1. 22 May, 2015 1 commit
    • Eric Dumazet's avatar
      tcp: fix a potential deadlock in tcp_get_info() · d654976c
      Eric Dumazet authored
      Taking socket spinlock in tcp_get_info() can deadlock, as
      inet_diag_dump_icsk() holds the &hashinfo->ehash_locks[i],
      while packet processing can use the reverse locking order.
      
      We could avoid this locking for TCP_LISTEN states, but lockdep would
      certainly get confused as all TCP sockets share same lockdep classes.
      
      [  523.722504] ======================================================
      [  523.728706] [ INFO: possible circular locking dependency detected ]
      [  523.734990] 4.1.0-dbg-DEV #1676 Not tainted
      [  523.739202] -------------------------------------------------------
      [  523.745474] ss/18032 is trying to acquire lock:
      [  523.750002]  (slock-AF_INET){+.-...}, at: [<ffffffff81669d44>] tcp_get_info+0x2c4/0x360
      [  523.758129]
      [  523.758129] but task is already holding lock:
      [  523.763968]  (&(&hashinfo->ehash_locks[i])->rlock){+.-...}, at: [<ffffffff816bcb75>] inet_diag_dump_icsk+0x1d5/0x6c0
      [  523.774661]
      [  523.774661] which lock already depends on the new lock.
      [  523.774661]
      [  523.782850]
      [  523.782850] the existing dependency chain (in reverse order) is:
      [  523.790326]
      -> #1 (&(&hashinfo->ehash_locks[i])->rlock){+.-...}:
      [  523.796599]        [<ffffffff811126bb>] lock_acquire+0xbb/0x270
      [  523.802565]        [<ffffffff816f5868>] _raw_spin_lock+0x38/0x50
      [  523.808628]        [<ffffffff81665af8>] __inet_hash_nolisten+0x78/0x110
      [  523.815273]        [<ffffffff816819db>] tcp_v4_syn_recv_sock+0x24b/0x350
      [  523.822067]        [<ffffffff81684d41>] tcp_check_req+0x3c1/0x500
      [  523.828199]        [<ffffffff81682d09>] tcp_v4_do_rcv+0x239/0x3d0
      [  523.834331]        [<ffffffff816842fe>] tcp_v4_rcv+0xa8e/0xc10
      [  523.840202]        [<ffffffff81658fa3>] ip_local_deliver_finish+0x133/0x3e0
      [  523.847214]        [<ffffffff81659a9a>] ip_local_deliver+0xaa/0xc0
      [  523.853440]        [<ffffffff816593b8>] ip_rcv_finish+0x168/0x5c0
      [  523.859624]        [<ffffffff81659db7>] ip_rcv+0x307/0x420
      
      Lets use u64_sync infrastructure instead. As a bonus, 64bit
      arches get optimized, as these are nop for them.
      
      Fixes: 0df48c26 ("tcp: add tcpi_bytes_acked to tcp_info")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d654976c
  2. 21 May, 2015 1 commit
    • Daniel Borkmann's avatar
      net: sched: fix call_rcu() race on classifier module unloads · c78e1746
      Daniel Borkmann authored
      Vijay reported that a loop as simple as ...
      
        while true; do
          tc qdisc add dev foo root handle 1: prio
          tc filter add dev foo parent 1: u32 match u32 0 0  flowid 1
          tc qdisc del dev foo root
          rmmod cls_u32
        done
      
      ... will panic the kernel. Moreover, he bisected the change
      apparently introducing it to 78fd1d0a ("netlink: Re-add
      locking to netlink_lookup() and seq walker").
      
      The removal of synchronize_net() from the netlink socket
      triggering the qdisc to be removed, seems to have uncovered
      an RCU resp. module reference count race from the tc API.
      Given that RCU conversion was done after e341694e ("netlink:
      Convert netlink_lookup() to use RCU protected hash table")
      which added the synchronize_net() originally, occasion of
      hitting the bug was less likely (not impossible though):
      
      When qdiscs that i) support attaching classifiers and,
      ii) have at least one of them attached, get deleted, they
      invoke tcf_destroy_chain(), and thus call into ->destroy()
      handler from a classifier module.
      
      After RCU conversion, all classifier that have an internal
      prio list, unlink them and initiate freeing via call_rcu()
      deferral.
      
      Meanhile, tcf_destroy() releases already reference to the
      tp->ops->owner module before the queued RCU callback handler
      has been invoked.
      
      Subsequent rmmod on the classifier module is then not prevented
      since all module references are already dropped.
      
      By the time, the kernel invokes the RCU callback handler from
      the module, that function address is then invalid.
      
      One way to fix it would be to add an rcu_barrier() to
      unregister_tcf_proto_ops() to wait for all pending call_rcu()s
      to complete.
      
      synchronize_rcu() is not appropriate as under heavy RCU
      callback load, registered call_rcu()s could be deferred
      longer than a grace period. In case we don't have any pending
      call_rcu()s, the barrier is allowed to return immediately.
      
      Since we came here via unregister_tcf_proto_ops(), there
      are no users of a given classifier anymore. Further nested
      call_rcu()s pointing into the module space are not being
      done anywhere.
      
      Only cls_bpf_delete_prog() may schedule a work item, to
      unlock pages eventually, but that is not in the range/context
      of cls_bpf anymore.
      
      Fixes: 25d8c0d5 ("net: rcu-ify tcf_proto")
      Fixes: 9888faef ("net: sched: cls_basic use RCU")
      Reported-by: default avatarVijay Subramanian <subramanian.vijay@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Cc: John Fastabend <john.r.fastabend@intel.com>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Thomas Graf <tgraf@suug.ch>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Alexei Starovoitov <ast@plumgrid.com>
      Tested-by: default avatarVijay Subramanian <subramanian.vijay@gmail.com>
      Acked-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c78e1746
  3. 20 May, 2015 4 commits
    • Tim Beale's avatar
      net: phy: Make sure phy_start() always re-enables the phy interrupts · c15e10e7
      Tim Beale authored
      This is an alternative way of fixing:
       commit db9683fb ("net: phy: Make sure PHY_RESUMING state change
                            is always processed")
      
      When the PHY state transitions from PHY_HALTED to PHY_RESUMING, there are
      two things we need to do:
      1). Re-enable interrupts (and power up the physical link, if powered down)
      2). Update the PHY state and net-device based on the link status.
      
      There's no strict reason why #1 has to be done from within the main
      phy_state_machine() function. There is a risk that other changes to the
      PHY (e.g. setting speed/duplex, which calls phy_start_aneg()) could cause
      a subsequent state transition before phy_state_machine() has processed
      the PHY_RESUMING state change. This would leave the PHY with interrupts
      disabled and/or still in the BMCR_PDOWN/low-power mode.
      
      Moving enabling the interrupts and phy_resume() into phy_start() will
      guarantee this work always gets done. As the PHY is already in the HALTED
      state and interrupts are disabled, it shouldn't conflict with any work
      being done in phy_state_machine(). The downside of this change is that if
      the PHY_RESUMING state is ever entered from anywhere else, it'll also have
      to repeat this work.
      Signed-off-by: default avatarTim Beale <tim.beale@alliedtelesis.co.nz>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c15e10e7
    • David S. Miller's avatar
      Merge branch 'ipv6_ecmp_fixes' · 7764b9dd
      David S. Miller authored
      Michal Kubecek says:
      
      ====================
      IPv6 ECMP route add/replace fixes
      
      (1) When adding a nexthop of a multipath route fails (e.g. because of a
      conflict with an existing route), we are supposed to delete nexthops
      already added. However, currently we try to also delete all nexthops we
      haven't even tried to add yet so that a "ip route add" command can
      actually remove pre-existing routes if it fails.
      
      (2) Attempt to replace a multipath route results in a broken siblings
      linked list. Following commands (like "ip route del") can then either
      follow a link into freed memory or end in an infinite loop (if the slab
      object has been reused).
      
      v2: fix an omission in first patch
      
      v3: change the semantics of replace operation to better match IPv4
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7764b9dd
    • Michal Kubeček's avatar
      ipv6: fix ECMP route replacement · 27596472
      Michal Kubeček authored
      When replacing an IPv6 multipath route with "ip route replace", i.e.
      NLM_F_CREATE | NLM_F_REPLACE, fib6_add_rt2node() replaces only first
      matching route without fixing its siblings, resulting in corrupted
      siblings linked list; removing one of the siblings can then end in an
      infinite loop.
      
      IPv6 ECMP implementation is a bit different from IPv4 so that route
      replacement cannot work in exactly the same way. This should be a
      reasonable approximation:
      
      1. If the new route is ECMP-able and there is a matching ECMP-able one
      already, replace it and all its siblings (if any).
      
      2. If the new route is ECMP-able and no matching ECMP-able route exists,
      replace first matching non-ECMP-able (if any) or just add the new one.
      
      3. If the new route is not ECMP-able, replace first matching
      non-ECMP-able route (if any) or add the new route.
      
      We also need to remove the NLM_F_REPLACE flag after replacing old
      route(s) by first nexthop of an ECMP route so that each subsequent
      nexthop does not replace previous one.
      
      Fixes: 51ebd318 ("ipv6: add support of equal cost multipath (ECMP)")
      Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
      Acked-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      27596472
    • Michal Kubeček's avatar
      ipv6: do not delete previously existing ECMP routes if add fails · 35f1b4e9
      Michal Kubeček authored
      If adding a nexthop of an IPv6 multipath route fails, comment in
      ip6_route_multipath() says we are going to delete all nexthops already
      added. However, current implementation deletes even the routes it
      hasn't even tried to add yet. For example, running
      
        ip route add 1234:5678::/64 \
            nexthop via fe80::aa dev dummy1 \
            nexthop via fe80::bb dev dummy1 \
            nexthop via fe80::cc dev dummy1
      
      twice results in removing all routes first command added.
      
      Limit the second (delete) run to nexthops that succeeded in the first
      (add) run.
      
      Fixes: 51ebd318 ("ipv6: add support of equal cost multipath (ECMP)")
      Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
      Acked-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      35f1b4e9
  4. 19 May, 2015 5 commits
  5. 18 May, 2015 4 commits
  6. 16 May, 2015 6 commits
    • Herbert Xu's avatar
      rhashtable: Add cap on number of elements in hash table · 07ee0722
      Herbert Xu authored
      We currently have no limit on the number of elements in a hash table.
      This is a problem because some users (tipc) set a ceiling on the
      maximum table size and when that is reached the hash table may
      degenerate.  Others may encounter OOM when growing and if we allow
      insertions when that happens the hash table perofrmance may also
      suffer.
      
      This patch adds a new paramater insecure_max_entries which becomes
      the cap on the table.  If unset it defaults to max_size * 2.  If
      it is also zero it means that there is no cap on the number of
      elements in the table.  However, the table will grow whenever the
      utilisation hits 100% and if that growth fails, you will get ENOMEM
      on insertion.
      
      As allowing oversubscription is potentially dangerous, the name
      contains the word insecure.
      
      Note that the cap is not a hard limit.  This is done for performance
      reasons as enforcing a hard limit will result in use of atomic ops
      that are heavier than the ones we currently use.
      
      The reasoning is that we're only guarding against a gross over-
      subscription of the table, rather than a small breach of the limit.
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      07ee0722
    • Tim Beale's avatar
      net: phy: Make sure PHY_RESUMING state change is always processed · db9683fb
      Tim Beale authored
      If phy_start_aneg() was called while the phydev is in the PHY_RESUMING
      state, then its state would immediately transition to PHY_AN (or
      PHY_FORCING). This meant the phy_state_machine() never processed the
      PHY_RESUMING state change, which meant interrupts weren't enabled for the
      PHY. If the PHY used low-power mode (i.e. using BMCR_PDOWN), then the
      physical link wouldn't get powered up again.
      
      There seems no point for phy_start_aneg() to make the PHY_RESUMING -->
      PHY_AN transition, as the state machine will do this anyway. I'm not sure
      about the case where autoneg is disabled, as my patch will change
      behaviour so that the PHY goes to PHY_NOLINK instead of PHY_FORCING. An
      alternative solution would be to move the phy_config_interrupt() and
      phy_resume() work out of the state machine and into phy_start().
      
      The background behind this: we're running linux v3.16.7 and from user-space
      we want to enable the eth port (i.e. do a SIOCSIFFLAGS ioctl with the
      IFF_UP flag) and immediately afterward set the interface's speed/duplex.
      Enabling the interface calls .ndo_open() then phy_start() and the PHY
      transitions PHY_HALTED --> PHY_RESUMING. Setting the speed/duplex ends up
      calling phy_ethtool_sset(), which calls phy_start_aneg() (meanwhile the
      phy_state_machine() hasn't processed the PHY_RESUMING state change yet).
      Signed-off-by: default avatarTim Beale <tim.beale@alliedtelesis.co.nz>
      Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      db9683fb
    • Herbert Xu's avatar
      netlink: Reset portid after netlink_insert failure · c0bb07df
      Herbert Xu authored
      The commit c5adde94 ("netlink:
      eliminate nl_sk_hash_lock") breaks the autobind retry mechanism
      because it doesn't reset portid after a failed netlink_insert.
      
      This means that should autobind fail the first time around, then
      the socket will be stuck in limbo as it can never be bound again
      since it already has a non-zero portid.
      
      Fixes: c5adde94 ("netlink: eliminate nl_sk_hash_lock")
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c0bb07df
    • David S. Miller's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf · 1d605701
      David S. Miller authored
      Pablo Neira Ayuso says:
      
      ====================
      The following patchset contains Netfilter fixes for your net tree, they are:
      
      1) Fix a leak in IPVS, the sysctl table is not released accordingly when
         destroying a netns, patch from Tommi Rantala.
      
      2) Fix a build error when TPROXY and socket are built-in but IPv6 defrag is
         compiled as module, from Florian Westphal.
      
      3) Fix TCP tracket wrt. RFC5961 challenge ACK when in LAST_ACK state, patch
         from Jesper Dangaard Brouer.
      
      4) Fix a bogus WARN_ON() in nf_tables when deleting a set element that stores
         a map, from Mirek Kratochvil.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1d605701
    • Florian Fainelli's avatar
      net: phy: Allow EEE for all RGMII variants · 7e140696
      Florian Fainelli authored
      RGMII interfaces come in multiple flavors: RGMII with transmit or
      receive internal delay, no delays at all, or delays in both direction.
      
      This change extends the initial check for PHY_INTERFACE_MODE_RGMII to
      cover all of these variants since EEE should be allowed for any of these
      modes, since it is a property of the RGMII, hence Gigabit PHY capability
      more than the RGMII electrical interface and its delays.
      
      Fixes: a59a4d19 ("phy: add the EEE support and the way to access to the MMD registers")
      Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7e140696
    • Ying Xue's avatar
      rocker: fix a neigh entry leak issue · 1f9993f6
      Ying Xue authored
      Once we get a neighbour through looking up arp cache or creating a
      new one in rocker_port_ipv4_resolve(), the neighbour's refcount is
      already taken. But as we don't put the refcount again after it's
      used, this makes the neighbour entry leaked.
      Suggested-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarJiri Pirko <jiri@resnulli.us>
      Acked-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
      Acked-by: default avatarJiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1f9993f6
  7. 15 May, 2015 7 commits
  8. 14 May, 2015 3 commits
    • Eric Dumazet's avatar
      netlink: move nl_table in read_mostly section · 91dd93f9
      Eric Dumazet authored
      netlink sockets creation and deletion heavily modify nl_table_users
      and nl_table_lock.
      
      If nl_table is sharing one cache line with one of them, netlink
      performance is really bad on SMP.
      
      ffffffff81ff5f00 B nl_table
      ffffffff81ff5f0c b nl_table_users
      
      Putting nl_table in read_mostly section increased performance
      of my open/delete netlink sockets test by about 80 %
      
      This came up while diagnosing a getaddrinfo() problem.
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      91dd93f9
    • Wesley Kuo's avatar
      Bluetooth: Fix remote name event return directly. · 177d0506
      Wesley Kuo authored
      This patch fixes hci_remote_name_evt dose not resolve name during
      discovery status is RESOLVING. Before simultaneous dual mode scan enabled,
      hci_check_pending_name will set discovery status to STOPPED eventually.
      Signed-off-by: default avatarWesley Kuo <wesley.kuo@intel.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      177d0506
    • Vlad Yasevich's avatar
      vlan: Correctly propagate promisc|allmulti flags in notifier. · be346ffa
      Vlad Yasevich authored
      Currently vlan notifier handler will try to update all vlans
      for a device when that device comes up.  A problem occurs,
      however, when the vlan device was set to promiscuous, but not
      by the user (ex: a bridge).  In that case, dev->gflags are
      not updated.  What results is that the lower device ends
      up with an extra promiscuity count.  Here are the
      backtraces that prove this:
      [62852.052179]  [<ffffffff814fe248>] __dev_set_promiscuity+0x38/0x1e0
      [62852.052186]  [<ffffffff8160bcbb>] ? _raw_spin_unlock_bh+0x1b/0x40
      [62852.052188]  [<ffffffff814fe4be>] ? dev_set_rx_mode+0x2e/0x40
      [62852.052190]  [<ffffffff814fe694>] dev_set_promiscuity+0x24/0x50
      [62852.052194]  [<ffffffffa0324795>] vlan_dev_open+0xd5/0x1f0 [8021q]
      [62852.052196]  [<ffffffff814fe58f>] __dev_open+0xbf/0x140
      [62852.052198]  [<ffffffff814fe88d>] __dev_change_flags+0x9d/0x170
      [62852.052200]  [<ffffffff814fe989>] dev_change_flags+0x29/0x60
      
      The above comes from the setting the vlan device to IFF_UP state.
      
      [62852.053569]  [<ffffffff814fe248>] __dev_set_promiscuity+0x38/0x1e0
      [62852.053571]  [<ffffffffa032459b>] ? vlan_dev_set_rx_mode+0x2b/0x30
      [8021q]
      [62852.053573]  [<ffffffff814fe8d5>] __dev_change_flags+0xe5/0x170
      [62852.053645]  [<ffffffff814fe989>] dev_change_flags+0x29/0x60
      [62852.053647]  [<ffffffffa032334a>] vlan_device_event+0x18a/0x690
      [8021q]
      [62852.053649]  [<ffffffff8161036c>] notifier_call_chain+0x4c/0x70
      [62852.053651]  [<ffffffff8109d456>] raw_notifier_call_chain+0x16/0x20
      [62852.053653]  [<ffffffff814f744d>] call_netdevice_notifiers+0x2d/0x60
      [62852.053654]  [<ffffffff814fe1a3>] __dev_notify_flags+0x33/0xa0
      [62852.053656]  [<ffffffff814fe9b2>] dev_change_flags+0x52/0x60
      [62852.053657]  [<ffffffff8150cd57>] do_setlink+0x397/0xa40
      
      And this one comes from the notification code.  What we end
      up with is a vlan with promiscuity count of 1 and and a physical
      device with a promiscuity count of 2.  They should both have
      a count 1.
      
      To resolve this issue, vlan code can use dev_get_flags() api
      which correctly masks promiscuity and allmulti flags.
      Signed-off-by: default avatarVlad Yasevich <vyasevic@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      be346ffa
  9. 13 May, 2015 9 commits
    • Dmitry Tunin's avatar
      Bluetooth: ath3k: add support of 04ca:300f AR3012 device · ec0810d2
      Dmitry Tunin authored
      BugLink: https://bugs.launchpad.net/bugs/1449730
      
      T:  Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#=  3 Spd=12  MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=04ca ProdID=300f Rev=00.01
      C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      Signed-off-by: default avatarDmitry Tunin <hanipouspilot@gmail.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      ec0810d2
    • Wen-chien Jesse Sung's avatar
      Bluetooth: btusb: Add support for 0cf3:e007 · 2054111b
      Wen-chien Jesse Sung authored
      Device 0cf3:e007 is one of the QCA ROME family.
      
      T:  Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#=  3 Spd=12   MxCh= 0
      D:  Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=0cf3 ProdID=e007 Rev= 0.01
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      Signed-off-by: default avatarWen-chien Jesse Sung <jesse.sung@canonical.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      2054111b
    • Wen-chien Jesse Sung's avatar
      Bluetooth: ath3k: Add a new ID 0cf3:e006 to ath3k list · ca79f232
      Wen-chien Jesse Sung authored
      Device info in /sys/kernel/debug/usb/devices:
      
      T:  Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#=  3 Spd=12   MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=0cf3 ProdID=e006 Rev= 0.01
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
      E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
      I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
      I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
      I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
      I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
      I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
      Signed-off-by: default avatarWen-chien Jesse Sung <jesse.sung@canonical.com>
      Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
      ca79f232
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 110bc767
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Handle max TX power properly wrt VIFs and the MAC in iwlwifi, from
          Avri Altman.
      
       2) Use the correct FW API for scan completions in iwlwifi, from Avraham
          Stern.
      
       3) FW monitor in iwlwifi accidently uses unmapped memory, fix from Liad
          Kaufman.
      
       4) rhashtable conversion of mac80211 station table was buggy, the
          virtual interface was not taken into account.  Fix from Johannes
          Berg.
      
       5) Fix deadlock in rtlwifi by not using a zero timeout for
          usb_control_msg(), from Larry Finger.
      
       6) Update reordering state before calculating loss detection, from
          Yuchung Cheng.
      
       7) Fix off by one in bluetooth firmward parsing, from Dan Carpenter.
      
       8) Fix extended frame handling in xiling_can driver, from Jeppe
          Ledet-Pedersen.
      
       9) Fix CODEL packet scheduler behavior in the presence of TSO packets,
          from Eric Dumazet.
      
      10) Fix NAPI budget testing in fm10k driver, from Alexander Duyck.
      
      11) macvlan needs to propagate promisc settings down the the lower
          device, from Vlad Yasevich.
      
      12) igb driver can oops when changing number of rings, from Toshiaki
          Makita.
      
      13) Source specific default routes not handled properly in ipv6, from
          Markus Stenberg.
      
      14) Use after free in tc_ctl_tfilter(), from WANG Cong.
      
      15) Use softirq spinlocking in netxen driver, from Tony Camuso.
      
      16) Two ARM bpf JIT fixes from Nicolas Schichan.
      
      17) Handle MSG_DONTWAIT properly in ring based AF_PACKET sends, from
          Mathias Kretschmer.
      
      18) Fix x86 bpf JIT implementation of FROM_{BE16,LE16,LE32}, from Alexei
          Starovoitov.
      
      19) ll_temac driver DMA maps TX packet header with incorrect length, fix
          from Michal Simek.
      
      20) We removed pm_qos bits from netdevice.h, but some indirect
          references remained.  Kill them.  From David Ahern.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (90 commits)
        net: Remove remaining remnants of pm_qos from netdevice.h
        e1000e: Add pm_qos header
        net: phy: micrel: Fix regression in kszphy_probe
        net: ll_temac: Fix DMA map size bug
        x86: bpf_jit: fix FROM_BE16 and FROM_LE16/32 instructions
        netns: return RTM_NEWNSID instead of RTM_GETNSID on a get
        Update be2net maintainers' email addresses
        net_sched: gred: use correct backlog value in WRED mode
        pppoe: drop pppoe device in pppoe_unbind_sock_work
        net: qca_spi: Fix possible race during probe
        net: mdio-gpio: Allow for unspecified bus id
        af_packet / TX_RING not fully non-blocking (w/ MSG_DONTWAIT).
        bnx2x: limit fw delay in kdump to 5s after boot
        ARM: net: delegate filter to kernel interpreter when imm_offset() return value can't fit into 12bits.
        ARM: net fix emit_udiv() for BPF_ALU | BPF_DIV | BPF_K intruction.
        mpls: Change reserved label names to be consistent with netbsd
        usbnet: avoid integer overflow in start_xmit
        netxen_nic: use spin_[un]lock_bh around tx_clean_lock (2)
        net: xgene_enet: Set hardware dependency
        net: amd-xgbe: Add hardware dependency
        ...
      110bc767
    • David Ahern's avatar
      net: Remove remaining remnants of pm_qos from netdevice.h · 01d460dd
      David Ahern authored
      Commit e2c65448 removed pm_qos from struct net_device but left the
      comment and header file. Remove those.
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Cc: Thomas Graf <tgraf@suug.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      01d460dd
    • David Ahern's avatar
      e1000e: Add pm_qos header · 5684044f
      David Ahern authored
      Commit e2c65448 moved pm_qos_req to e1000_adapter. Add the header file
      that defines the struct.
      Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
      Cc: Thomas Graf <tgraf@suug.ch>
      Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5684044f
    • Niklas Cassel's avatar
      net: phy: micrel: Fix regression in kszphy_probe · bced8701
      Niklas Cassel authored
      Don't do clock-mode-select if clk == NULL,
      since when building without CONFIG_HAVE_CLK,
      clk_get returns NULL and clk_get_rate returns 0.
      
      Doing clock-mode-select in this cause causes kszphy_probe to
      return -EINVAL and thus prevents the device from being probed.
      
      The original code (before regression) would return 0
      when building without CONFIG_HAVE_CLK.
      
      Cc: stable <stable@vger.kernel.org> # 3.18+
      Fixes: 1fadee0c ("net/phy: micrel: Add clock support for
      KSZ8021/KSZ8031")
      Reviewed-by: default avatarFabio Estevam <fabio.estevam@freescale.com>
      Reviewed-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarNiklas Cassel <niklass@axis.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bced8701
    • Michal Simek's avatar
      net: ll_temac: Fix DMA map size bug · 44d4f8d7
      Michal Simek authored
      DMA allocates skb->len instead of headlen
      which is used for DMA.
      Signed-off-by: default avatarMichal Simek <michal.simek@xilinx.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      44d4f8d7
    • Alexei Starovoitov's avatar
      x86: bpf_jit: fix FROM_BE16 and FROM_LE16/32 instructions · 343f845b
      Alexei Starovoitov authored
      FROM_BE16:
      'ror %reg, 8' doesn't clear upper bits of the register,
      so use additional 'movzwl' insn to zero extend 16 bits into 64
      
      FROM_LE16:
      should zero extend lower 16 bits into 64 bit
      
      FROM_LE32:
      should zero extend lower 32 bits into 64 bit
      
      Fixes: 89aa0758 ("net: sock: allow eBPF programs to be attached to sockets")
      Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      343f845b