII_TX_DELAY 0x0002 57 + 58 + #define MII_M1145_HWCFG_MODE_SGMII_NO_CLK 0x4 59 + #define MII_M1145_HWCFG_MODE_MASK 0xf 60 + #define MII_M1145_HWCFG_FIBER_COPPER_AUTO 0x8000 56 61 57 62 #define MII_M1111_PHY_LED_CONTROL 0x18 58 63 #define MII_M1111_PHY_LED_DIRECT 0x4100 ··· 679 674 if (err < 0) 680 675 return err; 681 676 } 677 + } 678 + 679 + if (phydev->interface == PHY_INTERFACE_MODE_SGMII) { 680 + int temp = phy_read(phydev, MII_M1145_PHY_EXT_SR); 681 + if (temp < 0) 682 + return temp; 683 + 684 + temp &= ~MII_M1145_HWCFG_MODE_MASK; 685 + temp |= MII_M1145_HWCFG_MODE_SGMII_NO_CLK; 686 + temp |= MII_M1145_HWCFG_FIBER_COPPER_AUTO; 687 + 688 + err = phy_write(phydev, MII_M1145_PHY_EXT_SR, temp); 689 + if (err < 0) 690 + return err; 682 691 } 683 692 684 693 err = marvell_of_reg_init(phydev);

+16 -9

drivers/net/tun.c

··· 65 65 #include <linux/nsproxy.h> 66 66 #include <linux/virtio_net.h> 67 67 #include <linux/rcupdate.h> 68 + #include <net/ipv6.h> 68 69 #include <net/net_namespace.h> 69 70 #include <net/netns/generic.h> 70 71 #include <net/rtnetlink.h> ··· 175 174 struct net_device *dev; 176 175 netdev_features_t set_features; 177 176 #define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \ 178 - NETIF_F_TSO6|NETIF_F_UFO) 177 + NETIF_F_TSO6) 179 178 180 179 int vnet_hdr_sz; 181 180 int sndbuf; ··· 1140 1139 break; 1141 1140 } 1142 1141 1142 + skb_reset_network_header(skb); 1143 + 1143 1144 if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) { 1144 1145 pr_debug("GSO!\n"); 1145 1146 switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { ··· 1152 1149 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6; 1153 1150 break; 1154 1151 case VIRTIO_NET_HDR_GSO_UDP: 1152 + { 1153 + static bool warned; 1154 + 1155 + if (!warned) { 1156 + warned = true; 1157 + netdev_warn(tun->dev, 1158 + "%s: using disabled UFO feature; please fix this program\n", 1159 + current->comm); 1160 + } 1155 1161 skb_shinfo(skb)->gso_type = SKB_GSO_UDP; 1162 + if (skb->protocol == htons(ETH_P_IPV6)) 1163 + ipv6_proxy_select_ident(skb); 1156 1164 break; 1165 + } 1157 1166 default: 1158 1167 tun->dev->stats.rx_frame_errors++; 1159 1168 kfree_skb(skb); ··· 1194 1179 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG; 1195 1180 } 1196 1181 1197 - skb_reset_network_header(skb); 1198 1182 skb_probe_transport_header(skb, 0); 1199 1183 1200 1184 rxhash = skb_get_hash(skb); ··· 1265 1251 gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4; 1266 1252 else if (sinfo->gso_type & SKB_GSO_TCPV6) 1267 1253 gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6; 1268 - else if (sinfo->gso_type & SKB_GSO_UDP) 1269 - gso.gso_type = VIRTIO_NET_HDR_GSO_UDP; 1270 1254 else { 1271 1255 pr_err("unexpected GSO type: " 1272 1256 "0x%x, gso_size %d, hdr_len %d\n", ··· 1773 1761 if (arg & TUN_F_TSO6) 1774 1762 features |= NETIF_F_TSO6; 1775 1763 arg &= ~(TUN_F_TSO4|TUN_F_TSO6); 1776 - } 1777 - 1778 - if (arg & TUN_F_UFO) { 1779 - features |= NETIF_F_UFO; 1780 - arg &= ~TUN_F_UFO; 1781 1764 } 1782 1765 } 1783 1766

+6 -1

drivers/net/usb/ax88179_178a.c

··· 937 937 { 938 938 struct usbnet *dev = netdev_priv(net); 939 939 struct sockaddr *addr = p; 940 + int ret; 940 941 941 942 if (netif_running(net)) 942 943 return -EBUSY; ··· 947 946 memcpy(net->dev_addr, addr->sa_data, ETH_ALEN); 948 947 949 948 /* Set the MAC address */ 950 - return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, 949 + ret = ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, 951 950 ETH_ALEN, net->dev_addr); 951 + if (ret < 0) 952 + return ret; 953 + 954 + return 0; 952 955 } 953 956 954 957 static const struct net_device_ops ax88179_netdev_ops = {

+33 -14

drivers/net/usb/cdc_ether.c

··· 67 67 0xa6, 0x07, 0xc0, 0xff, 0xcb, 0x7e, 0x39, 0x2a, 68 68 }; 69 69 70 + static void usbnet_cdc_update_filter(struct usbnet *dev) 71 + { 72 + struct cdc_state *info = (void *) &dev->data; 73 + struct usb_interface *intf = info->control; 74 + 75 + u16 cdc_filter = 76 + USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED | 77 + USB_CDC_PACKET_TYPE_BROADCAST; 78 + 79 + if (dev->net->flags & IFF_PROMISC) 80 + cdc_filter |= USB_CDC_PACKET_TYPE_PROMISCUOUS; 81 + 82 + /* FIXME cdc-ether has some multicast code too, though it complains 83 + * in routine cases. info->ether describes the multicast support. 84 + * Implement that here, manipulating the cdc filter as needed. 85 + */ 86 + 87 + usb_control_msg(dev->udev, 88 + usb_sndctrlpipe(dev->udev, 0), 89 + USB_CDC_SET_ETHERNET_PACKET_FILTER, 90 + USB_TYPE_CLASS | USB_RECIP_INTERFACE, 91 + cdc_filter, 92 + intf->cur_altsetting->desc.bInterfaceNumber, 93 + NULL, 94 + 0, 95 + USB_CTRL_SET_TIMEOUT 96 + ); 97 + } 98 + 70 99 /* probes control interface, claims data interface, collects the bulk 71 100 * endpoints, activates data interface (if needed), maybe sets MTU. 72 101 * all pure cdc, except for certain firmware workarounds, and knowing ··· 376 347 * don't do reset all the way. So the packet filter should 377 348 * be set to a sane initial value. 378 349 */ 379 - usb_control_msg(dev->udev, 380 - usb_sndctrlpipe(dev->udev, 0), 381 - USB_CDC_SET_ETHERNET_PACKET_FILTER, 382 - USB_TYPE_CLASS | USB_RECIP_INTERFACE, 383 - USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED | USB_CDC_PACKET_TYPE_BROADCAST, 384 - intf->cur_altsetting->desc.bInterfaceNumber, 385 - NULL, 386 - 0, 387 - USB_CTRL_SET_TIMEOUT 388 - ); 350 + usbnet_cdc_update_filter(dev); 351 + 389 352 return 0; 390 353 391 354 bad_desc: ··· 489 468 return status; 490 469 } 491 470 492 - /* FIXME cdc-ether has some multicast code too, though it complains 493 - * in routine cases. info->ether describes the multicast support. 494 - * Implement that here, manipulating the cdc filter as needed. 495 - */ 496 471 return 0; 497 472 } 498 473 EXPORT_SYMBOL_GPL(usbnet_cdc_bind); ··· 499 482 .bind = usbnet_cdc_bind, 500 483 .unbind = usbnet_cdc_unbind, 501 484 .status = usbnet_cdc_status, 485 + .set_rx_mode = usbnet_cdc_update_filter, 502 486 .manage_power = usbnet_manage_power, 503 487 }; 504 488 ··· 509 491 .bind = usbnet_cdc_bind, 510 492 .unbind = usbnet_cdc_unbind, 511 493 .status = usbnet_cdc_status, 494 + .set_rx_mode = usbnet_cdc_update_filter, 512 495 .manage_power = usbnet_manage_power, 513 496 }; 514 497

+12 -5

drivers/net/usb/r8152.c

··· 1162 1162 case -ESHUTDOWN: 1163 1163 netif_device_detach(tp->netdev); 1164 1164 case -ENOENT: 1165 + case -EPROTO: 1166 + netif_info(tp, intr, tp->netdev, 1167 + "Stop submitting intr, status %d\n", status); 1165 1168 return; 1166 1169 case -EOVERFLOW: 1167 1170 netif_info(tp, intr, tp->netdev, "intr status -EOVERFLOW\n"); ··· 2894 2891 if (res) 2895 2892 goto out; 2896 2893 2894 + /* set speed to 0 to avoid autoresume try to submit rx */ 2895 + tp->speed = 0; 2896 + 2897 2897 res = usb_autopm_get_interface(tp->intf); 2898 2898 if (res < 0) { 2899 2899 free_all_mem(tp); ··· 2910 2904 clear_bit(WORK_ENABLE, &tp->flags); 2911 2905 usb_kill_urb(tp->intr_urb); 2912 2906 cancel_delayed_work_sync(&tp->schedule); 2907 + 2908 + /* disable the tx/rx, if the workqueue has enabled them. */ 2913 2909 if (tp->speed & LINK_STATUS) 2914 2910 tp->rtl_ops.disable(tp); 2915 2911 } ··· 2963 2955 * be disable when autoresume occurs, because the 2964 2956 * netif_running() would be false. 2965 2957 */ 2966 - if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) { 2967 - rtl_runtime_suspend_enable(tp, false); 2968 - clear_bit(SELECTIVE_SUSPEND, &tp->flags); 2969 - } 2958 + rtl_runtime_suspend_enable(tp, false); 2970 2959 2971 2960 tasklet_disable(&tp->tl); 2972 2961 tp->rtl_ops.down(tp); ··· 3210 3205 netif_device_detach(netdev); 3211 3206 } 3212 3207 3213 - if (netif_running(netdev)) { 3208 + if (netif_running(netdev) && test_bit(WORK_ENABLE, &tp->flags)) { 3214 3209 clear_bit(WORK_ENABLE, &tp->flags); 3215 3210 usb_kill_urb(tp->intr_urb); 3216 3211 tasklet_disable(&tp->tl); ··· 3258 3253 set_bit(WORK_ENABLE, &tp->flags); 3259 3254 } 3260 3255 usb_submit_urb(tp->intr_urb, GFP_KERNEL); 3256 + } else if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) { 3257 + clear_bit(SELECTIVE_SUSPEND, &tp->flags); 3261 3258 } 3262 3259 3263 3260 mutex_unlock(&tp->control);

+20

drivers/net/usb/usbnet.c

··· 1052 1052 clear_bit(EVENT_LINK_CHANGE, &dev->flags); 1053 1053 } 1054 1054 1055 + static void usbnet_set_rx_mode(struct net_device *net) 1056 + { 1057 + struct usbnet *dev = netdev_priv(net); 1058 + 1059 + usbnet_defer_kevent(dev, EVENT_SET_RX_MODE); 1060 + } 1061 + 1062 + static void __handle_set_rx_mode(struct usbnet *dev) 1063 + { 1064 + if (dev->driver_info->set_rx_mode) 1065 + (dev->driver_info->set_rx_mode)(dev); 1066 + 1067 + clear_bit(EVENT_SET_RX_MODE, &dev->flags); 1068 + } 1069 + 1055 1070 /* work that cannot be done in interrupt context uses keventd. 1056 1071 * 1057 1072 * NOTE: with 2.5 we could do more of this using completion callbacks, ··· 1171 1156 1172 1157 if (test_bit (EVENT_LINK_CHANGE, &dev->flags)) 1173 1158 __handle_link_change(dev); 1159 + 1160 + if (test_bit (EVENT_SET_RX_MODE, &dev->flags)) 1161 + __handle_set_rx_mode(dev); 1162 + 1174 1163 1175 1164 if (dev->flags) 1176 1165 netdev_dbg(dev->net, "kevent done, flags = 0x%lx\n", dev->flags); ··· 1544 1525 .ndo_stop = usbnet_stop, 1545 1526 .ndo_start_xmit = usbnet_start_xmit, 1546 1527 .ndo_tx_timeout = usbnet_tx_timeout, 1528 + .ndo_set_rx_mode = usbnet_set_rx_mode, 1547 1529 .ndo_change_mtu = usbnet_change_mtu, 1548 1530 .ndo_set_mac_address = eth_mac_addr, 1549 1531 .ndo_validate_addr = eth_validate_addr,

+14 -10

drivers/net/virtio_net.c

··· 491 491 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4; 492 492 break; 493 493 case VIRTIO_NET_HDR_GSO_UDP: 494 + { 495 + static bool warned; 496 + 497 + if (!warned) { 498 + warned = true; 499 + netdev_warn(dev, 500 + "host using disabled UFO feature; please fix it\n"); 501 + } 494 502 skb_shinfo(skb)->gso_type = SKB_GSO_UDP; 495 503 break; 504 + } 496 505 case VIRTIO_NET_HDR_GSO_TCPV6: 497 506 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6; 498 507 break; ··· 890 881 hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4; 891 882 else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) 892 883 hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV6; 893 - else if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP) 894 - hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_UDP; 895 884 else 896 885 BUG(); 897 886 if (skb_shinfo(skb)->gso_type & SKB_GSO_TCP_ECN) ··· 1712 1705 dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST; 1713 1706 1714 1707 if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) { 1715 - dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO 1708 + dev->hw_features |= NETIF_F_TSO 1716 1709 | NETIF_F_TSO_ECN | NETIF_F_TSO6; 1717 1710 } 1718 1711 /* Individual feature bits: what can host handle? */ ··· 1722 1715 dev->hw_features |= NETIF_F_TSO6; 1723 1716 if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_ECN)) 1724 1717 dev->hw_features |= NETIF_F_TSO_ECN; 1725 - if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_UFO)) 1726 - dev->hw_features |= NETIF_F_UFO; 1727 1718 1728 1719 if (gso) 1729 - dev->features |= dev->hw_features & (NETIF_F_ALL_TSO|NETIF_F_UFO); 1720 + dev->features |= dev->hw_features & NETIF_F_ALL_TSO; 1730 1721 /* (!csum && gso) case will be fixed by register_netdev() */ 1731 1722 } 1732 1723 if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_CSUM)) ··· 1762 1757 /* If we can receive ANY GSO packets, we must allocate large ones. */ 1763 1758 if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) || 1764 1759 virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) || 1765 - virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) || 1766 - virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO)) 1760 + virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN)) 1767 1761 vi->big_packets = true; 1768 1762 1769 1763 if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF)) ··· 1956 1952 static unsigned int features[] = { 1957 1953 VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM, 1958 1954 VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC, 1959 - VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6, 1955 + VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_TSO6, 1960 1956 VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6, 1961 - VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO, 1957 + VIRTIO_NET_F_GUEST_ECN, 1962 1958 VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ, 1963 1959 VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN, 1964 1960 VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ,

+1

drivers/net/wireless/ath/ath.h

··· 80 80 81 81 struct ath_regulatory { 82 82 char alpha2[2]; 83 + enum nl80211_dfs_regions region; 83 84 u16 country_code; 84 85 u16 max_power_level; 85 86 u16 current_rd;

+4 -4

drivers/net/wireless/ath/ath9k/common.c

··· 368 368 { 369 369 struct ath_regulatory *reg = ath9k_hw_regulatory(ah); 370 370 371 - if (reg->power_limit != new_txpow) { 371 + if (reg->power_limit != new_txpow) 372 372 ath9k_hw_set_txpowerlimit(ah, new_txpow, false); 373 - /* read back in case value is clamped */ 374 - *txpower = reg->max_power_level; 375 - } 373 + 374 + /* read back in case value is clamped */ 375 + *txpower = reg->max_power_level; 376 376 } 377 377 EXPORT_SYMBOL(ath9k_cmn_update_txpow); 378 378

+1 -1

drivers/net/wireless/ath/ath9k/debug.c

··· 455 455 "%2d %2x %1x %2x %2x\n", 456 456 i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset, 457 457 (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3), 458 - val[2] & (0x7 << (i * 3)) >> (i * 3), 458 + (val[2] & (0x7 << (i * 3))) >> (i * 3), 459 459 (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset); 460 460 } 461 461

+30 -25

drivers/net/wireless/ath/ath9k/init.c

··· 734 734 #endif 735 735 }; 736 736 737 + #ifdef CONFIG_ATH9K_CHANNEL_CONTEXT 738 + static void ath9k_set_mcc_capab(struct ath_softc *sc, struct ieee80211_hw *hw) 739 + { 740 + struct ath_hw *ah = sc->sc_ah; 741 + struct ath_common *common = ath9k_hw_common(ah); 742 + 743 + if (!ath9k_is_chanctx_enabled()) 744 + return; 745 + 746 + hw->flags |= IEEE80211_HW_QUEUE_CONTROL; 747 + hw->queues = ATH9K_NUM_TX_QUEUES; 748 + hw->offchannel_tx_hw_queue = hw->queues - 1; 749 + hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS); 750 + hw->wiphy->iface_combinations = if_comb_multi; 751 + hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi); 752 + hw->wiphy->max_scan_ssids = 255; 753 + hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN; 754 + hw->wiphy->max_remain_on_channel_duration = 10000; 755 + hw->chanctx_data_size = sizeof(void *); 756 + hw->extra_beacon_tailroom = 757 + sizeof(struct ieee80211_p2p_noa_attr) + 9; 758 + 759 + ath_dbg(common, CHAN_CTX, "Use channel contexts\n"); 760 + } 761 + #endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */ 762 + 737 763 static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw) 738 764 { 739 765 struct ath_hw *ah = sc->sc_ah; ··· 772 746 IEEE80211_HW_SPECTRUM_MGMT | 773 747 IEEE80211_HW_REPORTS_TX_ACK_STATUS | 774 748 IEEE80211_HW_SUPPORTS_RC_TABLE | 775 - IEEE80211_HW_QUEUE_CONTROL | 776 749 IEEE80211_HW_SUPPORTS_HT_CCK_RATES; 777 750 778 751 if (ath9k_ps_enable) ··· 806 781 hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb); 807 782 } 808 783 809 - #ifdef CONFIG_ATH9K_CHANNEL_CONTEXT 810 - 811 - if (ath9k_is_chanctx_enabled()) { 812 - hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS); 813 - hw->wiphy->iface_combinations = if_comb_multi; 814 - hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi); 815 - hw->wiphy->max_scan_ssids = 255; 816 - hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN; 817 - hw->wiphy->max_remain_on_channel_duration = 10000; 818 - hw->chanctx_data_size = sizeof(void *); 819 - hw->extra_beacon_tailroom = 820 - sizeof(struct ieee80211_p2p_noa_attr) + 9; 821 - 822 - ath_dbg(common, CHAN_CTX, "Use channel contexts\n"); 823 - } 824 - 825 - #endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */ 826 - 827 784 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT; 828 785 829 786 hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN; ··· 815 808 hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH; 816 809 hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD; 817 810 818 - /* allow 4 queues per channel context + 819 - * 1 cab queue + 1 offchannel tx queue 820 - */ 821 - hw->queues = ATH9K_NUM_TX_QUEUES; 822 - /* last queue for offchannel */ 823 - hw->offchannel_tx_hw_queue = hw->queues - 1; 811 + hw->queues = 4; 824 812 hw->max_rates = 4; 825 813 hw->max_listen_interval = 10; 826 814 hw->max_rate_tries = 10; ··· 839 837 hw->wiphy->bands[IEEE80211_BAND_5GHZ] = 840 838 &common->sbands[IEEE80211_BAND_5GHZ]; 841 839 840 + #ifdef CONFIG_ATH9K_CHANNEL_CONTEXT 841 + ath9k_set_mcc_capab(sc, hw); 842 + #endif 842 843 ath9k_init_wow(hw); 843 844 ath9k_cmn_reload_chainmask(ah); 844 845

+3

drivers/net/wireless/ath/ath9k/main.c

··· 1162 1162 { 1163 1163 int i; 1164 1164 1165 + if (!ath9k_is_chanctx_enabled()) 1166 + return; 1167 + 1165 1168 for (i = 0; i < IEEE80211_NUM_ACS; i++) 1166 1169 vif->hw_queue[i] = i; 1167 1170

+8 -2

drivers/net/wireless/ath/ath9k/xmit.c

··· 169 169 170 170 if (txq->stopped && 171 171 txq->pending_frames < sc->tx.txq_max_pending[q]) { 172 - ieee80211_wake_queue(sc->hw, info->hw_queue); 172 + if (ath9k_is_chanctx_enabled()) 173 + ieee80211_wake_queue(sc->hw, info->hw_queue); 174 + else 175 + ieee80211_wake_queue(sc->hw, q); 173 176 txq->stopped = false; 174 177 } 175 178 } ··· 2250 2247 fi->txq = q; 2251 2248 if (++txq->pending_frames > sc->tx.txq_max_pending[q] && 2252 2249 !txq->stopped) { 2253 - ieee80211_stop_queue(sc->hw, info->hw_queue); 2250 + if (ath9k_is_chanctx_enabled()) 2251 + ieee80211_stop_queue(sc->hw, info->hw_queue); 2252 + else 2253 + ieee80211_stop_queue(sc->hw, q); 2254 2254 txq->stopped = true; 2255 2255 } 2256 2256 }

+14

drivers/net/wireless/ath/regd.c

··· 515 515 if (!request) 516 516 return; 517 517 518 + reg->region = request->dfs_region; 518 519 switch (request->initiator) { 519 520 case NL80211_REGDOM_SET_BY_CORE: 520 521 /* ··· 778 777 (reg->country_code == CTRY_DEFAULT && 779 778 is_wwr_sku(ath_regd_get_eepromRD(reg)))) { 780 779 return SD_NO_CTL; 780 + } 781 + 782 + if (ath_regd_get_eepromRD(reg) == CTRY_DEFAULT) { 783 + switch (reg->region) { 784 + case NL80211_DFS_FCC: 785 + return CTL_FCC; 786 + case NL80211_DFS_ETSI: 787 + return CTL_ETSI; 788 + case NL80211_DFS_JP: 789 + return CTL_MKK; 790 + default: 791 + break; 792 + } 781 793 } 782 794 783 795 switch (band) {

+12 -13

drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c

··· 670 670 struct brcmf_sdio_dev *sdiodev) 671 671 { 672 672 int i; 673 - uint fw_len, nv_len; 674 673 char end; 675 674 676 675 for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) { ··· 683 684 return -ENODEV; 684 685 } 685 686 686 - fw_len = sizeof(sdiodev->fw_name) - 1; 687 - nv_len = sizeof(sdiodev->nvram_name) - 1; 688 687 /* check if firmware path is provided by module parameter */ 689 688 if (brcmf_firmware_path[0] != '\0') { 690 - strncpy(sdiodev->fw_name, brcmf_firmware_path, fw_len); 691 - strncpy(sdiodev->nvram_name, brcmf_firmware_path, nv_len); 692 - fw_len -= strlen(sdiodev->fw_name); 693 - nv_len -= strlen(sdiodev->nvram_name); 689 + strlcpy(sdiodev->fw_name, brcmf_firmware_path, 690 + sizeof(sdiodev->fw_name)); 691 + strlcpy(sdiodev->nvram_name, brcmf_firmware_path, 692 + sizeof(sdiodev->nvram_name)); 694 693 695 694 end = brcmf_firmware_path[strlen(brcmf_firmware_path) - 1]; 696 695 if (end != '/') { 697 - strncat(sdiodev->fw_name, "/", fw_len); 698 - strncat(sdiodev->nvram_name, "/", nv_len); 699 - fw_len--; 700 - nv_len--; 696 + strlcat(sdiodev->fw_name, "/", 697 + sizeof(sdiodev->fw_name)); 698 + strlcat(sdiodev->nvram_name, "/", 699 + sizeof(sdiodev->nvram_name)); 701 700 } 702 701 } 703 - strncat(sdiodev->fw_name, brcmf_fwname_data[i].bin, fw_len); 704 - strncat(sdiodev->nvram_name, brcmf_fwname_data[i].nv, nv_len); 702 + strlcat(sdiodev->fw_name, brcmf_fwname_data[i].bin, 703 + sizeof(sdiodev->fw_name)); 704 + strlcat(sdiodev->nvram_name, brcmf_fwname_data[i].nv, 705 + sizeof(sdiodev->nvram_name)); 705 706 706 707 return 0; 707 708 }

+13 -11

drivers/net/wireless/iwlwifi/dvm/mac80211.c

··· 1095 1095 u32 queues, bool drop) 1096 1096 { 1097 1097 struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw); 1098 + u32 scd_queues; 1098 1099 1099 1100 mutex_lock(&priv->mutex); 1100 1101 IWL_DEBUG_MAC80211(priv, "enter\n"); ··· 1109 1108 goto done; 1110 1109 } 1111 1110 1112 - /* 1113 - * mac80211 will not push any more frames for transmit 1114 - * until the flush is completed 1115 - */ 1116 - if (drop) { 1117 - IWL_DEBUG_MAC80211(priv, "send flush command\n"); 1118 - if (iwlagn_txfifo_flush(priv, 0)) { 1119 - IWL_ERR(priv, "flush request fail\n"); 1120 - goto done; 1121 - } 1111 + scd_queues = BIT(priv->cfg->base_params->num_of_queues) - 1; 1112 + scd_queues &= ~(BIT(IWL_IPAN_CMD_QUEUE_NUM) | 1113 + BIT(IWL_DEFAULT_CMD_QUEUE_NUM)); 1114 + 1115 + if (vif) 1116 + scd_queues &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]); 1117 + 1118 + IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n", scd_queues); 1119 + if (iwlagn_txfifo_flush(priv, scd_queues)) { 1120 + IWL_ERR(priv, "flush request fail\n"); 1121 + goto done; 1122 1122 } 1123 - IWL_DEBUG_MAC80211(priv, "wait transmit/flush all frames\n"); 1123 + IWL_DEBUG_TX_QUEUES(priv, "wait transmit/flush all frames\n"); 1124 1124 iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff); 1125 1125 done: 1126 1126 mutex_unlock(&priv->mutex);

+2 -1

drivers/net/wireless/iwlwifi/iwl-8000.c

··· 82 82 #define IWL8000_TX_POWER_VERSION 0xffff /* meaningless */ 83 83 84 84 #define IWL8000_FW_PRE "iwlwifi-8000" 85 - #define IWL8000_MODULE_FIRMWARE(api) IWL8000_FW_PRE __stringify(api) ".ucode" 85 + #define IWL8000_MODULE_FIRMWARE(api) \ 86 + IWL8000_FW_PRE "-" __stringify(api) ".ucode" 86 87 87 88 #define NVM_HW_SECTION_NUM_FAMILY_8000 10 88 89 #define DEFAULT_NVM_FILE_FAMILY_8000 "iwl_nvm_8000.bin"

+2

drivers/net/wireless/iwlwifi/iwl-trans.h

··· 563 563 * Set during transport allocation. 564 564 * @hw_id_str: a string with info about HW ID. Set during transport allocation. 565 565 * @pm_support: set to true in start_hw if link pm is supported 566 + * @ltr_enabled: set to true if the LTR is enabled 566 567 * @dev_cmd_pool: pool for Tx cmd allocation - for internal use only. 567 568 * The user should use iwl_trans_{alloc,free}_tx_cmd. 568 569 * @dev_cmd_headroom: room needed for the transport's private use before the ··· 590 589 u8 rx_mpdu_cmd, rx_mpdu_cmd_hdr_size; 591 590 592 591 bool pm_support; 592 + bool ltr_enabled; 593 593 594 594 /* The following fields are internal only */ 595 595 struct kmem_cache *dev_cmd_pool;

+2 -2

drivers/net/wireless/iwlwifi/mvm/coex.c

··· 303 303 }; 304 304 305 305 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = { 306 - cpu_to_le32(0x28412201), 307 - cpu_to_le32(0x11118451), 306 + cpu_to_le32(0x2e402280), 307 + cpu_to_le32(0x7711a751), 308 308 }; 309 309 310 310 struct corunning_block_luts {

+2 -2

drivers/net/wireless/iwlwifi/mvm/coex_legacy.c

··· 291 291 }; 292 292 293 293 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = { 294 - cpu_to_le32(0x28412201), 295 - cpu_to_le32(0x11118451), 294 + cpu_to_le32(0x2e402280), 295 + cpu_to_le32(0x7711a751), 296 296 }; 297 297 298 298 struct corunning_block_luts {

+34 -1

drivers/net/wireless/iwlwifi/mvm/fw-api-power.h

··· 68 68 69 69 /* Power Management Commands, Responses, Notifications */ 70 70 71 + /** 72 + * enum iwl_ltr_config_flags - masks for LTR config command flags 73 + * @LTR_CFG_FLAG_FEATURE_ENABLE: Feature operational status 74 + * @LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS: allow LTR change on shadow 75 + * memory access 76 + * @LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH: allow LTR msg send on ANY LTR 77 + * reg change 78 + * @LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3: allow LTR msg send on transition from 79 + * D0 to D3 80 + * @LTR_CFG_FLAG_SW_SET_SHORT: fixed static short LTR register 81 + * @LTR_CFG_FLAG_SW_SET_LONG: fixed static short LONG register 82 + * @LTR_CFG_FLAG_DENIE_C10_ON_PD: allow going into C10 on PD 83 + */ 84 + enum iwl_ltr_config_flags { 85 + LTR_CFG_FLAG_FEATURE_ENABLE = BIT(0), 86 + LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS = BIT(1), 87 + LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH = BIT(2), 88 + LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3 = BIT(3), 89 + LTR_CFG_FLAG_SW_SET_SHORT = BIT(4), 90 + LTR_CFG_FLAG_SW_SET_LONG = BIT(5), 91 + LTR_CFG_FLAG_DENIE_C10_ON_PD = BIT(6), 92 + }; 93 + 94 + /** 95 + * struct iwl_ltr_config_cmd - configures the LTR 96 + * @flags: See %enum iwl_ltr_config_flags 97 + */ 98 + struct iwl_ltr_config_cmd { 99 + __le32 flags; 100 + __le32 static_long; 101 + __le32 static_short; 102 + } __packed; 103 + 71 104 /* Radio LP RX Energy Threshold measured in dBm */ 72 105 #define POWER_LPRX_RSSI_THRESHOLD 75 73 106 #define POWER_LPRX_RSSI_THRESHOLD_MAX 94 74 107 #define POWER_LPRX_RSSI_THRESHOLD_MIN 30 75 108 76 109 /** 77 - * enum iwl_scan_flags - masks for power table command flags 110 + * enum iwl_power_flags - masks for power table command flags 78 111 * @POWER_FLAGS_POWER_SAVE_ENA_MSK: '1' Allow to save power by turning off 79 112 * receiver and transmitter. '0' - does not allow. 80 113 * @POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK: '0' Driver disables power management,

+1

drivers/net/wireless/iwlwifi/mvm/fw-api.h

··· 157 157 /* Power - legacy power table command */ 158 158 POWER_TABLE_CMD = 0x77, 159 159 PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION = 0x78, 160 + LTR_CONFIG = 0xee, 160 161 161 162 /* Thermal Throttling*/ 162 163 REPLY_THERMAL_MNG_BACKOFF = 0x7e,

+9

drivers/net/wireless/iwlwifi/mvm/fw.c

··· 480 480 /* Initialize tx backoffs to the minimal possible */ 481 481 iwl_mvm_tt_tx_backoff(mvm, 0); 482 482 483 + if (mvm->trans->ltr_enabled) { 484 + struct iwl_ltr_config_cmd cmd = { 485 + .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE), 486 + }; 487 + 488 + WARN_ON(iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0, 489 + sizeof(cmd), &cmd)); 490 + } 491 + 483 492 ret = iwl_mvm_power_update_device(mvm); 484 493 if (ret) 485 494 goto error;

+23 -9

drivers/net/wireless/iwlwifi/mvm/mac80211.c

··· 526 526 } 527 527 528 528 if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE && 529 - !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status)) 529 + !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) && 530 + !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status)) 530 531 goto drop; 531 532 532 533 /* treat non-bufferable MMPDUs as broadcast if sta is sleeping */ ··· 1735 1734 if (changes & BSS_CHANGED_BEACON && 1736 1735 iwl_mvm_mac_ctxt_beacon_changed(mvm, vif)) 1737 1736 IWL_WARN(mvm, "Failed updating beacon data\n"); 1737 + 1738 + if (changes & BSS_CHANGED_TXPOWER) { 1739 + IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n", 1740 + bss_conf->txpower); 1741 + iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower); 1742 + } 1743 + 1738 1744 } 1739 1745 1740 1746 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw, ··· 2375 2367 /* Set the node address */ 2376 2368 memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN); 2377 2369 2370 + lockdep_assert_held(&mvm->mutex); 2371 + 2372 + spin_lock_bh(&mvm->time_event_lock); 2373 + 2374 + if (WARN_ON(te_data->id == HOT_SPOT_CMD)) { 2375 + spin_unlock_bh(&mvm->time_event_lock); 2376 + return -EIO; 2377 + } 2378 + 2378 2379 te_data->vif = vif; 2379 2380 te_data->duration = duration; 2380 2381 te_data->id = HOT_SPOT_CMD; 2381 2382 2382 - lockdep_assert_held(&mvm->mutex); 2383 - 2384 - spin_lock_bh(&mvm->time_event_lock); 2385 - list_add_tail(&te_data->list, &mvm->time_event_list); 2386 2383 spin_unlock_bh(&mvm->time_event_lock); 2387 2384 2388 2385 /* ··· 2443 2430 IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value, 2444 2431 duration, type); 2445 2432 2433 + mutex_lock(&mvm->mutex); 2434 + 2446 2435 switch (vif->type) { 2447 2436 case NL80211_IFTYPE_STATION: 2448 2437 /* Use aux roc framework (HS20) */ 2449 2438 ret = iwl_mvm_send_aux_roc_cmd(mvm, channel, 2450 2439 vif, duration); 2451 - return ret; 2440 + goto out_unlock; 2452 2441 case NL80211_IFTYPE_P2P_DEVICE: 2453 2442 /* handle below */ 2454 2443 break; 2455 2444 default: 2456 2445 IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type); 2457 - return -EINVAL; 2446 + ret = -EINVAL; 2447 + goto out_unlock; 2458 2448 } 2459 - 2460 - mutex_lock(&mvm->mutex); 2461 2449 2462 2450 for (i = 0; i < NUM_PHY_CTX; i++) { 2463 2451 phy_ctxt = &mvm->phy_ctxts[i];

+1

drivers/net/wireless/iwlwifi/mvm/ops.c

··· 336 336 CMD(DTS_MEASUREMENT_NOTIFICATION), 337 337 CMD(REPLY_THERMAL_MNG_BACKOFF), 338 338 CMD(MAC_PM_POWER_TABLE), 339 + CMD(LTR_CONFIG), 339 340 CMD(BT_COEX_CI), 340 341 CMD(BT_COEX_UPDATE_SW_BOOST), 341 342 CMD(BT_COEX_UPDATE_CORUN_LUT),

+2 -1

drivers/net/wireless/iwlwifi/mvm/scan.c

··· 459 459 basic_ssid ? 1 : 0); 460 460 461 461 cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL | 462 - TX_CMD_FLG_BT_DIS); 462 + 3 << TX_CMD_FLG_BT_PRIO_POS); 463 + 463 464 cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id; 464 465 cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE); 465 466 cmd->tx_cmd.rate_n_flags =

+1 -1

drivers/net/wireless/iwlwifi/mvm/time-event.c

··· 305 305 te_data->running = false; 306 306 te_data->vif = NULL; 307 307 te_data->uid = 0; 308 + te_data->id = TE_MAX; 308 309 } else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) { 309 - set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status); 310 310 set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status); 311 311 te_data->running = true; 312 312 ieee80211_ready_on_channel(mvm->hw); /* Start TE */

+2 -6

drivers/net/wireless/iwlwifi/mvm/tx.c

··· 175 175 176 176 /* 177 177 * for data packets, rate info comes from the table inside the fw. This 178 - * table is controlled by LINK_QUALITY commands. Exclude ctrl port 179 - * frames like EAPOLs which should be treated as mgmt frames. This 180 - * avoids them being sent initially in high rates which increases the 181 - * chances for completion of the 4-Way handshake. 178 + * table is controlled by LINK_QUALITY commands 182 179 */ 183 180 184 - if (ieee80211_is_data(fc) && sta && 185 - !(info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO)) { 181 + if (ieee80211_is_data(fc) && sta) { 186 182 tx_cmd->initial_rate_index = 0; 187 183 tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE); 188 184 return;

+12 -10

drivers/net/wireless/iwlwifi/pcie/trans.c

··· 174 174 { 175 175 struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); 176 176 u16 lctl; 177 + u16 cap; 177 178 178 179 /* 179 180 * HW bug W/A for instability in PCIe bus L0S->L1 transition. ··· 185 184 * power savings, even without L1. 186 185 */ 187 186 pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_LNKCTL, &lctl); 188 - if (lctl & PCI_EXP_LNKCTL_ASPM_L1) { 189 - /* L1-ASPM enabled; disable(!) L0S */ 187 + if (lctl & PCI_EXP_LNKCTL_ASPM_L1) 190 188 iwl_set_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED); 191 - dev_info(trans->dev, "L1 Enabled; Disabling L0S\n"); 192 - } else { 193 - /* L1-ASPM disabled; enable(!) L0S */ 189 + else 194 190 iwl_clear_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED); 195 - dev_info(trans->dev, "L1 Disabled; Enabling L0S\n"); 196 - } 197 191 trans->pm_support = !(lctl & PCI_EXP_LNKCTL_ASPM_L0S); 192 + 193 + pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_DEVCTL2, &cap); 194 + trans->ltr_enabled = cap & PCI_EXP_DEVCTL2_LTR_EN; 195 + dev_info(trans->dev, "L1 %sabled - LTR %sabled\n", 196 + (lctl & PCI_EXP_LNKCTL_ASPM_L1) ? "En" : "Dis", 197 + trans->ltr_enabled ? "En" : "Dis"); 198 198 } 199 199 200 200 /* ··· 430 428 ret = iwl_poll_bit(trans, CSR_RESET, 431 429 CSR_RESET_REG_FLAG_MASTER_DISABLED, 432 430 CSR_RESET_REG_FLAG_MASTER_DISABLED, 100); 433 - if (ret) 431 + if (ret < 0) 434 432 IWL_WARN(trans, "Master Disable Timed Out, 100 usec\n"); 435 433 436 434 IWL_DEBUG_INFO(trans, "stop master\n"); ··· 546 544 msleep(25); 547 545 } 548 546 549 - IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter); 547 + IWL_ERR(trans, "Couldn't prepare the card\n"); 550 548 551 549 return ret; 552 550 } ··· 1045 1043 CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 1046 1044 CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 1047 1045 25000); 1048 - if (ret) { 1046 + if (ret < 0) { 1049 1047 IWL_ERR(trans, "Failed to resume the device (mac ready)\n"); 1050 1048 return ret; 1051 1049 }

+40 -12

drivers/net/wireless/mwifiex/11n_rxreorder.c

··· 196 196 mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, start_win); 197 197 198 198 del_timer_sync(&tbl->timer_context.timer); 199 + tbl->timer_context.timer_is_set = false; 199 200 200 201 spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); 201 202 list_del(&tbl->list); ··· 298 297 (struct reorder_tmr_cnxt *) context; 299 298 int start_win, seq_num; 300 299 300 + ctx->timer_is_set = false; 301 301 seq_num = mwifiex_11n_find_last_seq_num(ctx); 302 302 303 303 if (seq_num < 0) ··· 387 385 388 386 new_node->timer_context.ptr = new_node; 389 387 new_node->timer_context.priv = priv; 388 + new_node->timer_context.timer_is_set = false; 390 389 391 390 init_timer(&new_node->timer_context.timer); 392 391 new_node->timer_context.timer.function = mwifiex_flush_data; ··· 400 397 spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags); 401 398 list_add_tail(&new_node->list, &priv->rx_reorder_tbl_ptr); 402 399 spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags); 400 + } 401 + 402 + static void 403 + mwifiex_11n_rxreorder_timer_restart(struct mwifiex_rx_reorder_tbl *tbl) 404 + { 405 + u32 min_flush_time; 406 + 407 + if (tbl->win_size >= MWIFIEX_BA_WIN_SIZE_32) 408 + min_flush_time = MIN_FLUSH_TIMER_15_MS; 409 + else 410 + min_flush_time = MIN_FLUSH_TIMER_MS; 411 + 412 + mod_timer(&tbl->timer_context.timer, 413 + jiffies + msecs_to_jiffies(min_flush_time * tbl->win_size)); 414 + 415 + tbl->timer_context.timer_is_set = true; 403 416 } 404 417 405 418 /* ··· 542 523 u8 *ta, u8 pkt_type, void *payload) 543 524 { 544 525 struct mwifiex_rx_reorder_tbl *tbl; 545 - int start_win, end_win, win_size; 526 + int prev_start_win, start_win, end_win, win_size; 546 527 u16 pkt_index; 547 528 bool init_window_shift = false; 529 + int ret = 0; 548 530 549 531 tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta); 550 532 if (!tbl) { 551 533 if (pkt_type != PKT_TYPE_BAR) 552 534 mwifiex_11n_dispatch_pkt(priv, payload); 553 - return 0; 535 + return ret; 554 536 } 555 537 556 538 if ((pkt_type == PKT_TYPE_AMSDU) && !tbl->amsdu) { 557 539 mwifiex_11n_dispatch_pkt(priv, payload); 558 - return 0; 540 + return ret; 559 541 } 560 542 561 543 start_win = tbl->start_win; 544 + prev_start_win = start_win; 562 545 win_size = tbl->win_size; 563 546 end_win = ((start_win + win_size) - 1) & (MAX_TID_VALUE - 1); 564 547 if (tbl->flags & RXREOR_INIT_WINDOW_SHIFT) { 565 548 init_window_shift = true; 566 549 tbl->flags &= ~RXREOR_INIT_WINDOW_SHIFT; 567 550 } 568 - mod_timer(&tbl->timer_context.timer, 569 - jiffies + msecs_to_jiffies(MIN_FLUSH_TIMER_MS * win_size)); 570 551 571 552 if (tbl->flags & RXREOR_FORCE_NO_DROP) { 572 553 dev_dbg(priv->adapter->dev, ··· 587 568 if ((start_win + TWOPOW11) > (MAX_TID_VALUE - 1)) { 588 569 if (seq_num >= ((start_win + TWOPOW11) & 589 570 (MAX_TID_VALUE - 1)) && 590 - seq_num < start_win) 591 - return -1; 571 + seq_num < start_win) { 572 + ret = -1; 573 + goto done; 574 + } 592 575 } else if ((seq_num < start_win) || 593 - (seq_num > (start_win + TWOPOW11))) { 594 - return -1; 576 + (seq_num >= (start_win + TWOPOW11))) { 577 + ret = -1; 578 + goto done; 595 579 } 596 580 } 597 581 ··· 623 601 else 624 602 pkt_index = (seq_num+MAX_TID_VALUE) - start_win; 625 603 626 - if (tbl->rx_reorder_ptr[pkt_index]) 627 - return -1; 604 + if (tbl->rx_reorder_ptr[pkt_index]) { 605 + ret = -1; 606 + goto done; 607 + } 628 608 629 609 tbl->rx_reorder_ptr[pkt_index] = payload; 630 610 } ··· 637 613 */ 638 614 mwifiex_11n_scan_and_dispatch(priv, tbl); 639 615 640 - return 0; 616 + done: 617 + if (!tbl->timer_context.timer_is_set || 618 + prev_start_win != tbl->start_win) 619 + mwifiex_11n_rxreorder_timer_restart(tbl); 620 + return ret; 641 621 } 642 622 643 623 /*

+2

drivers/net/wireless/mwifiex/11n_rxreorder.h

··· 21 21 #define _MWIFIEX_11N_RXREORDER_H_ 22 22 23 23 #define MIN_FLUSH_TIMER_MS 50 24 + #define MIN_FLUSH_TIMER_15_MS 15 25 + #define MWIFIEX_BA_WIN_SIZE_32 32 24 26 25 27 #define PKT_TYPE_BAR 0xE7 26 28 #define MAX_TID_VALUE (2 << 11)

+1

drivers/net/wireless/mwifiex/main.h

··· 592 592 struct timer_list timer; 593 593 struct mwifiex_rx_reorder_tbl *ptr; 594 594 struct mwifiex_private *priv; 595 + u8 timer_is_set; 595 596 }; 596 597 597 598 struct mwifiex_rx_reorder_tbl {

+1

drivers/net/wireless/rt2x00/rt2800usb.c

··· 1111 1111 /* Ovislink */ 1112 1112 { USB_DEVICE(0x1b75, 0x3071) }, 1113 1113 { USB_DEVICE(0x1b75, 0x3072) }, 1114 + { USB_DEVICE(0x1b75, 0xa200) }, 1114 1115 /* Para */ 1115 1116 { USB_DEVICE(0x20b8, 0x8888) }, 1116 1117 /* Pegatron */

+1 -1

drivers/net/wireless/rtlwifi/base.c

··· 467 467 rtl_easy_concurrent_retrytimer_callback, (unsigned long)hw); 468 468 /* <2> work queue */ 469 469 rtlpriv->works.hw = hw; 470 - rtlpriv->works.rtl_wq = alloc_workqueue(rtlpriv->cfg->name, 0, 0); 470 + rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); 471 471 INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq, 472 472 (void *)rtl_watchdog_wq_callback); 473 473 INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,

+6

drivers/net/wireless/rtlwifi/core.c

··· 1828 1828 .flush = rtl_op_flush, 1829 1829 }; 1830 1830 EXPORT_SYMBOL_GPL(rtl_ops); 1831 + 1832 + bool rtl_btc_status_false(void) 1833 + { 1834 + return false; 1835 + } 1836 + EXPORT_SYMBOL_GPL(rtl_btc_status_false);

+1

drivers/net/wireless/rtlwifi/core.h

··· 42 42 u32 mask, u32 data); 43 43 void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data); 44 44 bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb); 45 + bool rtl_btc_status_false(void); 45 46 46 47 #endif

+2 -1

drivers/net/wireless/rtlwifi/pci.c

··· 1796 1796 rtl_pci_reset_trx_ring(hw); 1797 1797 1798 1798 rtlpci->driver_is_goingto_unload = false; 1799 - if (rtlpriv->cfg->ops->get_btc_status()) { 1799 + if (rtlpriv->cfg->ops->get_btc_status && 1800 + rtlpriv->cfg->ops->get_btc_status()) { 1800 1801 rtlpriv->btcoexist.btc_ops->btc_init_variables(rtlpriv); 1801 1802 rtlpriv->btcoexist.btc_ops->btc_init_hal_vars(rtlpriv); 1802 1803 }

+6 -2

drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c

··· 656 656 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 657 657 }; 658 658 659 - void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished) 659 + void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, 660 + bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *)) 660 661 { 661 662 struct rtl_priv *rtlpriv = rtl_priv(hw); 662 663 struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); ··· 723 722 memcpy((u8 *)skb_put(skb, totalpacketlen), 724 723 &reserved_page_packet, totalpacketlen); 725 724 726 - rtstatus = rtl_cmd_send_packet(hw, skb); 725 + if (cmd_send_packet) 726 + rtstatus = cmd_send_packet(hw, skb); 727 + else 728 + rtstatus = rtl_cmd_send_packet(hw, skb); 727 729 728 730 if (rtstatus) 729 731 b_dlok = true;

+3 -1

drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h

··· 109 109 u32 cmd_len, u8 *p_cmdbuffer); 110 110 void rtl92c_firmware_selfreset(struct ieee80211_hw *hw); 111 111 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode); 112 - void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished); 112 + void rtl92c_set_fw_rsvdpagepkt 113 + (struct ieee80211_hw *hw, 114 + bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *)); 113 115 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus); 114 116 void usb_writeN_async(struct rtl_priv *rtlpriv, u32 addr, void *data, u16 len); 115 117 void rtl92c_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);

+2

drivers/net/wireless/rtlwifi/rtl8192ce/def.h

··· 114 114 LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 16, 4) 115 115 #define GET_C2H_CMD_FEEDBACK_CCX_SEQ(__pcmdfbhdr) \ 116 116 LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 20, 12) 117 + #define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc) \ 118 + SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32) 117 119 118 120 #define CHIP_VER_B BIT(4) 119 121 #define CHIP_BONDING_IDENTIFIER(_value) (((_value) >> 22) & 0x3)

+1 -1

drivers/net/wireless/rtlwifi/rtl8192ce/hw.c

··· 459 459 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2, 460 460 tmp_reg422 & (~BIT(6))); 461 461 462 - rtl92c_set_fw_rsvdpagepkt(hw, 0); 462 + rtl92c_set_fw_rsvdpagepkt(hw, NULL); 463 463 464 464 _rtl92ce_set_bcn_ctrl_reg(hw, BIT(3), 0); 465 465 _rtl92ce_set_bcn_ctrl_reg(hw, 0, BIT(4));

+1

drivers/net/wireless/rtlwifi/rtl8192ce/sw.c

··· 244 244 .phy_lc_calibrate = _rtl92ce_phy_lc_calibrate, 245 245 .phy_set_bw_mode_callback = rtl92ce_phy_set_bw_mode_callback, 246 246 .dm_dynamic_txpower = rtl92ce_dm_dynamic_txpower, 247 + .get_btc_status = rtl_btc_status_false, 247 248 }; 248 249 249 250 static struct rtl_mod_params rtl92ce_mod_params = {

+3

drivers/net/wireless/rtlwifi/rtl8192ce/trx.c

··· 728 728 case HW_DESC_RXPKT_LEN: 729 729 ret = GET_RX_DESC_PKT_LEN(pdesc); 730 730 break; 731 + case HW_DESC_RXBUFF_ADDR: 732 + ret = GET_RX_STATUS_DESC_BUFF_ADDR(pdesc); 733 + break; 731 734 default: 732 735 RT_ASSERT(false, "ERR rxdesc :%d not process\n", 733 736 desc_name);

+16 -1

drivers/net/wireless/rtlwifi/rtl8192cu/hw.c

··· 1592 1592 } 1593 1593 } 1594 1594 1595 + bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb) 1596 + { 1597 + /* Currently nothing happens here. 1598 + * Traffic stops after some seconds in WPA2 802.11n mode. 1599 + * Maybe because rtl8192cu chip should be set from here? 1600 + * If I understand correctly, the realtek vendor driver sends some urbs 1601 + * if its "here". 1602 + * 1603 + * This is maybe necessary: 1604 + * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb); 1605 + */ 1606 + return true; 1607 + } 1608 + 1595 1609 void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val) 1596 1610 { 1597 1611 struct rtl_priv *rtlpriv = rtl_priv(hw); ··· 1953 1939 recover = true; 1954 1940 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2, 1955 1941 tmp_reg422 & (~BIT(6))); 1956 - rtl92c_set_fw_rsvdpagepkt(hw, 0); 1942 + rtl92c_set_fw_rsvdpagepkt(hw, 1943 + &usb_cmd_send_packet); 1957 1944 _rtl92cu_set_bcn_ctrl_reg(hw, BIT(3), 0); 1958 1945 _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4)); 1959 1946 if (recover)

-1

drivers/net/wireless/rtlwifi/rtl8192cu/hw.h

··· 104 104 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid); 105 105 int rtl92c_download_fw(struct ieee80211_hw *hw); 106 106 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode); 107 - void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished); 108 107 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus); 109 108 void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw, 110 109 u8 element_id, u32 cmd_len, u8 *p_cmdbuffer);

+7

drivers/net/wireless/rtlwifi/rtl8192cu/sw.c

··· 101 101 } 102 102 } 103 103 104 + /* get bt coexist status */ 105 + static bool rtl92cu_get_btc_status(void) 106 + { 107 + return false; 108 + } 109 + 104 110 static struct rtl_hal_ops rtl8192cu_hal_ops = { 105 111 .init_sw_vars = rtl92cu_init_sw_vars, 106 112 .deinit_sw_vars = rtl92cu_deinit_sw_vars, ··· 154 148 .phy_set_bw_mode_callback = rtl92cu_phy_set_bw_mode_callback, 155 149 .dm_dynamic_txpower = rtl92cu_dm_dynamic_txpower, 156 150 .fill_h2c_cmd = rtl92c_fill_h2c_cmd, 151 + .get_btc_status = rtl92cu_get_btc_status, 157 152 }; 158 153 159 154 static struct rtl_mod_params rtl92cu_mod_params = {

+1

drivers/net/wireless/rtlwifi/rtl8192de/sw.c

··· 251 251 .get_rfreg = rtl92d_phy_query_rf_reg, 252 252 .set_rfreg = rtl92d_phy_set_rf_reg, 253 253 .linked_set_reg = rtl92d_linked_set_reg, 254 + .get_btc_status = rtl_btc_status_false, 254 255 }; 255 256 256 257 static struct rtl_mod_params rtl92de_mod_params = {

+4 -4

drivers/net/wireless/rtlwifi/rtl8192ee/hw.c

··· 362 362 } 363 363 break; 364 364 default: 365 - RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, 365 + RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, 366 366 "switch case not process %x\n", variable); 367 367 break; 368 368 } ··· 591 591 acm_ctrl &= (~ACMHW_BEQEN); 592 592 break; 593 593 default: 594 - RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, 594 + RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, 595 595 "switch case not process\n"); 596 596 break; 597 597 } ··· 710 710 } 711 711 break; 712 712 default: 713 - RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, 713 + RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, 714 714 "switch case not process %x\n", variable); 715 715 break; 716 716 } ··· 2424 2424 enc_algo = CAM_AES; 2425 2425 break; 2426 2426 default: 2427 - RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, 2427 + RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, 2428 2428 "switch case not process\n"); 2429 2429 enc_algo = CAM_TKIP; 2430 2430 break;

+2

drivers/net/wireless/rtlwifi/rtl8192se/def.h

··· 446 446 /* DWORD 6 */ 447 447 #define SET_RX_STATUS__DESC_BUFF_ADDR(__pdesc, __val) \ 448 448 SET_BITS_OFFSET_LE(__pdesc + 24, 0, 32, __val) 449 + #define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc) \ 450 + SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32) 449 451 450 452 #define SE_RX_HAL_IS_CCK_RATE(_pdesc)\ 451 453 (GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE1M || \

+3 -19

drivers/net/wireless/rtlwifi/rtl8192se/sw.c

··· 87 87 static void rtl92se_fw_cb(const struct firmware *firmware, void *context) 88 88 { 89 89 struct ieee80211_hw *hw = context; 90 - struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw); 91 90 struct rtl_priv *rtlpriv = rtl_priv(hw); 92 - struct rtl_pci *rtlpci = rtl_pcidev(pcipriv); 93 91 struct rt_firmware *pfirmware = NULL; 94 - int err; 95 92 96 93 RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD, 97 94 "Firmware callback routine entered!\n"); ··· 109 112 memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size); 110 113 pfirmware->sz_fw_tmpbufferlen = firmware->size; 111 114 release_firmware(firmware); 112 - 113 - err = ieee80211_register_hw(hw); 114 - if (err) { 115 - RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, 116 - "Can't register mac80211 hw\n"); 117 - return; 118 - } else { 119 - rtlpriv->mac80211.mac80211_registered = 1; 120 - } 121 - rtlpci->irq_alloc = 1; 122 - set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status); 123 - 124 - /*init rfkill */ 125 - rtl_init_rfkill(hw); 126 115 } 127 116 128 117 static int rtl92s_init_sw_vars(struct ieee80211_hw *hw) ··· 209 226 if (!rtlpriv->rtlhal.pfirmware) 210 227 return 1; 211 228 212 - rtlpriv->max_fw_size = RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE; 213 - 229 + rtlpriv->max_fw_size = RTL8190_MAX_FIRMWARE_CODE_SIZE*2 + 230 + sizeof(struct fw_hdr); 214 231 pr_info("Driver for Realtek RTL8192SE/RTL8191SE\n" 215 232 "Loading firmware %s\n", rtlpriv->cfg->fw_name); 216 233 /* request fw */ ··· 277 294 .set_bbreg = rtl92s_phy_set_bb_reg, 278 295 .get_rfreg = rtl92s_phy_query_rf_reg, 279 296 .set_rfreg = rtl92s_phy_set_rf_reg, 297 + .get_btc_status = rtl_btc_status_false, 280 298 }; 281 299 282 300 static struct rtl_mod_params rtl92se_mod_params = {

+3

drivers/net/wireless/rtlwifi/rtl8192se/trx.c

··· 640 640 case HW_DESC_RXPKT_LEN: 641 641 ret = GET_RX_STATUS_DESC_PKT_LEN(desc); 642 642 break; 643 + case HW_DESC_RXBUFF_ADDR: 644 + ret = GET_RX_STATUS_DESC_BUFF_ADDR(desc); 645 + break; 643 646 default: 644 647 RT_ASSERT(false, "ERR rxdesc :%d not process\n", 645 648 desc_name);

+9 -6

drivers/net/wireless/rtlwifi/rtl8821ae/phy.c

··· 1889 1889 struct rtl_phy *rtlphy = &rtlpriv->phy; 1890 1890 u8 rate_section = _rtl8821ae_get_rate_section_index(regaddr); 1891 1891 1892 - if (band != BAND_ON_2_4G && band != BAND_ON_5G) 1892 + if (band != BAND_ON_2_4G && band != BAND_ON_5G) { 1893 1893 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid Band %d\n", band); 1894 - 1895 - if (rfpath >= MAX_RF_PATH) 1894 + band = BAND_ON_2_4G; 1895 + } 1896 + if (rfpath >= MAX_RF_PATH) { 1896 1897 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid RfPath %d\n", rfpath); 1897 - 1898 - if (txnum >= MAX_RF_PATH) 1898 + rfpath = MAX_RF_PATH - 1; 1899 + } 1900 + if (txnum >= MAX_RF_PATH) { 1899 1901 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid TxNum %d\n", txnum); 1900 - 1902 + txnum = MAX_RF_PATH - 1; 1903 + } 1901 1904 rtlphy->tx_power_by_rate_offset[band][rfpath][txnum][rate_section] = data; 1902 1905 RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, 1903 1906 "TxPwrByRateOffset[Band %d][RfPath %d][TxNum %d][RateSection %d] = 0x%x\n",

+11

drivers/net/wireless/rtlwifi/usb.c

··· 1117 1117 } 1118 1118 rtlpriv->cfg->ops->init_sw_leds(hw); 1119 1119 1120 + err = ieee80211_register_hw(hw); 1121 + if (err) { 1122 + RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, 1123 + "Can't register mac80211 hw.\n"); 1124 + err = -ENODEV; 1125 + goto error_out; 1126 + } 1127 + rtlpriv->mac80211.mac80211_registered = 1; 1128 + 1129 + set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status); 1120 1130 return 0; 1131 + 1121 1132 error_out: 1122 1133 rtl_deinit_core(hw); 1123 1134 _rtl_usb_io_handler_release(hw);

+22 -17

drivers/net/xen-netback/common.h

··· 176 176 char rx_irq_name[IRQ_NAME_SIZE]; /* DEVNAME-qN-rx */ 177 177 struct xen_netif_rx_back_ring rx; 178 178 struct sk_buff_head rx_queue; 179 - RING_IDX rx_last_skb_slots; 180 - unsigned long status; 181 179 182 - struct timer_list rx_stalled; 180 + unsigned int rx_queue_max; 181 + unsigned int rx_queue_len; 182 + unsigned long last_rx_time; 183 + bool stalled; 183 184 184 185 struct gnttab_copy grant_copy_op[MAX_GRANT_COPY_OPS]; 185 186 ··· 200 199 struct xenvif_stats stats; 201 200 }; 202 201 202 + /* Maximum number of Rx slots a to-guest packet may use, including the 203 + * slot needed for GSO meta-data. 204 + */ 205 + #define XEN_NETBK_RX_SLOTS_MAX (MAX_SKB_FRAGS + 1) 206 + 203 207 enum state_bit_shift { 204 208 /* This bit marks that the vif is connected */ 205 209 VIF_STATUS_CONNECTED, 206 - /* This bit signals the RX thread that queuing was stopped (in 207 - * start_xmit), and either the timer fired or an RX interrupt came 208 - */ 209 - QUEUE_STATUS_RX_PURGE_EVENT, 210 - /* This bit tells the interrupt handler that this queue was the reason 211 - * for the carrier off, so it should kick the thread. Only queues which 212 - * brought it down can turn on the carrier. 213 - */ 214 - QUEUE_STATUS_RX_STALLED 215 210 }; 216 211 217 212 struct xenvif { ··· 225 228 u8 ip_csum:1; 226 229 u8 ipv6_csum:1; 227 230 228 - /* Internal feature information. */ 229 - u8 can_queue:1; /* can queue packets for receiver? */ 230 - 231 231 /* Is this interface disabled? True when backend discovers 232 232 * frontend is rogue. 233 233 */ ··· 234 240 /* Queues */ 235 241 struct xenvif_queue *queues; 236 242 unsigned int num_queues; /* active queues, resource allocated */ 243 + unsigned int stalled_queues; 244 + 245 + spinlock_t lock; 237 246 238 247 #ifdef CONFIG_DEBUG_FS 239 248 struct dentry *xenvif_dbg_root; ··· 245 248 /* Miscellaneous private stuff. */ 246 249 struct net_device *dev; 247 250 }; 251 + 252 + struct xenvif_rx_cb { 253 + unsigned long expires; 254 + int meta_slots_used; 255 + bool full_coalesce; 256 + }; 257 + 258 + #define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb) 248 259 249 260 static inline struct xenbus_device *xenvif_to_xenbus_device(struct xenvif *vif) 250 261 { ··· 277 272 278 273 int xenvif_schedulable(struct xenvif *vif); 279 274 280 - int xenvif_must_stop_queue(struct xenvif_queue *queue); 281 - 282 275 int xenvif_queue_stopped(struct xenvif_queue *queue); 283 276 void xenvif_wake_queue(struct xenvif_queue *queue); 284 277 ··· 298 295 void xenvif_kick_thread(struct xenvif_queue *queue); 299 296 300 297 int xenvif_dealloc_kthread(void *data); 298 + 299 + void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb); 301 300 302 301 /* Determine whether the needed number of slots (req) are available, 303 302 * and set req_event if not.

+15 -59

drivers/net/xen-netback/interface.c

··· 43 43 #define XENVIF_QUEUE_LENGTH 32 44 44 #define XENVIF_NAPI_WEIGHT 64 45 45 46 + /* Number of bytes allowed on the internal guest Rx queue. */ 47 + #define XENVIF_RX_QUEUE_BYTES (XEN_NETIF_RX_RING_SIZE/2 * PAGE_SIZE) 48 + 46 49 /* This function is used to set SKBTX_DEV_ZEROCOPY as well as 47 50 * increasing the inflight counter. We need to increase the inflight 48 51 * counter because core driver calls into xenvif_zerocopy_callback ··· 63 60 atomic_dec(&queue->inflight_packets); 64 61 } 65 62 66 - static inline void xenvif_stop_queue(struct xenvif_queue *queue) 67 - { 68 - struct net_device *dev = queue->vif->dev; 69 - 70 - if (!queue->vif->can_queue) 71 - return; 72 - 73 - netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id)); 74 - } 75 - 76 63 int xenvif_schedulable(struct xenvif *vif) 77 64 { 78 65 return netif_running(vif->dev) && 79 - test_bit(VIF_STATUS_CONNECTED, &vif->status); 66 + test_bit(VIF_STATUS_CONNECTED, &vif->status) && 67 + !vif->disabled; 80 68 } 81 69 82 70 static irqreturn_t xenvif_tx_interrupt(int irq, void *dev_id) ··· 108 114 static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id) 109 115 { 110 116 struct xenvif_queue *queue = dev_id; 111 - struct netdev_queue *net_queue = 112 - netdev_get_tx_queue(queue->vif->dev, queue->id); 113 117 114 - /* QUEUE_STATUS_RX_PURGE_EVENT is only set if either QDisc was off OR 115 - * the carrier went down and this queue was previously blocked 116 - */ 117 - if (unlikely(netif_tx_queue_stopped(net_queue) || 118 - (!netif_carrier_ok(queue->vif->dev) && 119 - test_bit(QUEUE_STATUS_RX_STALLED, &queue->status)))) 120 - set_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status); 121 118 xenvif_kick_thread(queue); 122 119 123 120 return IRQ_HANDLED; ··· 136 151 netif_tx_wake_queue(netdev_get_tx_queue(dev, id)); 137 152 } 138 153 139 - /* Callback to wake the queue's thread and turn the carrier off on timeout */ 140 - static void xenvif_rx_stalled(unsigned long data) 141 - { 142 - struct xenvif_queue *queue = (struct xenvif_queue *)data; 143 - 144 - if (xenvif_queue_stopped(queue)) { 145 - set_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status); 146 - xenvif_kick_thread(queue); 147 - } 148 - } 149 - 150 154 static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev) 151 155 { 152 156 struct xenvif *vif = netdev_priv(dev); 153 157 struct xenvif_queue *queue = NULL; 154 158 unsigned int num_queues = vif->num_queues; 155 159 u16 index; 156 - int min_slots_needed; 160 + struct xenvif_rx_cb *cb; 157 161 158 162 BUG_ON(skb->dev != dev); 159 163 ··· 165 191 !xenvif_schedulable(vif)) 166 192 goto drop; 167 193 168 - /* At best we'll need one slot for the header and one for each 169 - * frag. 170 - */ 171 - min_slots_needed = 1 + skb_shinfo(skb)->nr_frags; 194 + cb = XENVIF_RX_CB(skb); 195 + cb->expires = jiffies + rx_drain_timeout_jiffies; 172 196 173 - /* If the skb is GSO then we'll also need an extra slot for the 174 - * metadata. 175 - */ 176 - if (skb_is_gso(skb)) 177 - min_slots_needed++; 178 - 179 - /* If the skb can't possibly fit in the remaining slots 180 - * then turn off the queue to give the ring a chance to 181 - * drain. 182 - */ 183 - if (!xenvif_rx_ring_slots_available(queue, min_slots_needed)) { 184 - queue->rx_stalled.function = xenvif_rx_stalled; 185 - queue->rx_stalled.data = (unsigned long)queue; 186 - xenvif_stop_queue(queue); 187 - mod_timer(&queue->rx_stalled, 188 - jiffies + rx_drain_timeout_jiffies); 189 - } 190 - 191 - skb_queue_tail(&queue->rx_queue, skb); 197 + xenvif_rx_queue_tail(queue, skb); 192 198 xenvif_kick_thread(queue); 193 199 194 200 return NETDEV_TX_OK; ··· 419 465 vif->queues = NULL; 420 466 vif->num_queues = 0; 421 467 468 + spin_lock_init(&vif->lock); 469 + 422 470 dev->netdev_ops = &xenvif_netdev_ops; 423 471 dev->hw_features = NETIF_F_SG | 424 472 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | ··· 464 508 init_timer(&queue->credit_timeout); 465 509 queue->credit_window_start = get_jiffies_64(); 466 510 511 + queue->rx_queue_max = XENVIF_RX_QUEUE_BYTES; 512 + 467 513 skb_queue_head_init(&queue->rx_queue); 468 514 skb_queue_head_init(&queue->tx_queue); 469 515 ··· 497 539 queue->grant_tx_handle[i] = NETBACK_INVALID_HANDLE; 498 540 } 499 541 500 - init_timer(&queue->rx_stalled); 501 - 502 542 return 0; 503 543 } 504 544 ··· 507 551 dev_set_mtu(vif->dev, ETH_DATA_LEN); 508 552 netdev_update_features(vif->dev); 509 553 set_bit(VIF_STATUS_CONNECTED, &vif->status); 510 - netif_carrier_on(vif->dev); 511 554 if (netif_running(vif->dev)) 512 555 xenvif_up(vif); 513 556 rtnl_unlock(); ··· 565 610 queue->rx_irq = err; 566 611 disable_irq(queue->rx_irq); 567 612 } 613 + 614 + queue->stalled = true; 568 615 569 616 task = kthread_create(xenvif_kthread_guest_rx, 570 617 (void *)queue, "%s-guest-rx", queue->name); ··· 631 674 netif_napi_del(&queue->napi); 632 675 633 676 if (queue->task) { 634 - del_timer_sync(&queue->rx_stalled); 635 677 kthread_stop(queue->task); 636 678 queue->task = NULL; 637 679 }

+202 -119

drivers/net/xen-netback/netback.c

··· 55 55 bool separate_tx_rx_irq = 1; 56 56 module_param(separate_tx_rx_irq, bool, 0644); 57 57 58 - /* When guest ring is filled up, qdisc queues the packets for us, but we have 59 - * to timeout them, otherwise other guests' packets can get stuck there 58 + /* The time that packets can stay on the guest Rx internal queue 59 + * before they are dropped. 60 60 */ 61 61 unsigned int rx_drain_timeout_msecs = 10000; 62 62 module_param(rx_drain_timeout_msecs, uint, 0444); 63 63 unsigned int rx_drain_timeout_jiffies; 64 + 65 + /* The length of time before the frontend is considered unresponsive 66 + * because it isn't providing Rx slots. 67 + */ 68 + static unsigned int rx_stall_timeout_msecs = 60000; 69 + module_param(rx_stall_timeout_msecs, uint, 0444); 70 + static unsigned int rx_stall_timeout_jiffies; 64 71 65 72 unsigned int xenvif_max_queues; 66 73 module_param_named(max_queues, xenvif_max_queues, uint, 0644); ··· 90 83 s8 st); 91 84 92 85 static inline int tx_work_todo(struct xenvif_queue *queue); 93 - static inline int rx_work_todo(struct xenvif_queue *queue); 94 86 95 87 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue, 96 88 u16 id, ··· 169 163 return false; 170 164 } 171 165 166 + void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) 167 + { 168 + unsigned long flags; 169 + 170 + spin_lock_irqsave(&queue->rx_queue.lock, flags); 171 + 172 + __skb_queue_tail(&queue->rx_queue, skb); 173 + 174 + queue->rx_queue_len += skb->len; 175 + if (queue->rx_queue_len > queue->rx_queue_max) 176 + netif_tx_stop_queue(netdev_get_tx_queue(queue->vif->dev, queue->id)); 177 + 178 + spin_unlock_irqrestore(&queue->rx_queue.lock, flags); 179 + } 180 + 181 + static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue) 182 + { 183 + struct sk_buff *skb; 184 + 185 + spin_lock_irq(&queue->rx_queue.lock); 186 + 187 + skb = __skb_dequeue(&queue->rx_queue); 188 + if (skb) 189 + queue->rx_queue_len -= skb->len; 190 + 191 + spin_unlock_irq(&queue->rx_queue.lock); 192 + 193 + return skb; 194 + } 195 + 196 + static void xenvif_rx_queue_maybe_wake(struct xenvif_queue *queue) 197 + { 198 + spin_lock_irq(&queue->rx_queue.lock); 199 + 200 + if (queue->rx_queue_len < queue->rx_queue_max) 201 + netif_tx_wake_queue(netdev_get_tx_queue(queue->vif->dev, queue->id)); 202 + 203 + spin_unlock_irq(&queue->rx_queue.lock); 204 + } 205 + 206 + 207 + static void xenvif_rx_queue_purge(struct xenvif_queue *queue) 208 + { 209 + struct sk_buff *skb; 210 + while ((skb = xenvif_rx_dequeue(queue)) != NULL) 211 + kfree_skb(skb); 212 + } 213 + 214 + static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue) 215 + { 216 + struct sk_buff *skb; 217 + 218 + for(;;) { 219 + skb = skb_peek(&queue->rx_queue); 220 + if (!skb) 221 + break; 222 + if (time_before(jiffies, XENVIF_RX_CB(skb)->expires)) 223 + break; 224 + xenvif_rx_dequeue(queue); 225 + kfree_skb(skb); 226 + } 227 + } 228 + 172 229 /* 173 230 * Returns true if we should start a new receive buffer instead of 174 231 * adding 'size' bytes to a buffer which currently contains 'offset' ··· 305 236 306 237 return meta; 307 238 } 308 - 309 - struct xenvif_rx_cb { 310 - int meta_slots_used; 311 - bool full_coalesce; 312 - }; 313 - 314 - #define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb) 315 239 316 240 /* 317 241 * Set up the grant operations for this fragment. If it's a flipping ··· 649 587 650 588 skb_queue_head_init(&rxq); 651 589 652 - while ((skb = skb_dequeue(&queue->rx_queue)) != NULL) { 590 + while (xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX) 591 + && (skb = xenvif_rx_dequeue(queue)) != NULL) { 653 592 RING_IDX max_slots_needed; 654 593 RING_IDX old_req_cons; 655 594 RING_IDX ring_slots_used; 656 595 int i; 596 + 597 + queue->last_rx_time = jiffies; 657 598 658 599 /* We need a cheap worse case estimate for the number of 659 600 * slots we'll use. ··· 698 633 (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 || 699 634 skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)) 700 635 max_slots_needed++; 701 - 702 - /* If the skb may not fit then bail out now */ 703 - if (!xenvif_rx_ring_slots_available(queue, max_slots_needed)) { 704 - skb_queue_head(&queue->rx_queue, skb); 705 - need_to_notify = true; 706 - queue->rx_last_skb_slots = max_slots_needed; 707 - break; 708 - } else 709 - queue->rx_last_skb_slots = 0; 710 636 711 637 old_req_cons = queue->rx.req_cons; 712 638 XENVIF_RX_CB(skb)->meta_slots_used = xenvif_gop_skb(skb, &npo, queue); ··· 1925 1869 } 1926 1870 } 1927 1871 1928 - static inline int rx_work_todo(struct xenvif_queue *queue) 1929 - { 1930 - return (!skb_queue_empty(&queue->rx_queue) && 1931 - xenvif_rx_ring_slots_available(queue, queue->rx_last_skb_slots)); 1932 - } 1933 - 1934 1872 static inline int tx_work_todo(struct xenvif_queue *queue) 1935 1873 { 1936 1874 if (likely(RING_HAS_UNCONSUMED_REQUESTS(&queue->tx))) ··· 1981 1931 return err; 1982 1932 } 1983 1933 1984 - static void xenvif_start_queue(struct xenvif_queue *queue) 1934 + static void xenvif_queue_carrier_off(struct xenvif_queue *queue) 1985 1935 { 1986 - if (xenvif_schedulable(queue->vif)) 1987 - xenvif_wake_queue(queue); 1936 + struct xenvif *vif = queue->vif; 1937 + 1938 + queue->stalled = true; 1939 + 1940 + /* At least one queue has stalled? Disable the carrier. */ 1941 + spin_lock(&vif->lock); 1942 + if (vif->stalled_queues++ == 0) { 1943 + netdev_info(vif->dev, "Guest Rx stalled"); 1944 + netif_carrier_off(vif->dev); 1945 + } 1946 + spin_unlock(&vif->lock); 1988 1947 } 1989 1948 1990 - /* Only called from the queue's thread, it handles the situation when the guest 1991 - * doesn't post enough requests on the receiving ring. 1992 - * First xenvif_start_xmit disables QDisc and start a timer, and then either the 1993 - * timer fires, or the guest send an interrupt after posting new request. If it 1994 - * is the timer, the carrier is turned off here. 1995 - * */ 1996 - static void xenvif_rx_purge_event(struct xenvif_queue *queue) 1949 + static void xenvif_queue_carrier_on(struct xenvif_queue *queue) 1997 1950 { 1998 - /* Either the last unsuccesful skb or at least 1 slot should fit */ 1999 - int needed = queue->rx_last_skb_slots ? 2000 - queue->rx_last_skb_slots : 1; 1951 + struct xenvif *vif = queue->vif; 2001 1952 2002 - /* It is assumed that if the guest post new slots after this, the RX 2003 - * interrupt will set the QUEUE_STATUS_RX_PURGE_EVENT bit and wake up 2004 - * the thread again 2005 - */ 2006 - set_bit(QUEUE_STATUS_RX_STALLED, &queue->status); 2007 - if (!xenvif_rx_ring_slots_available(queue, needed)) { 2008 - rtnl_lock(); 2009 - if (netif_carrier_ok(queue->vif->dev)) { 2010 - /* Timer fired and there are still no slots. Turn off 2011 - * everything except the interrupts 2012 - */ 2013 - netif_carrier_off(queue->vif->dev); 2014 - skb_queue_purge(&queue->rx_queue); 2015 - queue->rx_last_skb_slots = 0; 2016 - if (net_ratelimit()) 2017 - netdev_err(queue->vif->dev, "Carrier off due to lack of guest response on queue %d\n", queue->id); 2018 - } else { 2019 - /* Probably an another queue already turned the carrier 2020 - * off, make sure nothing is stucked in the internal 2021 - * queue of this queue 2022 - */ 2023 - skb_queue_purge(&queue->rx_queue); 2024 - queue->rx_last_skb_slots = 0; 2025 - } 2026 - rtnl_unlock(); 2027 - } else if (!netif_carrier_ok(queue->vif->dev)) { 2028 - unsigned int num_queues = queue->vif->num_queues; 2029 - unsigned int i; 2030 - /* The carrier was down, but an interrupt kicked 2031 - * the thread again after new requests were 2032 - * posted 2033 - */ 2034 - clear_bit(QUEUE_STATUS_RX_STALLED, 2035 - &queue->status); 2036 - rtnl_lock(); 2037 - netif_carrier_on(queue->vif->dev); 2038 - netif_tx_wake_all_queues(queue->vif->dev); 2039 - rtnl_unlock(); 1953 + queue->last_rx_time = jiffies; /* Reset Rx stall detection. */ 1954 + queue->stalled = false; 2040 1955 2041 - for (i = 0; i < num_queues; i++) { 2042 - struct xenvif_queue *temp = &queue->vif->queues[i]; 2043 - 2044 - xenvif_napi_schedule_or_enable_events(temp); 2045 - } 2046 - if (net_ratelimit()) 2047 - netdev_err(queue->vif->dev, "Carrier on again\n"); 2048 - } else { 2049 - /* Queuing were stopped, but the guest posted 2050 - * new requests and sent an interrupt 2051 - */ 2052 - clear_bit(QUEUE_STATUS_RX_STALLED, 2053 - &queue->status); 2054 - del_timer_sync(&queue->rx_stalled); 2055 - xenvif_start_queue(queue); 1956 + /* All queues are ready? Enable the carrier. */ 1957 + spin_lock(&vif->lock); 1958 + if (--vif->stalled_queues == 0) { 1959 + netdev_info(vif->dev, "Guest Rx ready"); 1960 + netif_carrier_on(vif->dev); 2056 1961 } 1962 + spin_unlock(&vif->lock); 1963 + } 1964 + 1965 + static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue) 1966 + { 1967 + RING_IDX prod, cons; 1968 + 1969 + prod = queue->rx.sring->req_prod; 1970 + cons = queue->rx.req_cons; 1971 + 1972 + return !queue->stalled 1973 + && prod - cons < XEN_NETBK_RX_SLOTS_MAX 1974 + && time_after(jiffies, 1975 + queue->last_rx_time + rx_stall_timeout_jiffies); 1976 + } 1977 + 1978 + static bool xenvif_rx_queue_ready(struct xenvif_queue *queue) 1979 + { 1980 + RING_IDX prod, cons; 1981 + 1982 + prod = queue->rx.sring->req_prod; 1983 + cons = queue->rx.req_cons; 1984 + 1985 + return queue->stalled 1986 + && prod - cons >= XEN_NETBK_RX_SLOTS_MAX; 1987 + } 1988 + 1989 + static bool xenvif_have_rx_work(struct xenvif_queue *queue) 1990 + { 1991 + return (!skb_queue_empty(&queue->rx_queue) 1992 + && xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX)) 1993 + || xenvif_rx_queue_stalled(queue) 1994 + || xenvif_rx_queue_ready(queue) 1995 + || kthread_should_stop() 1996 + || queue->vif->disabled; 1997 + } 1998 + 1999 + static long xenvif_rx_queue_timeout(struct xenvif_queue *queue) 2000 + { 2001 + struct sk_buff *skb; 2002 + long timeout; 2003 + 2004 + skb = skb_peek(&queue->rx_queue); 2005 + if (!skb) 2006 + return MAX_SCHEDULE_TIMEOUT; 2007 + 2008 + timeout = XENVIF_RX_CB(skb)->expires - jiffies; 2009 + return timeout < 0 ? 0 : timeout; 2010 + } 2011 + 2012 + /* Wait until the guest Rx thread has work. 2013 + * 2014 + * The timeout needs to be adjusted based on the current head of the 2015 + * queue (and not just the head at the beginning). In particular, if 2016 + * the queue is initially empty an infinite timeout is used and this 2017 + * needs to be reduced when a skb is queued. 2018 + * 2019 + * This cannot be done with wait_event_timeout() because it only 2020 + * calculates the timeout once. 2021 + */ 2022 + static void xenvif_wait_for_rx_work(struct xenvif_queue *queue) 2023 + { 2024 + DEFINE_WAIT(wait); 2025 + 2026 + if (xenvif_have_rx_work(queue)) 2027 + return; 2028 + 2029 + for (;;) { 2030 + long ret; 2031 + 2032 + prepare_to_wait(&queue->wq, &wait, TASK_INTERRUPTIBLE); 2033 + if (xenvif_have_rx_work(queue)) 2034 + break; 2035 + ret = schedule_timeout(xenvif_rx_queue_timeout(queue)); 2036 + if (!ret) 2037 + break; 2038 + } 2039 + finish_wait(&queue->wq, &wait); 2057 2040 } 2058 2041 2059 2042 int xenvif_kthread_guest_rx(void *data) 2060 2043 { 2061 2044 struct xenvif_queue *queue = data; 2062 - struct sk_buff *skb; 2045 + struct xenvif *vif = queue->vif; 2063 2046 2064 - while (!kthread_should_stop()) { 2065 - wait_event_interruptible(queue->wq, 2066 - rx_work_todo(queue) || 2067 - queue->vif->disabled || 2068 - test_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status) || 2069 - kthread_should_stop()); 2047 + for (;;) { 2048 + xenvif_wait_for_rx_work(queue); 2070 2049 2071 2050 if (kthread_should_stop()) 2072 2051 break; ··· 2107 2028 * context so we defer it here, if this thread is 2108 2029 * associated with queue 0. 2109 2030 */ 2110 - if (unlikely(queue->vif->disabled && queue->id == 0)) { 2111 - xenvif_carrier_off(queue->vif); 2112 - } else if (unlikely(queue->vif->disabled)) { 2113 - /* kthread_stop() would be called upon this thread soon, 2114 - * be a bit proactive 2115 - */ 2116 - skb_queue_purge(&queue->rx_queue); 2117 - queue->rx_last_skb_slots = 0; 2118 - } else if (unlikely(test_and_clear_bit(QUEUE_STATUS_RX_PURGE_EVENT, 2119 - &queue->status))) { 2120 - xenvif_rx_purge_event(queue); 2121 - } else if (!netif_carrier_ok(queue->vif->dev)) { 2122 - /* Another queue stalled and turned the carrier off, so 2123 - * purge the internal queue of queues which were not 2124 - * blocked 2125 - */ 2126 - skb_queue_purge(&queue->rx_queue); 2127 - queue->rx_last_skb_slots = 0; 2031 + if (unlikely(vif->disabled && queue->id == 0)) { 2032 + xenvif_carrier_off(vif); 2033 + xenvif_rx_queue_purge(queue); 2034 + continue; 2128 2035 } 2129 2036 2130 2037 if (!skb_queue_empty(&queue->rx_queue)) 2131 2038 xenvif_rx_action(queue); 2132 2039 2040 + /* If the guest hasn't provided any Rx slots for a 2041 + * while it's probably not responsive, drop the 2042 + * carrier so packets are dropped earlier. 2043 + */ 2044 + if (xenvif_rx_queue_stalled(queue)) 2045 + xenvif_queue_carrier_off(queue); 2046 + else if (xenvif_rx_queue_ready(queue)) 2047 + xenvif_queue_carrier_on(queue); 2048 + 2049 + /* Queued packets may have foreign pages from other 2050 + * domains. These cannot be queued indefinitely as 2051 + * this would starve guests of grant refs and transmit 2052 + * slots. 2053 + */ 2054 + xenvif_rx_queue_drop_expired(queue); 2055 + 2056 + xenvif_rx_queue_maybe_wake(queue); 2057 + 2133 2058 cond_resched(); 2134 2059 } 2135 2060 2136 2061 /* Bin any remaining skbs */ 2137 - while ((skb = skb_dequeue(&queue->rx_queue)) != NULL) 2138 - dev_kfree_skb(skb); 2062 + xenvif_rx_queue_purge(queue); 2139 2063 2140 2064 return 0; 2141 2065 } ··· 2195 2113 goto failed_init; 2196 2114 2197 2115 rx_drain_timeout_jiffies = msecs_to_jiffies(rx_drain_timeout_msecs); 2116 + rx_stall_timeout_jiffies = msecs_to_jiffies(rx_stall_timeout_msecs); 2198 2117 2199 2118 #ifdef CONFIG_DEBUG_FS 2200 2119 xen_netback_dbg_root = debugfs_create_dir("xen-netback", NULL);

+13 -9

drivers/net/xen-netback/xenbus.c

··· 52 52 struct xenvif_queue *queue = m->private; 53 53 struct xen_netif_tx_back_ring *tx_ring = &queue->tx; 54 54 struct xen_netif_rx_back_ring *rx_ring = &queue->rx; 55 + struct netdev_queue *dev_queue; 55 56 56 57 if (tx_ring->sring) { 57 58 struct xen_netif_tx_sring *sring = tx_ring->sring; ··· 112 111 queue->remaining_credit, 113 112 queue->credit_timeout.expires, 114 113 jiffies); 114 + 115 + dev_queue = netdev_get_tx_queue(queue->vif->dev, queue->id); 116 + 117 + seq_printf(m, "\nRx internal queue: len %u max %u pkts %u %s\n", 118 + queue->rx_queue_len, queue->rx_queue_max, 119 + skb_queue_len(&queue->rx_queue), 120 + netif_tx_queue_stopped(dev_queue) ? "stopped" : "running"); 115 121 116 122 return 0; 117 123 } ··· 711 703 be->vif->queues = vzalloc(requested_num_queues * 712 704 sizeof(struct xenvif_queue)); 713 705 be->vif->num_queues = requested_num_queues; 706 + be->vif->stalled_queues = requested_num_queues; 714 707 715 708 for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) { 716 709 queue = &be->vif->queues[queue_index]; ··· 882 873 if (!rx_copy) 883 874 return -EOPNOTSUPP; 884 875 885 - if (vif->dev->tx_queue_len != 0) { 886 - if (xenbus_scanf(XBT_NIL, dev->otherend, 887 - "feature-rx-notify", "%d", &val) < 0) 888 - val = 0; 889 - if (val) 890 - vif->can_queue = 1; 891 - else 892 - /* Must be non-zero for pfifo_fast to work. */ 893 - vif->dev->tx_queue_len = 1; 876 + if (xenbus_scanf(XBT_NIL, dev->otherend, 877 + "feature-rx-notify", "%d", &val) < 0 || val == 0) { 878 + xenbus_dev_fatal(dev, -EINVAL, "feature-rx-notify is mandatory"); 879 + return -EINVAL; 894 880 } 895 881 896 882 if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-sg",

+10 -2

include/linux/skbuff.h

··· 557 557 /* fields enclosed in headers_start/headers_end are copied 558 558 * using a single memcpy() in __copy_skb_header() 559 559 */ 560 + /* private: */ 560 561 __u32 headers_start[0]; 562 + /* public: */ 561 563 562 564 /* if you move pkt_type around you also must adapt those constants */ 563 565 #ifdef __BIG_ENDIAN_BITFIELD ··· 644 642 __u16 network_header; 645 643 __u16 mac_header; 646 644 645 + /* private: */ 647 646 __u32 headers_end[0]; 647 + /* public: */ 648 648 649 649 /* These elements must be at the end, see alloc_skb() for details. */ 650 650 sk_buff_data_t tail; ··· 799 795 * @skb: buffer 800 796 * 801 797 * Returns true is skb is a fast clone, and its clone is not freed. 798 + * Some drivers call skb_orphan() in their ndo_start_xmit(), 799 + * so we also check that this didnt happen. 802 800 */ 803 - static inline bool skb_fclone_busy(const struct sk_buff *skb) 801 + static inline bool skb_fclone_busy(const struct sock *sk, 802 + const struct sk_buff *skb) 804 803 { 805 804 const struct sk_buff_fclones *fclones; 806 805 807 806 fclones = container_of(skb, struct sk_buff_fclones, skb1); 808 807 809 808 return skb->fclone == SKB_FCLONE_ORIG && 810 - fclones->skb2.fclone == SKB_FCLONE_CLONE; 809 + fclones->skb2.fclone == SKB_FCLONE_CLONE && 810 + fclones->skb2.sk == sk; 811 811 } 812 812 813 813 static inline struct sk_buff *alloc_skb_fclone(unsigned int size,

+4

include/linux/usb/usbnet.h

··· 78 78 # define EVENT_NO_RUNTIME_PM 9 79 79 # define EVENT_RX_KILL 10 80 80 # define EVENT_LINK_CHANGE 11 81 + # define EVENT_SET_RX_MODE 12 81 82 }; 82 83 83 84 static inline struct usb_driver *driver_of(struct usb_interface *intf) ··· 159 158 160 159 /* called by minidriver when receiving indication */ 161 160 void (*indication)(struct usbnet *dev, void *ind, int indlen); 161 + 162 + /* rx mode change (device changes address list filtering) */ 163 + void (*set_rx_mode)(struct usbnet *dev); 162 164 163 165 /* for new devices, use the descriptor-reading code instead */ 164 166 int in; /* rx endpoint */

+2

include/net/ipv6.h

··· 671 671 return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr)); 672 672 } 673 673 674 + void ipv6_proxy_select_ident(struct sk_buff *skb); 675 + 674 676 int ip6_dst_hoplimit(struct dst_entry *dst); 675 677 676 678 static inline int ip6_sk_dst_hoplimit(struct ipv6_pinfo *np, struct flowi6 *fl6,

+10

include/net/netfilter/ipv4/nf_reject.h

··· 1 1 #ifndef _IPV4_NF_REJECT_H 2 2 #define _IPV4_NF_REJECT_H 3 3 4 + #include <linux/skbuff.h> 5 + #include <net/ip.h> 4 6 #include <net/icmp.h> 5 7 6 8 static inline void nf_send_unreach(struct sk_buff *skb_in, int code) ··· 11 9 } 12 10 13 11 void nf_send_reset(struct sk_buff *oldskb, int hook); 12 + 13 + const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb, 14 + struct tcphdr *_oth, int hook); 15 + struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb, 16 + const struct sk_buff *oldskb, 17 + __be16 protocol, int ttl); 18 + void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb, 19 + const struct tcphdr *oth); 14 20 15 21 #endif /* _IPV4_NF_REJECT_H */

+10

include/net/netfilter/ipv6/nf_reject.h

··· 15 15 16 16 void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook); 17 17 18 + const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb, 19 + struct tcphdr *otcph, 20 + unsigned int *otcplen, int hook); 21 + struct ipv6hdr *nf_reject_ip6hdr_put(struct sk_buff *nskb, 22 + const struct sk_buff *oldskb, 23 + __be16 protocol, int hoplimit); 24 + void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb, 25 + const struct sk_buff *oldskb, 26 + const struct tcphdr *oth, unsigned int otcplen); 27 + 18 28 #endif /* _IPV6_NF_REJECT_H */

+3

include/net/netfilter/nf_tables.h

··· 530 530 NFT_CHAIN_T_MAX 531 531 }; 532 532 533 + int nft_chain_validate_dependency(const struct nft_chain *chain, 534 + enum nft_chain_type type); 535 + 533 536 struct nft_stats { 534 537 u64 bytes; 535 538 u64 pkts;

+3

include/net/netfilter/nft_masq.h

··· 13 13 14 14 int nft_masq_dump(struct sk_buff *skb, const struct nft_expr *expr); 15 15 16 + int nft_masq_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, 17 + const struct nft_data **data); 18 + 16 19 #endif /* _NFT_MASQ_H_ */

+14

init/Kconfig

··· 1341 1341 config HAVE_PCSPKR_PLATFORM 1342 1342 bool 1343 1343 1344 + # interpreter that classic socket filters depend on 1345 + config BPF 1346 + bool 1347 + 1344 1348 menuconfig EXPERT 1345 1349 bool "Configure standard kernel features (expert users)" 1346 1350 # Unhide debug options, to make the on-by-default options visible ··· 1524 1520 kernel notification (ie. KAIO) or userspace notifications. 1525 1521 1526 1522 If unsure, say Y. 1523 + 1524 + # syscall, maps, verifier 1525 + config BPF_SYSCALL 1526 + bool "Enable bpf() system call" if EXPERT 1527 + select ANON_INODES 1528 + select BPF 1529 + default n 1530 + help 1531 + Enable the bpf() system call that allows to manipulate eBPF 1532 + programs and maps via file descriptors. 1527 1533 1528 1534 config SHMEM 1529 1535 bool "Use full shmem filesystem" if EXPERT

+1 -1

kernel/Makefile

··· 86 86 obj-$(CONFIG_TRACEPOINTS) += trace/ 87 87 obj-$(CONFIG_IRQ_WORK) += irq_work.o 88 88 obj-$(CONFIG_CPU_PM) += cpu_pm.o 89 - obj-$(CONFIG_NET) += bpf/ 89 + obj-$(CONFIG_BPF) += bpf/ 90 90 91 91 obj-$(CONFIG_PERF_EVENTS) += events/ 92 92

+3 -3

kernel/bpf/Makefile

··· 1 - obj-y := core.o syscall.o verifier.o 2 - 1 + obj-y := core.o 2 + obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o 3 3 ifdef CONFIG_TEST_BPF 4 - obj-y += test_stub.o 4 + obj-$(CONFIG_BPF_SYSCALL) += test_stub.o 5 5 endif

+9

kernel/bpf/core.c

··· 655 655 schedule_work(&aux->work); 656 656 } 657 657 EXPORT_SYMBOL_GPL(bpf_prog_free); 658 + 659 + /* To execute LD_ABS/LD_IND instructions __bpf_prog_run() may call 660 + * skb_copy_bits(), so provide a weak definition of it for NET-less config. 661 + */ 662 + int __weak skb_copy_bits(const struct sk_buff *skb, int offset, void *to, 663 + int len) 664 + { 665 + return -EFAULT; 666 + }

+2 -1

kernel/bpf/verifier.c

··· 1409 1409 if (memcmp(&old->regs[i], &cur->regs[i], 1410 1410 sizeof(old->regs[0])) != 0) { 1411 1411 if (old->regs[i].type == NOT_INIT || 1412 - old->regs[i].type == UNKNOWN_VALUE) 1412 + (old->regs[i].type == UNKNOWN_VALUE && 1413 + cur->regs[i].type != NOT_INIT)) 1413 1414 continue; 1414 1415 return false; 1415 1416 }

+1 -1

net/Kconfig

··· 6 6 bool "Networking support" 7 7 select NLATTR 8 8 select GENERIC_NET_UTILS 9 - select ANON_INODES 9 + select BPF 10 10 ---help--- 11 11 Unless you really know what you are doing, you should say Y here. 12 12 The reason is that some programs need kernel networking support even

+1

net/bridge/br_forward.c

··· 112 112 113 113 kfree_skb(skb); 114 114 } 115 + EXPORT_SYMBOL_GPL(br_deliver); 115 116 116 117 /* called with rcu_read_lock */ 117 118 void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, struct sk_buff *skb0)

+5 -19

net/bridge/br_netfilter.c

··· 192 192 193 193 static int br_parse_ip_options(struct sk_buff *skb) 194 194 { 195 - struct ip_options *opt; 196 195 const struct iphdr *iph; 197 196 struct net_device *dev = skb->dev; 198 197 u32 len; ··· 200 201 goto inhdr_error; 201 202 202 203 iph = ip_hdr(skb); 203 - opt = &(IPCB(skb)->opt); 204 204 205 205 /* Basic sanity checks */ 206 206 if (iph->ihl < 5 || iph->version != 4) ··· 225 227 } 226 228 227 229 memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); 228 - if (iph->ihl == 5) 229 - return 0; 230 - 231 - opt->optlen = iph->ihl*4 - sizeof(struct iphdr); 232 - if (ip_options_compile(dev_net(dev), opt, skb)) 233 - goto inhdr_error; 234 - 235 - /* Check correct handling of SRR option */ 236 - if (unlikely(opt->srr)) { 237 - struct in_device *in_dev = __in_dev_get_rcu(dev); 238 - if (in_dev && !IN_DEV_SOURCE_ROUTE(in_dev)) 239 - goto drop; 240 - 241 - if (ip_options_rcv_srr(skb)) 242 - goto drop; 243 - } 244 - 230 + /* We should really parse IP options here but until 231 + * somebody who actually uses IP options complains to 232 + * us we'll just silently ignore the options because 233 + * we're lazy! 234 + */ 245 235 return 0; 246 236 247 237 inhdr_error:

+4 -2

net/bridge/netfilter/nf_tables_bridge.c

··· 75 75 .type = NFT_CHAIN_T_DEFAULT, 76 76 .family = NFPROTO_BRIDGE, 77 77 .owner = THIS_MODULE, 78 - .hook_mask = (1 << NF_BR_LOCAL_IN) | 78 + .hook_mask = (1 << NF_BR_PRE_ROUTING) | 79 + (1 << NF_BR_LOCAL_IN) | 79 80 (1 << NF_BR_FORWARD) | 80 - (1 << NF_BR_LOCAL_OUT), 81 + (1 << NF_BR_LOCAL_OUT) | 82 + (1 << NF_BR_POST_ROUTING), 81 83 }; 82 84 83 85 static int __init nf_tables_bridge_init(void)

+285 -11

net/bridge/netfilter/nft_reject_bridge.c

··· 16 16 #include <net/netfilter/nft_reject.h> 17 17 #include <net/netfilter/ipv4/nf_reject.h> 18 18 #include <net/netfilter/ipv6/nf_reject.h> 19 + #include <linux/ip.h> 20 + #include <net/ip.h> 21 + #include <linux/netfilter_bridge.h> 22 + #include "../br_private.h" 23 + 24 + static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb, 25 + struct sk_buff *nskb) 26 + { 27 + struct ethhdr *eth; 28 + 29 + eth = (struct ethhdr *)skb_push(nskb, ETH_HLEN); 30 + skb_reset_mac_header(nskb); 31 + ether_addr_copy(eth->h_source, eth_hdr(oldskb)->h_dest); 32 + ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source); 33 + eth->h_proto = eth_hdr(oldskb)->h_proto; 34 + skb_pull(nskb, ETH_HLEN); 35 + } 36 + 37 + static int nft_reject_iphdr_validate(struct sk_buff *oldskb) 38 + { 39 + struct iphdr *iph; 40 + u32 len; 41 + 42 + if (!pskb_may_pull(oldskb, sizeof(struct iphdr))) 43 + return 0; 44 + 45 + iph = ip_hdr(oldskb); 46 + if (iph->ihl < 5 || iph->version != 4) 47 + return 0; 48 + 49 + len = ntohs(iph->tot_len); 50 + if (oldskb->len < len) 51 + return 0; 52 + else if (len < (iph->ihl*4)) 53 + return 0; 54 + 55 + if (!pskb_may_pull(oldskb, iph->ihl*4)) 56 + return 0; 57 + 58 + return 1; 59 + } 60 + 61 + static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb, int hook) 62 + { 63 + struct sk_buff *nskb; 64 + struct iphdr *niph; 65 + const struct tcphdr *oth; 66 + struct tcphdr _oth; 67 + 68 + if (!nft_reject_iphdr_validate(oldskb)) 69 + return; 70 + 71 + oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook); 72 + if (!oth) 73 + return; 74 + 75 + nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) + 76 + LL_MAX_HEADER, GFP_ATOMIC); 77 + if (!nskb) 78 + return; 79 + 80 + skb_reserve(nskb, LL_MAX_HEADER); 81 + niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP, 82 + sysctl_ip_default_ttl); 83 + nf_reject_ip_tcphdr_put(nskb, oldskb, oth); 84 + niph->ttl = sysctl_ip_default_ttl; 85 + niph->tot_len = htons(nskb->len); 86 + ip_send_check(niph); 87 + 88 + nft_reject_br_push_etherhdr(oldskb, nskb); 89 + 90 + br_deliver(br_port_get_rcu(oldskb->dev), nskb); 91 + } 92 + 93 + static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb, int hook, 94 + u8 code) 95 + { 96 + struct sk_buff *nskb; 97 + struct iphdr *niph; 98 + struct icmphdr *icmph; 99 + unsigned int len; 100 + void *payload; 101 + __wsum csum; 102 + 103 + if (!nft_reject_iphdr_validate(oldskb)) 104 + return; 105 + 106 + /* IP header checks: fragment. */ 107 + if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) 108 + return; 109 + 110 + /* RFC says return as much as we can without exceeding 576 bytes. */ 111 + len = min_t(unsigned int, 536, oldskb->len); 112 + 113 + if (!pskb_may_pull(oldskb, len)) 114 + return; 115 + 116 + if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), 0)) 117 + return; 118 + 119 + nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmphdr) + 120 + LL_MAX_HEADER + len, GFP_ATOMIC); 121 + if (!nskb) 122 + return; 123 + 124 + skb_reserve(nskb, LL_MAX_HEADER); 125 + niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_ICMP, 126 + sysctl_ip_default_ttl); 127 + 128 + skb_reset_transport_header(nskb); 129 + icmph = (struct icmphdr *)skb_put(nskb, sizeof(struct icmphdr)); 130 + memset(icmph, 0, sizeof(*icmph)); 131 + icmph->type = ICMP_DEST_UNREACH; 132 + icmph->code = code; 133 + 134 + payload = skb_put(nskb, len); 135 + memcpy(payload, skb_network_header(oldskb), len); 136 + 137 + csum = csum_partial((void *)icmph, len + sizeof(struct icmphdr), 0); 138 + icmph->checksum = csum_fold(csum); 139 + 140 + niph->tot_len = htons(nskb->len); 141 + ip_send_check(niph); 142 + 143 + nft_reject_br_push_etherhdr(oldskb, nskb); 144 + 145 + br_deliver(br_port_get_rcu(oldskb->dev), nskb); 146 + } 147 + 148 + static int nft_reject_ip6hdr_validate(struct sk_buff *oldskb) 149 + { 150 + struct ipv6hdr *hdr; 151 + u32 pkt_len; 152 + 153 + if (!pskb_may_pull(oldskb, sizeof(struct ipv6hdr))) 154 + return 0; 155 + 156 + hdr = ipv6_hdr(oldskb); 157 + if (hdr->version != 6) 158 + return 0; 159 + 160 + pkt_len = ntohs(hdr->payload_len); 161 + if (pkt_len + sizeof(struct ipv6hdr) > oldskb->len) 162 + return 0; 163 + 164 + return 1; 165 + } 166 + 167 + static void nft_reject_br_send_v6_tcp_reset(struct net *net, 168 + struct sk_buff *oldskb, int hook) 169 + { 170 + struct sk_buff *nskb; 171 + const struct tcphdr *oth; 172 + struct tcphdr _oth; 173 + unsigned int otcplen; 174 + struct ipv6hdr *nip6h; 175 + 176 + if (!nft_reject_ip6hdr_validate(oldskb)) 177 + return; 178 + 179 + oth = nf_reject_ip6_tcphdr_get(oldskb, &_oth, &otcplen, hook); 180 + if (!oth) 181 + return; 182 + 183 + nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct tcphdr) + 184 + LL_MAX_HEADER, GFP_ATOMIC); 185 + if (!nskb) 186 + return; 187 + 188 + skb_reserve(nskb, LL_MAX_HEADER); 189 + nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP, 190 + net->ipv6.devconf_all->hop_limit); 191 + nf_reject_ip6_tcphdr_put(nskb, oldskb, oth, otcplen); 192 + nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr)); 193 + 194 + nft_reject_br_push_etherhdr(oldskb, nskb); 195 + 196 + br_deliver(br_port_get_rcu(oldskb->dev), nskb); 197 + } 198 + 199 + static void nft_reject_br_send_v6_unreach(struct net *net, 200 + struct sk_buff *oldskb, int hook, 201 + u8 code) 202 + { 203 + struct sk_buff *nskb; 204 + struct ipv6hdr *nip6h; 205 + struct icmp6hdr *icmp6h; 206 + unsigned int len; 207 + void *payload; 208 + 209 + if (!nft_reject_ip6hdr_validate(oldskb)) 210 + return; 211 + 212 + /* Include "As much of invoking packet as possible without the ICMPv6 213 + * packet exceeding the minimum IPv6 MTU" in the ICMP payload. 214 + */ 215 + len = min_t(unsigned int, 1220, oldskb->len); 216 + 217 + if (!pskb_may_pull(oldskb, len)) 218 + return; 219 + 220 + nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) + 221 + LL_MAX_HEADER + len, GFP_ATOMIC); 222 + if (!nskb) 223 + return; 224 + 225 + skb_reserve(nskb, LL_MAX_HEADER); 226 + nip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_ICMPV6, 227 + net->ipv6.devconf_all->hop_limit); 228 + 229 + skb_reset_transport_header(nskb); 230 + icmp6h = (struct icmp6hdr *)skb_put(nskb, sizeof(struct icmp6hdr)); 231 + memset(icmp6h, 0, sizeof(*icmp6h)); 232 + icmp6h->icmp6_type = ICMPV6_DEST_UNREACH; 233 + icmp6h->icmp6_code = code; 234 + 235 + payload = skb_put(nskb, len); 236 + memcpy(payload, skb_network_header(oldskb), len); 237 + nip6h->payload_len = htons(nskb->len - sizeof(struct ipv6hdr)); 238 + 239 + icmp6h->icmp6_cksum = 240 + csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr, 241 + nskb->len - sizeof(struct ipv6hdr), 242 + IPPROTO_ICMPV6, 243 + csum_partial(icmp6h, 244 + nskb->len - sizeof(struct ipv6hdr), 245 + 0)); 246 + 247 + nft_reject_br_push_etherhdr(oldskb, nskb); 248 + 249 + br_deliver(br_port_get_rcu(oldskb->dev), nskb); 250 + } 19 251 20 252 static void nft_reject_bridge_eval(const struct nft_expr *expr, 21 253 struct nft_data data[NFT_REG_MAX + 1], ··· 255 23 { 256 24 struct nft_reject *priv = nft_expr_priv(expr); 257 25 struct net *net = dev_net((pkt->in != NULL) ? pkt->in : pkt->out); 26 + const unsigned char *dest = eth_hdr(pkt->skb)->h_dest; 27 + 28 + if (is_broadcast_ether_addr(dest) || 29 + is_multicast_ether_addr(dest)) 30 + goto out; 258 31 259 32 switch (eth_hdr(pkt->skb)->h_proto) { 260 33 case htons(ETH_P_IP): 261 34 switch (priv->type) { 262 35 case NFT_REJECT_ICMP_UNREACH: 263 - nf_send_unreach(pkt->skb, priv->icmp_code); 36 + nft_reject_br_send_v4_unreach(pkt->skb, 37 + pkt->ops->hooknum, 38 + priv->icmp_code); 264 39 break; 265 40 case NFT_REJECT_TCP_RST: 266 - nf_send_reset(pkt->skb, pkt->ops->hooknum); 41 + nft_reject_br_send_v4_tcp_reset(pkt->skb, 42 + pkt->ops->hooknum); 267 43 break; 268 44 case NFT_REJECT_ICMPX_UNREACH: 269 - nf_send_unreach(pkt->skb, 270 - nft_reject_icmp_code(priv->icmp_code)); 45 + nft_reject_br_send_v4_unreach(pkt->skb, 46 + pkt->ops->hooknum, 47 + nft_reject_icmp_code(priv->icmp_code)); 271 48 break; 272 49 } 273 50 break; 274 51 case htons(ETH_P_IPV6): 275 52 switch (priv->type) { 276 53 case NFT_REJECT_ICMP_UNREACH: 277 - nf_send_unreach6(net, pkt->skb, priv->icmp_code, 278 - pkt->ops->hooknum); 54 + nft_reject_br_send_v6_unreach(net, pkt->skb, 55 + pkt->ops->hooknum, 56 + priv->icmp_code); 279 57 break; 280 58 case NFT_REJECT_TCP_RST: 281 - nf_send_reset6(net, pkt->skb, pkt->ops->hooknum); 59 + nft_reject_br_send_v6_tcp_reset(net, pkt->skb, 60 + pkt->ops->hooknum); 282 61 break; 283 62 case NFT_REJECT_ICMPX_UNREACH: 284 - nf_send_unreach6(net, pkt->skb, 285 - nft_reject_icmpv6_code(priv->icmp_code), 286 - pkt->ops->hooknum); 63 + nft_reject_br_send_v6_unreach(net, pkt->skb, 64 + pkt->ops->hooknum, 65 + nft_reject_icmpv6_code(priv->icmp_code)); 287 66 break; 288 67 } 289 68 break; ··· 302 59 /* No explicit way to reject this protocol, drop it. */ 303 60 break; 304 61 } 62 + out: 305 63 data[NFT_REG_VERDICT].verdict = NF_DROP; 64 + } 65 + 66 + static int nft_reject_bridge_validate_hooks(const struct nft_chain *chain) 67 + { 68 + struct nft_base_chain *basechain; 69 + 70 + if (chain->flags & NFT_BASE_CHAIN) { 71 + basechain = nft_base_chain(chain); 72 + 73 + switch (basechain->ops[0].hooknum) { 74 + case NF_BR_PRE_ROUTING: 75 + case NF_BR_LOCAL_IN: 76 + break; 77 + default: 78 + return -EOPNOTSUPP; 79 + } 80 + } 81 + return 0; 306 82 } 307 83 308 84 static int nft_reject_bridge_init(const struct nft_ctx *ctx, ··· 329 67 const struct nlattr * const tb[]) 330 68 { 331 69 struct nft_reject *priv = nft_expr_priv(expr); 332 - int icmp_code; 70 + int icmp_code, err; 71 + 72 + err = nft_reject_bridge_validate_hooks(ctx->chain); 73 + if (err < 0) 74 + return err; 333 75 334 76 if (tb[NFTA_REJECT_TYPE] == NULL) 335 77 return -EINVAL; ··· 382 116 return -1; 383 117 } 384 118 119 + static int nft_reject_bridge_validate(const struct nft_ctx *ctx, 120 + const struct nft_expr *expr, 121 + const struct nft_data **data) 122 + { 123 + return nft_reject_bridge_validate_hooks(ctx->chain); 124 + } 125 + 385 126 static struct nft_expr_type nft_reject_bridge_type; 386 127 static const struct nft_expr_ops nft_reject_bridge_ops = { 387 128 .type = &nft_reject_bridge_type, ··· 396 123 .eval = nft_reject_bridge_eval, 397 124 .init = nft_reject_bridge_init, 398 125 .dump = nft_reject_bridge_dump, 126 + .validate = nft_reject_bridge_validate, 399 127 }; 400 128 401 129 static struct nft_expr_type nft_reject_bridge_type __read_mostly = {

+4

net/core/dev.c

··· 4157 4157 4158 4158 static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb) 4159 4159 { 4160 + if (unlikely(skb->pfmemalloc)) { 4161 + consume_skb(skb); 4162 + return; 4163 + } 4160 4164 __skb_pull(skb, skb_headlen(skb)); 4161 4165 /* restore the reserve we had after netdev_alloc_skb_ip_align() */ 4162 4166 skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN - skb_headroom(skb));

+4 -2

net/core/ethtool.c

··· 1036 1036 { 1037 1037 const struct ethtool_ops *ops = dev->ethtool_ops; 1038 1038 1039 - if (!ops->get_eeprom || !ops->get_eeprom_len) 1039 + if (!ops->get_eeprom || !ops->get_eeprom_len || 1040 + !ops->get_eeprom_len(dev)) 1040 1041 return -EOPNOTSUPP; 1041 1042 1042 1043 return ethtool_get_any_eeprom(dev, useraddr, ops->get_eeprom, ··· 1053 1052 u8 *data; 1054 1053 int ret = 0; 1055 1054 1056 - if (!ops->set_eeprom || !ops->get_eeprom_len) 1055 + if (!ops->set_eeprom || !ops->get_eeprom_len || 1056 + !ops->get_eeprom_len(dev)) 1057 1057 return -EOPNOTSUPP; 1058 1058 1059 1059 if (copy_from_user(&eeprom, useraddr, sizeof(eeprom)))

+10 -3

net/core/skbuff.c

··· 4070 4070 unsigned int skb_gso_transport_seglen(const struct sk_buff *skb) 4071 4071 { 4072 4072 const struct skb_shared_info *shinfo = skb_shinfo(skb); 4073 + unsigned int thlen = 0; 4073 4074 4074 - if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) 4075 - return tcp_hdrlen(skb) + shinfo->gso_size; 4075 + if (skb->encapsulation) { 4076 + thlen = skb_inner_transport_header(skb) - 4077 + skb_transport_header(skb); 4076 4078 4079 + if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) 4080 + thlen += inner_tcp_hdrlen(skb); 4081 + } else if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) { 4082 + thlen = tcp_hdrlen(skb); 4083 + } 4077 4084 /* UFO sets gso_size to the size of the fragmentation 4078 4085 * payload, i.e. the size of the L4 (UDP) header is already 4079 4086 * accounted for. 4080 4087 */ 4081 - return shinfo->gso_size; 4088 + return thlen + shinfo->gso_size; 4082 4089 } 4083 4090 EXPORT_SYMBOL_GPL(skb_gso_transport_seglen); 4084 4091

+2 -1

net/core/tso.c

··· 1 1 #include <linux/export.h> 2 2 #include <net/ip.h> 3 3 #include <net/tso.h> 4 + #include <asm/unaligned.h> 4 5 5 6 /* Calculate expected number of TX descriptors */ 6 7 int tso_count_descs(struct sk_buff *skb) ··· 24 23 iph->id = htons(tso->ip_id); 25 24 iph->tot_len = htons(size + hdr_len - mac_hdr_len); 26 25 tcph = (struct tcphdr *)(hdr + skb_transport_offset(skb)); 27 - tcph->seq = htonl(tso->tcp_seq); 26 + put_unaligned_be32(tso->tcp_seq, &tcph->seq); 28 27 tso->ip_id++; 29 28 30 29 if (!is_last) {

+4 -1

net/dsa/dsa.c

··· 174 174 dst->rcv = brcm_netdev_ops.rcv; 175 175 break; 176 176 #endif 177 - default: 177 + case DSA_TAG_PROTO_NONE: 178 178 break; 179 + default: 180 + ret = -ENOPROTOOPT; 181 + goto out; 179 182 } 180 183 181 184 dst->tag_protocol = drv->tag_protocol;

+1 -1

net/ipv4/af_inet.c

··· 1246 1246 1247 1247 encap = SKB_GSO_CB(skb)->encap_level > 0; 1248 1248 if (encap) 1249 - features = skb->dev->hw_enc_features & netif_skb_features(skb); 1249 + features &= skb->dev->hw_enc_features; 1250 1250 SKB_GSO_CB(skb)->encap_level += ihl; 1251 1251 1252 1252 skb_reset_transport_header(skb);

+2 -2

net/ipv4/gre_offload.c

··· 47 47 48 48 greh = (struct gre_base_hdr *)skb_transport_header(skb); 49 49 50 - ghl = skb_inner_network_header(skb) - skb_transport_header(skb); 50 + ghl = skb_inner_mac_header(skb) - skb_transport_header(skb); 51 51 if (unlikely(ghl < sizeof(*greh))) 52 52 goto out; 53 53 ··· 68 68 skb->mac_len = skb_inner_network_offset(skb); 69 69 70 70 /* segment inner packet. */ 71 - enc_features = skb->dev->hw_enc_features & netif_skb_features(skb); 71 + enc_features = skb->dev->hw_enc_features & features; 72 72 segs = skb_mac_gso_segment(skb, enc_features); 73 73 if (IS_ERR_OR_NULL(segs)) { 74 74 skb_gso_error_unwind(skb, protocol, ghl, mac_offset, mac_len);

+2 -2

net/ipv4/inet_fragment.c

··· 146 146 atomic_inc(&fq->refcnt); 147 147 spin_unlock(&hb->chain_lock); 148 148 del_timer_sync(&fq->timer); 149 - WARN_ON(atomic_read(&fq->refcnt) != 1); 150 149 inet_frag_put(fq, f); 151 150 goto evict_again; 152 151 } ··· 284 285 struct inet_frag_bucket *hb; 285 286 286 287 hb = get_frag_bucket_locked(fq, f); 287 - hlist_del(&fq->list); 288 + if (!(fq->flags & INET_FRAG_EVICTED)) 289 + hlist_del(&fq->list); 288 290 spin_unlock(&hb->chain_lock); 289 291 } 290 292

+1 -1

net/ipv4/ip_output.c

··· 231 231 */ 232 232 features = netif_skb_features(skb); 233 233 segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK); 234 - if (IS_ERR(segs)) { 234 + if (IS_ERR_OR_NULL(segs)) { 235 235 kfree_skb(skb); 236 236 return -ENOMEM; 237 237 }

+65 -26

net/ipv4/netfilter/nf_reject_ipv4.c

··· 6 6 * published by the Free Software Foundation. 7 7 */ 8 8 9 + #include <linux/module.h> 9 10 #include <net/ip.h> 10 11 #include <net/tcp.h> 11 12 #include <net/route.h> 12 13 #include <net/dst.h> 13 14 #include <linux/netfilter_ipv4.h> 15 + #include <net/netfilter/ipv4/nf_reject.h> 14 16 15 - /* Send RST reply */ 16 - void nf_send_reset(struct sk_buff *oldskb, int hook) 17 + const struct tcphdr *nf_reject_ip_tcphdr_get(struct sk_buff *oldskb, 18 + struct tcphdr *_oth, int hook) 17 19 { 18 - struct sk_buff *nskb; 19 - const struct iphdr *oiph; 20 - struct iphdr *niph; 21 20 const struct tcphdr *oth; 22 - struct tcphdr _otcph, *tcph; 23 21 24 22 /* IP header checks: fragment. */ 25 23 if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET)) 26 - return; 24 + return NULL; 27 25 28 26 oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb), 29 - sizeof(_otcph), &_otcph); 27 + sizeof(struct tcphdr), _oth); 30 28 if (oth == NULL) 31 - return; 29 + return NULL; 32 30 33 31 /* No RST for RST. */ 34 32 if (oth->rst) 35 - return; 36 - 37 - if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) 38 - return; 33 + return NULL; 39 34 40 35 /* Check checksum */ 41 36 if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP)) 42 - return; 43 - oiph = ip_hdr(oldskb); 37 + return NULL; 44 38 45 - nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) + 46 - LL_MAX_HEADER, GFP_ATOMIC); 47 - if (!nskb) 48 - return; 39 + return oth; 40 + } 41 + EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_get); 49 42 50 - skb_reserve(nskb, LL_MAX_HEADER); 43 + struct iphdr *nf_reject_iphdr_put(struct sk_buff *nskb, 44 + const struct sk_buff *oldskb, 45 + __be16 protocol, int ttl) 46 + { 47 + struct iphdr *niph, *oiph = ip_hdr(oldskb); 51 48 52 49 skb_reset_network_header(nskb); 53 50 niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr)); ··· 53 56 niph->tos = 0; 54 57 niph->id = 0; 55 58 niph->frag_off = htons(IP_DF); 56 - niph->protocol = IPPROTO_TCP; 59 + niph->protocol = protocol; 57 60 niph->check = 0; 58 61 niph->saddr = oiph->daddr; 59 62 niph->daddr = oiph->saddr; 63 + niph->ttl = ttl; 64 + 65 + nskb->protocol = htons(ETH_P_IP); 66 + 67 + return niph; 68 + } 69 + EXPORT_SYMBOL_GPL(nf_reject_iphdr_put); 70 + 71 + void nf_reject_ip_tcphdr_put(struct sk_buff *nskb, const struct sk_buff *oldskb, 72 + const struct tcphdr *oth) 73 + { 74 + struct iphdr *niph = ip_hdr(nskb); 75 + struct tcphdr *tcph; 60 76 61 77 skb_reset_transport_header(nskb); 62 78 tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr)); ··· 78 68 tcph->dest = oth->source; 79 69 tcph->doff = sizeof(struct tcphdr) / 4; 80 70 81 - if (oth->ack) 71 + if (oth->ack) { 82 72 tcph->seq = oth->ack_seq; 83 - else { 73 + } else { 84 74 tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + 85 75 oldskb->len - ip_hdrlen(oldskb) - 86 76 (oth->doff << 2)); ··· 93 83 nskb->ip_summed = CHECKSUM_PARTIAL; 94 84 nskb->csum_start = (unsigned char *)tcph - nskb->head; 95 85 nskb->csum_offset = offsetof(struct tcphdr, check); 86 + } 87 + EXPORT_SYMBOL_GPL(nf_reject_ip_tcphdr_put); 88 + 89 + /* Send RST reply */ 90 + void nf_send_reset(struct sk_buff *oldskb, int hook) 91 + { 92 + struct sk_buff *nskb; 93 + const struct iphdr *oiph; 94 + struct iphdr *niph; 95 + const struct tcphdr *oth; 96 + struct tcphdr _oth; 97 + 98 + oth = nf_reject_ip_tcphdr_get(oldskb, &_oth, hook); 99 + if (!oth) 100 + return; 101 + 102 + if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) 103 + return; 104 + 105 + oiph = ip_hdr(oldskb); 106 + 107 + nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) + 108 + LL_MAX_HEADER, GFP_ATOMIC); 109 + if (!nskb) 110 + return; 96 111 97 112 /* ip_route_me_harder expects skb->dst to be set */ 98 113 skb_dst_set_noref(nskb, skb_dst(oldskb)); 99 114 100 - nskb->protocol = htons(ETH_P_IP); 115 + skb_reserve(nskb, LL_MAX_HEADER); 116 + niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP, 117 + ip4_dst_hoplimit(skb_dst(nskb))); 118 + nf_reject_ip_tcphdr_put(nskb, oldskb, oth); 119 + 101 120 if (ip_route_me_harder(nskb, RTN_UNSPEC)) 102 121 goto free_nskb; 103 - 104 - niph->ttl = ip4_dst_hoplimit(skb_dst(nskb)); 105 122 106 123 /* "Never happens" */ 107 124 if (nskb->len > dst_mtu(skb_dst(nskb))) ··· 162 125 kfree_skb(nskb); 163 126 } 164 127 EXPORT_SYMBOL_GPL(nf_send_reset); 128 + 129 + MODULE_LICENSE("GPL");

+1

net/ipv4/netfilter/nft_masq_ipv4.c

··· 39 39 .eval = nft_masq_ipv4_eval, 40 40 .init = nft_masq_init, 41 41 .dump = nft_masq_dump, 42 + .validate = nft_masq_validate, 42 43 }; 43 44 44 45 static struct nft_expr_type nft_masq_ipv4_type __read_mostly = {

+1

net/ipv4/route.c

··· 1798 1798 no_route: 1799 1799 RT_CACHE_STAT_INC(in_no_route); 1800 1800 res.type = RTN_UNREACHABLE; 1801 + res.fi = NULL; 1801 1802 goto local_input; 1802 1803 1803 1804 /*

+20 -39

net/ipv4/tcp.c

··· 2868 2868 #endif 2869 2869 2870 2870 #ifdef CONFIG_TCP_MD5SIG 2871 - static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool __read_mostly; 2871 + static DEFINE_PER_CPU(struct tcp_md5sig_pool, tcp_md5sig_pool); 2872 2872 static DEFINE_MUTEX(tcp_md5sig_mutex); 2873 - 2874 - static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool __percpu *pool) 2875 - { 2876 - int cpu; 2877 - 2878 - for_each_possible_cpu(cpu) { 2879 - struct tcp_md5sig_pool *p = per_cpu_ptr(pool, cpu); 2880 - 2881 - if (p->md5_desc.tfm) 2882 - crypto_free_hash(p->md5_desc.tfm); 2883 - } 2884 - free_percpu(pool); 2885 - } 2873 + static bool tcp_md5sig_pool_populated = false; 2886 2874 2887 2875 static void __tcp_alloc_md5sig_pool(void) 2888 2876 { 2889 2877 int cpu; 2890 - struct tcp_md5sig_pool __percpu *pool; 2891 - 2892 - pool = alloc_percpu(struct tcp_md5sig_pool); 2893 - if (!pool) 2894 - return; 2895 2878 2896 2879 for_each_possible_cpu(cpu) { 2897 - struct crypto_hash *hash; 2880 + if (!per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm) { 2881 + struct crypto_hash *hash; 2898 2882 2899 - hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); 2900 - if (IS_ERR_OR_NULL(hash)) 2901 - goto out_free; 2902 - 2903 - per_cpu_ptr(pool, cpu)->md5_desc.tfm = hash; 2883 + hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); 2884 + if (IS_ERR_OR_NULL(hash)) 2885 + return; 2886 + per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm = hash; 2887 + } 2904 2888 } 2905 - /* before setting tcp_md5sig_pool, we must commit all writes 2906 - * to memory. See ACCESS_ONCE() in tcp_get_md5sig_pool() 2889 + /* before setting tcp_md5sig_pool_populated, we must commit all writes 2890 + * to memory. See smp_rmb() in tcp_get_md5sig_pool() 2907 2891 */ 2908 2892 smp_wmb(); 2909 - tcp_md5sig_pool = pool; 2910 - return; 2911 - out_free: 2912 - __tcp_free_md5sig_pool(pool); 2893 + tcp_md5sig_pool_populated = true; 2913 2894 } 2914 2895 2915 2896 bool tcp_alloc_md5sig_pool(void) 2916 2897 { 2917 - if (unlikely(!tcp_md5sig_pool)) { 2898 + if (unlikely(!tcp_md5sig_pool_populated)) { 2918 2899 mutex_lock(&tcp_md5sig_mutex); 2919 2900 2920 - if (!tcp_md5sig_pool) 2901 + if (!tcp_md5sig_pool_populated) 2921 2902 __tcp_alloc_md5sig_pool(); 2922 2903 2923 2904 mutex_unlock(&tcp_md5sig_mutex); 2924 2905 } 2925 - return tcp_md5sig_pool != NULL; 2906 + return tcp_md5sig_pool_populated; 2926 2907 } 2927 2908 EXPORT_SYMBOL(tcp_alloc_md5sig_pool); 2928 2909 ··· 2917 2936 */ 2918 2937 struct tcp_md5sig_pool *tcp_get_md5sig_pool(void) 2919 2938 { 2920 - struct tcp_md5sig_pool __percpu *p; 2921 - 2922 2939 local_bh_disable(); 2923 - p = ACCESS_ONCE(tcp_md5sig_pool); 2924 - if (p) 2925 - return raw_cpu_ptr(p); 2926 2940 2941 + if (tcp_md5sig_pool_populated) { 2942 + /* coupled with smp_wmb() in __tcp_alloc_md5sig_pool() */ 2943 + smp_rmb(); 2944 + return this_cpu_ptr(&tcp_md5sig_pool); 2945 + } 2927 2946 local_bh_enable(); 2928 2947 return NULL; 2929 2948 }

+2 -2

net/ipv4/tcp_ipv4.c

··· 206 206 inet->inet_dport = usin->sin_port; 207 207 inet->inet_daddr = daddr; 208 208 209 - inet_set_txhash(sk); 210 - 211 209 inet_csk(sk)->icsk_ext_hdr_len = 0; 212 210 if (inet_opt) 213 211 inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen; ··· 221 223 err = inet_hash_connect(&tcp_death_row, sk); 222 224 if (err) 223 225 goto failure; 226 + 227 + inet_set_txhash(sk); 224 228 225 229 rt = ip_route_newports(fl4, rt, orig_sport, orig_dport, 226 230 inet->inet_sport, inet->inet_dport, sk);

+1 -1

net/ipv4/tcp_output.c

··· 2126 2126 static bool skb_still_in_host_queue(const struct sock *sk, 2127 2127 const struct sk_buff *skb) 2128 2128 { 2129 - if (unlikely(skb_fclone_busy(skb))) { 2129 + if (unlikely(skb_fclone_busy(sk, skb))) { 2130 2130 NET_INC_STATS_BH(sock_net(sk), 2131 2131 LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES); 2132 2132 return true;

+1 -1

net/ipv4/udp_offload.c

··· 58 58 skb->encap_hdr_csum = 1; 59 59 60 60 /* segment inner packet. */ 61 - enc_features = skb->dev->hw_enc_features & netif_skb_features(skb); 61 + enc_features = skb->dev->hw_enc_features & features; 62 62 segs = gso_inner_segment(skb, enc_features); 63 63 if (IS_ERR_OR_NULL(segs)) { 64 64 skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset,

+1

net/ipv6/addrconf.c

··· 4531 4531 } 4532 4532 4533 4533 write_unlock_bh(&idev->lock); 4534 + inet6_ifinfo_notify(RTM_NEWLINK, idev); 4534 4535 addrconf_verify_rtnl(); 4535 4536 return 0; 4536 4537 }

+1 -1

net/ipv6/ip6_offload.c

··· 90 90 91 91 encap = SKB_GSO_CB(skb)->encap_level > 0; 92 92 if (encap) 93 - features = skb->dev->hw_enc_features & netif_skb_features(skb); 93 + features &= skb->dev->hw_enc_features; 94 94 SKB_GSO_CB(skb)->encap_level += sizeof(*ipv6h); 95 95 96 96 ipv6h = ipv6_hdr(skb);

+128 -81

net/ipv6/netfilter/nf_reject_ipv6.c

··· 5 5 * it under the terms of the GNU General Public License version 2 as 6 6 * published by the Free Software Foundation. 7 7 */ 8 + 9 + #include <linux/module.h> 8 10 #include <net/ipv6.h> 9 11 #include <net/ip6_route.h> 10 12 #include <net/ip6_fib.h> 11 13 #include <net/ip6_checksum.h> 12 14 #include <linux/netfilter_ipv6.h> 15 + #include <net/netfilter/ipv6/nf_reject.h> 16 + 17 + const struct tcphdr *nf_reject_ip6_tcphdr_get(struct sk_buff *oldskb, 18 + struct tcphdr *otcph, 19 + unsigned int *otcplen, int hook) 20 + { 21 + const struct ipv6hdr *oip6h = ipv6_hdr(oldskb); 22 + u8 proto; 23 + __be16 frag_off; 24 + int tcphoff; 25 + 26 + proto = oip6h->nexthdr; 27 + tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), 28 + &proto, &frag_off); 29 + 30 + if ((tcphoff < 0) || (tcphoff > oldskb->len)) { 31 + pr_debug("Cannot get TCP header.\n"); 32 + return NULL; 33 + } 34 + 35 + *otcplen = oldskb->len - tcphoff; 36 + 37 + /* IP header checks: fragment, too short. */ 38 + if (proto != IPPROTO_TCP || *otcplen < sizeof(struct tcphdr)) { 39 + pr_debug("proto(%d) != IPPROTO_TCP or too short (len = %d)\n", 40 + proto, *otcplen); 41 + return NULL; 42 + } 43 + 44 + otcph = skb_header_pointer(oldskb, tcphoff, sizeof(struct tcphdr), 45 + otcph); 46 + if (otcph == NULL) 47 + return NULL; 48 + 49 + /* No RST for RST. */ 50 + if (otcph->rst) { 51 + pr_debug("RST is set\n"); 52 + return NULL; 53 + } 54 + 55 + /* Check checksum. */ 56 + if (nf_ip6_checksum(oldskb, hook, tcphoff, IPPROTO_TCP)) { 57 + pr_debug("TCP checksum is invalid\n"); 58 + return NULL; 59 + } 60 + 61 + return otcph; 62 + } 63 + EXPORT_SYMBOL_GPL(nf_reject_ip6_tcphdr_get); 64 + 65 + struct ipv6hdr *nf_reject_ip6hdr_put(struct sk_buff *nskb, 66 + const struct sk_buff *oldskb, 67 + __be16 protocol, int hoplimit) 68 + { 69 + struct ipv6hdr *ip6h; 70 + const struct ipv6hdr *oip6h = ipv6_hdr(oldskb); 71 + #define DEFAULT_TOS_VALUE 0x0U 72 + const __u8 tclass = DEFAULT_TOS_VALUE; 73 + 74 + skb_put(nskb, sizeof(struct ipv6hdr)); 75 + skb_reset_network_header(nskb); 76 + ip6h = ipv6_hdr(nskb); 77 + ip6_flow_hdr(ip6h, tclass, 0); 78 + ip6h->hop_limit = hoplimit; 79 + ip6h->nexthdr = protocol; 80 + ip6h->saddr = oip6h->daddr; 81 + ip6h->daddr = oip6h->saddr; 82 + 83 + nskb->protocol = htons(ETH_P_IPV6); 84 + 85 + return ip6h; 86 + } 87 + EXPORT_SYMBOL_GPL(nf_reject_ip6hdr_put); 88 + 89 + void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb, 90 + const struct sk_buff *oldskb, 91 + const struct tcphdr *oth, unsigned int otcplen) 92 + { 93 + struct tcphdr *tcph; 94 + int needs_ack; 95 + 96 + skb_reset_transport_header(nskb); 97 + tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr)); 98 + /* Truncate to length (no data) */ 99 + tcph->doff = sizeof(struct tcphdr)/4; 100 + tcph->source = oth->dest; 101 + tcph->dest = oth->source; 102 + 103 + if (oth->ack) { 104 + needs_ack = 0; 105 + tcph->seq = oth->ack_seq; 106 + tcph->ack_seq = 0; 107 + } else { 108 + needs_ack = 1; 109 + tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin + 110 + otcplen - (oth->doff<<2)); 111 + tcph->seq = 0; 112 + } 113 + 114 + /* Reset flags */ 115 + ((u_int8_t *)tcph)[13] = 0; 116 + tcph->rst = 1; 117 + tcph->ack = needs_ack; 118 + tcph->window = 0; 119 + tcph->urg_ptr = 0; 120 + tcph->check = 0; 121 + 122 + /* Adjust TCP checksum */ 123 + tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr, 124 + &ipv6_hdr(nskb)->daddr, 125 + sizeof(struct tcphdr), IPPROTO_TCP, 126 + csum_partial(tcph, 127 + sizeof(struct tcphdr), 0)); 128 + } 129 + EXPORT_SYMBOL_GPL(nf_reject_ip6_tcphdr_put); 13 130 14 131 void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook) 15 132 { 16 133 struct sk_buff *nskb; 17 - struct tcphdr otcph, *tcph; 134 + struct tcphdr _otcph; 135 + const struct tcphdr *otcph; 18 136 unsigned int otcplen, hh_len; 19 - int tcphoff, needs_ack; 20 137 const struct ipv6hdr *oip6h = ipv6_hdr(oldskb); 21 138 struct ipv6hdr *ip6h; 22 - #define DEFAULT_TOS_VALUE 0x0U 23 - const __u8 tclass = DEFAULT_TOS_VALUE; 24 139 struct dst_entry *dst = NULL; 25 - u8 proto; 26 - __be16 frag_off; 27 140 struct flowi6 fl6; 28 141 29 142 if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) || ··· 145 32 return; 146 33 } 147 34 148 - proto = oip6h->nexthdr; 149 - tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), &proto, &frag_off); 150 - 151 - if ((tcphoff < 0) || (tcphoff > oldskb->len)) { 152 - pr_debug("Cannot get TCP header.\n"); 35 + otcph = nf_reject_ip6_tcphdr_get(oldskb, &_otcph, &otcplen, hook); 36 + if (!otcph) 153 37 return; 154 - } 155 - 156 - otcplen = oldskb->len - tcphoff; 157 - 158 - /* IP header checks: fragment, too short. */ 159 - if (proto != IPPROTO_TCP || otcplen < sizeof(struct tcphdr)) { 160 - pr_debug("proto(%d) != IPPROTO_TCP, " 161 - "or too short. otcplen = %d\n", 162 - proto, otcplen); 163 - return; 164 - } 165 - 166 - if (skb_copy_bits(oldskb, tcphoff, &otcph, sizeof(struct tcphdr))) 167 - BUG(); 168 - 169 - /* No RST for RST. */ 170 - if (otcph.rst) { 171 - pr_debug("RST is set\n"); 172 - return; 173 - } 174 - 175 - /* Check checksum. */ 176 - if (nf_ip6_checksum(oldskb, hook, tcphoff, IPPROTO_TCP)) { 177 - pr_debug("TCP checksum is invalid\n"); 178 - return; 179 - } 180 38 181 39 memset(&fl6, 0, sizeof(fl6)); 182 40 fl6.flowi6_proto = IPPROTO_TCP; 183 41 fl6.saddr = oip6h->daddr; 184 42 fl6.daddr = oip6h->saddr; 185 - fl6.fl6_sport = otcph.dest; 186 - fl6.fl6_dport = otcph.source; 43 + fl6.fl6_sport = otcph->dest; 44 + fl6.fl6_dport = otcph->source; 187 45 security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6)); 188 46 dst = ip6_route_output(net, NULL, &fl6); 189 47 if (dst == NULL || dst->error) { ··· 179 95 skb_dst_set(nskb, dst); 180 96 181 97 skb_reserve(nskb, hh_len + dst->header_len); 182 - 183 - skb_put(nskb, sizeof(struct ipv6hdr)); 184 - skb_reset_network_header(nskb); 185 - ip6h = ipv6_hdr(nskb); 186 - ip6_flow_hdr(ip6h, tclass, 0); 187 - ip6h->hop_limit = ip6_dst_hoplimit(dst); 188 - ip6h->nexthdr = IPPROTO_TCP; 189 - ip6h->saddr = oip6h->daddr; 190 - ip6h->daddr = oip6h->saddr; 191 - 192 - skb_reset_transport_header(nskb); 193 - tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr)); 194 - /* Truncate to length (no data) */ 195 - tcph->doff = sizeof(struct tcphdr)/4; 196 - tcph->source = otcph.dest; 197 - tcph->dest = otcph.source; 198 - 199 - if (otcph.ack) { 200 - needs_ack = 0; 201 - tcph->seq = otcph.ack_seq; 202 - tcph->ack_seq = 0; 203 - } else { 204 - needs_ack = 1; 205 - tcph->ack_seq = htonl(ntohl(otcph.seq) + otcph.syn + otcph.fin 206 - + otcplen - (otcph.doff<<2)); 207 - tcph->seq = 0; 208 - } 209 - 210 - /* Reset flags */ 211 - ((u_int8_t *)tcph)[13] = 0; 212 - tcph->rst = 1; 213 - tcph->ack = needs_ack; 214 - tcph->window = 0; 215 - tcph->urg_ptr = 0; 216 - tcph->check = 0; 217 - 218 - /* Adjust TCP checksum */ 219 - tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr, 220 - &ipv6_hdr(nskb)->daddr, 221 - sizeof(struct tcphdr), IPPROTO_TCP, 222 - csum_partial(tcph, 223 - sizeof(struct tcphdr), 0)); 98 + ip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP, 99 + ip6_dst_hoplimit(dst)); 100 + nf_reject_ip6_tcphdr_put(nskb, oldskb, otcph, otcplen); 224 101 225 102 nf_ct_attach(nskb, oldskb); 226 103 ··· 206 161 ip6_local_out(nskb); 207 162 } 208 163 EXPORT_SYMBOL_GPL(nf_send_reset6); 164 + 165 + MODULE_LICENSE("GPL");

+1

net/ipv6/netfilter/nft_masq_ipv6.c

··· 39 39 .eval = nft_masq_ipv6_eval, 40 40 .init = nft_masq_init, 41 41 .dump = nft_masq_dump, 42 + .validate = nft_masq_validate, 42 43 }; 43 44 44 45 static struct nft_expr_type nft_masq_ipv6_type __read_mostly = {

+34

net/ipv6/output_core.c

··· 3 3 * not configured or static. These functions are needed by GSO/GRO implementation. 4 4 */ 5 5 #include <linux/export.h> 6 + #include <net/ip.h> 6 7 #include <net/ipv6.h> 7 8 #include <net/ip6_fib.h> 8 9 #include <net/addrconf.h> 9 10 #include <net/secure_seq.h> 11 + 12 + /* This function exists only for tap drivers that must support broken 13 + * clients requesting UFO without specifying an IPv6 fragment ID. 14 + * 15 + * This is similar to ipv6_select_ident() but we use an independent hash 16 + * seed to limit information leakage. 17 + * 18 + * The network header must be set before calling this. 19 + */ 20 + void ipv6_proxy_select_ident(struct sk_buff *skb) 21 + { 22 + static u32 ip6_proxy_idents_hashrnd __read_mostly; 23 + struct in6_addr buf[2]; 24 + struct in6_addr *addrs; 25 + u32 hash, id; 26 + 27 + addrs = skb_header_pointer(skb, 28 + skb_network_offset(skb) + 29 + offsetof(struct ipv6hdr, saddr), 30 + sizeof(buf), buf); 31 + if (!addrs) 32 + return; 33 + 34 + net_get_random_once(&ip6_proxy_idents_hashrnd, 35 + sizeof(ip6_proxy_idents_hashrnd)); 36 + 37 + hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd); 38 + hash = __ipv6_addr_jhash(&addrs[0], hash); 39 + 40 + id = ip_idents_reserve(hash, 1); 41 + skb_shinfo(skb)->ip6_frag_id = htonl(id); 42 + } 43 + EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident); 10 44 11 45 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) 12 46 {

+2 -2

net/ipv6/tcp_ipv6.c

··· 200 200 sk->sk_v6_daddr = usin->sin6_addr; 201 201 np->flow_label = fl6.flowlabel; 202 202 203 - ip6_set_txhash(sk); 204 - 205 203 /* 206 204 * TCP over IPv4 207 205 */ ··· 294 296 err = inet6_hash_connect(&tcp_death_row, sk); 295 297 if (err) 296 298 goto late_failure; 299 + 300 + ip6_set_txhash(sk); 297 301 298 302 if (!tp->write_seq && likely(!tp->repair)) 299 303 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,

+8 -3

net/ipv6/xfrm6_policy.c

··· 170 170 case IPPROTO_DCCP: 171 171 if (!onlyproto && (nh + offset + 4 < skb->data || 172 172 pskb_may_pull(skb, nh + offset + 4 - skb->data))) { 173 - __be16 *ports = (__be16 *)exthdr; 173 + __be16 *ports; 174 174 175 + nh = skb_network_header(skb); 176 + ports = (__be16 *)(nh + offset); 175 177 fl6->fl6_sport = ports[!!reverse]; 176 178 fl6->fl6_dport = ports[!reverse]; 177 179 } ··· 182 180 183 181 case IPPROTO_ICMPV6: 184 182 if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) { 185 - u8 *icmp = (u8 *)exthdr; 183 + u8 *icmp; 186 184 185 + nh = skb_network_header(skb); 186 + icmp = (u8 *)(nh + offset); 187 187 fl6->fl6_icmp_type = icmp[0]; 188 188 fl6->fl6_icmp_code = icmp[1]; 189 189 } ··· 196 192 case IPPROTO_MH: 197 193 if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) { 198 194 struct ip6_mh *mh; 199 - mh = (struct ip6_mh *)exthdr; 200 195 196 + nh = skb_network_header(skb); 197 + mh = (struct ip6_mh *)(nh + offset); 201 198 fl6->fl6_mh_type = mh->ip6mh_type; 202 199 } 203 200 fl6->flowi6_proto = nexthdr;

+1 -1

net/mac80211/cfg.c

··· 3458 3458 rcu_read_lock(); 3459 3459 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 3460 3460 if (chanctx_conf) { 3461 - *chandef = chanctx_conf->def; 3461 + *chandef = sdata->vif.bss_conf.chandef; 3462 3462 ret = 0; 3463 3463 } else if (local->open_count > 0 && 3464 3464 local->open_count == local->monitors &&

+1 -1

net/mac80211/rate.c

··· 448 448 */ 449 449 if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) { 450 450 u32 basic_rates = vif->bss_conf.basic_rates; 451 - s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0; 451 + s8 baserate = basic_rates ? ffs(basic_rates) - 1 : 0; 452 452 453 453 rate = &sband->bitrates[rates[0].idx]; 454 454

+7 -5

net/mac80211/rc80211_minstrel_debugfs.c

··· 62 62 unsigned int i, tp, prob, eprob; 63 63 char *p; 64 64 65 - ms = kmalloc(sizeof(*ms) + 4096, GFP_KERNEL); 65 + ms = kmalloc(2048, GFP_KERNEL); 66 66 if (!ms) 67 67 return -ENOMEM; 68 68 69 69 file->private_data = ms; 70 70 p = ms->buf; 71 - p += sprintf(p, "rate throughput ewma prob this prob " 72 - "this succ/attempt success attempts\n"); 71 + p += sprintf(p, "rate tpt eprob *prob" 72 + " *ok(*cum) ok( cum)\n"); 73 73 for (i = 0; i < mi->n_rates; i++) { 74 74 struct minstrel_rate *mr = &mi->r[i]; 75 75 struct minstrel_rate_stats *mrs = &mi->r[i].stats; ··· 86 86 prob = MINSTREL_TRUNC(mrs->cur_prob * 1000); 87 87 eprob = MINSTREL_TRUNC(mrs->probability * 1000); 88 88 89 - p += sprintf(p, " %6u.%1u %6u.%1u %6u.%1u " 90 - " %3u(%3u) %8llu %8llu\n", 89 + p += sprintf(p, " %4u.%1u %3u.%1u %3u.%1u" 90 + " %4u(%4u) %9llu(%9llu)\n", 91 91 tp / 10, tp % 10, 92 92 eprob / 10, eprob % 10, 93 93 prob / 10, prob % 10, ··· 101 101 mi->total_packets - mi->sample_packets, 102 102 mi->sample_packets); 103 103 ms->len = p - ms->buf; 104 + 105 + WARN_ON(ms->len + sizeof(*ms) > 2048); 104 106 105 107 return 0; 106 108 }

+8 -5

net/mac80211/rc80211_minstrel_ht_debugfs.c

··· 63 63 prob = MINSTREL_TRUNC(mr->cur_prob * 1000); 64 64 eprob = MINSTREL_TRUNC(mr->probability * 1000); 65 65 66 - p += sprintf(p, " %6u.%1u %6u.%1u %6u.%1u " 67 - "%3u %3u(%3u) %8llu %8llu\n", 66 + p += sprintf(p, " %4u.%1u %3u.%1u %3u.%1u " 67 + "%3u %4u(%4u) %9llu(%9llu)\n", 68 68 tp / 10, tp % 10, 69 69 eprob / 10, eprob % 10, 70 70 prob / 10, prob % 10, ··· 96 96 return ret; 97 97 } 98 98 99 - ms = kmalloc(sizeof(*ms) + 8192, GFP_KERNEL); 99 + ms = kmalloc(8192, GFP_KERNEL); 100 100 if (!ms) 101 101 return -ENOMEM; 102 102 103 103 file->private_data = ms; 104 104 p = ms->buf; 105 - p += sprintf(p, "type rate throughput ewma prob " 106 - "this prob retry this succ/attempt success attempts\n"); 105 + p += sprintf(p, "type rate tpt eprob *prob " 106 + "ret *ok(*cum) ok( cum)\n"); 107 + 107 108 108 109 p = minstrel_ht_stats_dump(mi, max_mcs, p); 109 110 for (i = 0; i < max_mcs; i++) ··· 118 117 MINSTREL_TRUNC(mi->avg_ampdu_len), 119 118 MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10); 120 119 ms->len = p - ms->buf; 120 + 121 + WARN_ON(ms->len + sizeof(*ms) > 8192); 121 122 122 123 return nonseekable_open(inode, file); 123 124 }

+1

net/mac80211/sta_info.h

··· 336 336 * @known_smps_mode: the smps_mode the client thinks we are in. Relevant for 337 337 * AP only. 338 338 * @cipher_scheme: optional cipher scheme for this station 339 + * @last_tdls_pkt_time: holds the time in jiffies of last TDLS pkt ACKed 339 340 */ 340 341 struct sta_info { 341 342 /* General information, mostly static */

+1 -1

net/mpls/Makefile

··· 1 1 # 2 2 # Makefile for MPLS. 3 3 # 4 - obj-y += mpls_gso.o 4 + obj-$(CONFIG_NET_MPLS_GSO) += mpls_gso.o

+2 -3

net/mpls/mpls_gso.c

··· 48 48 __skb_push(skb, skb->mac_len); 49 49 50 50 /* Segment inner packet. */ 51 - mpls_features = skb->dev->mpls_features & netif_skb_features(skb); 51 + mpls_features = skb->dev->mpls_features & features; 52 52 segs = skb_mac_gso_segment(skb, mpls_features); 53 53 54 54 ··· 59 59 * above pulled. It will be re-pushed after returning 60 60 * skb_mac_gso_segment(), an indirect caller of this function. 61 61 */ 62 - __skb_push(skb, skb->data - skb_mac_header(skb)); 63 - 62 + __skb_pull(skb, skb->data - skb_mac_header(skb)); 64 63 out: 65 64 return segs; 66 65 }

+1 -1

net/netfilter/ipset/ip_set_core.c

··· 659 659 struct ip_set *set; 660 660 struct ip_set_net *inst = ip_set_pernet(net); 661 661 662 - if (index > inst->ip_set_max) 662 + if (index >= inst->ip_set_max) 663 663 return IPSET_INVALID_ID; 664 664 665 665 nfnl_lock(NFNL_SUBSYS_IPSET);

+2 -2

net/netfilter/ipvs/ip_vs_xmit.c

··· 316 316 if (unlikely(crosses_local_route_boundary(skb_af, skb, rt_mode, 317 317 local))) { 318 318 IP_VS_DBG_RL("We are crossing local and non-local addresses" 319 - " daddr=%pI4\n", &dest->addr.ip); 319 + " daddr=%pI4\n", &daddr); 320 320 goto err_put; 321 321 } 322 322 ··· 458 458 if (unlikely(crosses_local_route_boundary(skb_af, skb, rt_mode, 459 459 local))) { 460 460 IP_VS_DBG_RL("We are crossing local and non-local addresses" 461 - " daddr=%pI6\n", &dest->addr.in6); 461 + " daddr=%pI6\n", daddr); 462 462 goto err_put; 463 463 } 464 464

+2 -2

net/netfilter/nf_conntrack_proto_tcp.c

··· 213 213 { 214 214 /* REPLY */ 215 215 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */ 216 - /*syn*/ { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sS2 }, 216 + /*syn*/ { sIV, sS2, sIV, sIV, sIV, sIV, sIV, sSS, sIV, sS2 }, 217 217 /* 218 218 * sNO -> sIV Never reached. 219 219 * sSS -> sS2 Simultaneous open ··· 223 223 * sFW -> sIV 224 224 * sCW -> sIV 225 225 * sLA -> sIV 226 - * sTW -> sIV Reopened connection, but server may not do it. 226 + * sTW -> sSS Reopened connection, but server may have switched role 227 227 * sCL -> sIV 228 228 */ 229 229 /* sNO, sSS, sSR, sES, sFW, sCW, sLA, sTW, sCL, sS2 */

+16 -2

net/netfilter/nf_tables_api.c

··· 1328 1328 basechain->stats = stats; 1329 1329 } else { 1330 1330 stats = netdev_alloc_pcpu_stats(struct nft_stats); 1331 - if (IS_ERR(stats)) { 1331 + if (stats == NULL) { 1332 1332 module_put(type->owner); 1333 1333 kfree(basechain); 1334 - return PTR_ERR(stats); 1334 + return -ENOMEM; 1335 1335 } 1336 1336 rcu_assign_pointer(basechain->stats, stats); 1337 1337 } ··· 3743 3743 .commit = nf_tables_commit, 3744 3744 .abort = nf_tables_abort, 3745 3745 }; 3746 + 3747 + int nft_chain_validate_dependency(const struct nft_chain *chain, 3748 + enum nft_chain_type type) 3749 + { 3750 + const struct nft_base_chain *basechain; 3751 + 3752 + if (chain->flags & NFT_BASE_CHAIN) { 3753 + basechain = nft_base_chain(chain); 3754 + if (basechain->type->type != type) 3755 + return -EOPNOTSUPP; 3756 + } 3757 + return 0; 3758 + } 3759 + EXPORT_SYMBOL_GPL(nft_chain_validate_dependency); 3746 3760 3747 3761 /* 3748 3762 * Loop detection - walk through the ruleset beginning at the destination chain

+16 -15

net/netfilter/nfnetlink_log.c

··· 43 43 #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE 44 44 #define NFULNL_TIMEOUT_DEFAULT 100 /* every second */ 45 45 #define NFULNL_QTHRESH_DEFAULT 100 /* 100 packets */ 46 - #define NFULNL_COPY_RANGE_MAX 0xFFFF /* max packet size is limited by 16-bit struct nfattr nfa_len field */ 46 + /* max packet size is limited by 16-bit struct nfattr nfa_len field */ 47 + #define NFULNL_COPY_RANGE_MAX (0xFFFF - NLA_HDRLEN) 47 48 48 49 #define PRINTR(x, args...) do { if (net_ratelimit()) \ 49 50 printk(x, ## args); } while (0); ··· 253 252 254 253 case NFULNL_COPY_PACKET: 255 254 inst->copy_mode = mode; 255 + if (range == 0) 256 + range = NFULNL_COPY_RANGE_MAX; 256 257 inst->copy_range = min_t(unsigned int, 257 258 range, NFULNL_COPY_RANGE_MAX); 258 259 break; ··· 346 343 return skb; 347 344 } 348 345 349 - static int 346 + static void 350 347 __nfulnl_send(struct nfulnl_instance *inst) 351 348 { 352 - int status = -1; 353 - 354 349 if (inst->qlen > 1) { 355 350 struct nlmsghdr *nlh = nlmsg_put(inst->skb, 0, 0, 356 351 NLMSG_DONE, 357 352 sizeof(struct nfgenmsg), 358 353 0); 359 - if (!nlh) 354 + if (WARN_ONCE(!nlh, "bad nlskb size: %u, tailroom %d\n", 355 + inst->skb->len, skb_tailroom(inst->skb))) { 356 + kfree_skb(inst->skb); 360 357 goto out; 358 + } 361 359 } 362 - status = nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid, 363 - MSG_DONTWAIT); 364 - 360 + nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid, 361 + MSG_DONTWAIT); 362 + out: 365 363 inst->qlen = 0; 366 364 inst->skb = NULL; 367 - out: 368 - return status; 369 365 } 370 366 371 367 static void ··· 651 649 + nla_total_size(sizeof(u_int32_t)) /* gid */ 652 650 + nla_total_size(plen) /* prefix */ 653 651 + nla_total_size(sizeof(struct nfulnl_msg_packet_hw)) 654 - + nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp)); 652 + + nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp)) 653 + + nla_total_size(sizeof(struct nfgenmsg)); /* NLMSG_DONE */ 655 654 656 655 if (in && skb_mac_header_was_set(skb)) { 657 656 size += nla_total_size(skb->dev->hard_header_len) ··· 681 678 break; 682 679 683 680 case NFULNL_COPY_PACKET: 684 - if (inst->copy_range == 0 685 - || inst->copy_range > skb->len) 681 + if (inst->copy_range > skb->len) 686 682 data_len = skb->len; 687 683 else 688 684 data_len = inst->copy_range; ··· 694 692 goto unlock_and_release; 695 693 } 696 694 697 - if (inst->skb && 698 - size > skb_tailroom(inst->skb) - sizeof(struct nfgenmsg)) { 695 + if (inst->skb && size > skb_tailroom(inst->skb)) { 699 696 /* either the queue len is too high or we don't have 700 697 * enough room in the skb left. flush to userspace. */ 701 698 __nfulnl_flush(inst);

+1 -1

net/netfilter/nfnetlink_queue_core.c

··· 665 665 * returned by nf_queue. For instance, callers rely on -ECANCELED to 666 666 * mean 'ignore this hook'. 667 667 */ 668 - if (IS_ERR(segs)) 668 + if (IS_ERR_OR_NULL(segs)) 669 669 goto out_err; 670 670 queued = 0; 671 671 err = 0;

+71 -10

net/netfilter/nft_compat.c

··· 19 19 #include <linux/netfilter/x_tables.h> 20 20 #include <linux/netfilter_ipv4/ip_tables.h> 21 21 #include <linux/netfilter_ipv6/ip6_tables.h> 22 - #include <asm/uaccess.h> /* for set_fs */ 23 22 #include <net/netfilter/nf_tables.h> 23 + 24 + static const struct { 25 + const char *name; 26 + u8 type; 27 + } table_to_chaintype[] = { 28 + { "filter", NFT_CHAIN_T_DEFAULT }, 29 + { "raw", NFT_CHAIN_T_DEFAULT }, 30 + { "security", NFT_CHAIN_T_DEFAULT }, 31 + { "mangle", NFT_CHAIN_T_ROUTE }, 32 + { "nat", NFT_CHAIN_T_NAT }, 33 + { }, 34 + }; 35 + 36 + static int nft_compat_table_to_chaintype(const char *table) 37 + { 38 + int i; 39 + 40 + for (i = 0; table_to_chaintype[i].name != NULL; i++) { 41 + if (strcmp(table_to_chaintype[i].name, table) == 0) 42 + return table_to_chaintype[i].type; 43 + } 44 + 45 + return -1; 46 + } 47 + 48 + static int nft_compat_chain_validate_dependency(const char *tablename, 49 + const struct nft_chain *chain) 50 + { 51 + enum nft_chain_type type; 52 + const struct nft_base_chain *basechain; 53 + 54 + if (!tablename || !(chain->flags & NFT_BASE_CHAIN)) 55 + return 0; 56 + 57 + type = nft_compat_table_to_chaintype(tablename); 58 + if (type < 0) 59 + return -EINVAL; 60 + 61 + basechain = nft_base_chain(chain); 62 + if (basechain->type->type != type) 63 + return -EINVAL; 64 + 65 + return 0; 66 + } 24 67 25 68 union nft_entry { 26 69 struct ipt_entry e4; ··· 138 95 const struct nf_hook_ops *ops = &basechain->ops[0]; 139 96 140 97 par->hook_mask = 1 << ops->hooknum; 98 + } else { 99 + par->hook_mask = 0; 141 100 } 142 101 par->family = ctx->afi->family; 143 102 } ··· 195 150 bool inv = false; 196 151 union nft_entry e = {}; 197 152 int ret; 153 + 154 + ret = nft_compat_chain_validate_dependency(target->table, ctx->chain); 155 + if (ret < 0) 156 + goto err; 198 157 199 158 target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info); 200 159 ··· 265 216 { 266 217 struct xt_target *target = expr->ops->data; 267 218 unsigned int hook_mask = 0; 219 + int ret; 268 220 269 221 if (ctx->chain->flags & NFT_BASE_CHAIN) { 270 222 const struct nft_base_chain *basechain = ··· 273 223 const struct nf_hook_ops *ops = &basechain->ops[0]; 274 224 275 225 hook_mask = 1 << ops->hooknum; 276 - if (hook_mask & target->hooks) 277 - return 0; 226 + if (!(hook_mask & target->hooks)) 227 + return -EINVAL; 278 228 279 - /* This target is being called from an invalid chain */ 280 - return -EINVAL; 229 + ret = nft_compat_chain_validate_dependency(target->table, 230 + ctx->chain); 231 + if (ret < 0) 232 + return ret; 281 233 } 282 234 return 0; 283 235 } ··· 345 293 const struct nf_hook_ops *ops = &basechain->ops[0]; 346 294 347 295 par->hook_mask = 1 << ops->hooknum; 296 + } else { 297 + par->hook_mask = 0; 348 298 } 349 299 par->family = ctx->afi->family; 350 300 } ··· 373 319 bool inv = false; 374 320 union nft_entry e = {}; 375 321 int ret; 322 + 323 + ret = nft_compat_chain_validate_dependency(match->name, ctx->chain); 324 + if (ret < 0) 325 + goto err; 376 326 377 327 match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info); 378 328 ··· 437 379 { 438 380 struct xt_match *match = expr->ops->data; 439 381 unsigned int hook_mask = 0; 382 + int ret; 440 383 441 384 if (ctx->chain->flags & NFT_BASE_CHAIN) { 442 385 const struct nft_base_chain *basechain = ··· 445 386 const struct nf_hook_ops *ops = &basechain->ops[0]; 446 387 447 388 hook_mask = 1 << ops->hooknum; 448 - if (hook_mask & match->hooks) 449 - return 0; 389 + if (!(hook_mask & match->hooks)) 390 + return -EINVAL; 450 391 451 - /* This match is being called from an invalid chain */ 452 - return -EINVAL; 392 + ret = nft_compat_chain_validate_dependency(match->name, 393 + ctx->chain); 394 + if (ret < 0) 395 + return ret; 453 396 } 454 397 return 0; 455 398 } ··· 672 611 family = ctx->afi->family; 673 612 674 613 /* Re-use the existing target if it's already loaded. */ 675 - list_for_each_entry(nft_target, &nft_match_list, head) { 614 + list_for_each_entry(nft_target, &nft_target_list, head) { 676 615 struct xt_target *target = nft_target->ops.data; 677 616 678 617 if (strcmp(target->name, tg_name) == 0 &&

+12

net/netfilter/nft_masq.c

··· 26 26 const struct nlattr * const tb[]) 27 27 { 28 28 struct nft_masq *priv = nft_expr_priv(expr); 29 + int err; 30 + 31 + err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT); 32 + if (err < 0) 33 + return err; 29 34 30 35 if (tb[NFTA_MASQ_FLAGS] == NULL) 31 36 return 0; ··· 59 54 return -1; 60 55 } 61 56 EXPORT_SYMBOL_GPL(nft_masq_dump); 57 + 58 + int nft_masq_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, 59 + const struct nft_data **data) 60 + { 61 + return nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT); 62 + } 63 + EXPORT_SYMBOL_GPL(nft_masq_validate); 62 64 63 65 MODULE_LICENSE("GPL"); 64 66 MODULE_AUTHOR("Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>");

+54 -32

net/netfilter/nft_nat.c

··· 95 95 u32 family; 96 96 int err; 97 97 98 - if (tb[NFTA_NAT_TYPE] == NULL) 98 + err = nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT); 99 + if (err < 0) 100 + return err; 101 + 102 + if (tb[NFTA_NAT_TYPE] == NULL || 103 + (tb[NFTA_NAT_REG_ADDR_MIN] == NULL && 104 + tb[NFTA_NAT_REG_PROTO_MIN] == NULL)) 99 105 return -EINVAL; 100 106 101 107 switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) { ··· 126 120 priv->family = family; 127 121 128 122 if (tb[NFTA_NAT_REG_ADDR_MIN]) { 129 - priv->sreg_addr_min = ntohl(nla_get_be32( 130 - tb[NFTA_NAT_REG_ADDR_MIN])); 123 + priv->sreg_addr_min = 124 + ntohl(nla_get_be32(tb[NFTA_NAT_REG_ADDR_MIN])); 125 + 131 126 err = nft_validate_input_register(priv->sreg_addr_min); 132 127 if (err < 0) 133 128 return err; 129 + 130 + if (tb[NFTA_NAT_REG_ADDR_MAX]) { 131 + priv->sreg_addr_max = 132 + ntohl(nla_get_be32(tb[NFTA_NAT_REG_ADDR_MAX])); 133 + 134 + err = nft_validate_input_register(priv->sreg_addr_max); 135 + if (err < 0) 136 + return err; 137 + } else { 138 + priv->sreg_addr_max = priv->sreg_addr_min; 139 + } 134 140 } 135 141 136 - if (tb[NFTA_NAT_REG_ADDR_MAX]) { 137 - priv->sreg_addr_max = ntohl(nla_get_be32( 138 - tb[NFTA_NAT_REG_ADDR_MAX])); 139 - err = nft_validate_input_register(priv->sreg_addr_max); 140 - if (err < 0) 141 - return err; 142 - } else 143 - priv->sreg_addr_max = priv->sreg_addr_min; 144 - 145 142 if (tb[NFTA_NAT_REG_PROTO_MIN]) { 146 - priv->sreg_proto_min = ntohl(nla_get_be32( 147 - tb[NFTA_NAT_REG_PROTO_MIN])); 143 + priv->sreg_proto_min = 144 + ntohl(nla_get_be32(tb[NFTA_NAT_REG_PROTO_MIN])); 145 + 148 146 err = nft_validate_input_register(priv->sreg_proto_min); 149 147 if (err < 0) 150 148 return err; 151 - } 152 149 153 - if (tb[NFTA_NAT_REG_PROTO_MAX]) { 154 - priv->sreg_proto_max = ntohl(nla_get_be32( 155 - tb[NFTA_NAT_REG_PROTO_MAX])); 156 - err = nft_validate_input_register(priv->sreg_proto_max); 157 - if (err < 0) 158 - return err; 159 - } else 160 - priv->sreg_proto_max = priv->sreg_proto_min; 150 + if (tb[NFTA_NAT_REG_PROTO_MAX]) { 151 + priv->sreg_proto_max = 152 + ntohl(nla_get_be32(tb[NFTA_NAT_REG_PROTO_MAX])); 153 + 154 + err = nft_validate_input_register(priv->sreg_proto_max); 155 + if (err < 0) 156 + return err; 157 + } else { 158 + priv->sreg_proto_max = priv->sreg_proto_min; 159 + } 160 + } 161 161 162 162 if (tb[NFTA_NAT_FLAGS]) { 163 163 priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS])); ··· 191 179 192 180 if (nla_put_be32(skb, NFTA_NAT_FAMILY, htonl(priv->family))) 193 181 goto nla_put_failure; 194 - if (nla_put_be32(skb, 195 - NFTA_NAT_REG_ADDR_MIN, htonl(priv->sreg_addr_min))) 196 - goto nla_put_failure; 197 - if (nla_put_be32(skb, 198 - NFTA_NAT_REG_ADDR_MAX, htonl(priv->sreg_addr_max))) 199 - goto nla_put_failure; 182 + 183 + if (priv->sreg_addr_min) { 184 + if (nla_put_be32(skb, NFTA_NAT_REG_ADDR_MIN, 185 + htonl(priv->sreg_addr_min)) || 186 + nla_put_be32(skb, NFTA_NAT_REG_ADDR_MAX, 187 + htonl(priv->sreg_addr_max))) 188 + goto nla_put_failure; 189 + } 190 + 200 191 if (priv->sreg_proto_min) { 201 192 if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MIN, 202 - htonl(priv->sreg_proto_min))) 203 - goto nla_put_failure; 204 - if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MAX, 193 + htonl(priv->sreg_proto_min)) || 194 + nla_put_be32(skb, NFTA_NAT_REG_PROTO_MAX, 205 195 htonl(priv->sreg_proto_max))) 206 196 goto nla_put_failure; 207 197 } ··· 219 205 return -1; 220 206 } 221 207 208 + static int nft_nat_validate(const struct nft_ctx *ctx, 209 + const struct nft_expr *expr, 210 + const struct nft_data **data) 211 + { 212 + return nft_chain_validate_dependency(ctx->chain, NFT_CHAIN_T_NAT); 213 + } 214 + 222 215 static struct nft_expr_type nft_nat_type; 223 216 static const struct nft_expr_ops nft_nat_ops = { 224 217 .type = &nft_nat_type, ··· 233 212 .eval = nft_nat_eval, 234 213 .init = nft_nat_init, 235 214 .dump = nft_nat_dump, 215 + .validate = nft_nat_validate, 236 216 }; 237 217 238 218 static struct nft_expr_type nft_nat_type __read_mostly = {

+25 -12

net/netlink/af_netlink.c

··· 96 96 static int netlink_dump(struct sock *sk); 97 97 static void netlink_skb_destructor(struct sk_buff *skb); 98 98 99 + /* nl_table locking explained: 100 + * Lookup and traversal are protected with nl_sk_hash_lock or nl_table_lock 101 + * combined with an RCU read-side lock. Insertion and removal are protected 102 + * with nl_sk_hash_lock while using RCU list modification primitives and may 103 + * run in parallel to nl_table_lock protected lookups. Destruction of the 104 + * Netlink socket may only occur *after* nl_table_lock has been acquired 105 + * either during or after the socket has been removed from the list. 106 + */ 99 107 DEFINE_RWLOCK(nl_table_lock); 100 108 EXPORT_SYMBOL_GPL(nl_table_lock); 101 109 static atomic_t nl_table_users = ATOMIC_INIT(0); ··· 117 109 static int lockdep_nl_sk_hash_is_held(void) 118 110 { 119 111 #ifdef CONFIG_LOCKDEP 120 - return (debug_locks) ? lockdep_is_held(&nl_sk_hash_lock) : 1; 121 - #else 122 - return 1; 112 + if (debug_locks) 113 + return lockdep_is_held(&nl_sk_hash_lock) || lockdep_is_held(&nl_table_lock); 123 114 #endif 115 + return 1; 124 116 } 125 117 126 118 static ATOMIC_NOTIFIER_HEAD(netlink_chain); ··· 1036 1028 struct netlink_table *table = &nl_table[protocol]; 1037 1029 struct sock *sk; 1038 1030 1031 + read_lock(&nl_table_lock); 1039 1032 rcu_read_lock(); 1040 1033 sk = __netlink_lookup(table, portid, net); 1041 1034 if (sk) 1042 1035 sock_hold(sk); 1043 1036 rcu_read_unlock(); 1037 + read_unlock(&nl_table_lock); 1044 1038 1045 1039 return sk; 1046 1040 } ··· 1267 1257 } 1268 1258 netlink_table_ungrab(); 1269 1259 1270 - /* Wait for readers to complete */ 1271 - synchronize_net(); 1272 - 1273 1260 kfree(nlk->groups); 1274 1261 nlk->groups = NULL; 1275 1262 ··· 1288 1281 1289 1282 retry: 1290 1283 cond_resched(); 1284 + netlink_table_grab(); 1291 1285 rcu_read_lock(); 1292 1286 if (__netlink_lookup(table, portid, net)) { 1293 1287 /* Bind collision, search negative portid values. */ ··· 1296 1288 if (rover > -4097) 1297 1289 rover = -4097; 1298 1290 rcu_read_unlock(); 1291 + netlink_table_ungrab(); 1299 1292 goto retry; 1300 1293 } 1301 1294 rcu_read_unlock(); 1295 + netlink_table_ungrab(); 1302 1296 1303 1297 err = netlink_insert(sk, net, portid); 1304 1298 if (err == -EADDRINUSE) ··· 2931 2921 } 2932 2922 2933 2923 static void *netlink_seq_start(struct seq_file *seq, loff_t *pos) 2934 - __acquires(RCU) 2924 + __acquires(nl_table_lock) __acquires(RCU) 2935 2925 { 2926 + read_lock(&nl_table_lock); 2936 2927 rcu_read_lock(); 2937 2928 return *pos ? netlink_seq_socket_idx(seq, *pos - 1) : SEQ_START_TOKEN; 2938 2929 } 2939 2930 2940 2931 static void *netlink_seq_next(struct seq_file *seq, void *v, loff_t *pos) 2941 2932 { 2933 + struct rhashtable *ht; 2942 2934 struct netlink_sock *nlk; 2943 2935 struct nl_seq_iter *iter; 2944 2936 struct net *net; ··· 2955 2943 iter = seq->private; 2956 2944 nlk = v; 2957 2945 2958 - rht_for_each_entry_rcu(nlk, nlk->node.next, node) 2946 + i = iter->link; 2947 + ht = &nl_table[i].hash; 2948 + rht_for_each_entry(nlk, nlk->node.next, ht, node) 2959 2949 if (net_eq(sock_net((struct sock *)nlk), net)) 2960 2950 return nlk; 2961 2951 2962 - i = iter->link; 2963 2952 j = iter->hash_idx + 1; 2964 2953 2965 2954 do { 2966 - struct rhashtable *ht = &nl_table[i].hash; 2967 2955 const struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht); 2968 2956 2969 2957 for (; j < tbl->size; j++) { 2970 - rht_for_each_entry_rcu(nlk, tbl->buckets[j], node) { 2958 + rht_for_each_entry(nlk, tbl->buckets[j], ht, node) { 2971 2959 if (net_eq(sock_net((struct sock *)nlk), net)) { 2972 2960 iter->link = i; 2973 2961 iter->hash_idx = j; ··· 2983 2971 } 2984 2972 2985 2973 static void netlink_seq_stop(struct seq_file *seq, void *v) 2986 - __releases(RCU) 2974 + __releases(RCU) __releases(nl_table_lock) 2987 2975 { 2988 2976 rcu_read_unlock(); 2977 + read_unlock(&nl_table_lock); 2989 2978 } 2990 2979 2991 2980

+2

net/openvswitch/datapath.c

··· 324 324 segs = __skb_gso_segment(skb, NETIF_F_SG, false); 325 325 if (IS_ERR(segs)) 326 326 return PTR_ERR(segs); 327 + if (segs == NULL) 328 + return -EINVAL; 327 329 328 330 /* Queue all of the segments. */ 329 331 skb = segs;

+1 -1

net/sched/sch_api.c

··· 947 947 if (!ops->init || (err = ops->init(sch, tca[TCA_OPTIONS])) == 0) { 948 948 if (qdisc_is_percpu_stats(sch)) { 949 949 sch->cpu_bstats = 950 - alloc_percpu(struct gnet_stats_basic_cpu); 950 + netdev_alloc_pcpu_stats(struct gnet_stats_basic_cpu); 951 951 if (!sch->cpu_bstats) 952 952 goto err_out4; 953 953

+1 -1

net/sched/sch_pie.c

··· 445 445 sch->limit = q->params.limit; 446 446 447 447 setup_timer(&q->adapt_timer, pie_timer, (unsigned long)sch); 448 - mod_timer(&q->adapt_timer, jiffies + HZ / 2); 449 448 450 449 if (opt) { 451 450 int err = pie_change(sch, opt); ··· 453 454 return err; 454 455 } 455 456 457 + mod_timer(&q->adapt_timer, jiffies + HZ / 2); 456 458 return 0; 457 459 } 458 460

+28 -18

net/tipc/node.c

··· 219 219 void tipc_node_link_up(struct tipc_node *n_ptr, struct tipc_link *l_ptr) 220 220 { 221 221 struct tipc_link **active = &n_ptr->active_links[0]; 222 - u32 addr = n_ptr->addr; 223 222 224 223 n_ptr->working_links++; 225 - tipc_nametbl_publish(TIPC_LINK_STATE, addr, addr, TIPC_NODE_SCOPE, 226 - l_ptr->bearer_id, addr); 224 + n_ptr->action_flags |= TIPC_NOTIFY_LINK_UP; 225 + n_ptr->link_id = l_ptr->peer_bearer_id << 16 | l_ptr->bearer_id; 226 + 227 227 pr_info("Established link <%s> on network plane %c\n", 228 228 l_ptr->name, l_ptr->net_plane); 229 229 ··· 284 284 void tipc_node_link_down(struct tipc_node *n_ptr, struct tipc_link *l_ptr) 285 285 { 286 286 struct tipc_link **active; 287 - u32 addr = n_ptr->addr; 288 287 289 288 n_ptr->working_links--; 290 - tipc_nametbl_withdraw(TIPC_LINK_STATE, addr, l_ptr->bearer_id, addr); 289 + n_ptr->action_flags |= TIPC_NOTIFY_LINK_DOWN; 290 + n_ptr->link_id = l_ptr->peer_bearer_id << 16 | l_ptr->bearer_id; 291 291 292 292 if (!tipc_link_is_active(l_ptr)) { 293 293 pr_info("Lost standby link <%s> on network plane %c\n", ··· 552 552 LIST_HEAD(conn_sks); 553 553 struct sk_buff_head waiting_sks; 554 554 u32 addr = 0; 555 - unsigned int flags = node->action_flags; 555 + int flags = node->action_flags; 556 + u32 link_id = 0; 556 557 557 - if (likely(!node->action_flags)) { 558 + if (likely(!flags)) { 558 559 spin_unlock_bh(&node->lock); 559 560 return; 560 561 } 561 562 563 + addr = node->addr; 564 + link_id = node->link_id; 562 565 __skb_queue_head_init(&waiting_sks); 563 - if (node->action_flags & TIPC_WAKEUP_USERS) { 566 + 567 + if (flags & TIPC_WAKEUP_USERS) 564 568 skb_queue_splice_init(&node->waiting_sks, &waiting_sks); 565 - node->action_flags &= ~TIPC_WAKEUP_USERS; 566 - } 567 - if (node->action_flags & TIPC_NOTIFY_NODE_DOWN) { 569 + 570 + if (flags & TIPC_NOTIFY_NODE_DOWN) { 568 571 list_replace_init(&node->nsub, &nsub_list); 569 572 list_replace_init(&node->conn_sks, &conn_sks); 570 - node->action_flags &= ~TIPC_NOTIFY_NODE_DOWN; 571 573 } 572 - if (node->action_flags & TIPC_NOTIFY_NODE_UP) { 573 - node->action_flags &= ~TIPC_NOTIFY_NODE_UP; 574 - addr = node->addr; 575 - } 576 - node->action_flags &= ~TIPC_WAKEUP_BCAST_USERS; 574 + node->action_flags &= ~(TIPC_WAKEUP_USERS | TIPC_NOTIFY_NODE_DOWN | 575 + TIPC_NOTIFY_NODE_UP | TIPC_NOTIFY_LINK_UP | 576 + TIPC_NOTIFY_LINK_DOWN | 577 + TIPC_WAKEUP_BCAST_USERS); 578 + 577 579 spin_unlock_bh(&node->lock); 578 580 579 581 while (!skb_queue_empty(&waiting_sks)) ··· 590 588 if (flags & TIPC_WAKEUP_BCAST_USERS) 591 589 tipc_bclink_wakeup_users(); 592 590 593 - if (addr) 591 + if (flags & TIPC_NOTIFY_NODE_UP) 594 592 tipc_named_node_up(addr); 593 + 594 + if (flags & TIPC_NOTIFY_LINK_UP) 595 + tipc_nametbl_publish(TIPC_LINK_STATE, addr, addr, 596 + TIPC_NODE_SCOPE, link_id, addr); 597 + 598 + if (flags & TIPC_NOTIFY_LINK_DOWN) 599 + tipc_nametbl_withdraw(TIPC_LINK_STATE, addr, 600 + link_id, addr); 595 601 }

+6 -1

net/tipc/node.h

··· 53 53 * TIPC_WAIT_OWN_LINKS_DOWN: wait until peer node is declared down 54 54 * TIPC_NOTIFY_NODE_DOWN: notify node is down 55 55 * TIPC_NOTIFY_NODE_UP: notify node is up 56 + * TIPC_DISTRIBUTE_NAME: publish or withdraw link state name type 56 57 */ 57 58 enum { 58 59 TIPC_WAIT_PEER_LINKS_DOWN = (1 << 1), ··· 61 60 TIPC_NOTIFY_NODE_DOWN = (1 << 3), 62 61 TIPC_NOTIFY_NODE_UP = (1 << 4), 63 62 TIPC_WAKEUP_USERS = (1 << 5), 64 - TIPC_WAKEUP_BCAST_USERS = (1 << 6) 63 + TIPC_WAKEUP_BCAST_USERS = (1 << 6), 64 + TIPC_NOTIFY_LINK_UP = (1 << 7), 65 + TIPC_NOTIFY_LINK_DOWN = (1 << 8) 65 66 }; 66 67 67 68 /** ··· 103 100 * @working_links: number of working links to node (both active and standby) 104 101 * @link_cnt: number of links to node 105 102 * @signature: node instance identifier 103 + * @link_id: local and remote bearer ids of changing link, if any 106 104 * @nsub: list of "node down" subscriptions monitoring node 107 105 * @rcu: rcu struct for tipc_node 108 106 */ ··· 120 116 int link_cnt; 121 117 int working_links; 122 118 u32 signature; 119 + u32 link_id; 123 120 struct list_head nsub; 124 121 struct sk_buff_head waiting_sks; 125 122 struct list_head conn_sks;

+3 -3

net/tipc/socket.c

··· 1776 1776 sk = &tsk->sk; 1777 1777 1778 1778 /* Queue message */ 1779 - bh_lock_sock(sk); 1779 + spin_lock_bh(&sk->sk_lock.slock); 1780 1780 1781 1781 if (!sock_owned_by_user(sk)) { 1782 1782 rc = filter_rcv(sk, buf); ··· 1787 1787 if (sk_add_backlog(sk, buf, limit)) 1788 1788 rc = -TIPC_ERR_OVERLOAD; 1789 1789 } 1790 - bh_unlock_sock(sk); 1790 + spin_unlock_bh(&sk->sk_lock.slock); 1791 1791 tipc_sk_put(tsk); 1792 1792 if (likely(!rc)) 1793 1793 return 0; ··· 2673 2673 case SIOCGETLINKNAME: 2674 2674 if (copy_from_user(&lnr, argp, sizeof(lnr))) 2675 2675 return -EFAULT; 2676 - if (!tipc_node_get_linkname(lnr.bearer_id, lnr.peer, 2676 + if (!tipc_node_get_linkname(lnr.bearer_id & 0xffff, lnr.peer, 2677 2677 lnr.linkname, TIPC_MAX_LINK_NAME)) { 2678 2678 if (copy_to_user(argp, &lnr, sizeof(lnr))) 2679 2679 return -EFAULT;

+9 -1

net/wireless/nl80211.c

··· 5927 5927 int err; 5928 5928 bool need_new_beacon = false; 5929 5929 int len, i; 5930 + u32 cs_count; 5930 5931 5931 5932 if (!rdev->ops->channel_switch || 5932 5933 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) ··· 5964 5963 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 5965 5964 return -EINVAL; 5966 5965 5967 - params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 5966 + /* Even though the attribute is u32, the specification says 5967 + * u8, so let's make sure we don't overflow. 5968 + */ 5969 + cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 5970 + if (cs_count > 255) 5971 + return -EINVAL; 5972 + 5973 + params.count = cs_count; 5968 5974 5969 5975 if (!need_new_beacon) 5970 5976 goto skip_beacons;

+2

net/xfrm/xfrm_output.c

··· 157 157 kfree_skb(skb); 158 158 if (IS_ERR(segs)) 159 159 return PTR_ERR(segs); 160 + if (segs == NULL) 161 + return -EINVAL; 160 162 161 163 do { 162 164 struct sk_buff *nskb = segs->next;

+1 -1

net/xfrm/xfrm_policy.c

··· 1962 1962 struct xfrm_policy *pol = xdst->pols[0]; 1963 1963 struct xfrm_policy_queue *pq = &pol->polq; 1964 1964 1965 - if (unlikely(skb_fclone_busy(skb))) { 1965 + if (unlikely(skb_fclone_busy(sk, skb))) { 1966 1966 kfree_skb(skb); 1967 1967 return 0; 1968 1968 }

+11

samples/bpf/test_verifier.c

··· 209 209 .result = REJECT, 210 210 }, 211 211 { 212 + "program doesn't init R0 before exit in all branches", 213 + .insns = { 214 + BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2), 215 + BPF_MOV64_IMM(BPF_REG_0, 1), 216 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2), 217 + BPF_EXIT_INSN(), 218 + }, 219 + .errstr = "R0 !read_ok", 220 + .result = REJECT, 221 + }, 222 + { 212 223 "stack out of bounds", 213 224 .insns = { 214 225 BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),

Configure Feed

Configure Feed