lael-labs/linux

Documentation/devicetree/bindings/net/fsl-fman.txt+13−0

@@ -403,6 +403,19 @@ PROPERTIES · 402 unmodified lines
403	The settings and programming routines for internal/external	403	The settings and programming routines for internal/external
404	MDIO are different. Must be included for internal MDIO.	404	MDIO are different. Must be included for internal MDIO.
405		405
		406	- fsl,erratum-a011043
		407	Usage: optional
		408	Value type: <boolean>
		409	Definition: Indicates the presence of the A011043 erratum
		410	describing that the MDIO_CFG[MDIO_RD_ER] bit may be falsely
		411	set when reading internal PCS registers. MDIO reads to
		412	internal PCS registers may result in having the
		413	MDIO_CFG[MDIO_RD_ER] bit set, even when there is no error and
		414	read data (MDIO_DATA[MDIO_DATA]) is correct.
		415	Software may get false read error when reading internal
		416	PCS registers through MDIO. As a workaround, all internal
		417	MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
		418
406	For internal PHY device on internal mdio bus, a PHY node should be created.	419	For internal PHY device on internal mdio bus, a PHY node should be created.
407	See the definition of the PHY node in booting-without-of.txt for an	420	See the definition of the PHY node in booting-without-of.txt for an
408	example of how to define a PHY (Internal PHY has no interrupt line).	421	example of how to define a PHY (Internal PHY has no interrupt line).

MAINTAINERS+5−3

 M:	Andrew Lunn <andrew@lunn.ch>
 M:	Florian Fainelli <f.fainelli@gmail.com>
 M:	Heiner Kallweit <hkallweit1@gmail.com>
+R:	Russell King <linux@armlinux.org.uk>
 L:	netdev@vger.kernel.org
 S:	Maintained
 F:	Documentation/ABI/testing/sysfs-class-net-phydev
 F:	drivers/platform/x86/intel-vbtn.c
 INTEL WIRELESS 3945ABG/BG, 4965AGN (iwlegacy)
-M:	Stanislaw Gruszka <sgruszka@redhat.com>
+M:	Stanislaw Gruszka <stf_xl@wp.pl>
 L:	linux-wireless@vger.kernel.org
 S:	Supported
 F:	drivers/net/wireless/intel/iwlegacy/
 NETWORKING [GENERAL]
 M:	"David S. Miller" <davem@davemloft.net>
+M:	Jakub Kicinski <kuba@kernel.org>
 L:	netdev@vger.kernel.org
 W:	http://www.linuxfoundation.org/en/Net
 Q:	http://patchwork.ozlabs.org/project/netdev/list/
 F:	arch/mips/ralink
 RALINK RT2X00 WIRELESS LAN DRIVER
-M:	Stanislaw Gruszka <sgruszka@redhat.com>
+M:	Stanislaw Gruszka <stf_xl@wp.pl>
 M:	Helmut Schaa <helmut.schaa@googlemail.com>
 L:	linux-wireless@vger.kernel.org
 S:	Maintained
 F:	tools/testing/selftests/timers/
 TIPC NETWORK LAYER
-M:	Jon Maloy <jon.maloy@ericsson.com>
+M:	Jon Maloy <jmaloy@redhat.com>
 M:	Ying Xue <ying.xue@windriver.com>
 L:	netdev@vger.kernel.org (core kernel code)
 L:	tipc-discussion@lists.sourceforge.net (user apps, general discussion)

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi+1−0

@@ -63,6 +63,7 @@ fman@400000 { · 62 unmodified lines
63	#size-cells = <0>;	63	#size-cells = <0>;
64	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	64	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
65	reg = <0xe1000 0x1000>;	65	reg = <0xe1000 0x1000>;
		66	fsl,erratum-a011043; /* must ignore read errors */
66		67
67	pcsphy0: ethernet-phy@0 {	68	pcsphy0: ethernet-phy@0 {
68	reg = <0x0>;	69	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi+1−0

@@ -60,6 +60,7 @@ fman@400000 { · 59 unmodified lines
60	#size-cells = <0>;	60	#size-cells = <0>;
61	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	61	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
62	reg = <0xf1000 0x1000>;	62	reg = <0xf1000 0x1000>;
		63	fsl,erratum-a011043; /* must ignore read errors */
63		64
64	pcsphy6: ethernet-phy@0 {	65	pcsphy6: ethernet-phy@0 {
65	reg = <0x0>;	66	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi+1−0

@@ -63,6 +63,7 @@ fman@400000 { · 62 unmodified lines
63	#size-cells = <0>;	63	#size-cells = <0>;
64	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	64	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
65	reg = <0xe3000 0x1000>;	65	reg = <0xe3000 0x1000>;
		66	fsl,erratum-a011043; /* must ignore read errors */
66		67
67	pcsphy1: ethernet-phy@0 {	68	pcsphy1: ethernet-phy@0 {
68	reg = <0x0>;	69	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi+1−0

@@ -60,6 +60,7 @@ fman@400000 { · 59 unmodified lines
60	#size-cells = <0>;	60	#size-cells = <0>;
61	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	61	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
62	reg = <0xf3000 0x1000>;	62	reg = <0xf3000 0x1000>;
		63	fsl,erratum-a011043; /* must ignore read errors */
63		64
64	pcsphy7: ethernet-phy@0 {	65	pcsphy7: ethernet-phy@0 {
65	reg = <0x0>;	66	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi+1−0

@@ -59,6 +59,7 @@ fman@400000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe1000 0x1000>;	61	reg = <0xe1000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy0: ethernet-phy@0 {	64	pcsphy0: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi+1−0

@@ -59,6 +59,7 @@ fman@400000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe3000 0x1000>;	61	reg = <0xe3000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy1: ethernet-phy@0 {	64	pcsphy1: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi+1−0

@@ -59,6 +59,7 @@ fman@400000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe5000 0x1000>;	61	reg = <0xe5000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy2: ethernet-phy@0 {	64	pcsphy2: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi+1−0

@@ -59,6 +59,7 @@ fman@400000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe7000 0x1000>;	61	reg = <0xe7000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy3: ethernet-phy@0 {	64	pcsphy3: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi+1−0

@@ -59,6 +59,7 @@ fman@400000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe9000 0x1000>;	61	reg = <0xe9000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy4: ethernet-phy@0 {	64	pcsphy4: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi+1−0

@@ -59,6 +59,7 @@ fman@400000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xeb000 0x1000>;	61	reg = <0xeb000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy5: ethernet-phy@0 {	64	pcsphy5: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi+1−0

@@ -60,6 +60,7 @@ fman@500000 { · 59 unmodified lines
60	#size-cells = <0>;	60	#size-cells = <0>;
61	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	61	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
62	reg = <0xf1000 0x1000>;	62	reg = <0xf1000 0x1000>;
		63	fsl,erratum-a011043; /* must ignore read errors */
63		64
64	pcsphy14: ethernet-phy@0 {	65	pcsphy14: ethernet-phy@0 {
65	reg = <0x0>;	66	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi+1−0

@@ -60,6 +60,7 @@ fman@500000 { · 59 unmodified lines
60	#size-cells = <0>;	60	#size-cells = <0>;
61	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	61	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
62	reg = <0xf3000 0x1000>;	62	reg = <0xf3000 0x1000>;
		63	fsl,erratum-a011043; /* must ignore read errors */
63		64
64	pcsphy15: ethernet-phy@0 {	65	pcsphy15: ethernet-phy@0 {
65	reg = <0x0>;	66	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi+1−0

@@ -59,6 +59,7 @@ fman@500000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe1000 0x1000>;	61	reg = <0xe1000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy8: ethernet-phy@0 {	64	pcsphy8: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi+1−0

@@ -59,6 +59,7 @@ fman@500000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe3000 0x1000>;	61	reg = <0xe3000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy9: ethernet-phy@0 {	64	pcsphy9: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi+1−0

@@ -59,6 +59,7 @@ fman@500000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe5000 0x1000>;	61	reg = <0xe5000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy10: ethernet-phy@0 {	64	pcsphy10: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi+1−0

@@ -59,6 +59,7 @@ fman@500000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe7000 0x1000>;	61	reg = <0xe7000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy11: ethernet-phy@0 {	64	pcsphy11: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi+1−0

@@ -59,6 +59,7 @@ fman@500000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xe9000 0x1000>;	61	reg = <0xe9000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy12: ethernet-phy@0 {	64	pcsphy12: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi+1−0

@@ -59,6 +59,7 @@ fman@500000 { · 58 unmodified lines
59	#size-cells = <0>;	59	#size-cells = <0>;
60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";	60	compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
61	reg = <0xeb000 0x1000>;	61	reg = <0xeb000 0x1000>;
		62	fsl,erratum-a011043; /* must ignore read errors */
62		63
63	pcsphy13: ethernet-phy@0 {	64	pcsphy13: ethernet-phy@0 {
64	reg = <0x0>;	65	reg = <0x0>;

drivers/atm/firestream.c+3−0

 			}
 			if (!to) {
 				printk ("No more free channels for FS50..\n");
+				kfree(vcc);
 				return -EBUSY;
 			}
 			vcc->channo = dev->channo;
 			if (((DO_DIRECTION(rxtp) && dev->atm_vccs[vcc->channo])) ||
 			    ( DO_DIRECTION(txtp) && test_bit (vcc->channo, dev->tx_inuse))) {
 				printk ("Channel is in use for FS155.\n");
+				kfree(vcc);
 				return -EBUSY;
 			}
 		}
 			    tc, sizeof (struct fs_transmit_config));
 		if (!tc) {
 			fs_dprintk (FS_DEBUG_OPEN, "fs: can't alloc transmit_config.\n");
+			kfree(vcc);
 			return -ENOMEM;
 		}

drivers/net/can/slcan.c+10−2

  */
 static void slcan_write_wakeup(struct tty_struct *tty)
 {
-	struct slcan *sl = tty->disc_data;
+	struct slcan *sl;
+	rcu_read_lock();
+	sl = rcu_dereference(tty->disc_data);
+	if (!sl)
+		goto out;
 	schedule_work(&sl->tx_work);
+out:
+	rcu_read_unlock();
 }
 /* Send a can_frame to a TTY queue. */
 		return;
 	spin_lock_bh(&sl->lock);
-	tty->disc_data = NULL;
+	rcu_assign_pointer(tty->disc_data, NULL);
 	sl->tty = NULL;
 	spin_unlock_bh(&sl->lock);
+	synchronize_rcu();
 	flush_work(&sl->tx_work);
 	/* Flush network side */

drivers/net/ethernet/broadcom/genet/bcmgenet.c+2−2

@@ -2164,8 +2164,8 @@ static void bcmgenet_init_tx_ring(struct bcmgenet_priv *priv, · 2163 unmodified lines
2164	DMA_END_ADDR);	2164	DMA_END_ADDR);
2165		2165
2166	/* Initialize Tx NAPI */	2166	/* Initialize Tx NAPI */
2167	netif_napi_add(priv->dev, &ring->napi, bcmgenet_tx_poll,	2167	netif_tx_napi_add(priv->dev, &ring->napi, bcmgenet_tx_poll,
2168	NAPI_POLL_WEIGHT);	2168	NAPI_POLL_WEIGHT);
2169	}	2169	}
2170		2170
2171	/* Initialize a RDMA ring */	2171	/* Initialize a RDMA ring */

drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c+2−0

@@ -2448,6 +2448,8 @@ static int cxgb_extension_ioctl(struct net_device dev, void __user useraddr) · 2447 unmodified lines
2448		2448
2449	if (!is_offload(adapter))	2449	if (!is_offload(adapter))
2450	return -EOPNOTSUPP;	2450	return -EOPNOTSUPP;
		2451	if (!capable(CAP_NET_ADMIN))
		2452	return -EPERM;
2451	if (!(adapter->flags & FULL_INIT_DONE))	2453	if (!(adapter->flags & FULL_INIT_DONE))
2452	return -EIO; /* need the memory controllers */	2454	return -EIO; /* need the memory controllers */
2453	if (copy_from_user(&t, useraddr, sizeof(t)))	2455	if (copy_from_user(&t, useraddr, sizeof(t)))

drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c+1−2

@@ -70,8 +70,7 @@ static void seq_tab_start(struct seq_file seq, loff_t *pos) · 69 unmodified lines
70	static void seq_tab_next(struct seq_file seq, void v, loff_t pos)	70	static void seq_tab_next(struct seq_file seq, void v, loff_t pos)
71	{	71	{
72	v = seq_tab_get_idx(seq->private, *pos + 1);	72	v = seq_tab_get_idx(seq->private, *pos + 1);
73	if (v)	73	++(*pos);
74	++*pos;
75	return v;	74	return v;
76	}	75	}
77		76

drivers/net/ethernet/chelsio/cxgb4/l2t.c+1−2

@@ -678,8 +678,7 @@ static void l2t_seq_start(struct seq_file seq, loff_t *pos) · 677 unmodified lines
678	static void l2t_seq_next(struct seq_file seq, void v, loff_t pos)	678	static void l2t_seq_next(struct seq_file seq, void v, loff_t pos)
679	{	679	{
680	v = l2t_get_idx(seq, *pos);	680	v = l2t_get_idx(seq, *pos);
681	if (v)	681	++(*pos);
682	++*pos;
683	return v;	682	return v;
684	}	683	}
685		684

drivers/net/ethernet/freescale/fman/fman_memac.c+2−2

@@ -110,7 +110,7 @@ do { \ · 109 unmodified lines
110	/* Interface Mode Register (IF_MODE) */	110	/* Interface Mode Register (IF_MODE) */
111		111
112	#define IF_MODE_MASK 0x00000003 /* 30-31 Mask on i/f mode bits */	112	#define IF_MODE_MASK 0x00000003 /* 30-31 Mask on i/f mode bits */
113	#define IF_MODE_XGMII 0x00000000 /* 30-31 XGMII (10G) interface */	113	#define IF_MODE_10G 0x00000000 /* 30-31 10G interface */
114	#define IF_MODE_GMII 0x00000002 /* 30-31 GMII (1G) interface */	114	#define IF_MODE_GMII 0x00000002 /* 30-31 GMII (1G) interface */
115	#define IF_MODE_RGMII 0x00000004	115	#define IF_MODE_RGMII 0x00000004
116	#define IF_MODE_RGMII_AUTO 0x00008000	116	#define IF_MODE_RGMII_AUTO 0x00008000
@@ -440,7 +440,7 @@ static int init(struct memac_regs __iomem regs, struct memac_cfg cfg, · 323 unmodified lines
440	tmp = 0;	440	tmp = 0;
441	switch (phy_if) {	441	switch (phy_if) {
442	case PHY_INTERFACE_MODE_XGMII:	442	case PHY_INTERFACE_MODE_XGMII:
443	tmp \|= IF_MODE_XGMII;	443	tmp \|= IF_MODE_10G;
444	break;	444	break;
445	default:	445	default:
446	tmp \|= IF_MODE_GMII;	446	tmp \|= IF_MODE_GMII;

drivers/net/ethernet/freescale/xgmac_mdio.c+6−1

 struct mdio_fsl_priv {
 	struct	tgec_mdio_controller __iomem *mdio_base;
 	bool	is_little_endian;
+	bool	has_a011043;
 };
 static u32 xgmac_read32(void __iomem *regs,
 		return ret;
 	/* Return all Fs if nothing was there */
-	if (xgmac_read32(&regs->mdio_stat, endian) & MDIO_STAT_RD_ER) {
+	if ((xgmac_read32(&regs->mdio_stat, endian) & MDIO_STAT_RD_ER) &&
+	    !priv->has_a011043) {
 		dev_err(&bus->dev,
 			"Error while reading PHY%d reg at %d.%hhu\n",
 			phy_id, dev_addr, regnum);
 	priv->is_little_endian = of_property_read_bool(pdev->dev.of_node,
 						       "little-endian");
+	priv->has_a011043 = of_property_read_bool(pdev->dev.of_node,
+						  "fsl,erratum-a011043");
 	ret = of_mdiobus_register(bus, np);
 	if (ret) {
 		dev_err(&pdev->dev, "cannot register MDIO bus\n");

drivers/net/ethernet/intel/i40e/i40e_common.c+1−1

@@ -1113,7 +1113,7 @@ i40e_status i40e_read_pba_string(struct i40e_hw hw, u8 pba_num, · 1112 unmodified lines
1113	*/	1113	*/
1114	pba_size--;	1114	pba_size--;
1115	if (pba_num_size < (((u32)pba_size * 2) + 1)) {	1115	if (pba_num_size < (((u32)pba_size * 2) + 1)) {
1116	hw_dbg(hw, "Buffer to small for PBA data.\n");	1116	hw_dbg(hw, "Buffer too small for PBA data.\n");
1117	return I40E_ERR_PARAM;	1117	return I40E_ERR_PARAM;
1118	}	1118	}
1119		1119

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c+29−20

 struct tx_sync_info {
 	u64 rcd_sn;
-	s32 sync_len;
+	u32 sync_len;
 	int nr_frags;
 	skb_frag_t frags[MAX_SKB_FRAGS];
 };
 static enum mlx5e_ktls_sync_retval
 tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx,
-		 u32 tcp_seq, struct tx_sync_info *info)
+		 u32 tcp_seq, int datalen, struct tx_sync_info *info)
 {
 	struct tls_offload_context_tx *tx_ctx = priv_tx->tx_ctx;
 	enum mlx5e_ktls_sync_retval ret = MLX5E_KTLS_SYNC_DONE;
 	struct tls_record_info *record;
 	int remaining, i = 0;
 	unsigned long flags;
+	bool ends_before;
 	spin_lock_irqsave(&tx_ctx->lock, flags);
 	record = tls_get_record(tx_ctx, tcp_seq, &info->rcd_sn);
 		goto out;
 	}
-	if (unlikely(tcp_seq < tls_record_start_seq(record))) {
+	/* There are the following cases:
-		ret = tls_record_is_start_marker(record) ?
+	 * 1. packet ends before start marker: bypass offload.
-			MLX5E_KTLS_SYNC_SKIP_NO_DATA : MLX5E_KTLS_SYNC_FAIL;
+	 * 2. packet starts before start marker and ends after it: drop,
+	 *    not supported, breaks contract with kernel.
+	 * 3. packet ends before tls record info starts: drop,
+	 *    this packet was already acknowledged and its record info
+	 *    was released.
+	 */
+	ends_before = before(tcp_seq + datalen, tls_record_start_seq(record));
+	if (unlikely(tls_record_is_start_marker(record))) {
+		ret = ends_before ? MLX5E_KTLS_SYNC_SKIP_NO_DATA : MLX5E_KTLS_SYNC_FAIL;
+		goto out;
+	} else if (ends_before) {
+		ret = MLX5E_KTLS_SYNC_FAIL;
 		goto out;
 	}
 	u8 num_wqebbs;
 	int i = 0;
-	ret = tx_sync_info_get(priv_tx, seq, &info);
+	ret = tx_sync_info_get(priv_tx, seq, datalen, &info);
 	if (unlikely(ret != MLX5E_KTLS_SYNC_DONE)) {
 		if (ret == MLX5E_KTLS_SYNC_SKIP_NO_DATA) {
 			stats->tls_skip_no_sync_data++;
 		goto err_out;
 	}
-	if (unlikely(info.sync_len < 0)) {
-		if (likely(datalen <= -info.sync_len))
-			return MLX5E_KTLS_SYNC_DONE;
-		stats->tls_drop_bypass_req++;
-		goto err_out;
-	}
 	stats->tls_ooo++;
 	tx_post_resync_params(sq, priv_tx, info.rcd_sn);
 	if (unlikely(contig_wqebbs_room < num_wqebbs))
 		mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
-	tx_post_resync_params(sq, priv_tx, info.rcd_sn);
 	for (; i < info.nr_frags; i++) {
 		unsigned int orig_fsz, frag_offset = 0, n = 0;
 		skb_frag_t *f = &info.frags[i];
 		enum mlx5e_ktls_sync_retval ret =
 			mlx5e_ktls_tx_handle_ooo(priv_tx, sq, datalen, seq);
-		if (likely(ret == MLX5E_KTLS_SYNC_DONE))
+		switch (ret) {
+		case MLX5E_KTLS_SYNC_DONE:
 			*wqe = mlx5e_sq_fetch_wqe(sq, sizeof(**wqe), pi);
-		else if (ret == MLX5E_KTLS_SYNC_FAIL)
+			break;
+		case MLX5E_KTLS_SYNC_SKIP_NO_DATA:
+			if (likely(!skb->decrypted))
+				goto out;
+			WARN_ON_ONCE(1);
+			/* fall-through */
+		default: /* MLX5E_KTLS_SYNC_FAIL */
 			goto err_out;
-		else /* ret == MLX5E_KTLS_SYNC_SKIP_NO_DATA */
+		}
-			goto out;
 	}
 	priv_tx->expected_seq = seq + datalen;

drivers/net/ethernet/mellanox/mlx5/core/en_tc.c+7−2

 	u32 rate_mbps;
 	int err;
+	vport_num = rpriv->rep->vport;
+	if (vport_num >= MLX5_VPORT_ECPF) {
+		NL_SET_ERR_MSG_MOD(extack,
+				   "Ingress rate limit is supported only for Eswitch ports connected to VFs");
+		return -EOPNOTSUPP;
+	}
 	esw = priv->mdev->priv.eswitch;
 	/* rate is given in bytes/sec.
 	 * First convert to bits/sec and then round to the nearest mbit/secs.
 	 * 1 mbit/sec.
 	 */
 	rate_mbps = rate ? max_t(u32, (rate * 8 + 500000) / 1000000, 1) : 0;
-	vport_num = rpriv->rep->vport;
 	err = mlx5_esw_modify_vport_rate(esw, vport_num, rate_mbps);
 	if (err)
 		NL_SET_ERR_MSG_MOD(extack, "failed applying action to hardware");

drivers/net/ethernet/mellanox/mlx5/core/eswitch.c+3−1

 	struct mlx5_vport *vport;
 	int i;
-	mlx5_esw_for_each_vf_vport(esw, i, vport, esw->esw_funcs.num_vfs)
+	mlx5_esw_for_each_vf_vport(esw, i, vport, esw->esw_funcs.num_vfs) {
 		memset(&vport->info, 0, sizeof(vport->info));
+		vport->info.link_state = MLX5_VPORT_ADMIN_STATE_AUTO;
+	}
 }
 /* Public E-Switch API */

drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c+9−4

  */
 #define ESW_SIZE (16 * 1024 * 1024)
 const unsigned int ESW_POOLS[4] = { 4 * 1024 * 1024, 1 * 1024 * 1024,
-				    64 * 1024, 4 * 1024 };
+				    64 * 1024, 128 };
 static int
 get_sz_from_pool(struct mlx5_eswitch *esw)
 		return -EINVAL;
 	}
-	mlx5_eswitch_disable(esw, false);
+	mlx5_eswitch_disable(esw, true);
 	mlx5_eswitch_update_num_of_vfs(esw, esw->dev->priv.sriov.num_vfs);
 	err = mlx5_eswitch_enable(esw, MLX5_ESWITCH_OFFLOADS);
 	if (err) {
 int esw_offloads_enable(struct mlx5_eswitch *esw)
 {
-	int err;
+	struct mlx5_vport *vport;
+	int err, i;
 	if (MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, reformat) &&
 	    MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, decap))
 	if (err)
 		goto err_vport_metadata;
+	/* Representor will control the vport link state */
+	mlx5_esw_for_each_vf_vport(esw, i, vport, esw->esw_funcs.num_vfs)
+		vport->info.link_state = MLX5_VPORT_ADMIN_STATE_DOWN;
 	err = mlx5_eswitch_enable_pf_vf_vports(esw, MLX5_VPORT_UC_ADDR_CHANGE);
 	if (err)
 		goto err_vports;
 {
 	int err, err1;
-	mlx5_eswitch_disable(esw, false);
+	mlx5_eswitch_disable(esw, true);
 	err = mlx5_eswitch_enable(esw, MLX5_ESWITCH_LEGACY);
 	if (err) {
 		NL_SET_ERR_MSG_MOD(extack, "Failed setting eswitch to legacy");

drivers/net/ethernet/mellanox/mlx5/core/main.c+1−0

@@ -1563,6 +1563,7 @@ static const struct pci_device_id mlx5_core_pci_table[] = { · 1562 unmodified lines
1563	{ PCI_VDEVICE(MELLANOX, 0x101d) }, /* ConnectX-6 Dx */	1563	{ PCI_VDEVICE(MELLANOX, 0x101d) }, /* ConnectX-6 Dx */
1564	{ PCI_VDEVICE(MELLANOX, 0x101e), MLX5_PCI_DEV_IS_VF}, /* ConnectX Family mlx5Gen Virtual Function */	1564	{ PCI_VDEVICE(MELLANOX, 0x101e), MLX5_PCI_DEV_IS_VF}, /* ConnectX Family mlx5Gen Virtual Function */
1565	{ PCI_VDEVICE(MELLANOX, 0x101f) }, /* ConnectX-6 LX */	1565	{ PCI_VDEVICE(MELLANOX, 0x101f) }, /* ConnectX-6 LX */
		1566	{ PCI_VDEVICE(MELLANOX, 0x1021) }, /* ConnectX-7 */
1566	{ PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */	1567	{ PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */
1567	{ PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */	1568	{ PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */
1568	{ PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */	1569	{ PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */

drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c+2−1

 // SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
 /* Copyright (c) 2019 Mellanox Technologies. */
+#include <linux/smp.h>
 #include "dr_types.h"
 #define QUEUE_SIZE 128
 	if (!in)
 		goto err_cqwq;
-	vector = smp_processor_id() % mlx5_comp_vectors_count(mdev);
+	vector = raw_smp_processor_id() % mlx5_comp_vectors_count(mdev);
 	err = mlx5_vector2eqn(mdev, vector, &eqn, &irqn);
 	if (err) {
 		kvfree(in);

drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c+29−13

 	if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) {
 		list_for_each_entry(dst, &fte->node.children, node.list) {
 			enum mlx5_flow_destination_type type = dst->dest_attr.type;
-			u32 id;
 			if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
 				err = -ENOSPC;
 				goto free_actions;
 			}
-			switch (type) {
+			if (type == MLX5_FLOW_DESTINATION_TYPE_COUNTER)
-			case MLX5_FLOW_DESTINATION_TYPE_COUNTER:
+				continue;
-				id = dst->dest_attr.counter_id;
-				tmp_action =
+			switch (type) {
-					mlx5dr_action_create_flow_counter(id);
-				if (!tmp_action) {
-					err = -ENOMEM;
-					goto free_actions;
-				}
-				fs_dr_actions[fs_dr_num_actions++] = tmp_action;
-				actions[num_actions++] = tmp_action;
-				break;
 			case MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE:
 				tmp_action = create_ft_action(dev, dst);
 				if (!tmp_action) {
 		}
 	}
+	if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_COUNT) {
+		list_for_each_entry(dst, &fte->node.children, node.list) {
+			u32 id;
+			if (dst->dest_attr.type !=
+			    MLX5_FLOW_DESTINATION_TYPE_COUNTER)
+				continue;
+			if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
+				err = -ENOSPC;
+				goto free_actions;
+			}
+			id = dst->dest_attr.counter_id;
+			tmp_action =
+				mlx5dr_action_create_flow_counter(id);
+			if (!tmp_action) {
+				err = -ENOMEM;
+				goto free_actions;
+			}
+			fs_dr_actions[fs_dr_num_actions++] = tmp_action;
+			actions[num_actions++] = tmp_action;
+		}
+	}
 	params.match_sz = match_sz;
 	params.match_buf = (u64 *)fte->val;

drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c+12−4

 #include <linux/string.h>
 #include <linux/rhashtable.h>
 #include <linux/netdevice.h>
+#include <linux/mutex.h>
 #include <net/net_namespace.h>
 #include <net/tc_act/tc_vlan.h>
 	struct mlxsw_sp_fid *dummy_fid;
 	struct rhashtable ruleset_ht;
 	struct list_head rules;
+	struct mutex rules_lock; /* Protects rules list */
 	struct {
 		struct delayed_work dw;
 		unsigned long interval;	/* ms */
 			goto err_ruleset_block_bind;
 	}
+	mutex_lock(&mlxsw_sp->acl->rules_lock);
 	list_add_tail(&rule->list, &mlxsw_sp->acl->rules);
+	mutex_unlock(&mlxsw_sp->acl->rules_lock);
 	block->rule_count++;
 	block->egress_blocker_rule_count += rule->rulei->egress_bind_blocker;
 	return 0;
 	block->egress_blocker_rule_count -= rule->rulei->egress_bind_blocker;
 	ruleset->ht_key.block->rule_count--;
+	mutex_lock(&mlxsw_sp->acl->rules_lock);
 	list_del(&rule->list);
+	mutex_unlock(&mlxsw_sp->acl->rules_lock);
 	if (!ruleset->ht_key.chain_index &&
 	    mlxsw_sp_acl_ruleset_is_singular(ruleset))
 		mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset,
 	struct mlxsw_sp_acl_rule *rule;
 	int err;
-	/* Protect internal structures from changes */
+	mutex_lock(&acl->rules_lock);
-	rtnl_lock();
 	list_for_each_entry(rule, &acl->rules, list) {
 		err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp,
 							rule);
 		if (err)
 			goto err_rule_update;
 	}
-	rtnl_unlock();
+	mutex_unlock(&acl->rules_lock);
 	return 0;
 err_rule_update:
-	rtnl_unlock();
+	mutex_unlock(&acl->rules_lock);
 	return err;
 }
 	acl->dummy_fid = fid;
 	INIT_LIST_HEAD(&acl->rules);
+	mutex_init(&acl->rules_lock);
 	err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam);
 	if (err)
 		goto err_acl_ops_init;
 	return 0;
 err_acl_ops_init:
+	mutex_destroy(&acl->rules_lock);
 	mlxsw_sp_fid_put(fid);
 err_fid_get:
 	rhashtable_destroy(&acl->ruleset_ht);
 	cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw);
 	mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam);
+	mutex_destroy(&acl->rules_lock);
 	WARN_ON(!list_empty(&acl->rules));
 	mlxsw_sp_fid_put(acl->dummy_fid);
 	rhashtable_destroy(&acl->ruleset_ht);

drivers/net/ethernet/natsemi/sonic.c+230−150

@@ -64,6 +64,8 @@ static int sonic_open(struct net_device *dev) · 63 unmodified lines
64		64
65	netif_dbg(lp, ifup, dev, "%s: initializing sonic driver\n", __func__);	65	netif_dbg(lp, ifup, dev, "%s: initializing sonic driver\n", __func__);
66		66
		67	spin_lock_init(&lp->lock);
		68
67	for (i = 0; i < SONIC_NUM_RRS; i++) {	69	for (i = 0; i < SONIC_NUM_RRS; i++) {
68	struct sk_buff *skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2);	70	struct sk_buff *skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2);
69	if (skb == NULL) {	71	if (skb == NULL) {
@@ -114,6 +116,24 @@ static int sonic_open(struct net_device *dev) · 44 unmodified lines
114	return 0;	116	return 0;
115	}	117	}
116		118
		119	/* Wait for the SONIC to become idle. */
		120	static void sonic_quiesce(struct net_device *dev, u16 mask)
		121	{
		122	struct sonic_local * __maybe_unused lp = netdev_priv(dev);
		123	int i;
		124	u16 bits;
		125
		126	for (i = 0; i < 1000; ++i) {
		127	bits = SONIC_READ(SONIC_CMD) & mask;
		128	if (!bits)
		129	return;
		130	if (irqs_disabled() \|\| in_interrupt())
		131	udelay(20);
		132	else
		133	usleep_range(100, 200);
		134	}
		135	WARN_ONCE(1, "command deadline expired! 0x%04x\n", bits);
		136	}
117		137
118	/*	138	/*
119	* Close the SONIC device	139	* Close the SONIC device
@@ -130,6 +150,9 @@ static int sonic_close(struct net_device *dev) · 10 unmodified lines
130	/*	150	/*
131	* stop the SONIC, disable interrupts	151	* stop the SONIC, disable interrupts
132	*/	152	*/
		153	SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS);
		154	sonic_quiesce(dev, SONIC_CR_ALL);
		155
133	SONIC_WRITE(SONIC_IMR, 0);	156	SONIC_WRITE(SONIC_IMR, 0);
134	SONIC_WRITE(SONIC_ISR, 0x7fff);	157	SONIC_WRITE(SONIC_ISR, 0x7fff);
135	SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);	158	SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
@@ -169,6 +192,9 @@ static void sonic_tx_timeout(struct net_device *dev) · 33 unmodified lines
169	* put the Sonic into software-reset mode and	192	* put the Sonic into software-reset mode and
170	* disable all interrupts before releasing DMA buffers	193	* disable all interrupts before releasing DMA buffers
171	*/	194	*/
		195	SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS);
		196	sonic_quiesce(dev, SONIC_CR_ALL);
		197
172	SONIC_WRITE(SONIC_IMR, 0);	198	SONIC_WRITE(SONIC_IMR, 0);
173	SONIC_WRITE(SONIC_ISR, 0x7fff);	199	SONIC_WRITE(SONIC_ISR, 0x7fff);
174	SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);	200	SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
@@ -206,8 +232,6 @@ static void sonic_tx_timeout(struct net_device *dev) · 31 unmodified lines
206	* wake the tx queue	232	* wake the tx queue
207	* Concurrently with all of this, the SONIC is potentially writing to	233	* Concurrently with all of this, the SONIC is potentially writing to
208	* the status flags of the TDs.	234	* the status flags of the TDs.
209	* Until some mutual exclusion is added, this code will not work with SMP. However,
210	* MIPS Jazz machines and m68k Macs were all uni-processor machines.
211	*/	235	*/
212		236
213	static int sonic_send_packet(struct sk_buff skb, struct net_device dev)	237	static int sonic_send_packet(struct sk_buff skb, struct net_device dev)
@@ -215,7 +239,8 @@ static int sonic_send_packet(struct sk_buff skb, struct net_device dev) · 1 unmodified line
215	struct sonic_local *lp = netdev_priv(dev);	239	struct sonic_local *lp = netdev_priv(dev);
216	dma_addr_t laddr;	240	dma_addr_t laddr;
217	int length;	241	int length;
218	int entry = lp->next_tx;	242	int entry;
		243	unsigned long flags;
219		244
220	netif_dbg(lp, tx_queued, dev, "%s: skb=%p\n", __func__, skb);	245	netif_dbg(lp, tx_queued, dev, "%s: skb=%p\n", __func__, skb);
221		246
@@ -237,6 +262,10 @@ static int sonic_send_packet(struct sk_buff skb, struct net_device dev) · 15 unmodified lines
237	return NETDEV_TX_OK;	262	return NETDEV_TX_OK;
238	}	263	}
239		264
		265	spin_lock_irqsave(&lp->lock, flags);
		266
		267	entry = lp->next_tx;
		268
240	sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */	269	sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */
241	sonic_tda_put(dev, entry, SONIC_TD_FRAG_COUNT, 1); /* single fragment */	270	sonic_tda_put(dev, entry, SONIC_TD_FRAG_COUNT, 1); /* single fragment */
242	sonic_tda_put(dev, entry, SONIC_TD_PKTSIZE, length); /* length of packet */	271	sonic_tda_put(dev, entry, SONIC_TD_PKTSIZE, length); /* length of packet */
@@ -246,10 +275,6 @@ static int sonic_send_packet(struct sk_buff skb, struct net_device dev) · 3 unmodified lines
246	sonic_tda_put(dev, entry, SONIC_TD_LINK,	275	sonic_tda_put(dev, entry, SONIC_TD_LINK,
247	sonic_tda_get(dev, entry, SONIC_TD_LINK) \| SONIC_EOL);	276	sonic_tda_get(dev, entry, SONIC_TD_LINK) \| SONIC_EOL);
248		277
249	/*
250	* Must set tx_skb[entry] only after clearing status, and
251	* before clearing EOL and before stopping queue
252	*/
253	wmb();	278	wmb();
254	lp->tx_len[entry] = length;	279	lp->tx_len[entry] = length;
255	lp->tx_laddr[entry] = laddr;	280	lp->tx_laddr[entry] = laddr;
@@ -272,6 +297,8 @@ static int sonic_send_packet(struct sk_buff skb, struct net_device dev) · 16 unmodified lines
272		297
273	SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP);	298	SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP);
274		299
		300	spin_unlock_irqrestore(&lp->lock, flags);
		301
275	return NETDEV_TX_OK;	302	return NETDEV_TX_OK;
276	}	303	}
277		304
@@ -284,15 +311,28 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) · 6 unmodified lines
284	struct net_device *dev = dev_id;	311	struct net_device *dev = dev_id;
285	struct sonic_local *lp = netdev_priv(dev);	312	struct sonic_local *lp = netdev_priv(dev);
286	int status;	313	int status;
		314	unsigned long flags;
		315
		316	/* The lock has two purposes. Firstly, it synchronizes sonic_interrupt()
		317	* with sonic_send_packet() so that the two functions can share state.
		318	* Secondly, it makes sonic_interrupt() re-entrant, as that is required
		319	* by macsonic which must use two IRQs with different priority levels.
		320	*/
		321	spin_lock_irqsave(&lp->lock, flags);
		322
		323	status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT;
		324	if (!status) {
		325	spin_unlock_irqrestore(&lp->lock, flags);
287		326
288	if (!(status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT))
289	return IRQ_NONE;	327	return IRQ_NONE;
		328	}
290		329
291	do {	330	do {
		331	SONIC_WRITE(SONIC_ISR, status); /* clear the interrupt(s) */
		332
292	if (status & SONIC_INT_PKTRX) {	333	if (status & SONIC_INT_PKTRX) {
293	netif_dbg(lp, intr, dev, "%s: packet rx\n", __func__);	334	netif_dbg(lp, intr, dev, "%s: packet rx\n", __func__);
294	sonic_rx(dev); /* got packet(s) */	335	sonic_rx(dev); /* got packet(s) */
295	SONIC_WRITE(SONIC_ISR, SONIC_INT_PKTRX); /* clear the interrupt */
296	}	336	}
297		337
298	if (status & SONIC_INT_TXDN) {	338	if (status & SONIC_INT_TXDN) {
@@ -300,11 +340,12 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) · 1 unmodified line
300	int td_status;	340	int td_status;
301	int freed_some = 0;	341	int freed_some = 0;
302		342
303	/* At this point, cur_tx is the index of a TD that is one of:	343	/* The state of a Transmit Descriptor may be inferred
304	* unallocated/freed (status set & tx_skb[entry] clear)	344	* from { tx_skb[entry], td_status } as follows.
305	* allocated and sent (status set & tx_skb[entry] set )	345	* { clear, clear } => the TD has never been used
306	* allocated and not yet sent (status clear & tx_skb[entry] set )	346	* { set, clear } => the TD was handed to SONIC
307	* still being allocated by sonic_send_packet (status clear & tx_skb[entry] clear)	347	* { set, set } => the TD was handed back
		348	* { clear, set } => the TD is available for re-use
308	*/	349	*/
309		350
310	netif_dbg(lp, intr, dev, "%s: tx done\n", __func__);	351	netif_dbg(lp, intr, dev, "%s: tx done\n", __func__);
@@ -313,18 +354,19 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) · 2 unmodified lines
313	if ((td_status = sonic_tda_get(dev, entry, SONIC_TD_STATUS)) == 0)	354	if ((td_status = sonic_tda_get(dev, entry, SONIC_TD_STATUS)) == 0)
314	break;	355	break;
315		356
316	if (td_status & 0x0001) {	357	if (td_status & SONIC_TCR_PTX) {
317	lp->stats.tx_packets++;	358	lp->stats.tx_packets++;
318	lp->stats.tx_bytes += sonic_tda_get(dev, entry, SONIC_TD_PKTSIZE);	359	lp->stats.tx_bytes += sonic_tda_get(dev, entry, SONIC_TD_PKTSIZE);
319	} else {	360	} else {
320	lp->stats.tx_errors++;	361	if (td_status & (SONIC_TCR_EXD \|
321	if (td_status & 0x0642)	362	SONIC_TCR_EXC \| SONIC_TCR_BCM))
322	lp->stats.tx_aborted_errors++;	363	lp->stats.tx_aborted_errors++;
323	if (td_status & 0x0180)	364	if (td_status &
		365	(SONIC_TCR_NCRS \| SONIC_TCR_CRLS))
324	lp->stats.tx_carrier_errors++;	366	lp->stats.tx_carrier_errors++;
325	if (td_status & 0x0020)	367	if (td_status & SONIC_TCR_OWC)
326	lp->stats.tx_window_errors++;	368	lp->stats.tx_window_errors++;
327	if (td_status & 0x0004)	369	if (td_status & SONIC_TCR_FU)
328	lp->stats.tx_fifo_errors++;	370	lp->stats.tx_fifo_errors++;
329	}	371	}
330		372
@@ -346,7 +388,6 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) · 15 unmodified lines
346	if (freed_some \|\| lp->tx_skb[entry] == NULL)	388	if (freed_some \|\| lp->tx_skb[entry] == NULL)
347	netif_wake_queue(dev); /* The ring is no longer full */	389	netif_wake_queue(dev); /* The ring is no longer full */
348	lp->cur_tx = entry;	390	lp->cur_tx = entry;
349	SONIC_WRITE(SONIC_ISR, SONIC_INT_TXDN); /* clear the interrupt */
350	}	391	}
351		392
352	/*	393	/*
@@ -355,42 +396,37 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) · 2 unmodified lines
355	if (status & SONIC_INT_RFO) {	396	if (status & SONIC_INT_RFO) {
356	netif_dbg(lp, rx_err, dev, "%s: rx fifo overrun\n",	397	netif_dbg(lp, rx_err, dev, "%s: rx fifo overrun\n",
357	__func__);	398	__func__);
358	lp->stats.rx_fifo_errors++;
359	SONIC_WRITE(SONIC_ISR, SONIC_INT_RFO); /* clear the interrupt */
360	}	399	}
361	if (status & SONIC_INT_RDE) {	400	if (status & SONIC_INT_RDE) {
362	netif_dbg(lp, rx_err, dev, "%s: rx descriptors exhausted\n",	401	netif_dbg(lp, rx_err, dev, "%s: rx descriptors exhausted\n",
363	__func__);	402	__func__);
364	lp->stats.rx_dropped++;
365	SONIC_WRITE(SONIC_ISR, SONIC_INT_RDE); /* clear the interrupt */
366	}	403	}
367	if (status & SONIC_INT_RBAE) {	404	if (status & SONIC_INT_RBAE) {
368	netif_dbg(lp, rx_err, dev, "%s: rx buffer area exceeded\n",	405	netif_dbg(lp, rx_err, dev, "%s: rx buffer area exceeded\n",
369	__func__);	406	__func__);
370	lp->stats.rx_dropped++;
371	SONIC_WRITE(SONIC_ISR, SONIC_INT_RBAE); /* clear the interrupt */
372	}	407	}
373		408
374	/* counter overruns; all counters are 16bit wide */	409	/* counter overruns; all counters are 16bit wide */
375	if (status & SONIC_INT_FAE) {	410	if (status & SONIC_INT_FAE)
376	lp->stats.rx_frame_errors += 65536;	411	lp->stats.rx_frame_errors += 65536;
377	SONIC_WRITE(SONIC_ISR, SONIC_INT_FAE); /* clear the interrupt */	412	if (status & SONIC_INT_CRC)
378	}
379	if (status & SONIC_INT_CRC) {
380	lp->stats.rx_crc_errors += 65536;	413	lp->stats.rx_crc_errors += 65536;
381	SONIC_WRITE(SONIC_ISR, SONIC_INT_CRC); /* clear the interrupt */	414	if (status & SONIC_INT_MP)
382	}
383	if (status & SONIC_INT_MP) {
384	lp->stats.rx_missed_errors += 65536;	415	lp->stats.rx_missed_errors += 65536;
385	SONIC_WRITE(SONIC_ISR, SONIC_INT_MP); /* clear the interrupt */
386	}
387		416
388	/* transmit error */	417	/* transmit error */
389	if (status & SONIC_INT_TXER) {	418	if (status & SONIC_INT_TXER) {
390	if (SONIC_READ(SONIC_TCR) & SONIC_TCR_FU)	419	u16 tcr = SONIC_READ(SONIC_TCR);
391	netif_dbg(lp, tx_err, dev, "%s: tx fifo underrun\n",	420
392	__func__);	421	netif_dbg(lp, tx_err, dev, "%s: TXER intr, TCR %04x\n",
393	SONIC_WRITE(SONIC_ISR, SONIC_INT_TXER); /* clear the interrupt */	422	__func__, tcr);
		423
		424	if (tcr & (SONIC_TCR_EXD \| SONIC_TCR_EXC \|
		425	SONIC_TCR_FU \| SONIC_TCR_BCM)) {
		426	/* Aborted transmission. Try again. */
		427	netif_stop_queue(dev);
		428	SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP);
		429	}
394	}	430	}
395		431
396	/* bus retry */	432	/* bus retry */
@@ -400,107 +436,164 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id) · 3 unmodified lines
400	/* ... to help debug DMA problems causing endless interrupts. */	436	/* ... to help debug DMA problems causing endless interrupts. */
401	/* Bounce the eth interface to turn on the interrupt again. */	437	/* Bounce the eth interface to turn on the interrupt again. */
402	SONIC_WRITE(SONIC_IMR, 0);	438	SONIC_WRITE(SONIC_IMR, 0);
403	SONIC_WRITE(SONIC_ISR, SONIC_INT_BR); /* clear the interrupt */
404	}	439	}
405		440
406	/* load CAM done */	441	status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT;
407	if (status & SONIC_INT_LCD)	442	} while (status);
408	SONIC_WRITE(SONIC_ISR, SONIC_INT_LCD); /* clear the interrupt */	443
409	} while((status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT));	444	spin_unlock_irqrestore(&lp->lock, flags);
		445
410	return IRQ_HANDLED;	446	return IRQ_HANDLED;
411	}	447	}
412		448
		449	/* Return the array index corresponding to a given Receive Buffer pointer. */
		450	static int index_from_addr(struct sonic_local *lp, dma_addr_t addr,
		451	unsigned int last)
		452	{
		453	unsigned int i = last;
		454
		455	do {
		456	i = (i + 1) & SONIC_RRS_MASK;
		457	if (addr == lp->rx_laddr[i])
		458	return i;
		459	} while (i != last);
		460
		461	return -ENOENT;
		462	}
		463
		464	/* Allocate and map a new skb to be used as a receive buffer. */
		465	static bool sonic_alloc_rb(struct net_device dev, struct sonic_local lp,
		466	struct sk_buff *new_skb, dma_addr_t new_addr)
		467	{
		468	*new_skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2);
		469	if (!*new_skb)
		470	return false;
		471
		472	if (SONIC_BUS_SCALE(lp->dma_bitmode) == 2)
		473	skb_reserve(*new_skb, 2);
		474
		475	new_addr = dma_map_single(lp->device, skb_put(new_skb, SONIC_RBSIZE),
		476	SONIC_RBSIZE, DMA_FROM_DEVICE);
		477	if (!*new_addr) {
		478	dev_kfree_skb(*new_skb);
		479	*new_skb = NULL;
		480	return false;
		481	}
		482
		483	return true;
		484	}
		485
		486	/* Place a new receive resource in the Receive Resource Area and update RWP. */
		487	static void sonic_update_rra(struct net_device dev, struct sonic_local lp,
		488	dma_addr_t old_addr, dma_addr_t new_addr)
		489	{
		490	unsigned int entry = sonic_rr_entry(dev, SONIC_READ(SONIC_RWP));
		491	unsigned int end = sonic_rr_entry(dev, SONIC_READ(SONIC_RRP));
		492	u32 buf;
		493
		494	/* The resources in the range [RRP, RWP) belong to the SONIC. This loop
		495	* scans the other resources in the RRA, those in the range [RWP, RRP).
		496	*/
		497	do {
		498	buf = (sonic_rra_get(dev, entry, SONIC_RR_BUFADR_H) << 16) \|
		499	sonic_rra_get(dev, entry, SONIC_RR_BUFADR_L);
		500
		501	if (buf == old_addr)
		502	break;
		503
		504	entry = (entry + 1) & SONIC_RRS_MASK;
		505	} while (entry != end);
		506
		507	WARN_ONCE(buf != old_addr, "failed to find resource!\n");
		508
		509	sonic_rra_put(dev, entry, SONIC_RR_BUFADR_H, new_addr >> 16);
		510	sonic_rra_put(dev, entry, SONIC_RR_BUFADR_L, new_addr & 0xffff);
		511
		512	entry = (entry + 1) & SONIC_RRS_MASK;
		513
		514	SONIC_WRITE(SONIC_RWP, sonic_rr_addr(dev, entry));
		515	}
		516
413	/*	517	/*
414	* We have a good packet(s), pass it/them up the network stack.	518	* We have a good packet(s), pass it/them up the network stack.
415	*/	519	*/
416	static void sonic_rx(struct net_device *dev)	520	static void sonic_rx(struct net_device *dev)
417	{	521	{
418	struct sonic_local *lp = netdev_priv(dev);	522	struct sonic_local *lp = netdev_priv(dev);
419	int status;
420	int entry = lp->cur_rx;	523	int entry = lp->cur_rx;
		524	int prev_entry = lp->eol_rx;
		525	bool rbe = false;
421		526
422	while (sonic_rda_get(dev, entry, SONIC_RD_IN_USE) == 0) {	527	while (sonic_rda_get(dev, entry, SONIC_RD_IN_USE) == 0) {
423	struct sk_buff *used_skb;	528	u16 status = sonic_rda_get(dev, entry, SONIC_RD_STATUS);
424	struct sk_buff *new_skb;	529
425	dma_addr_t new_laddr;	530	/* If the RD has LPKT set, the chip has finished with the RB */
426	u16 bufadr_l;	531	if ((status & SONIC_RCR_PRX) && (status & SONIC_RCR_LPKT)) {
427	u16 bufadr_h;	532	struct sk_buff *new_skb;
428	int pkt_len;	533	dma_addr_t new_laddr;
429		534	u32 addr = (sonic_rda_get(dev, entry,
430	status = sonic_rda_get(dev, entry, SONIC_RD_STATUS);	535	SONIC_RD_PKTPTR_H) << 16) \|
431	if (status & SONIC_RCR_PRX) {	536	sonic_rda_get(dev, entry, SONIC_RD_PKTPTR_L);
432	/* Malloc up new buffer. */	537	int i = index_from_addr(lp, addr, entry);
433	new_skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2);	538
434	if (new_skb == NULL) {	539	if (i < 0) {
435	lp->stats.rx_dropped++;	540	WARN_ONCE(1, "failed to find buffer!\n");
436	break;	541	break;
437	}	542	}
438	/* provide 16 byte IP header alignment unless DMA requires otherwise */	543
439	if(SONIC_BUS_SCALE(lp->dma_bitmode) == 2)	544	if (sonic_alloc_rb(dev, lp, &new_skb, &new_laddr)) {
440	skb_reserve(new_skb, 2);	545	struct sk_buff *used_skb = lp->rx_skb[i];
441		546	int pkt_len;
442	new_laddr = dma_map_single(lp->device, skb_put(new_skb, SONIC_RBSIZE),	547
443	SONIC_RBSIZE, DMA_FROM_DEVICE);	548	/* Pass the used buffer up the stack */
444	if (!new_laddr) {	549	dma_unmap_single(lp->device, addr, SONIC_RBSIZE,
445	dev_kfree_skb(new_skb);	550	DMA_FROM_DEVICE);
446	printk(KERN_ERR "%s: Failed to map rx buffer, dropping packet.\n", dev->name);	551
		552	pkt_len = sonic_rda_get(dev, entry,
		553	SONIC_RD_PKTLEN);
		554	skb_trim(used_skb, pkt_len);
		555	used_skb->protocol = eth_type_trans(used_skb,
		556	dev);
		557	netif_rx(used_skb);
		558	lp->stats.rx_packets++;
		559	lp->stats.rx_bytes += pkt_len;
		560
		561	lp->rx_skb[i] = new_skb;
		562	lp->rx_laddr[i] = new_laddr;
		563	} else {
		564	/* Failed to obtain a new buffer so re-use it */
		565	new_laddr = addr;
447	lp->stats.rx_dropped++;	566	lp->stats.rx_dropped++;
448	break;
449	}	567	}
450		568	/* If RBE is already asserted when RWP advances then
451	/* now we have a new skb to replace it, pass the used one up the stack */	569	* it's safe to clear RBE after processing this packet.
452	dma_unmap_single(lp->device, lp->rx_laddr[entry], SONIC_RBSIZE, DMA_FROM_DEVICE);
453	used_skb = lp->rx_skb[entry];
454	pkt_len = sonic_rda_get(dev, entry, SONIC_RD_PKTLEN);
455	skb_trim(used_skb, pkt_len);
456	used_skb->protocol = eth_type_trans(used_skb, dev);
457	netif_rx(used_skb);
458	lp->stats.rx_packets++;
459	lp->stats.rx_bytes += pkt_len;
460
461	/* and insert the new skb */
462	lp->rx_laddr[entry] = new_laddr;
463	lp->rx_skb[entry] = new_skb;
464
465	bufadr_l = (unsigned long)new_laddr & 0xffff;
466	bufadr_h = (unsigned long)new_laddr >> 16;
467	sonic_rra_put(dev, entry, SONIC_RR_BUFADR_L, bufadr_l);
468	sonic_rra_put(dev, entry, SONIC_RR_BUFADR_H, bufadr_h);
469	} else {
470	/* This should only happen, if we enable accepting broken packets. */
471	lp->stats.rx_errors++;
472	if (status & SONIC_RCR_FAER)
473	lp->stats.rx_frame_errors++;
474	if (status & SONIC_RCR_CRCR)
475	lp->stats.rx_crc_errors++;
476	}
477	if (status & SONIC_RCR_LPKT) {
478	/*
479	* this was the last packet out of the current receive buffer
480	* give the buffer back to the SONIC
481	*/	570	*/
482	lp->cur_rwp += SIZEOF_SONIC_RR * SONIC_BUS_SCALE(lp->dma_bitmode);	571	rbe = rbe \|\| SONIC_READ(SONIC_ISR) & SONIC_INT_RBE;
483	if (lp->cur_rwp >= lp->rra_end) lp->cur_rwp = lp->rra_laddr & 0xffff;	572	sonic_update_rra(dev, lp, addr, new_laddr);
484	SONIC_WRITE(SONIC_RWP, lp->cur_rwp);	573	}
485	if (SONIC_READ(SONIC_ISR) & SONIC_INT_RBE) {
486	netif_dbg(lp, rx_err, dev, "%s: rx buffer exhausted\n",
487	__func__);
488	SONIC_WRITE(SONIC_ISR, SONIC_INT_RBE); /* clear the flag */
489	}
490	} else
491	printk(KERN_ERR "%s: rx desc without RCR_LPKT. Shouldn't happen !?\n",
492	dev->name);
493	/*	574	/*
494	* give back the descriptor	575	* give back the descriptor
495	*/	576	*/
496	sonic_rda_put(dev, entry, SONIC_RD_LINK,	577	sonic_rda_put(dev, entry, SONIC_RD_STATUS, 0);
497	sonic_rda_get(dev, entry, SONIC_RD_LINK) \| SONIC_EOL);
498	sonic_rda_put(dev, entry, SONIC_RD_IN_USE, 1);	578	sonic_rda_put(dev, entry, SONIC_RD_IN_USE, 1);
499	sonic_rda_put(dev, lp->eol_rx, SONIC_RD_LINK,	579
500	sonic_rda_get(dev, lp->eol_rx, SONIC_RD_LINK) & ~SONIC_EOL);	580	prev_entry = entry;
501	lp->eol_rx = entry;	581	entry = (entry + 1) & SONIC_RDS_MASK;
502	lp->cur_rx = entry = (entry + 1) & SONIC_RDS_MASK;	582	}
		583
		584	lp->cur_rx = entry;
		585
		586	if (prev_entry != lp->eol_rx) {
		587	/* Advance the EOL flag to put descriptors back into service */
		588	sonic_rda_put(dev, prev_entry, SONIC_RD_LINK, SONIC_EOL \|
		589	sonic_rda_get(dev, prev_entry, SONIC_RD_LINK));
		590	sonic_rda_put(dev, lp->eol_rx, SONIC_RD_LINK, ~SONIC_EOL &
		591	sonic_rda_get(dev, lp->eol_rx, SONIC_RD_LINK));
		592	lp->eol_rx = prev_entry;
503	}	593	}
		594
		595	if (rbe)
		596	SONIC_WRITE(SONIC_ISR, SONIC_INT_RBE);
504	/*	597	/*
505	* If any worth-while packets have been received, netif_rx()	598	* If any worth-while packets have been received, netif_rx()
506	* has done a mark_bh(NET_BH) for us and will work on them	599	* has done a mark_bh(NET_BH) for us and will work on them
@@ -550,6 +643,8 @@ static void sonic_multicast_list(struct net_device *dev) · 43 unmodified lines
550	(netdev_mc_count(dev) > 15)) {	643	(netdev_mc_count(dev) > 15)) {
551	rcr \|= SONIC_RCR_AMC;	644	rcr \|= SONIC_RCR_AMC;
552	} else {	645	} else {
		646	unsigned long flags;
		647
553	netif_dbg(lp, ifup, dev, "%s: mc_count %d\n", __func__,	648	netif_dbg(lp, ifup, dev, "%s: mc_count %d\n", __func__,
554	netdev_mc_count(dev));	649	netdev_mc_count(dev));
555	sonic_set_cam_enable(dev, 1); /* always enable our own address */	650	sonic_set_cam_enable(dev, 1); /* always enable our own address */
@@ -563,9 +658,14 @@ static void sonic_multicast_list(struct net_device *dev) · 7 unmodified lines
563	i++;	658	i++;
564	}	659	}
565	SONIC_WRITE(SONIC_CDC, 16);	660	SONIC_WRITE(SONIC_CDC, 16);
566	/* issue Load CAM command */
567	SONIC_WRITE(SONIC_CDP, lp->cda_laddr & 0xffff);	661	SONIC_WRITE(SONIC_CDP, lp->cda_laddr & 0xffff);
		662
		663	/* LCAM and TXP commands can't be used simultaneously */
		664	spin_lock_irqsave(&lp->lock, flags);
		665	sonic_quiesce(dev, SONIC_CR_TXP);
568	SONIC_WRITE(SONIC_CMD, SONIC_CR_LCAM);	666	SONIC_WRITE(SONIC_CMD, SONIC_CR_LCAM);
		667	sonic_quiesce(dev, SONIC_CR_LCAM);
		668	spin_unlock_irqrestore(&lp->lock, flags);
569	}	669	}
570	}	670	}
571		671
@@ -580,7 +680,6 @@ static void sonic_multicast_list(struct net_device *dev) · 8 unmodified lines
580	*/	680	*/
581	static int sonic_init(struct net_device *dev)	681	static int sonic_init(struct net_device *dev)
582	{	682	{
583	unsigned int cmd;
584	struct sonic_local *lp = netdev_priv(dev);	683	struct sonic_local *lp = netdev_priv(dev);
585	int i;	684	int i;
586		685
@@ -592,12 +691,16 @@ static int sonic_init(struct net_device *dev) · 5 unmodified lines
592	SONIC_WRITE(SONIC_ISR, 0x7fff);	691	SONIC_WRITE(SONIC_ISR, 0x7fff);
593	SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);	692	SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
594		693
		694	/* While in reset mode, clear CAM Enable register */
		695	SONIC_WRITE(SONIC_CE, 0);
		696
595	/*	697	/*
596	* clear software reset flag, disable receiver, clear and	698	* clear software reset flag, disable receiver, clear and
597	* enable interrupts, then completely initialize the SONIC	699	* enable interrupts, then completely initialize the SONIC
598	*/	700	*/
599	SONIC_WRITE(SONIC_CMD, 0);	701	SONIC_WRITE(SONIC_CMD, 0);
600	SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS);	702	SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS \| SONIC_CR_STP);
		703	sonic_quiesce(dev, SONIC_CR_ALL);
601		704
602	/*	705	/*
603	* initialize the receive resource area	706	* initialize the receive resource area
@@ -615,15 +718,10 @@ static int sonic_init(struct net_device *dev) · 11 unmodified lines
615	}	718	}
616		719
617	/* initialize all RRA registers */	720	/* initialize all RRA registers */
618	lp->rra_end = (lp->rra_laddr + SONIC_NUM_RRS * SIZEOF_SONIC_RR *	721	SONIC_WRITE(SONIC_RSA, sonic_rr_addr(dev, 0));
619	SONIC_BUS_SCALE(lp->dma_bitmode)) & 0xffff;	722	SONIC_WRITE(SONIC_REA, sonic_rr_addr(dev, SONIC_NUM_RRS));
620	lp->cur_rwp = (lp->rra_laddr + (SONIC_NUM_RRS - 1) * SIZEOF_SONIC_RR *	723	SONIC_WRITE(SONIC_RRP, sonic_rr_addr(dev, 0));
621	SONIC_BUS_SCALE(lp->dma_bitmode)) & 0xffff;	724	SONIC_WRITE(SONIC_RWP, sonic_rr_addr(dev, SONIC_NUM_RRS - 1));
622
623	SONIC_WRITE(SONIC_RSA, lp->rra_laddr & 0xffff);
624	SONIC_WRITE(SONIC_REA, lp->rra_end);
625	SONIC_WRITE(SONIC_RRP, lp->rra_laddr & 0xffff);
626	SONIC_WRITE(SONIC_RWP, lp->cur_rwp);
627	SONIC_WRITE(SONIC_URRA, lp->rra_laddr >> 16);	725	SONIC_WRITE(SONIC_URRA, lp->rra_laddr >> 16);
628	SONIC_WRITE(SONIC_EOBC, (SONIC_RBSIZE >> 1) - (lp->dma_bitmode ? 2 : 1));	726	SONIC_WRITE(SONIC_EOBC, (SONIC_RBSIZE >> 1) - (lp->dma_bitmode ? 2 : 1));
629		727
@@ -631,14 +729,7 @@ static int sonic_init(struct net_device *dev) · 1 unmodified line
631	netif_dbg(lp, ifup, dev, "%s: issuing RRRA command\n", __func__);	729	netif_dbg(lp, ifup, dev, "%s: issuing RRRA command\n", __func__);
632		730
633	SONIC_WRITE(SONIC_CMD, SONIC_CR_RRRA);	731	SONIC_WRITE(SONIC_CMD, SONIC_CR_RRRA);
634	i = 0;	732	sonic_quiesce(dev, SONIC_CR_RRRA);
635	while (i++ < 100) {
636	if (SONIC_READ(SONIC_CMD) & SONIC_CR_RRRA)
637	break;
638	}
639
640	netif_dbg(lp, ifup, dev, "%s: status=%x, i=%d\n", __func__,
641	SONIC_READ(SONIC_CMD), i);
642		733
643	/*	734	/*
644	* Initialize the receive descriptors so that they	735	* Initialize the receive descriptors so that they
@@ -713,28 +804,17 @@ static int sonic_init(struct net_device *dev) · 68 unmodified lines
713	* load the CAM	804	* load the CAM
714	*/	805	*/
715	SONIC_WRITE(SONIC_CMD, SONIC_CR_LCAM);	806	SONIC_WRITE(SONIC_CMD, SONIC_CR_LCAM);
716		807	sonic_quiesce(dev, SONIC_CR_LCAM);
717	i = 0;
718	while (i++ < 100) {
719	if (SONIC_READ(SONIC_ISR) & SONIC_INT_LCD)
720	break;
721	}
722	netif_dbg(lp, ifup, dev, "%s: CMD=%x, ISR=%x, i=%d\n", __func__,
723	SONIC_READ(SONIC_CMD), SONIC_READ(SONIC_ISR), i);
724		808
725	/*	809	/*
726	* enable receiver, disable loopback	810	* enable receiver, disable loopback
727	* and enable all interrupts	811	* and enable all interrupts
728	*/	812	*/
729	SONIC_WRITE(SONIC_CMD, SONIC_CR_RXEN \| SONIC_CR_STP);
730	SONIC_WRITE(SONIC_RCR, SONIC_RCR_DEFAULT);	813	SONIC_WRITE(SONIC_RCR, SONIC_RCR_DEFAULT);
731	SONIC_WRITE(SONIC_TCR, SONIC_TCR_DEFAULT);	814	SONIC_WRITE(SONIC_TCR, SONIC_TCR_DEFAULT);
732	SONIC_WRITE(SONIC_ISR, 0x7fff);	815	SONIC_WRITE(SONIC_ISR, 0x7fff);
733	SONIC_WRITE(SONIC_IMR, SONIC_IMR_DEFAULT);	816	SONIC_WRITE(SONIC_IMR, SONIC_IMR_DEFAULT);
734		817	SONIC_WRITE(SONIC_CMD, SONIC_CR_RXEN);
735	cmd = SONIC_READ(SONIC_CMD);
736	if ((cmd & SONIC_CR_RXEN) == 0 \|\| (cmd & SONIC_CR_STP) == 0)
737	printk(KERN_ERR "sonic_init: failed, status=%x\n", cmd);
738		818
739	netif_dbg(lp, ifup, dev, "%s: new status=%x\n", __func__,	819	netif_dbg(lp, ifup, dev, "%s: new status=%x\n", __func__,
740	SONIC_READ(SONIC_CMD));	820	SONIC_READ(SONIC_CMD));

drivers/net/ethernet/natsemi/sonic.h+32−12

 #define SONIC_CR_TXP            0x0002
 #define SONIC_CR_HTX            0x0001
+#define SONIC_CR_ALL (SONIC_CR_LCAM | SONIC_CR_RRRA | \
+		      SONIC_CR_RXEN | SONIC_CR_TXP)
 /*
  * SONIC data configuration bits
  */
 #define SONIC_TCR_NCRS          0x0100
 #define SONIC_TCR_CRLS          0x0080
 #define SONIC_TCR_EXC           0x0040
+#define SONIC_TCR_OWC           0x0020
 #define SONIC_TCR_PMB           0x0008
 #define SONIC_TCR_FU            0x0004
 #define SONIC_TCR_BCM           0x0002
 #define SONIC_NUM_RDS   SONIC_NUM_RRS /* number of receive descriptors */
 #define SONIC_NUM_TDS   16            /* number of transmit descriptors */
-#define SONIC_RDS_MASK  (SONIC_NUM_RDS-1)
+#define SONIC_RRS_MASK  (SONIC_NUM_RRS - 1)
-#define SONIC_TDS_MASK  (SONIC_NUM_TDS-1)
+#define SONIC_RDS_MASK  (SONIC_NUM_RDS - 1)
+#define SONIC_TDS_MASK  (SONIC_NUM_TDS - 1)
 #define SONIC_RBSIZE	1520          /* size of one resource buffer */
 	u32 rda_laddr;              /* logical DMA address of RDA */
 	dma_addr_t rx_laddr[SONIC_NUM_RRS]; /* logical DMA addresses of rx skbuffs */
 	dma_addr_t tx_laddr[SONIC_NUM_TDS]; /* logical DMA addresses of tx skbuffs */
-	unsigned int rra_end;
-	unsigned int cur_rwp;
 	unsigned int cur_rx;
 	unsigned int cur_tx;           /* first unacked transmit packet */
 	unsigned int eol_rx;
 	int msg_enable;
 	struct device *device;         /* generic device */
 	struct net_device_stats stats;
+	spinlock_t lock;
 };
 #define TX_TIMEOUT (3 * HZ)
    as far as we can tell. */
 /* OpenBSD calls this "SWO".  I'd like to think that sonic_buf_put()
    is a much better name. */
-static inline void sonic_buf_put(void* base, int bitmode,
+static inline void sonic_buf_put(u16 *base, int bitmode,
 				 int offset, __u16 val)
 {
 	if (bitmode)
 #ifdef __BIG_ENDIAN
-		((__u16 *) base + (offset*2))[1] = val;
+		__raw_writew(val, base + (offset * 2) + 1);
 #else
-		((__u16 *) base + (offset*2))[0] = val;
+		__raw_writew(val, base + (offset * 2) + 0);
 #endif
 	else
-	 	((__u16 *) base)[offset] = val;
+		__raw_writew(val, base + (offset * 1) + 0);
 }
-static inline __u16 sonic_buf_get(void* base, int bitmode,
+static inline __u16 sonic_buf_get(u16 *base, int bitmode,
 				  int offset)
 {
 	if (bitmode)
 #ifdef __BIG_ENDIAN
-		return ((volatile __u16 *) base + (offset*2))[1];
+		return __raw_readw(base + (offset * 2) + 1);
 #else
-		return ((volatile __u16 *) base + (offset*2))[0];
+		return __raw_readw(base + (offset * 2) + 0);
 #endif
 	else
-		return ((volatile __u16 *) base)[offset];
+		return __raw_readw(base + (offset * 1) + 0);
 }
 /* Inlines that you should actually use for reading/writing DMA buffers */
 			     (entry * SIZEOF_SONIC_RR) + offset);
 }
+static inline u16 sonic_rr_addr(struct net_device *dev, int entry)
+{
+	struct sonic_local *lp = netdev_priv(dev);
+	return lp->rra_laddr +
+	       entry * SIZEOF_SONIC_RR * SONIC_BUS_SCALE(lp->dma_bitmode);
+}
+static inline u16 sonic_rr_entry(struct net_device *dev, u16 addr)
+{
+	struct sonic_local *lp = netdev_priv(dev);
+	return (addr - (u16)lp->rra_laddr) / (SIZEOF_SONIC_RR *
+					      SONIC_BUS_SCALE(lp->dma_bitmode));
+}
 static const char version[] =
     "sonic.c:v0.92 20.9.98 tsbogend@alpha.franken.de\n";

drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c+1−0

@@ -2043,6 +2043,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev, · 2042 unmodified lines
2043	break;	2043	break;
2044	}	2044	}
2045	entry += p_hdr->size;	2045	entry += p_hdr->size;
		2046	cond_resched();
2046	}	2047	}
2047	p_dev->ahw->reset.seq_index = index;	2048	p_dev->ahw->reset.seq_index = index;
2048	}	2049	}

drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c+2−0

 		addr += 16;
 		reg_read -= 16;
 		ret += 16;
+		cond_resched();
 	}
 out:
 	mutex_unlock(&adapter->ahw->mem_lock);
 		buf_offset += entry->hdr.cap_size;
 		entry_offset += entry->hdr.offset;
 		buffer = fw_dump->data + buf_offset;
+		cond_resched();
 	}
 	fw_dump->clr = 1;

drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c+3−3

@@ -412,9 +412,9 @@ stmmac_probe_config_dt(struct platform_device pdev, const char *mac) · 411 unmodified lines
412	*mac = NULL;	412	*mac = NULL;
413	}	413	}
414		414
415	rc = of_get_phy_mode(np, &plat->phy_interface);	415	plat->phy_interface = device_get_phy_mode(&pdev->dev);
416	if (rc)	416	if (plat->phy_interface < 0)
417	return ERR_PTR(rc);	417	return ERR_PTR(plat->phy_interface);
418		418
419	plat->interface = stmmac_of_get_mac_mode(np);	419	plat->interface = stmmac_of_get_mac_mode(np);
420	if (plat->interface < 0)	420	if (plat->interface < 0)

drivers/net/gtp.c+6−4

 		return NULL;
 	}
-	if (sock->sk->sk_protocol != IPPROTO_UDP) {
+	sk = sock->sk;
+	if (sk->sk_protocol != IPPROTO_UDP ||
+	    sk->sk_type != SOCK_DGRAM ||
+	    (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)) {
 		pr_debug("socket fd=%d not UDP\n", fd);
 		sk = ERR_PTR(-EINVAL);
 		goto out_sock;
 	}
-	lock_sock(sock->sk);
+	lock_sock(sk);
-	if (sock->sk->sk_user_data) {
+	if (sk->sk_user_data) {
 		sk = ERR_PTR(-EBUSY);
 		goto out_rel_sock;
 	}
-	sk = sock->sk;
 	sock_hold(sk);
 	tuncfg.sk_user_data = gtp;

drivers/net/slip/slip.c+10−2

  */
 static void slip_write_wakeup(struct tty_struct *tty)
 {
-	struct slip *sl = tty->disc_data;
+	struct slip *sl;
+	rcu_read_lock();
+	sl = rcu_dereference(tty->disc_data);
+	if (!sl)
+		goto out;
 	schedule_work(&sl->tx_work);
+out:
+	rcu_read_unlock();
 }
 static void sl_tx_timeout(struct net_device *dev)
 		return;
 	spin_lock_bh(&sl->lock);
-	tty->disc_data = NULL;
+	rcu_assign_pointer(tty->disc_data, NULL);
 	sl->tty = NULL;
 	spin_unlock_bh(&sl->lock);
+	synchronize_rcu();
 	flush_work(&sl->tx_work);
 	/* VSV = very important to remove timers */

drivers/net/tun.c+4−0

 			if (ret != XDP_PASS) {
 				rcu_read_unlock();
 				local_bh_enable();
+				if (frags) {
+					tfile->napi.skb = NULL;
+					mutex_unlock(&tfile->napi_mutex);
+				}
 				return total_len;
 			}
 		}

drivers/net/usb/lan78xx.c+15−0

 #include <linux/mdio.h>
 #include <linux/phy.h>
 #include <net/ip6_checksum.h>
+#include <net/vxlan.h>
 #include <linux/interrupt.h>
 #include <linux/irqdomain.h>
 #include <linux/irq.h>
 	tasklet_schedule(&dev->bh);
 }
+static netdev_features_t lan78xx_features_check(struct sk_buff *skb,
+						struct net_device *netdev,
+						netdev_features_t features)
+{
+	if (skb->len + TX_OVERHEAD > MAX_SINGLE_PACKET_SIZE)
+		features &= ~NETIF_F_GSO_MASK;
+	features = vlan_features_check(skb, features);
+	features = vxlan_features_check(skb, features);
+	return features;
+}
 static const struct net_device_ops lan78xx_netdev_ops = {
 	.ndo_open		= lan78xx_open,
 	.ndo_stop		= lan78xx_stop,
 	.ndo_set_features	= lan78xx_set_features,
 	.ndo_vlan_rx_add_vid	= lan78xx_vlan_rx_add_vid,
 	.ndo_vlan_rx_kill_vid	= lan78xx_vlan_rx_kill_vid,
+	.ndo_features_check	= lan78xx_features_check,
 };
 static void lan78xx_stat_monitor(struct timer_list *t)

drivers/net/usb/r8152.c+114−11

@@ -31,7 +31,7 @@ · 30 unmodified lines
31	#define NETNEXT_VERSION "11"	31	#define NETNEXT_VERSION "11"
32		32
33	/* Information for net */	33	/* Information for net */
34	#define NET_VERSION "10"	34	#define NET_VERSION "11"
35		35
36	#define DRIVER_VERSION "v1." NETNEXT_VERSION "." NET_VERSION	36	#define DRIVER_VERSION "v1." NETNEXT_VERSION "." NET_VERSION
37	#define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"	37	#define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
@@ -68,6 +68,7 @@ · 30 unmodified lines
68	#define PLA_LED_FEATURE 0xdd92	68	#define PLA_LED_FEATURE 0xdd92
69	#define PLA_PHYAR 0xde00	69	#define PLA_PHYAR 0xde00
70	#define PLA_BOOT_CTRL 0xe004	70	#define PLA_BOOT_CTRL 0xe004
		71	#define PLA_LWAKE_CTRL_REG 0xe007
71	#define PLA_GPHY_INTR_IMR 0xe022	72	#define PLA_GPHY_INTR_IMR 0xe022
72	#define PLA_EEE_CR 0xe040	73	#define PLA_EEE_CR 0xe040
73	#define PLA_EEEP_CR 0xe080	74	#define PLA_EEEP_CR 0xe080
@@ -95,6 +96,7 @@ · 21 unmodified lines
95	#define PLA_TALLYCNT 0xe890	96	#define PLA_TALLYCNT 0xe890
96	#define PLA_SFF_STS_7 0xe8de	97	#define PLA_SFF_STS_7 0xe8de
97	#define PLA_PHYSTATUS 0xe908	98	#define PLA_PHYSTATUS 0xe908
		99	#define PLA_CONFIG6 0xe90a /* CONFIG6 */
98	#define PLA_BP_BA 0xfc26	100	#define PLA_BP_BA 0xfc26
99	#define PLA_BP_0 0xfc28	101	#define PLA_BP_0 0xfc28
100	#define PLA_BP_1 0xfc2a	102	#define PLA_BP_1 0xfc2a
@@ -107,6 +109,7 @@ · 6 unmodified lines
107	#define PLA_BP_EN 0xfc38	109	#define PLA_BP_EN 0xfc38
108		110
109	#define USB_USB2PHY 0xb41e	111	#define USB_USB2PHY 0xb41e
		112	#define USB_SSPHYLINK1 0xb426
110	#define USB_SSPHYLINK2 0xb428	113	#define USB_SSPHYLINK2 0xb428
111	#define USB_U2P3_CTRL 0xb460	114	#define USB_U2P3_CTRL 0xb460
112	#define USB_CSR_DUMMY1 0xb464	115	#define USB_CSR_DUMMY1 0xb464
@@ -300,6 +303,9 @@ · 187 unmodified lines
300	#define LINK_ON_WAKE_EN 0x0010	303	#define LINK_ON_WAKE_EN 0x0010
301	#define LINK_OFF_WAKE_EN 0x0008	304	#define LINK_OFF_WAKE_EN 0x0008
302		305
		306	/* PLA_CONFIG6 */
		307	#define LANWAKE_CLR_EN BIT(0)
		308
303	/* PLA_CONFIG5 */	309	/* PLA_CONFIG5 */
304	#define BWF_EN 0x0040	310	#define BWF_EN 0x0040
305	#define MWF_EN 0x0020	311	#define MWF_EN 0x0020
@@ -312,6 +318,7 @@ · 6 unmodified lines
312	/* PLA_PHY_PWR */	318	/* PLA_PHY_PWR */
313	#define TX_10M_IDLE_EN 0x0080	319	#define TX_10M_IDLE_EN 0x0080
314	#define PFM_PWM_SWITCH 0x0040	320	#define PFM_PWM_SWITCH 0x0040
		321	#define TEST_IO_OFF BIT(4)
315		322
316	/* PLA_MAC_PWR_CTRL */	323	/* PLA_MAC_PWR_CTRL */
317	#define D3_CLK_GATED_EN 0x00004000	324	#define D3_CLK_GATED_EN 0x00004000
@@ -324,6 +331,7 @@ · 6 unmodified lines
324	#define MAC_CLK_SPDWN_EN BIT(15)	331	#define MAC_CLK_SPDWN_EN BIT(15)
325		332
326	/* PLA_MAC_PWR_CTRL3 */	333	/* PLA_MAC_PWR_CTRL3 */
		334	#define PLA_MCU_SPDWN_EN BIT(14)
327	#define PKT_AVAIL_SPDWN_EN 0x0100	335	#define PKT_AVAIL_SPDWN_EN 0x0100
328	#define SUSPEND_SPDWN_EN 0x0004	336	#define SUSPEND_SPDWN_EN 0x0004
329	#define U1U2_SPDWN_EN 0x0002	337	#define U1U2_SPDWN_EN 0x0002
@@ -354,6 +362,9 @@ · 24 unmodified lines
354	/* PLA_BOOT_CTRL */	362	/* PLA_BOOT_CTRL */
355	#define AUTOLOAD_DONE 0x0002	363	#define AUTOLOAD_DONE 0x0002
356		364
		365	/* PLA_LWAKE_CTRL_REG */
		366	#define LANWAKE_PIN BIT(7)
		367
357	/* PLA_SUSPEND_FLAG */	368	/* PLA_SUSPEND_FLAG */
358	#define LINK_CHG_EVENT BIT(0)	369	#define LINK_CHG_EVENT BIT(0)
359		370
@@ -365,13 +376,18 @@ · 5 unmodified lines
365	#define DEBUG_LTSSM 0x0082	376	#define DEBUG_LTSSM 0x0082
366		377
367	/* PLA_EXTRA_STATUS */	378	/* PLA_EXTRA_STATUS */
		379	#define CUR_LINK_OK BIT(15)
368	#define U3P3_CHECK_EN BIT(7) /* RTL_VER_05 only */	380	#define U3P3_CHECK_EN BIT(7) /* RTL_VER_05 only */
369	#define LINK_CHANGE_FLAG BIT(8)	381	#define LINK_CHANGE_FLAG BIT(8)
		382	#define POLL_LINK_CHG BIT(0)
370		383
371	/* USB_USB2PHY */	384	/* USB_USB2PHY */
372	#define USB2PHY_SUSPEND 0x0001	385	#define USB2PHY_SUSPEND 0x0001
373	#define USB2PHY_L1 0x0002	386	#define USB2PHY_L1 0x0002
374		387
		388	/* USB_SSPHYLINK1 */
		389	#define DELAY_PHY_PWR_CHG BIT(1)
		390
375	/* USB_SSPHYLINK2 */	391	/* USB_SSPHYLINK2 */
376	#define pwd_dn_scale_mask 0x3ffe	392	#define pwd_dn_scale_mask 0x3ffe
377	#define pwd_dn_scale(x) ((x) << 1)	393	#define pwd_dn_scale(x) ((x) << 1)
@@ -2863,6 +2879,17 @@ static int rtl8153_enable(struct r8152 *tp) · 2485 unmodified lines
2863	r8153_set_rx_early_timeout(tp);	2879	r8153_set_rx_early_timeout(tp);
2864	r8153_set_rx_early_size(tp);	2880	r8153_set_rx_early_size(tp);
2865		2881
		2882	if (tp->version == RTL_VER_09) {
		2883	u32 ocp_data;
		2884
		2885	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_FW_TASK);
		2886	ocp_data &= ~FC_PATCH_TASK;
		2887	ocp_write_word(tp, MCU_TYPE_USB, USB_FW_TASK, ocp_data);
		2888	usleep_range(1000, 2000);
		2889	ocp_data \|= FC_PATCH_TASK;
		2890	ocp_write_word(tp, MCU_TYPE_USB, USB_FW_TASK, ocp_data);
		2891	}
		2892
2866	return rtl_enable(tp);	2893	return rtl_enable(tp);
2867	}	2894	}
2868		2895
@@ -3376,8 +3403,8 @@ static void rtl8153b_runtime_enable(struct r8152 *tp, bool enable) · 507 unmodified lines
3376	r8153b_ups_en(tp, false);	3403	r8153b_ups_en(tp, false);
3377	r8153_queue_wake(tp, false);	3404	r8153_queue_wake(tp, false);
3378	rtl_runtime_suspend_enable(tp, false);	3405	rtl_runtime_suspend_enable(tp, false);
3379	r8153_u2p3en(tp, true);	3406	if (tp->udev->speed != USB_SPEED_HIGH)
3380	r8153b_u1u2en(tp, true);	3407	r8153b_u1u2en(tp, true);
3381	}	3408	}
3382	}	3409	}
3383		3410
@@ -4675,7 +4702,6 @@ static void r8153b_hw_phy_cfg(struct r8152 *tp) · 1291 unmodified lines
4675		4702
4676	r8153_aldps_en(tp, true);	4703	r8153_aldps_en(tp, true);
4677	r8152b_enable_fc(tp);	4704	r8152b_enable_fc(tp);
4678	r8153_u2p3en(tp, true);
4679		4705
4680	set_bit(PHY_RESET, &tp->flags);	4706	set_bit(PHY_RESET, &tp->flags);
4681	}	4707	}
@@ -4954,6 +4980,8 @@ static void rtl8152_down(struct r8152 *tp) · 272 unmodified lines
4954		4980
4955	static void rtl8153_up(struct r8152 *tp)	4981	static void rtl8153_up(struct r8152 *tp)
4956	{	4982	{
		4983	u32 ocp_data;
		4984
4957	if (test_bit(RTL8152_UNPLUG, &tp->flags))	4985	if (test_bit(RTL8152_UNPLUG, &tp->flags))
4958	return;	4986	return;
4959		4987
@@ -4961,6 +4989,19 @@ static void rtl8153_up(struct r8152 *tp) · 1 unmodified line
4961	r8153_u2p3en(tp, false);	4989	r8153_u2p3en(tp, false);
4962	r8153_aldps_en(tp, false);	4990	r8153_aldps_en(tp, false);
4963	r8153_first_init(tp);	4991	r8153_first_init(tp);
		4992
		4993	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6);
		4994	ocp_data \|= LANWAKE_CLR_EN;
		4995	ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6, ocp_data);
		4996
		4997	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_LWAKE_CTRL_REG);
		4998	ocp_data &= ~LANWAKE_PIN;
		4999	ocp_write_byte(tp, MCU_TYPE_PLA, PLA_LWAKE_CTRL_REG, ocp_data);
		5000
		5001	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_SSPHYLINK1);
		5002	ocp_data &= ~DELAY_PHY_PWR_CHG;
		5003	ocp_write_word(tp, MCU_TYPE_USB, USB_SSPHYLINK1, ocp_data);
		5004
4964	r8153_aldps_en(tp, true);	5005	r8153_aldps_en(tp, true);
4965		5006
4966	switch (tp->version) {	5007	switch (tp->version) {
@@ -4979,11 +5020,17 @@ static void rtl8153_up(struct r8152 *tp) · 12 unmodified lines
4979		5020
4980	static void rtl8153_down(struct r8152 *tp)	5021	static void rtl8153_down(struct r8152 *tp)
4981	{	5022	{
		5023	u32 ocp_data;
		5024
4982	if (test_bit(RTL8152_UNPLUG, &tp->flags)) {	5025	if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
4983	rtl_drop_queued_tx(tp);	5026	rtl_drop_queued_tx(tp);
4984	return;	5027	return;
4985	}	5028	}
4986		5029
		5030	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6);
		5031	ocp_data &= ~LANWAKE_CLR_EN;
		5032	ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6, ocp_data);
		5033
4987	r8153_u1u2en(tp, false);	5034	r8153_u1u2en(tp, false);
4988	r8153_u2p3en(tp, false);	5035	r8153_u2p3en(tp, false);
4989	r8153_power_cut_en(tp, false);	5036	r8153_power_cut_en(tp, false);
@@ -4994,6 +5041,8 @@ static void rtl8153_down(struct r8152 *tp) · 4 unmodified lines
4994		5041
4995	static void rtl8153b_up(struct r8152 *tp)	5042	static void rtl8153b_up(struct r8152 *tp)
4996	{	5043	{
		5044	u32 ocp_data;
		5045
4997	if (test_bit(RTL8152_UNPLUG, &tp->flags))	5046	if (test_bit(RTL8152_UNPLUG, &tp->flags))
4998	return;	5047	return;
4999		5048
@@ -5004,18 +5053,29 @@ static void rtl8153b_up(struct r8152 *tp) · 4 unmodified lines
5004	r8153_first_init(tp);	5053	r8153_first_init(tp);
5005	ocp_write_dword(tp, MCU_TYPE_USB, USB_RX_BUF_TH, RX_THR_B);	5054	ocp_write_dword(tp, MCU_TYPE_USB, USB_RX_BUF_TH, RX_THR_B);
5006		5055
		5056	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3);
		5057	ocp_data &= ~PLA_MCU_SPDWN_EN;
		5058	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, ocp_data);
		5059
5007	r8153_aldps_en(tp, true);	5060	r8153_aldps_en(tp, true);
5008	r8153_u2p3en(tp, true);	5061
5009	r8153b_u1u2en(tp, true);	5062	if (tp->udev->speed != USB_SPEED_HIGH)
		5063	r8153b_u1u2en(tp, true);
5010	}	5064	}
5011		5065
5012	static void rtl8153b_down(struct r8152 *tp)	5066	static void rtl8153b_down(struct r8152 *tp)
5013	{	5067	{
		5068	u32 ocp_data;
		5069
5014	if (test_bit(RTL8152_UNPLUG, &tp->flags)) {	5070	if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
5015	rtl_drop_queued_tx(tp);	5071	rtl_drop_queued_tx(tp);
5016	return;	5072	return;
5017	}	5073	}
5018		5074
		5075	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3);
		5076	ocp_data \|= PLA_MCU_SPDWN_EN;
		5077	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, ocp_data);
		5078
5019	r8153b_u1u2en(tp, false);	5079	r8153b_u1u2en(tp, false);
5020	r8153_u2p3en(tp, false);	5080	r8153_u2p3en(tp, false);
5021	r8153b_power_cut_en(tp, false);	5081	r8153b_power_cut_en(tp, false);
@@ -5387,6 +5447,16 @@ static void r8153_init(struct r8152 *tp) · 365 unmodified lines
5387	else	5447	else
5388	ocp_data \|= DYNAMIC_BURST;	5448	ocp_data \|= DYNAMIC_BURST;
5389	ocp_write_byte(tp, MCU_TYPE_USB, USB_CSR_DUMMY1, ocp_data);	5449	ocp_write_byte(tp, MCU_TYPE_USB, USB_CSR_DUMMY1, ocp_data);
		5450
		5451	r8153_queue_wake(tp, false);
		5452
		5453	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EXTRA_STATUS);
		5454	if (rtl8152_get_speed(tp) & LINK_STATUS)
		5455	ocp_data \|= CUR_LINK_OK;
		5456	else
		5457	ocp_data &= ~CUR_LINK_OK;
		5458	ocp_data \|= POLL_LINK_CHG;
		5459	ocp_write_word(tp, MCU_TYPE_PLA, PLA_EXTRA_STATUS, ocp_data);
5390	}	5460	}
5391		5461
5392	ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_CSR_DUMMY2);	5462	ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_CSR_DUMMY2);
@@ -5416,10 +5486,19 @@ static void r8153_init(struct r8152 *tp) · 23 unmodified lines
5416	ocp_write_word(tp, MCU_TYPE_USB, USB_CONNECT_TIMER, 0x0001);	5486	ocp_write_word(tp, MCU_TYPE_USB, USB_CONNECT_TIMER, 0x0001);
5417		5487
5418	r8153_power_cut_en(tp, false);	5488	r8153_power_cut_en(tp, false);
		5489	rtl_runtime_suspend_enable(tp, false);
5419	r8153_u1u2en(tp, true);	5490	r8153_u1u2en(tp, true);
5420	r8153_mac_clk_spd(tp, false);	5491	r8153_mac_clk_spd(tp, false);
5421	usb_enable_lpm(tp->udev);	5492	usb_enable_lpm(tp->udev);
5422		5493
		5494	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6);
		5495	ocp_data \|= LANWAKE_CLR_EN;
		5496	ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6, ocp_data);
		5497
		5498	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_LWAKE_CTRL_REG);
		5499	ocp_data &= ~LANWAKE_PIN;
		5500	ocp_write_byte(tp, MCU_TYPE_PLA, PLA_LWAKE_CTRL_REG, ocp_data);
		5501
5423	/* rx aggregation */	5502	/* rx aggregation */
5424	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);	5503	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
5425	ocp_data &= ~(RX_AGG_DISABLE \| RX_ZERO_EN);	5504	ocp_data &= ~(RX_AGG_DISABLE \| RX_ZERO_EN);
@@ -5484,7 +5563,17 @@ static void r8153b_init(struct r8152 *tp) · 58 unmodified lines
5484	r8153b_ups_en(tp, false);	5563	r8153b_ups_en(tp, false);
5485	r8153_queue_wake(tp, false);	5564	r8153_queue_wake(tp, false);
5486	rtl_runtime_suspend_enable(tp, false);	5565	rtl_runtime_suspend_enable(tp, false);
5487	r8153b_u1u2en(tp, true);	5566
		5567	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EXTRA_STATUS);
		5568	if (rtl8152_get_speed(tp) & LINK_STATUS)
		5569	ocp_data \|= CUR_LINK_OK;
		5570	else
		5571	ocp_data &= ~CUR_LINK_OK;
		5572	ocp_data \|= POLL_LINK_CHG;
		5573	ocp_write_word(tp, MCU_TYPE_PLA, PLA_EXTRA_STATUS, ocp_data);
		5574
		5575	if (tp->udev->speed != USB_SPEED_HIGH)
		5576	r8153b_u1u2en(tp, true);
5488	usb_enable_lpm(tp->udev);	5577	usb_enable_lpm(tp->udev);
5489		5578
5490	/* MAC clock speed down */	5579	/* MAC clock speed down */
@@ -5492,6 +5581,19 @@ static void r8153b_init(struct r8152 *tp) · 1 unmodified line
5492	ocp_data \|= MAC_CLK_SPDWN_EN;	5581	ocp_data \|= MAC_CLK_SPDWN_EN;
5493	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, ocp_data);	5582	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, ocp_data);
5494		5583
		5584	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3);
		5585	ocp_data &= ~PLA_MCU_SPDWN_EN;
		5586	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, ocp_data);
		5587
		5588	if (tp->version == RTL_VER_09) {
		5589	/* Disable Test IO for 32QFN */
		5590	if (ocp_read_byte(tp, MCU_TYPE_PLA, 0xdc00) & BIT(5)) {
		5591	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_PHY_PWR);
		5592	ocp_data \|= TEST_IO_OFF;
		5593	ocp_write_word(tp, MCU_TYPE_PLA, PLA_PHY_PWR, ocp_data);
		5594	}
		5595	}
		5596
5495	set_bit(GREEN_ETHERNET, &tp->flags);	5597	set_bit(GREEN_ETHERNET, &tp->flags);
5496		5598
5497	/* rx aggregation */	5599	/* rx aggregation */
@@ -6707,6 +6809,11 @@ static int rtl8152_probe(struct usb_interface *intf, · 1209 unmodified lines
6707		6809
6708	intf->needs_remote_wakeup = 1;	6810	intf->needs_remote_wakeup = 1;
6709		6811
		6812	if (!rtl_can_wakeup(tp))
		6813	__rtl_set_wol(tp, 0);
		6814	else
		6815	tp->saved_wolopts = __rtl_get_wol(tp);
		6816
6710	tp->rtl_ops.init(tp);	6817	tp->rtl_ops.init(tp);
6711	#if IS_BUILTIN(CONFIG_USB_RTL8152)	6818	#if IS_BUILTIN(CONFIG_USB_RTL8152)
6712	/* Retry in case request_firmware() is not ready yet. */	6819	/* Retry in case request_firmware() is not ready yet. */
@@ -6724,10 +6831,6 @@ static int rtl8152_probe(struct usb_interface *intf, · 11 unmodified lines
6724	goto out1;	6831	goto out1;
6725	}	6832	}
6726		6833
6727	if (!rtl_can_wakeup(tp))
6728	__rtl_set_wol(tp, 0);
6729
6730	tp->saved_wolopts = __rtl_get_wol(tp);
6731	if (tp->saved_wolopts)	6834	if (tp->saved_wolopts)
6732	device_set_wakeup_enable(&udev->dev, true);	6835	device_set_wakeup_enable(&udev->dev, true);
6733	else	6836	else

drivers/net/wireless/cisco/airo.c+9−11

 	case AIROGVLIST:    ridcode = RID_APLIST;       break;
 	case AIROGDRVNAM:   ridcode = RID_DRVNAME;      break;
 	case AIROGEHTENC:   ridcode = RID_ETHERENCAP;   break;
-	case AIROGWEPKTMP:  ridcode = RID_WEP_TEMP;
+	case AIROGWEPKTMP:  ridcode = RID_WEP_TEMP;	break;
-		/* Only super-user can read WEP keys */
+	case AIROGWEPKNV:   ridcode = RID_WEP_PERM;	break;
-		if (!capable(CAP_NET_ADMIN))
-			return -EPERM;
-		break;
-	case AIROGWEPKNV:   ridcode = RID_WEP_PERM;
-		/* Only super-user can read WEP keys */
-		if (!capable(CAP_NET_ADMIN))
-			return -EPERM;
-		break;
 	case AIROGSTAT:     ridcode = RID_STATUS;       break;
 	case AIROGSTATSD32: ridcode = RID_STATSDELTA;   break;
 	case AIROGSTATSC32: ridcode = RID_STATS;        break;
 		return -EINVAL;
 	}
-	if ((iobuf = kmalloc(RIDSIZE, GFP_KERNEL)) == NULL)
+	if (ridcode == RID_WEP_TEMP || ridcode == RID_WEP_PERM) {
+		/* Only super-user can read WEP keys */
+		if (!capable(CAP_NET_ADMIN))
+			return -EPERM;
+	}
+	if ((iobuf = kzalloc(RIDSIZE, GFP_KERNEL)) == NULL)
 		return -ENOMEM;
 	PC4500_readrid(ai,ridcode,iobuf,RIDSIZE, 1);

drivers/net/wireless/intel/iwlwifi/dvm/tx.c+1−2

 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	struct iwl_station_priv *sta_priv = NULL;
 	struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
-	struct iwl_device_cmd *dev_cmd;
+	struct iwl_device_tx_cmd *dev_cmd;
 	struct iwl_tx_cmd *tx_cmd;
 	__le16 fc;
 	u8 hdr_len;
 	if (unlikely(!dev_cmd))
 		goto drop_unlock_priv;
-	memset(dev_cmd, 0, sizeof(*dev_cmd));
 	dev_cmd->hdr.cmd = REPLY_TX;
 	tx_cmd = (struct iwl_tx_cmd *) dev_cmd->payload;

drivers/net/wireless/intel/iwlwifi/fw/acpi.c+5−5

 {
 	union acpi_object *wifi_pkg, *data;
 	bool enabled;
-	int i, n_profiles, tbl_rev;
+	int i, n_profiles, tbl_rev, pos;
-	int  ret = 0;
+	int ret = 0;
 	data = iwl_acpi_get_object(fwrt->dev, ACPI_EWRD_METHOD);
 	if (IS_ERR(data))
 		goto out_free;
 	}
-	for (i = 0; i < n_profiles; i++) {
+	/* the tables start at element 3 */
-		/* the tables start at element 3 */
+	pos = 3;
-		int pos = 3;
+	for (i = 0; i < n_profiles; i++) {
 		/* The EWRD profiles officially go from 2 to 4, but we
 		 * save them in sar_profiles[1-3] (because we don't
 		 * have profile 0).  So in the array we start from 1.

drivers/net/wireless/intel/iwlwifi/fw/dbg.c+1−6

 {
 	int ret = 0;
-	/* if the FW crashed or not debug monitor cfg was given, there is
+	if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status))
-	 * no point in changing the recording state
-	 */
-	if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status) ||
-	    (!fwrt->trans->dbg.dest_tlv &&
-	     fwrt->trans->dbg.ini_dest == IWL_FW_INI_LOCATION_INVALID))
 		return 0;
 	if (fw_has_capa(&fwrt->fw->ucode_capa,

drivers/net/wireless/intel/iwlwifi/iwl-csr.h+1−1

@@ -379,7 +379,7 @@ enum { · 378 unmodified lines
379		379
380		380
381	/* CSR GIO */	381	/* CSR GIO */
382	#define CSR_GIO_REG_VAL_L0S_ENABLED (0x00000002)	382	#define CSR_GIO_REG_VAL_L0S_DISABLED (0x00000002)
383		383
384	/*	384	/*
385	* UCODE-DRIVER GP (general purpose) mailbox register 1	385	* UCODE-DRIVER GP (general purpose) mailbox register 1

drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c+8−1

 	if (!frag || frag->size || !pages)
 		return -EIO;
-	while (pages) {
+	/*
+	 * We try to allocate as many pages as we can, starting with
+	 * the requested amount and going down until we can allocate
+	 * something.  Because of DIV_ROUND_UP(), pages will never go
+	 * down to 0 and stop the loop, so stop when pages reaches 1,
+	 * which is too small anyway.
+	 */
+	while (pages > 1) {
 		block = dma_alloc_coherent(fwrt->dev, pages * PAGE_SIZE,
 					   &physical,
 					   GFP_KERNEL | __GFP_NOWARN);

drivers/net/wireless/intel/iwlwifi/iwl-drv.c+0−3

@@ -1817,9 +1817,6 @@ MODULE_PARM_DESC(antenna_coupling, · 1816 unmodified lines
1817	module_param_named(nvm_file, iwlwifi_mod_params.nvm_file, charp, 0444);	1817	module_param_named(nvm_file, iwlwifi_mod_params.nvm_file, charp, 0444);
1818	MODULE_PARM_DESC(nvm_file, "NVM file name");	1818	MODULE_PARM_DESC(nvm_file, "NVM file name");
1819		1819
1820	module_param_named(lar_disable, iwlwifi_mod_params.lar_disable, bool, 0444);
1821	MODULE_PARM_DESC(lar_disable, "disable LAR functionality (default: N)");
1822
1823	module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable, uint, 0644);	1820	module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable, uint, 0644);
1824	MODULE_PARM_DESC(uapsd_disable,	1821	MODULE_PARM_DESC(uapsd_disable,
1825	"disable U-APSD functionality bitmap 1: BSS 2: P2P Client (default: 3)");	1822	"disable U-APSD functionality bitmap 1: BSS 2: P2P Client (default: 3)");

drivers/net/wireless/intel/iwlwifi/iwl-modparams.h+0−2

  * @nvm_file: specifies a external NVM file
  * @uapsd_disable: disable U-APSD, see &enum iwl_uapsd_disable, default =
  *	IWL_DISABLE_UAPSD_BSS | IWL_DISABLE_UAPSD_P2P_CLIENT
- * @lar_disable: disable LAR (regulatory), default = 0
  * @fw_monitor: allow to use firmware monitor
  * @disable_11ac: disable VHT capabilities, default = false.
  * @remove_when_gone: remove an inaccessible device from the PCIe bus.
 	int antenna_coupling;
 	char *nvm_file;
 	u32 uapsd_disable;
-	bool lar_disable;
 	bool fw_monitor;
 	bool disable_11ac;
 	/**

drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c+53−8

 	NVM_CHANNEL_DC_HIGH		= BIT(12),
 };
+/**
+ * enum iwl_reg_capa_flags - global flags applied for the whole regulatory
+ * domain.
+ * @REG_CAPA_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
+ *	2.4Ghz band is allowed.
+ * @REG_CAPA_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
+ *	5Ghz band is allowed.
+ * @REG_CAPA_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
+ *	for this regulatory domain (valid only in 5Ghz).
+ * @REG_CAPA_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
+ *	for this regulatory domain (valid only in 5Ghz).
+ * @REG_CAPA_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
+ * @REG_CAPA_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
+ * @REG_CAPA_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
+ *	for this regulatory domain (valid only in 5Ghz).
+ * @REG_CAPA_DC_HIGH_ENABLED: DC HIGH allowed.
+ */
+enum iwl_reg_capa_flags {
+	REG_CAPA_BF_CCD_LOW_BAND	= BIT(0),
+	REG_CAPA_BF_CCD_HIGH_BAND	= BIT(1),
+	REG_CAPA_160MHZ_ALLOWED		= BIT(2),
+	REG_CAPA_80MHZ_ALLOWED		= BIT(3),
+	REG_CAPA_MCS_8_ALLOWED		= BIT(4),
+	REG_CAPA_MCS_9_ALLOWED		= BIT(5),
+	REG_CAPA_40MHZ_FORBIDDEN	= BIT(7),
+	REG_CAPA_DC_HIGH_ENABLED	= BIT(9),
+};
 static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
 					       int chan, u32 flags)
 {
 struct iwl_nvm_data *
 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
+		   const struct iwl_fw *fw,
 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
 		   const __le16 *nvm_calib, const __le16 *regulatory,
 		   const __le16 *mac_override, const __le16 *phy_sku,
-		   u8 tx_chains, u8 rx_chains, bool lar_fw_supported)
+		   u8 tx_chains, u8 rx_chains)
 {
 	struct iwl_nvm_data *data;
 	bool lar_enabled;
 		return NULL;
 	}
-	if (lar_fw_supported && lar_enabled)
+	if (lar_enabled &&
+	    fw_has_capa(&fw->ucode_capa, IWL_UCODE_TLV_CAPA_LAR_SUPPORT))
 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
 	if (iwl_nvm_no_wide_in_5ghz(trans, cfg, nvm_hw))
 static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
 				       int ch_idx, u16 nvm_flags,
+				       u16 cap_flags,
 				       const struct iwl_cfg *cfg)
 {
 	u32 flags = NL80211_RRF_NO_HT40;
 	    (flags & NL80211_RRF_NO_IR))
 		flags |= NL80211_RRF_GO_CONCURRENT;
+	/*
+	 * cap_flags is per regulatory domain so apply it for every channel
+	 */
+	if (ch_idx >= NUM_2GHZ_CHANNELS) {
+		if (cap_flags & REG_CAPA_40MHZ_FORBIDDEN)
+			flags |= NL80211_RRF_NO_HT40;
+		if (!(cap_flags & REG_CAPA_80MHZ_ALLOWED))
+			flags |= NL80211_RRF_NO_80MHZ;
+		if (!(cap_flags & REG_CAPA_160MHZ_ALLOWED))
+			flags |= NL80211_RRF_NO_160MHZ;
+	}
 	return flags;
 }
 struct ieee80211_regdomain *
 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
-		       u16 geo_info)
+		       u16 geo_info, u16 cap)
 {
 	int ch_idx;
 	u16 ch_flags;
 		}
 		reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
-							     ch_flags, cfg);
+							     ch_flags, cap,
+							     cfg);
 		/* we can't continue the same rule */
 		if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
 		.id = WIDE_ID(REGULATORY_AND_NVM_GROUP, NVM_GET_INFO)
 	};
 	int  ret;
-	bool lar_fw_supported = !iwlwifi_mod_params.lar_disable &&
-				fw_has_capa(&fw->ucode_capa,
-					    IWL_UCODE_TLV_CAPA_LAR_SUPPORT);
 	bool empty_otp;
 	u32 mac_flags;
 	u32 sbands_flags = 0;
 	nvm->valid_tx_ant = (u8)le32_to_cpu(rsp->phy_sku.tx_chains);
 	nvm->valid_rx_ant = (u8)le32_to_cpu(rsp->phy_sku.rx_chains);
-	if (le32_to_cpu(rsp->regulatory.lar_enabled) && lar_fw_supported) {
+	if (le32_to_cpu(rsp->regulatory.lar_enabled) &&
+	    fw_has_capa(&fw->ucode_capa,
+			IWL_UCODE_TLV_CAPA_LAR_SUPPORT)) {
 		nvm->lar_enabled = true;
 		sbands_flags |= IWL_NVM_SBANDS_FLAGS_LAR;
 	}

drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h+5−4

  *
  * Copyright(c) 2008 - 2015 Intel Corporation. All rights reserved.
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018        Intel Corporation
+ * Copyright(c) 2018 - 2019 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  */
 struct iwl_nvm_data *
 iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
+		   const struct iwl_fw *fw,
 		   const __be16 *nvm_hw, const __le16 *nvm_sw,
 		   const __le16 *nvm_calib, const __le16 *regulatory,
 		   const __le16 *mac_override, const __le16 *phy_sku,
-		   u8 tx_chains, u8 rx_chains, bool lar_fw_supported);
+		   u8 tx_chains, u8 rx_chains);
 /**
  * iwl_parse_mcc_info - parse MCC (mobile country code) info coming from FW
 struct ieee80211_regdomain *
 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
 		       int num_of_ch, __le32 *channels, u16 fw_mcc,
-		       u16 geo_info);
+		       u16 geo_info, u16 cap);
 /**
  * struct iwl_nvm_section - describes an NVM section in memory.

drivers/net/wireless/intel/iwlwifi/iwl-trans.c+5−5

 struct iwl_trans *iwl_trans_alloc(unsigned int priv_size,
 				  struct device *dev,
-				  const struct iwl_trans_ops *ops)
+				  const struct iwl_trans_ops *ops,
+				  unsigned int cmd_pool_size,
+				  unsigned int cmd_pool_align)
 {
 	struct iwl_trans *trans;
 #ifdef CONFIG_LOCKDEP
 		 "iwl_cmd_pool:%s", dev_name(trans->dev));
 	trans->dev_cmd_pool =
 		kmem_cache_create(trans->dev_cmd_pool_name,
-				  sizeof(struct iwl_device_cmd),
+				  cmd_pool_size, cmd_pool_align,
-				  sizeof(void *),
+				  SLAB_HWCACHE_ALIGN, NULL);
-				  SLAB_HWCACHE_ALIGN,
-				  NULL);
 	if (!trans->dev_cmd_pool)
 		return NULL;

drivers/net/wireless/intel/iwlwifi/iwl-trans.h+20−6

 	};
 } __packed;
+/**
+ * struct iwl_device_tx_cmd - buffer for TX command
+ * @hdr: the header
+ * @payload: the payload placeholder
+ *
+ * The actual structure is sized dynamically according to need.
+ */
+struct iwl_device_tx_cmd {
+	struct iwl_cmd_header hdr;
+	u8 payload[];
+} __packed;
 #define TFD_MAX_PAYLOAD_SIZE (sizeof(struct iwl_device_cmd))
 /*
 	int (*send_cmd)(struct iwl_trans *trans, struct iwl_host_cmd *cmd);
 	int (*tx)(struct iwl_trans *trans, struct sk_buff *skb,
-		  struct iwl_device_cmd *dev_cmd, int queue);
+		  struct iwl_device_tx_cmd *dev_cmd, int queue);
 	void (*reclaim)(struct iwl_trans *trans, int queue, int ssn,
 			struct sk_buff_head *skbs);
 	return trans->ops->dump_data(trans, dump_mask);
 }
-static inline struct iwl_device_cmd *
+static inline struct iwl_device_tx_cmd *
 iwl_trans_alloc_tx_cmd(struct iwl_trans *trans)
 {
-	return kmem_cache_alloc(trans->dev_cmd_pool, GFP_ATOMIC);
+	return kmem_cache_zalloc(trans->dev_cmd_pool, GFP_ATOMIC);
 }
 int iwl_trans_send_cmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd);
 static inline void iwl_trans_free_tx_cmd(struct iwl_trans *trans,
-					 struct iwl_device_cmd *dev_cmd)
+					 struct iwl_device_tx_cmd *dev_cmd)
 {
 	kmem_cache_free(trans->dev_cmd_pool, dev_cmd);
 }
 static inline int iwl_trans_tx(struct iwl_trans *trans, struct sk_buff *skb,
-			       struct iwl_device_cmd *dev_cmd, int queue)
+			       struct iwl_device_tx_cmd *dev_cmd, int queue)
 {
 	if (unlikely(test_bit(STATUS_FW_ERROR, &trans->status)))
 		return -EIO;
  *****************************************************/
 struct iwl_trans *iwl_trans_alloc(unsigned int priv_size,
 				  struct device *dev,
-				  const struct iwl_trans_ops *ops);
+				  const struct iwl_trans_ops *ops,
+				  unsigned int cmd_pool_size,
+				  unsigned int cmd_pool_align);
 void iwl_trans_free(struct iwl_trans *trans);
 /*****************************************************

drivers/net/wireless/intel/iwlwifi/mvm/constants.h+1−0

@@ -154,5 +154,6 @@ · 153 unmodified lines
154	#define IWL_MVM_D3_DEBUG false	154	#define IWL_MVM_D3_DEBUG false
155	#define IWL_MVM_USE_TWT false	155	#define IWL_MVM_USE_TWT false
156	#define IWL_MVM_AMPDU_CONSEC_DROPS_DELBA 10	156	#define IWL_MVM_AMPDU_CONSEC_DROPS_DELBA 10
		157	#define IWL_MVM_USE_NSSN_SYNC 0
157		158
158	#endif /* __MVM_CONSTANTS_H */	159	#endif /* __MVM_CONSTANTS_H */

drivers/net/wireless/intel/iwlwifi/mvm/fw.c+6−2

 		return 0;
 	}
+	if (!mvm->fwrt.ppag_table.enabled) {
+		IWL_DEBUG_RADIO(mvm,
+				"PPAG not enabled, command not sent.\n");
+		return 0;
+	}
 	IWL_DEBUG_RADIO(mvm, "Sending PER_PLATFORM_ANT_GAIN_CMD\n");
-	IWL_DEBUG_RADIO(mvm, "PPAG is %s\n",
-			mvm->fwrt.ppag_table.enabled ? "enabled" : "disabled");
 	for (i = 0; i < ACPI_PPAG_NUM_CHAINS; i++) {
 		for (j = 0; j < ACPI_PPAG_NUM_SUB_BANDS; j++) {

drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c+144−13

@@ -256,7 +256,8 @@ struct ieee80211_regdomain iwl_mvm_get_regdomain(struct wiphy wiphy, · 255 unmodified lines
256	__le32_to_cpu(resp->n_channels),	256	__le32_to_cpu(resp->n_channels),
257	resp->channels,	257	resp->channels,
258	__le16_to_cpu(resp->mcc),	258	__le16_to_cpu(resp->mcc),
259	__le16_to_cpu(resp->geo_info));	259	__le16_to_cpu(resp->geo_info),
		260	__le16_to_cpu(resp->cap));
260	/* Store the return source id */	261	/* Store the return source id */
261	src_id = resp->source_id;	262	src_id = resp->source_id;
262	kfree(resp);	263	kfree(resp);
@@ -754,6 +755,20 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm) · 491 unmodified lines
754	return ret;	755	return ret;
755	}	756	}
756		757
		758	static void iwl_mvm_tx_skb(struct iwl_mvm mvm, struct sk_buff skb,
		759	struct ieee80211_sta *sta)
		760	{
		761	if (likely(sta)) {
		762	if (likely(iwl_mvm_tx_skb_sta(mvm, skb, sta) == 0))
		763	return;
		764	} else {
		765	if (likely(iwl_mvm_tx_skb_non_sta(mvm, skb) == 0))
		766	return;
		767	}
		768
		769	ieee80211_free_txskb(mvm->hw, skb);
		770	}
		771
757	static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,	772	static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
758	struct ieee80211_tx_control *control,	773	struct ieee80211_tx_control *control,
759	struct sk_buff *skb)	774	struct sk_buff *skb)
@@ -797,14 +812,7 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw, · 37 unmodified lines
797	}	812	}
798	}	813	}
799		814
800	if (sta) {	815	iwl_mvm_tx_skb(mvm, skb, sta);
801	if (iwl_mvm_tx_skb(mvm, skb, sta))
802	goto drop;
803	return;
804	}
805
806	if (iwl_mvm_tx_skb_non_sta(mvm, skb))
807	goto drop;
808	return;	816	return;
809	drop:	817	drop:
810	ieee80211_free_txskb(hw, skb);	818	ieee80211_free_txskb(hw, skb);
@@ -854,10 +862,7 @@ void iwl_mvm_mac_itxq_xmit(struct ieee80211_hw hw, struct ieee80211_txq txq) · 43 unmodified lines
854	break;	862	break;
855	}	863	}
856		864
857	if (!txq->sta)	865	iwl_mvm_tx_skb(mvm, skb, txq->sta);
858	iwl_mvm_tx_skb_non_sta(mvm, skb);
859	else
860	iwl_mvm_tx_skb(mvm, skb, txq->sta);
861	}	866	}
862	} while (atomic_dec_return(&mvmtxq->tx_request));	867	} while (atomic_dec_return(&mvmtxq->tx_request));
863	rcu_read_unlock();	868	rcu_read_unlock();
@@ -4771,6 +4776,125 @@ static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx, · 3907 unmodified lines
4771	return ret;	4776	return ret;
4772	}	4777	}
4773		4778
		4779	static void iwl_mvm_set_sta_rate(u32 rate_n_flags, struct rate_info *rinfo)
		4780	{
		4781	switch (rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK) {
		4782	case RATE_MCS_CHAN_WIDTH_20:
		4783	rinfo->bw = RATE_INFO_BW_20;
		4784	break;
		4785	case RATE_MCS_CHAN_WIDTH_40:
		4786	rinfo->bw = RATE_INFO_BW_40;
		4787	break;
		4788	case RATE_MCS_CHAN_WIDTH_80:
		4789	rinfo->bw = RATE_INFO_BW_80;
		4790	break;
		4791	case RATE_MCS_CHAN_WIDTH_160:
		4792	rinfo->bw = RATE_INFO_BW_160;
		4793	break;
		4794	}
		4795
		4796	if (rate_n_flags & RATE_MCS_HT_MSK) {
		4797	rinfo->flags \|= RATE_INFO_FLAGS_MCS;
		4798	rinfo->mcs = u32_get_bits(rate_n_flags, RATE_HT_MCS_INDEX_MSK);
		4799	rinfo->nss = u32_get_bits(rate_n_flags,
		4800	RATE_HT_MCS_NSS_MSK) + 1;
		4801	if (rate_n_flags & RATE_MCS_SGI_MSK)
		4802	rinfo->flags \|= RATE_INFO_FLAGS_SHORT_GI;
		4803	} else if (rate_n_flags & RATE_MCS_VHT_MSK) {
		4804	rinfo->flags \|= RATE_INFO_FLAGS_VHT_MCS;
		4805	rinfo->mcs = u32_get_bits(rate_n_flags,
		4806	RATE_VHT_MCS_RATE_CODE_MSK);
		4807	rinfo->nss = u32_get_bits(rate_n_flags,
		4808	RATE_VHT_MCS_NSS_MSK) + 1;
		4809	if (rate_n_flags & RATE_MCS_SGI_MSK)
		4810	rinfo->flags \|= RATE_INFO_FLAGS_SHORT_GI;
		4811	} else if (rate_n_flags & RATE_MCS_HE_MSK) {
		4812	u32 gi_ltf = u32_get_bits(rate_n_flags,
		4813	RATE_MCS_HE_GI_LTF_MSK);
		4814
		4815	rinfo->flags \|= RATE_INFO_FLAGS_HE_MCS;
		4816	rinfo->mcs = u32_get_bits(rate_n_flags,
		4817	RATE_VHT_MCS_RATE_CODE_MSK);
		4818	rinfo->nss = u32_get_bits(rate_n_flags,
		4819	RATE_VHT_MCS_NSS_MSK) + 1;
		4820
		4821	if (rate_n_flags & RATE_MCS_HE_106T_MSK) {
		4822	rinfo->bw = RATE_INFO_BW_HE_RU;
		4823	rinfo->he_ru_alloc = NL80211_RATE_INFO_HE_RU_ALLOC_106;
		4824	}
		4825
		4826	switch (rate_n_flags & RATE_MCS_HE_TYPE_MSK) {
		4827	case RATE_MCS_HE_TYPE_SU:
		4828	case RATE_MCS_HE_TYPE_EXT_SU:
		4829	if (gi_ltf == 0 \|\| gi_ltf == 1)
		4830	rinfo->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
		4831	else if (gi_ltf == 2)
		4832	rinfo->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
		4833	else if (rate_n_flags & RATE_MCS_SGI_MSK)
		4834	rinfo->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
		4835	else
		4836	rinfo->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
		4837	break;
		4838	case RATE_MCS_HE_TYPE_MU:
		4839	if (gi_ltf == 0 \|\| gi_ltf == 1)
		4840	rinfo->he_gi = NL80211_RATE_INFO_HE_GI_0_8;
		4841	else if (gi_ltf == 2)
		4842	rinfo->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
		4843	else
		4844	rinfo->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
		4845	break;
		4846	case RATE_MCS_HE_TYPE_TRIG:
		4847	if (gi_ltf == 0 \|\| gi_ltf == 1)
		4848	rinfo->he_gi = NL80211_RATE_INFO_HE_GI_1_6;
		4849	else
		4850	rinfo->he_gi = NL80211_RATE_INFO_HE_GI_3_2;
		4851	break;
		4852	}
		4853
		4854	if (rate_n_flags & RATE_HE_DUAL_CARRIER_MODE_MSK)
		4855	rinfo->he_dcm = 1;
		4856	} else {
		4857	switch (u32_get_bits(rate_n_flags, RATE_LEGACY_RATE_MSK)) {
		4858	case IWL_RATE_1M_PLCP:
		4859	rinfo->legacy = 10;
		4860	break;
		4861	case IWL_RATE_2M_PLCP:
		4862	rinfo->legacy = 20;
		4863	break;
		4864	case IWL_RATE_5M_PLCP:
		4865	rinfo->legacy = 55;
		4866	break;
		4867	case IWL_RATE_11M_PLCP:
		4868	rinfo->legacy = 110;
		4869	break;
		4870	case IWL_RATE_6M_PLCP:
		4871	rinfo->legacy = 60;
		4872	break;
		4873	case IWL_RATE_9M_PLCP:
		4874	rinfo->legacy = 90;
		4875	break;
		4876	case IWL_RATE_12M_PLCP:
		4877	rinfo->legacy = 120;
		4878	break;
		4879	case IWL_RATE_18M_PLCP:
		4880	rinfo->legacy = 180;
		4881	break;
		4882	case IWL_RATE_24M_PLCP:
		4883	rinfo->legacy = 240;
		4884	break;
		4885	case IWL_RATE_36M_PLCP:
		4886	rinfo->legacy = 360;
		4887	break;
		4888	case IWL_RATE_48M_PLCP:
		4889	rinfo->legacy = 480;
		4890	break;
		4891	case IWL_RATE_54M_PLCP:
		4892	rinfo->legacy = 540;
		4893	break;
		4894	}
		4895	}
		4896	}
		4897
4774	static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,	4898	static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
4775	struct ieee80211_vif *vif,	4899	struct ieee80211_vif *vif,
4776	struct ieee80211_sta *sta,	4900	struct ieee80211_sta *sta,
@@ -4785,6 +4909,13 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw, · 8 unmodified lines
4785	sinfo->filled \|= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);	4909	sinfo->filled \|= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
4786	}	4910	}
4787		4911
		4912	if (iwl_mvm_has_tlc_offload(mvm)) {
		4913	struct iwl_lq_sta_rs_fw *lq_sta = &mvmsta->lq_sta.rs_fw;
		4914
		4915	iwl_mvm_set_sta_rate(lq_sta->last_rate_n_flags, &sinfo->txrate);
		4916	sinfo->filled \|= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
		4917	}
		4918
4788	/* if beacon filtering isn't on mac80211 does it anyway */	4919	/* if beacon filtering isn't on mac80211 does it anyway */
4789	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))	4920	if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
4790	return;	4921	return;

drivers/net/wireless/intel/iwlwifi/mvm/mvm.h+2−5

 	bool tlv_lar = fw_has_capa(&mvm->fw->ucode_capa,
 				   IWL_UCODE_TLV_CAPA_LAR_SUPPORT);
-	if (iwlwifi_mod_params.lar_disable)
-		return false;
 	/*
 	 * Enable LAR only if it is supported by the FW (TLV) &&
 	 * enabled in the NVM
 int __must_check iwl_mvm_send_cmd_pdu_status(struct iwl_mvm *mvm, u32 id,
 					     u16 len, const void *data,
 					     u32 *status);
-int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
+int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb,
-		   struct ieee80211_sta *sta);
+		       struct ieee80211_sta *sta);
 int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb);
 void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
 			struct iwl_tx_cmd *tx_cmd,

drivers/net/wireless/intel/iwlwifi/mvm/nvm.c+3−9

 	struct iwl_nvm_section *sections = mvm->nvm_sections;
 	const __be16 *hw;
 	const __le16 *sw, *calib, *regulatory, *mac_override, *phy_sku;
-	bool lar_enabled;
 	int regulatory_type;
 	/* Checking for required sections */
-	if (mvm->trans->cfg->nvm_type != IWL_NVM_EXT) {
+	if (mvm->trans->cfg->nvm_type == IWL_NVM) {
 		if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data ||
 		    !mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data) {
 			IWL_ERR(mvm, "Can't parse empty OTP/NVM sections\n");
 		(const __le16 *)sections[NVM_SECTION_TYPE_REGULATORY_SDP].data :
 		(const __le16 *)sections[NVM_SECTION_TYPE_REGULATORY].data;
-	lar_enabled = !iwlwifi_mod_params.lar_disable &&
+	return iwl_parse_nvm_data(mvm->trans, mvm->cfg, mvm->fw, hw, sw, calib,
-		      fw_has_capa(&mvm->fw->ucode_capa,
-				  IWL_UCODE_TLV_CAPA_LAR_SUPPORT);
-	return iwl_parse_nvm_data(mvm->trans, mvm->cfg, hw, sw, calib,
 				  regulatory, mac_override, phy_sku,
-				  mvm->fw->valid_tx_ant, mvm->fw->valid_rx_ant,
+				  mvm->fw->valid_tx_ant, mvm->fw->valid_rx_ant);
-				  lar_enabled);
 }
 /* Loads the NVM data stored in mvm->nvm_sections into the NIC */

drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c+11−8

@@ -514,14 +514,17 @@ static bool iwl_mvm_is_sn_less(u16 sn1, u16 sn2, u16 buffer_size) · 513 unmodified lines
514		514
515	static void iwl_mvm_sync_nssn(struct iwl_mvm *mvm, u8 baid, u16 nssn)	515	static void iwl_mvm_sync_nssn(struct iwl_mvm *mvm, u8 baid, u16 nssn)
516	{	516	{
517	struct iwl_mvm_rss_sync_notif notif = {	517	if (IWL_MVM_USE_NSSN_SYNC) {
518	.metadata.type = IWL_MVM_RXQ_NSSN_SYNC,	518	struct iwl_mvm_rss_sync_notif notif = {
519	.metadata.sync = 0,	519	.metadata.type = IWL_MVM_RXQ_NSSN_SYNC,
520	.nssn_sync.baid = baid,	520	.metadata.sync = 0,
521	.nssn_sync.nssn = nssn,	521	.nssn_sync.baid = baid,
522	};	522	.nssn_sync.nssn = nssn,
523		523	};
524	iwl_mvm_sync_rx_queues_internal(mvm, (void *)&notif, sizeof(notif));	524
		525	iwl_mvm_sync_rx_queues_internal(mvm, (void *)&notif,
		526	sizeof(notif));
		527	}
525	}	528	}
526		529
527	#define RX_REORDER_BUF_TIMEOUT_MQ (HZ / 10)	530	#define RX_REORDER_BUF_TIMEOUT_MQ (HZ / 10)

drivers/net/wireless/intel/iwlwifi/mvm/scan.c+1−1

@@ -1213,7 +1213,7 @@ static int iwl_mvm_legacy_config_scan(struct iwl_mvm *mvm) · 1212 unmodified lines
1213	cmd_size = sizeof(struct iwl_scan_config_v2);	1213	cmd_size = sizeof(struct iwl_scan_config_v2);
1214	else	1214	else
1215	cmd_size = sizeof(struct iwl_scan_config_v1);	1215	cmd_size = sizeof(struct iwl_scan_config_v1);
1216	cmd_size += num_channels;	1216	cmd_size += mvm->fw->ucode_capa.n_scan_channels;
1217		1217
1218	cfg = kzalloc(cmd_size, GFP_KERNEL);	1218	cfg = kzalloc(cmd_size, GFP_KERNEL);
1219	if (!cfg)	1219	if (!cfg)

drivers/net/wireless/intel/iwlwifi/mvm/tx.c+8−13

 /*
  * Allocates and sets the Tx cmd the driver data pointers in the skb
  */
-static struct iwl_device_cmd *
+static struct iwl_device_tx_cmd *
 iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,
 		      struct ieee80211_tx_info *info, int hdrlen,
 		      struct ieee80211_sta *sta, u8 sta_id)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-	struct iwl_device_cmd *dev_cmd;
+	struct iwl_device_tx_cmd *dev_cmd;
 	struct iwl_tx_cmd *tx_cmd;
 	dev_cmd = iwl_trans_alloc_tx_cmd(mvm->trans);
 	if (unlikely(!dev_cmd))
 		return NULL;
-	/* Make sure we zero enough of dev_cmd */
-	BUILD_BUG_ON(sizeof(struct iwl_tx_cmd_gen2) > sizeof(*tx_cmd));
-	BUILD_BUG_ON(sizeof(struct iwl_tx_cmd_gen3) > sizeof(*tx_cmd));
-	memset(dev_cmd, 0, sizeof(dev_cmd->hdr) + sizeof(*tx_cmd));
 	dev_cmd->hdr.cmd = TX_CMD;
 	if (iwl_mvm_has_new_tx_api(mvm)) {
 }
 static void iwl_mvm_skb_prepare_status(struct sk_buff *skb,
-				       struct iwl_device_cmd *cmd)
+				       struct iwl_device_tx_cmd *cmd)
 {
 	struct ieee80211_tx_info *skb_info = IEEE80211_SKB_CB(skb);
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 	struct ieee80211_tx_info info;
-	struct iwl_device_cmd *dev_cmd;
+	struct iwl_device_tx_cmd *dev_cmd;
 	u8 sta_id;
 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 	__le16 fc = hdr->frame_control;
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 	struct iwl_mvm_sta *mvmsta;
-	struct iwl_device_cmd *dev_cmd;
+	struct iwl_device_tx_cmd *dev_cmd;
 	__le16 fc;
 	u16 seq_number = 0;
 	u8 tid = IWL_MAX_TID_COUNT;
 	if (WARN_ONCE(txq_id == IWL_MVM_INVALID_QUEUE, "Invalid TXQ id")) {
 		iwl_trans_free_tx_cmd(mvm->trans, dev_cmd);
 		spin_unlock(&mvmsta->lock);
-		return 0;
+		return -1;
 	}
 	if (!iwl_mvm_has_new_tx_api(mvm)) {
 	return -1;
 }
-int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
+int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb,
-		   struct ieee80211_sta *sta)
+		       struct ieee80211_sta *sta)
 {
 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 	struct ieee80211_tx_info info;

drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c+42−3

@@ -57,6 +57,42 @@ · 56 unmodified lines
57	#include "internal.h"	57	#include "internal.h"
58	#include "iwl-prph.h"	58	#include "iwl-prph.h"
59		59
		60	static void _iwl_pcie_ctxt_info_dma_alloc_coherent(struct iwl_trans trans,
		61	size_t size,
		62	dma_addr_t *phys,
		63	int depth)
		64	{
		65	void *result;
		66
		67	if (WARN(depth > 2,
		68	"failed to allocate DMA memory not crossing 2^32 boundary"))
		69	return NULL;
		70
		71	result = dma_alloc_coherent(trans->dev, size, phys, GFP_KERNEL);
		72
		73	if (!result)
		74	return NULL;
		75
		76	if (unlikely(iwl_pcie_crosses_4g_boundary(*phys, size))) {
		77	void *old = result;
		78	dma_addr_t oldphys = *phys;
		79
		80	result = _iwl_pcie_ctxt_info_dma_alloc_coherent(trans, size,
		81	phys,
		82	depth + 1);
		83	dma_free_coherent(trans->dev, size, old, oldphys);
		84	}
		85
		86	return result;
		87	}
		88
		89	static void iwl_pcie_ctxt_info_dma_alloc_coherent(struct iwl_trans trans,
		90	size_t size,
		91	dma_addr_t *phys)
		92	{
		93	return _iwl_pcie_ctxt_info_dma_alloc_coherent(trans, size, phys, 0);
		94	}
		95
60	void iwl_pcie_ctxt_info_free_paging(struct iwl_trans *trans)	96	void iwl_pcie_ctxt_info_free_paging(struct iwl_trans *trans)
61	{	97	{
62	struct iwl_self_init_dram *dram = &trans->init_dram;	98	struct iwl_self_init_dram *dram = &trans->init_dram;
@@ -161,14 +197,17 @@ int iwl_pcie_ctxt_info_init(struct iwl_trans *trans, · 98 unmodified lines
161	struct iwl_context_info *ctxt_info;	197	struct iwl_context_info *ctxt_info;
162	struct iwl_context_info_rbd_cfg *rx_cfg;	198	struct iwl_context_info_rbd_cfg *rx_cfg;
163	u32 control_flags = 0, rb_size;	199	u32 control_flags = 0, rb_size;
		200	dma_addr_t phys;
164	int ret;	201	int ret;
165		202
166	ctxt_info = dma_alloc_coherent(trans->dev, sizeof(*ctxt_info),	203	ctxt_info = iwl_pcie_ctxt_info_dma_alloc_coherent(trans,
167	&trans_pcie->ctxt_info_dma_addr,	204	sizeof(*ctxt_info),
168	GFP_KERNEL);	205	&phys);
169	if (!ctxt_info)	206	if (!ctxt_info)
170	return -ENOMEM;	207	return -ENOMEM;
171		208
		209	trans_pcie->ctxt_info_dma_addr = phys;
		210
172	ctxt_info->version.version = 0;	211	ctxt_info->version.version = 0;
173	ctxt_info->version.mac_id =	212	ctxt_info->version.mac_id =
174	cpu_to_le16((u16)iwl_read32(trans, CSR_HW_REV));	213	cpu_to_le16((u16)iwl_read32(trans, CSR_HW_REV));

drivers/net/wireless/intel/iwlwifi/pcie/internal.h+15−4

 #define IWL_FIRST_TB_SIZE_ALIGN ALIGN(IWL_FIRST_TB_SIZE, 64)
 struct iwl_pcie_txq_entry {
-	struct iwl_device_cmd *cmd;
+	void *cmd;
 	struct sk_buff *skb;
 	/* buffer to free after command completes */
 	const void *free_buf;
 /*****************************************************
 * TX / HCMD
 ******************************************************/
+/*
+ * We need this inline in case dma_addr_t is only 32-bits - since the
+ * hardware is always 64-bit, the issue can still occur in that case,
+ * so use u64 for 'phys' here to force the addition in 64-bit.
+ */
+static inline bool iwl_pcie_crosses_4g_boundary(u64 phys, u16 len)
+{
+	return upper_32_bits(phys) != upper_32_bits(phys + len);
+}
 int iwl_pcie_tx_init(struct iwl_trans *trans);
 int iwl_pcie_gen2_tx_init(struct iwl_trans *trans, int txq_id,
 			  int queue_size);
 void iwl_trans_pcie_log_scd_error(struct iwl_trans *trans,
 				  struct iwl_txq *txq);
 int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
-		      struct iwl_device_cmd *dev_cmd, int txq_id);
+		      struct iwl_device_tx_cmd *dev_cmd, int txq_id);
 void iwl_pcie_txq_check_wrptrs(struct iwl_trans *trans);
 int iwl_trans_pcie_send_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd);
 void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx);
 void iwl_pcie_free_tso_page(struct iwl_trans_pcie *trans_pcie,
 			    struct sk_buff *skb);
 #ifdef CONFIG_INET
-struct iwl_tso_hdr_page *get_page_hdr(struct iwl_trans *trans, size_t len);
+struct iwl_tso_hdr_page *get_page_hdr(struct iwl_trans *trans, size_t len,
+				      struct sk_buff *skb);
 #endif
 /* common functions that are used by gen3 transport */
 				 unsigned int timeout);
 void iwl_trans_pcie_dyn_txq_free(struct iwl_trans *trans, int queue);
 int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
-			   struct iwl_device_cmd *dev_cmd, int txq_id);
+			   struct iwl_device_tx_cmd *dev_cmd, int txq_id);
 int iwl_trans_pcie_gen2_send_hcmd(struct iwl_trans *trans,
 				  struct iwl_host_cmd *cmd);
 void iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans);

drivers/net/wireless/intel/iwlwifi/pcie/rx.c+2−2

 	napi = &rxq->napi;
 	if (napi->poll) {
+		napi_gro_flush(napi, false);
 		if (napi->rx_count) {
 			netif_receive_skb_list(&napi->rx_list);
 			INIT_LIST_HEAD(&napi->rx_list);
 			napi->rx_count = 0;
 		}
-		napi_gro_flush(napi, false);
 	}
 	iwl_pcie_rxq_restock(trans, rxq);

drivers/net/wireless/intel/iwlwifi/pcie/trans.c+29−18

 #include "iwl-agn-hw.h"
 #include "fw/error-dump.h"
 #include "fw/dbg.h"
+#include "fw/api/tx.h"
 #include "internal.h"
 #include "iwl-fh.h"
 	u16 cap;
 	/*
-	 * HW bug W/A for instability in PCIe bus L0S->L1 transition.
+	 * L0S states have been found to be unstable with our devices
-	 * Check if BIOS (or OS) enabled L1-ASPM on this device.
+	 * and in newer hardware they are not officially supported at
-	 * If so (likely), disable L0S, so device moves directly L0->L1;
+	 * all, so we must always set the L0S_DISABLED bit.
-	 *    costs negligible amount of power savings.
-	 * If not (unlikely), enable L0S, so there is at least some
-	 *    power savings, even without L1.
 	 */
+	iwl_set_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_DISABLED);
 	pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_LNKCTL, &lctl);
-	if (lctl & PCI_EXP_LNKCTL_ASPM_L1)
-		iwl_set_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-	else
-		iwl_clear_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
 	trans->pm_support = !(lctl & PCI_EXP_LNKCTL_ASPM_L0S);
 	pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_DEVCTL2, &cap);
 {
 	struct iwl_trans_pcie *trans_pcie;
 	struct iwl_trans *trans;
-	int ret, addr_size;
+	int ret, addr_size, txcmd_size, txcmd_align;
+	const struct iwl_trans_ops *ops = &trans_ops_pcie_gen2;
+	if (!cfg_trans->gen2) {
+		ops = &trans_ops_pcie;
+		txcmd_size = sizeof(struct iwl_tx_cmd);
+		txcmd_align = sizeof(void *);
+	} else if (cfg_trans->device_family < IWL_DEVICE_FAMILY_AX210) {
+		txcmd_size = sizeof(struct iwl_tx_cmd_gen2);
+		txcmd_align = 64;
+	} else {
+		txcmd_size = sizeof(struct iwl_tx_cmd_gen3);
+		txcmd_align = 128;
+	}
+	txcmd_size += sizeof(struct iwl_cmd_header);
+	txcmd_size += 36; /* biggest possible 802.11 header */
+	/* Ensure device TX cmd cannot reach/cross a page boundary in gen2 */
+	if (WARN_ON(cfg_trans->gen2 && txcmd_size >= txcmd_align))
+		return ERR_PTR(-EINVAL);
 	ret = pcim_enable_device(pdev);
 	if (ret)
 		return ERR_PTR(ret);
-	if (cfg_trans->gen2)
+	trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie), &pdev->dev, ops,
-		trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie),
+				txcmd_size, txcmd_align);
-					&pdev->dev, &trans_ops_pcie_gen2);
-	else
-		trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie),
-					&pdev->dev, &trans_ops_pcie);
 	if (!trans)
 		return ERR_PTR(-ENOMEM);

drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c+170−38

@@ -221,6 +221,17 @@ static int iwl_pcie_gen2_set_tb(struct iwl_trans *trans, · 220 unmodified lines
221	int idx = iwl_pcie_gen2_get_num_tbs(trans, tfd);	221	int idx = iwl_pcie_gen2_get_num_tbs(trans, tfd);
222	struct iwl_tfh_tb *tb;	222	struct iwl_tfh_tb *tb;
223		223
		224	/*
		225	* Only WARN here so we know about the issue, but we mess up our
		226	* unmap path because not every place currently checks for errors
		227	* returned from this function - it can only return an error if
		228	* there's no more space, and so when we know there is enough we
		229	* don't always check ...
		230	*/
		231	WARN(iwl_pcie_crosses_4g_boundary(addr, len),
		232	"possible DMA problem with iova:0x%llx, len:%d\n",
		233	(unsigned long long)addr, len);
		234
224	if (WARN_ON(idx >= IWL_TFH_NUM_TBS))	235	if (WARN_ON(idx >= IWL_TFH_NUM_TBS))
225	return -EINVAL;	236	return -EINVAL;
226	tb = &tfd->tbs[idx];	237	tb = &tfd->tbs[idx];
@@ -240,13 +251,114 @@ static int iwl_pcie_gen2_set_tb(struct iwl_trans *trans, · 13 unmodified lines
240	return idx;	251	return idx;
241	}	252	}
242		253
		254	static struct page get_workaround_page(struct iwl_trans trans,
		255	struct sk_buff *skb)
		256	{
		257	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
		258	struct page **page_ptr;
		259	struct page *ret;
		260
		261	page_ptr = (void )((u8 )skb->cb + trans_pcie->page_offs);
		262
		263	ret = alloc_page(GFP_ATOMIC);
		264	if (!ret)
		265	return NULL;
		266
		267	/* set the chaining pointer to the previous page if there */
		268	(void )(page_address(ret) + PAGE_SIZE - sizeof(void )) = *page_ptr;
		269	*page_ptr = ret;
		270
		271	return ret;
		272	}
		273
		274	/*
		275	* Add a TB and if needed apply the FH HW bug workaround;
		276	* meta != NULL indicates that it's a page mapping and we
		277	* need to dma_unmap_page() and set the meta->tbs bit in
		278	* this case.
		279	*/
		280	static int iwl_pcie_gen2_set_tb_with_wa(struct iwl_trans *trans,
		281	struct sk_buff *skb,
		282	struct iwl_tfh_tfd *tfd,
		283	dma_addr_t phys, void *virt,
		284	u16 len, struct iwl_cmd_meta *meta)
		285	{
		286	dma_addr_t oldphys = phys;
		287	struct page *page;
		288	int ret;
		289
		290	if (unlikely(dma_mapping_error(trans->dev, phys)))
		291	return -ENOMEM;
		292
		293	if (likely(!iwl_pcie_crosses_4g_boundary(phys, len))) {
		294	ret = iwl_pcie_gen2_set_tb(trans, tfd, phys, len);
		295
		296	if (ret < 0)
		297	goto unmap;
		298
		299	if (meta)
		300	meta->tbs \|= BIT(ret);
		301
		302	ret = 0;
		303	goto trace;
		304	}
		305
		306	/*
		307	* Work around a hardware bug. If (as expressed in the
		308	* condition above) the TB ends on a 32-bit boundary,
		309	* then the next TB may be accessed with the wrong
		310	* address.
		311	* To work around it, copy the data elsewhere and make
		312	* a new mapping for it so the device will not fail.
		313	*/
		314
		315	if (WARN_ON(len > PAGE_SIZE - sizeof(void *))) {
		316	ret = -ENOBUFS;
		317	goto unmap;
		318	}
		319
		320	page = get_workaround_page(trans, skb);
		321	if (!page) {
		322	ret = -ENOMEM;
		323	goto unmap;
		324	}
		325
		326	memcpy(page_address(page), virt, len);
		327
		328	phys = dma_map_single(trans->dev, page_address(page), len,
		329	DMA_TO_DEVICE);
		330	if (unlikely(dma_mapping_error(trans->dev, phys)))
		331	return -ENOMEM;
		332	ret = iwl_pcie_gen2_set_tb(trans, tfd, phys, len);
		333	if (ret < 0) {
		334	/* unmap the new allocation as single */
		335	oldphys = phys;
		336	meta = NULL;
		337	goto unmap;
		338	}
		339	IWL_WARN(trans,
		340	"TB bug workaround: copied %d bytes from 0x%llx to 0x%llx\n",
		341	len, (unsigned long long)oldphys, (unsigned long long)phys);
		342
		343	ret = 0;
		344	unmap:
		345	if (meta)
		346	dma_unmap_page(trans->dev, oldphys, len, DMA_TO_DEVICE);
		347	else
		348	dma_unmap_single(trans->dev, oldphys, len, DMA_TO_DEVICE);
		349	trace:
		350	trace_iwlwifi_dev_tx_tb(trans->dev, skb, virt, phys, len);
		351
		352	return ret;
		353	}
		354
243	static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,	355	static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
244	struct sk_buff *skb,	356	struct sk_buff *skb,
245	struct iwl_tfh_tfd *tfd, int start_len,	357	struct iwl_tfh_tfd *tfd, int start_len,
246	u8 hdr_len, struct iwl_device_cmd *dev_cmd)	358	u8 hdr_len,
		359	struct iwl_device_tx_cmd *dev_cmd)
247	{	360	{
248	#ifdef CONFIG_INET	361	#ifdef CONFIG_INET
249	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
250	struct iwl_tx_cmd_gen2 tx_cmd = (void )dev_cmd->payload;	362	struct iwl_tx_cmd_gen2 tx_cmd = (void )dev_cmd->payload;
251	struct ieee80211_hdr hdr = (void )skb->data;	363	struct ieee80211_hdr hdr = (void )skb->data;
252	unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room;	364	unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room;
@@ -254,7 +366,6 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, · 1 unmodified line
254	u16 length, amsdu_pad;	366	u16 length, amsdu_pad;
255	u8 *start_hdr;	367	u8 *start_hdr;
256	struct iwl_tso_hdr_page *hdr_page;	368	struct iwl_tso_hdr_page *hdr_page;
257	struct page **page_ptr;
258	struct tso_t tso;	369	struct tso_t tso;
259		370
260	trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd),	371	trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd),
@@ -270,14 +381,11 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, · 9 unmodified lines
270	(3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr));	381	(3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr));
271		382
272	/* Our device supports 9 segments at most, it will fit in 1 page */	383	/* Our device supports 9 segments at most, it will fit in 1 page */
273	hdr_page = get_page_hdr(trans, hdr_room);	384	hdr_page = get_page_hdr(trans, hdr_room, skb);
274	if (!hdr_page)	385	if (!hdr_page)
275	return -ENOMEM;	386	return -ENOMEM;
276		387
277	get_page(hdr_page->page);
278	start_hdr = hdr_page->pos;	388	start_hdr = hdr_page->pos;
279	page_ptr = (void )((u8 )skb->cb + trans_pcie->page_offs);
280	*page_ptr = hdr_page->page;
281		389
282	/*	390	/*
283	* Pull the ieee80211 header to be able to use TSO core,	391	* Pull the ieee80211 header to be able to use TSO core,
@@ -332,6 +440,11 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, · 48 unmodified lines
332	dev_kfree_skb(csum_skb);	440	dev_kfree_skb(csum_skb);
333	goto out_err;	441	goto out_err;
334	}	442	}
		443	/*
		444	* No need for _with_wa, this is from the TSO page and
		445	* we leave some space at the end of it so can't hit
		446	* the buggy scenario.
		447	*/
335	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, tb_len);	448	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, tb_len);
336	trace_iwlwifi_dev_tx_tb(trans->dev, skb, start_hdr,	449	trace_iwlwifi_dev_tx_tb(trans->dev, skb, start_hdr,
337	tb_phys, tb_len);	450	tb_phys, tb_len);
@@ -343,16 +456,18 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, · 5 unmodified lines
343		456
344	/* put the payload */	457	/* put the payload */
345	while (data_left) {	458	while (data_left) {
		459	int ret;
		460
346	tb_len = min_t(unsigned int, tso.size, data_left);	461	tb_len = min_t(unsigned int, tso.size, data_left);
347	tb_phys = dma_map_single(trans->dev, tso.data,	462	tb_phys = dma_map_single(trans->dev, tso.data,
348	tb_len, DMA_TO_DEVICE);	463	tb_len, DMA_TO_DEVICE);
349	if (unlikely(dma_mapping_error(trans->dev, tb_phys))) {	464	ret = iwl_pcie_gen2_set_tb_with_wa(trans, skb, tfd,
		465	tb_phys, tso.data,
		466	tb_len, NULL);
		467	if (ret) {
350	dev_kfree_skb(csum_skb);	468	dev_kfree_skb(csum_skb);
351	goto out_err;	469	goto out_err;
352	}	470	}
353	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, tb_len);
354	trace_iwlwifi_dev_tx_tb(trans->dev, skb, tso.data,
355	tb_phys, tb_len);
356		471
357	data_left -= tb_len;	472	data_left -= tb_len;
358	tso_build_data(skb, &tso, tb_len);	473	tso_build_data(skb, &tso, tb_len);
@@ -372,7 +487,7 @@ out_err: · 13 unmodified lines
372	static struct	487	static struct
373	iwl_tfh_tfd iwl_pcie_gen2_build_tx_amsdu(struct iwl_trans trans,	488	iwl_tfh_tfd iwl_pcie_gen2_build_tx_amsdu(struct iwl_trans trans,
374	struct iwl_txq *txq,	489	struct iwl_txq *txq,
375	struct iwl_device_cmd *dev_cmd,	490	struct iwl_device_tx_cmd *dev_cmd,
376	struct sk_buff *skb,	491	struct sk_buff *skb,
377	struct iwl_cmd_meta *out_meta,	492	struct iwl_cmd_meta *out_meta,
378	int hdr_len,	493	int hdr_len,
@@ -386,6 +501,11 @@ iwl_tfh_tfd iwl_pcie_gen2_build_tx_amsdu(struct iwl_trans trans, · 7 unmodified lines
386		501
387	tb_phys = iwl_pcie_get_first_tb_dma(txq, idx);	502	tb_phys = iwl_pcie_get_first_tb_dma(txq, idx);
388		503
		504	/*
		505	* No need for _with_wa, the first TB allocation is aligned up
		506	* to a 64-byte boundary and thus can't be at the end or cross
		507	* a page boundary (much less a 2^32 boundary).
		508	*/
389	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, IWL_FIRST_TB_SIZE);	509	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, IWL_FIRST_TB_SIZE);
390		510
391	/*	511	/*
@@ -404,6 +524,10 @@ iwl_tfh_tfd iwl_pcie_gen2_build_tx_amsdu(struct iwl_trans trans, · 12 unmodified lines
404	tb_phys = dma_map_single(trans->dev, tb1_addr, len, DMA_TO_DEVICE);	524	tb_phys = dma_map_single(trans->dev, tb1_addr, len, DMA_TO_DEVICE);
405	if (unlikely(dma_mapping_error(trans->dev, tb_phys)))	525	if (unlikely(dma_mapping_error(trans->dev, tb_phys)))
406	goto out_err;	526	goto out_err;
		527	/*
		528	* No need for _with_wa(), we ensure (via alignment) that the data
		529	* here can never cross or end at a page boundary.
		530	*/
407	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, len);	531	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, len);
408		532
409	if (iwl_pcie_gen2_build_amsdu(trans, skb, tfd,	533	if (iwl_pcie_gen2_build_amsdu(trans, skb, tfd,
@@ -430,24 +554,19 @@ static int iwl_pcie_gen2_tx_add_frags(struct iwl_trans *trans, · 20 unmodified lines
430	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {	554	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
431	const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];	555	const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
432	dma_addr_t tb_phys;	556	dma_addr_t tb_phys;
433	int tb_idx;	557	unsigned int fragsz = skb_frag_size(frag);
		558	int ret;
434		559
435	if (!skb_frag_size(frag))	560	if (!fragsz)
436	continue;	561	continue;
437		562
438	tb_phys = skb_frag_dma_map(trans->dev, frag, 0,	563	tb_phys = skb_frag_dma_map(trans->dev, frag, 0,
439	skb_frag_size(frag), DMA_TO_DEVICE);	564	fragsz, DMA_TO_DEVICE);
440		565	ret = iwl_pcie_gen2_set_tb_with_wa(trans, skb, tfd, tb_phys,
441	if (unlikely(dma_mapping_error(trans->dev, tb_phys)))	566	skb_frag_address(frag),
442	return -ENOMEM;	567	fragsz, out_meta);
443	tb_idx = iwl_pcie_gen2_set_tb(trans, tfd, tb_phys,	568	if (ret)
444	skb_frag_size(frag));	569	return ret;
445	trace_iwlwifi_dev_tx_tb(trans->dev, skb, skb_frag_address(frag),
446	tb_phys, skb_frag_size(frag));
447	if (tb_idx < 0)
448	return tb_idx;
449
450	out_meta->tbs \|= BIT(tb_idx);
451	}	570	}
452		571
453	return 0;	572	return 0;
@@ -456,7 +575,7 @@ static int iwl_pcie_gen2_tx_add_frags(struct iwl_trans *trans, · 2 unmodified lines
456	static struct	575	static struct
457	iwl_tfh_tfd iwl_pcie_gen2_build_tx(struct iwl_trans trans,	576	iwl_tfh_tfd iwl_pcie_gen2_build_tx(struct iwl_trans trans,
458	struct iwl_txq *txq,	577	struct iwl_txq *txq,
459	struct iwl_device_cmd *dev_cmd,	578	struct iwl_device_tx_cmd *dev_cmd,
460	struct sk_buff *skb,	579	struct sk_buff *skb,
461	struct iwl_cmd_meta *out_meta,	580	struct iwl_cmd_meta *out_meta,
462	int hdr_len,	581	int hdr_len,
@@ -475,6 +594,11 @@ iwl_tfh_tfd iwl_pcie_gen2_build_tx(struct iwl_trans trans, · 12 unmodified lines
475	/* The first TB points to bi-directional DMA data */	594	/* The first TB points to bi-directional DMA data */
476	memcpy(&txq->first_tb_bufs[idx], dev_cmd, IWL_FIRST_TB_SIZE);	595	memcpy(&txq->first_tb_bufs[idx], dev_cmd, IWL_FIRST_TB_SIZE);
477		596
		597	/*
		598	* No need for _with_wa, the first TB allocation is aligned up
		599	* to a 64-byte boundary and thus can't be at the end or cross
		600	* a page boundary (much less a 2^32 boundary).
		601	*/
478	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, IWL_FIRST_TB_SIZE);	602	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, IWL_FIRST_TB_SIZE);
479		603
480	/*	604	/*
@@ -496,6 +620,10 @@ iwl_tfh_tfd iwl_pcie_gen2_build_tx(struct iwl_trans trans, · 15 unmodified lines
496	tb_phys = dma_map_single(trans->dev, tb1_addr, tb1_len, DMA_TO_DEVICE);	620	tb_phys = dma_map_single(trans->dev, tb1_addr, tb1_len, DMA_TO_DEVICE);
497	if (unlikely(dma_mapping_error(trans->dev, tb_phys)))	621	if (unlikely(dma_mapping_error(trans->dev, tb_phys)))
498	goto out_err;	622	goto out_err;
		623	/*
		624	* No need for _with_wa(), we ensure (via alignment) that the data
		625	* here can never cross or end at a page boundary.
		626	*/
499	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, tb1_len);	627	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, tb1_len);
500	trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd), &dev_cmd->hdr,	628	trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd), &dev_cmd->hdr,
501	IWL_FIRST_TB_SIZE + tb1_len, hdr_len);	629	IWL_FIRST_TB_SIZE + tb1_len, hdr_len);
@@ -504,26 +632,30 @@ iwl_tfh_tfd iwl_pcie_gen2_build_tx(struct iwl_trans trans, · 2 unmodified lines
504	tb2_len = skb_headlen(skb) - hdr_len;	632	tb2_len = skb_headlen(skb) - hdr_len;
505		633
506	if (tb2_len > 0) {	634	if (tb2_len > 0) {
		635	int ret;
		636
507	tb_phys = dma_map_single(trans->dev, skb->data + hdr_len,	637	tb_phys = dma_map_single(trans->dev, skb->data + hdr_len,
508	tb2_len, DMA_TO_DEVICE);	638	tb2_len, DMA_TO_DEVICE);
509	if (unlikely(dma_mapping_error(trans->dev, tb_phys)))	639	ret = iwl_pcie_gen2_set_tb_with_wa(trans, skb, tfd, tb_phys,
		640	skb->data + hdr_len, tb2_len,
		641	NULL);
		642	if (ret)
510	goto out_err;	643	goto out_err;
511	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, tb2_len);
512	trace_iwlwifi_dev_tx_tb(trans->dev, skb, skb->data + hdr_len,
513	tb_phys, tb2_len);
514	}	644	}
515		645
516	if (iwl_pcie_gen2_tx_add_frags(trans, skb, tfd, out_meta))	646	if (iwl_pcie_gen2_tx_add_frags(trans, skb, tfd, out_meta))
517	goto out_err;	647	goto out_err;
518		648
519	skb_walk_frags(skb, frag) {	649	skb_walk_frags(skb, frag) {
		650	int ret;
		651
520	tb_phys = dma_map_single(trans->dev, frag->data,	652	tb_phys = dma_map_single(trans->dev, frag->data,
521	skb_headlen(frag), DMA_TO_DEVICE);	653	skb_headlen(frag), DMA_TO_DEVICE);
522	if (unlikely(dma_mapping_error(trans->dev, tb_phys)))	654	ret = iwl_pcie_gen2_set_tb_with_wa(trans, skb, tfd, tb_phys,
		655	frag->data,
		656	skb_headlen(frag), NULL);
		657	if (ret)
523	goto out_err;	658	goto out_err;
524	iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, skb_headlen(frag));
525	trace_iwlwifi_dev_tx_tb(trans->dev, skb, frag->data,
526	tb_phys, skb_headlen(frag));
527	if (iwl_pcie_gen2_tx_add_frags(trans, frag, tfd, out_meta))	659	if (iwl_pcie_gen2_tx_add_frags(trans, frag, tfd, out_meta))
528	goto out_err;	660	goto out_err;
529	}	661	}
@@ -538,7 +670,7 @@ out_err: · 8 unmodified lines
538	static	670	static
539	struct iwl_tfh_tfd iwl_pcie_gen2_build_tfd(struct iwl_trans trans,	671	struct iwl_tfh_tfd iwl_pcie_gen2_build_tfd(struct iwl_trans trans,
540	struct iwl_txq *txq,	672	struct iwl_txq *txq,
541	struct iwl_device_cmd *dev_cmd,	673	struct iwl_device_tx_cmd *dev_cmd,
542	struct sk_buff *skb,	674	struct sk_buff *skb,
543	struct iwl_cmd_meta *out_meta)	675	struct iwl_cmd_meta *out_meta)
544	{	676	{
@@ -578,7 +710,7 @@ struct iwl_tfh_tfd iwl_pcie_gen2_build_tfd(struct iwl_trans trans, · 33 unmodified lines
578	}	710	}
579		711
580	int iwl_trans_pcie_gen2_tx(struct iwl_trans trans, struct sk_buff skb,	712	int iwl_trans_pcie_gen2_tx(struct iwl_trans trans, struct sk_buff skb,
581	struct iwl_device_cmd *dev_cmd, int txq_id)	713	struct iwl_device_tx_cmd *dev_cmd, int txq_id)
582	{	714	{
583	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);	715	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
584	struct iwl_cmd_meta *out_meta;	716	struct iwl_cmd_meta *out_meta;
@@ -603,7 +735,7 @@ int iwl_trans_pcie_gen2_tx(struct iwl_trans trans, struct sk_buff skb, · 18 unmodified lines
603		735
604	/* don't put the packet on the ring, if there is no room */	736	/* don't put the packet on the ring, if there is no room */
605	if (unlikely(iwl_queue_space(trans, txq) < 3)) {	737	if (unlikely(iwl_queue_space(trans, txq) < 3)) {
606	struct iwl_device_cmd **dev_cmd_ptr;	738	struct iwl_device_tx_cmd **dev_cmd_ptr;
607		739
608	dev_cmd_ptr = (void )((u8 )skb->cb +	740	dev_cmd_ptr = (void )((u8 )skb->cb +
609	trans_pcie->dev_cmd_offs);	741	trans_pcie->dev_cmd_offs);

drivers/net/wireless/intel/iwlwifi/pcie/tx.c+47−21

@@ -213,8 +213,8 @@ static void iwl_pcie_txq_update_byte_cnt_tbl(struct iwl_trans *trans, · 212 unmodified lines
213	u8 sec_ctl = 0;	213	u8 sec_ctl = 0;
214	u16 len = byte_cnt + IWL_TX_CRC_SIZE + IWL_TX_DELIMITER_SIZE;	214	u16 len = byte_cnt + IWL_TX_CRC_SIZE + IWL_TX_DELIMITER_SIZE;
215	__le16 bc_ent;	215	__le16 bc_ent;
216	struct iwl_tx_cmd *tx_cmd =	216	struct iwl_device_tx_cmd *dev_cmd = txq->entries[txq->write_ptr].cmd;
217	(void *)txq->entries[txq->write_ptr].cmd->payload;	217	struct iwl_tx_cmd tx_cmd = (void )dev_cmd->payload;
218	u8 sta_id = tx_cmd->sta_id;	218	u8 sta_id = tx_cmd->sta_id;
219		219
220	scd_bc_tbl = trans_pcie->scd_bc_tbls.addr;	220	scd_bc_tbl = trans_pcie->scd_bc_tbls.addr;
@@ -257,8 +257,8 @@ static void iwl_pcie_txq_inval_byte_cnt_tbl(struct iwl_trans *trans, · 36 unmodified lines
257	int read_ptr = txq->read_ptr;	257	int read_ptr = txq->read_ptr;
258	u8 sta_id = 0;	258	u8 sta_id = 0;
259	__le16 bc_ent;	259	__le16 bc_ent;
260	struct iwl_tx_cmd *tx_cmd =	260	struct iwl_device_tx_cmd *dev_cmd = txq->entries[read_ptr].cmd;
261	(void *)txq->entries[read_ptr].cmd->payload;	261	struct iwl_tx_cmd tx_cmd = (void )dev_cmd->payload;
262		262
263	WARN_ON(read_ptr >= TFD_QUEUE_SIZE_MAX);	263	WARN_ON(read_ptr >= TFD_QUEUE_SIZE_MAX);
264		264
@@ -624,12 +624,18 @@ void iwl_pcie_free_tso_page(struct iwl_trans_pcie *trans_pcie, · 359 unmodified lines
624	struct sk_buff *skb)	624	struct sk_buff *skb)
625	{	625	{
626	struct page **page_ptr;	626	struct page **page_ptr;
		627	struct page *next;
627		628
628	page_ptr = (void )((u8 )skb->cb + trans_pcie->page_offs);	629	page_ptr = (void )((u8 )skb->cb + trans_pcie->page_offs);
		630	next = *page_ptr;
		631	*page_ptr = NULL;
629		632
630	if (*page_ptr) {	633	while (next) {
631	__free_page(*page_ptr);	634	struct page *tmp = next;
632	*page_ptr = NULL;	635
		636	next = (void *)(page_address(next) + PAGE_SIZE -
		637	sizeof(void *));
		638	__free_page(tmp);
633	}	639	}
634	}	640	}
635		641
@@ -1196,7 +1202,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn, · 560 unmodified lines
1196		1202
1197	while (!skb_queue_empty(&overflow_skbs)) {	1203	while (!skb_queue_empty(&overflow_skbs)) {
1198	struct sk_buff *skb = __skb_dequeue(&overflow_skbs);	1204	struct sk_buff *skb = __skb_dequeue(&overflow_skbs);
1199	struct iwl_device_cmd *dev_cmd_ptr;	1205	struct iwl_device_tx_cmd *dev_cmd_ptr;
1200		1206
1201	dev_cmd_ptr = (void )((u8 )skb->cb +	1207	dev_cmd_ptr = (void )((u8 )skb->cb +
1202	trans_pcie->dev_cmd_offs);	1208	trans_pcie->dev_cmd_offs);
@@ -2052,17 +2058,34 @@ static int iwl_fill_data_tbs(struct iwl_trans trans, struct sk_buff skb, · 849 unmodified lines
2052	}	2058	}
2053		2059
2054	#ifdef CONFIG_INET	2060	#ifdef CONFIG_INET
2055	struct iwl_tso_hdr_page get_page_hdr(struct iwl_trans trans, size_t len)	2061	struct iwl_tso_hdr_page get_page_hdr(struct iwl_trans trans, size_t len,
		2062	struct sk_buff *skb)
2056	{	2063	{
2057	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);	2064	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
2058	struct iwl_tso_hdr_page *p = this_cpu_ptr(trans_pcie->tso_hdr_page);	2065	struct iwl_tso_hdr_page *p = this_cpu_ptr(trans_pcie->tso_hdr_page);
		2066	struct page **page_ptr;
		2067
		2068	page_ptr = (void )((u8 )skb->cb + trans_pcie->page_offs);
		2069
		2070	if (WARN_ON(*page_ptr))
		2071	return NULL;
2059		2072
2060	if (!p->page)	2073	if (!p->page)
2061	goto alloc;	2074	goto alloc;
2062		2075
2063	/* enough room on this page */	2076	/*
2064	if (p->pos + len < (u8 *)page_address(p->page) + PAGE_SIZE)	2077	* Check if there's enough room on this page
2065	return p;	2078	*
		2079	* Note that we put a page chaining pointer last in the
		2080	* page - we need it somewhere, and if it's there then we
		2081	* avoid DMA mapping the last bits of the page which may
		2082	* trigger the 32-bit boundary hardware bug.
		2083	*
		2084	* (see also get_workaround_page() in tx-gen2.c)
		2085	*/
		2086	if (p->pos + len < (u8 *)page_address(p->page) + PAGE_SIZE -
		2087	sizeof(void *))
		2088	goto out;
2066		2089
2067	/* We don't have enough room on this page, get a new one. */	2090	/* We don't have enough room on this page, get a new one. */
2068	__free_page(p->page);	2091	__free_page(p->page);
@@ -2072,6 +2095,11 @@ alloc: · 3 unmodified lines
2072	if (!p->page)	2095	if (!p->page)
2073	return NULL;	2096	return NULL;
2074	p->pos = page_address(p->page);	2097	p->pos = page_address(p->page);
		2098	/* set the chaining pointer to NULL */
		2099	(void )(page_address(p->page) + PAGE_SIZE - sizeof(void )) = NULL;
		2100	out:
		2101	*page_ptr = p->page;
		2102	get_page(p->page);
2075	return p;	2103	return p;
2076	}	2104	}
2077		2105
@@ -2097,7 +2125,8 @@ static void iwl_compute_pseudo_hdr_csum(void iph, struct tcphdr tcph, · 19 unmodified lines
2097	static int iwl_fill_data_tbs_amsdu(struct iwl_trans trans, struct sk_buff skb,	2125	static int iwl_fill_data_tbs_amsdu(struct iwl_trans trans, struct sk_buff skb,
2098	struct iwl_txq *txq, u8 hdr_len,	2126	struct iwl_txq *txq, u8 hdr_len,
2099	struct iwl_cmd_meta *out_meta,	2127	struct iwl_cmd_meta *out_meta,
2100	struct iwl_device_cmd *dev_cmd, u16 tb1_len)	2128	struct iwl_device_tx_cmd *dev_cmd,
		2129	u16 tb1_len)
2101	{	2130	{
2102	struct iwl_tx_cmd tx_cmd = (void )dev_cmd->payload;	2131	struct iwl_tx_cmd tx_cmd = (void )dev_cmd->payload;
2103	struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;	2132	struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;
@@ -2107,7 +2136,6 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans trans, struct sk_buff skb, · 3 unmodified lines
2107	u16 length, iv_len, amsdu_pad;	2136	u16 length, iv_len, amsdu_pad;
2108	u8 *start_hdr;	2137	u8 *start_hdr;
2109	struct iwl_tso_hdr_page *hdr_page;	2138	struct iwl_tso_hdr_page *hdr_page;
2110	struct page **page_ptr;
2111	struct tso_t tso;	2139	struct tso_t tso;
2112		2140
2113	/* if the packet is protected, then it must be CCMP or GCMP */	2141	/* if the packet is protected, then it must be CCMP or GCMP */
@@ -2130,14 +2158,11 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans trans, struct sk_buff skb, · 16 unmodified lines
2130	(3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len;	2158	(3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len;
2131		2159
2132	/* Our device supports 9 segments at most, it will fit in 1 page */	2160	/* Our device supports 9 segments at most, it will fit in 1 page */
2133	hdr_page = get_page_hdr(trans, hdr_room);	2161	hdr_page = get_page_hdr(trans, hdr_room, skb);
2134	if (!hdr_page)	2162	if (!hdr_page)
2135	return -ENOMEM;	2163	return -ENOMEM;
2136		2164
2137	get_page(hdr_page->page);
2138	start_hdr = hdr_page->pos;	2165	start_hdr = hdr_page->pos;
2139	page_ptr = (void )((u8 )skb->cb + trans_pcie->page_offs);
2140	*page_ptr = hdr_page->page;
2141	memcpy(hdr_page->pos, skb->data + hdr_len, iv_len);	2166	memcpy(hdr_page->pos, skb->data + hdr_len, iv_len);
2142	hdr_page->pos += iv_len;	2167	hdr_page->pos += iv_len;
2143		2168
@@ -2279,7 +2304,8 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans trans, struct sk_buff skb, · 135 unmodified lines
2279	static int iwl_fill_data_tbs_amsdu(struct iwl_trans trans, struct sk_buff skb,	2304	static int iwl_fill_data_tbs_amsdu(struct iwl_trans trans, struct sk_buff skb,
2280	struct iwl_txq *txq, u8 hdr_len,	2305	struct iwl_txq *txq, u8 hdr_len,
2281	struct iwl_cmd_meta *out_meta,	2306	struct iwl_cmd_meta *out_meta,
2282	struct iwl_device_cmd *dev_cmd, u16 tb1_len)	2307	struct iwl_device_tx_cmd *dev_cmd,
		2308	u16 tb1_len)
2283	{	2309	{
2284	/* No A-MSDU without CONFIG_INET */	2310	/* No A-MSDU without CONFIG_INET */
2285	WARN_ON(1);	2311	WARN_ON(1);
@@ -2289,7 +2315,7 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans trans, struct sk_buff skb, · 3 unmodified lines
2289	#endif /* CONFIG_INET */	2315	#endif /* CONFIG_INET */
2290		2316
2291	int iwl_trans_pcie_tx(struct iwl_trans trans, struct sk_buff skb,	2317	int iwl_trans_pcie_tx(struct iwl_trans trans, struct sk_buff skb,
2292	struct iwl_device_cmd *dev_cmd, int txq_id)	2318	struct iwl_device_tx_cmd *dev_cmd, int txq_id)
2293	{	2319	{
2294	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);	2320	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
2295	struct ieee80211_hdr *hdr;	2321	struct ieee80211_hdr *hdr;
@@ -2346,7 +2372,7 @@ int iwl_trans_pcie_tx(struct iwl_trans trans, struct sk_buff skb, · 50 unmodified lines
2346		2372
2347	/* don't put the packet on the ring, if there is no room */	2373	/* don't put the packet on the ring, if there is no room */
2348	if (unlikely(iwl_queue_space(trans, txq) < 3)) {	2374	if (unlikely(iwl_queue_space(trans, txq) < 3)) {
2349	struct iwl_device_cmd **dev_cmd_ptr;	2375	struct iwl_device_tx_cmd **dev_cmd_ptr;
2350		2376
2351	dev_cmd_ptr = (void )((u8 )skb->cb +	2377	dev_cmd_ptr = (void )((u8 )skb->cb +
2352	trans_pcie->dev_cmd_offs);	2378	trans_pcie->dev_cmd_offs);

drivers/net/wireless/marvell/libertas/cfg.c+13−3

 	int hw, ap, ap_max = ie[1];
 	u8 hw_rate;
+	if (ap_max > MAX_RATES) {
+		lbs_deb_assoc("invalid rates\n");
+		return tlv;
+	}
 	/* Advance past IE header */
 	ie += 2;
 	struct cmd_ds_802_11_ad_hoc_join cmd;
 	u8 preamble = RADIO_PREAMBLE_SHORT;
 	int ret = 0;
+	int hw, i;
+	u8 rates_max;
+	u8 *rates;
 	/* TODO: set preamble based on scan result */
 	ret = lbs_set_radio(priv, preamble, 1);
 	if (!rates_eid) {
 		lbs_add_rates(cmd.bss.rates);
 	} else {
-		int hw, i;
+		rates_max = rates_eid[1];
-		u8 rates_max = rates_eid[1];
+		if (rates_max > MAX_RATES) {
-		u8 *rates = cmd.bss.rates;
+			lbs_deb_join("invalid rates");
+			goto out;
+		}
+		rates = cmd.bss.rates;
 		for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
 			u8 hw_rate = lbs_rates[hw].bitrate / 5;
 			for (i = 0; i < rates_max; i++) {

drivers/net/wireless/mediatek/mt76/airtime.c+1−1

@@ -242,7 +242,7 @@ u32 mt76_calc_rx_airtime(struct mt76_dev dev, struct mt76_rx_status status, · 241 unmodified lines
242	return 0;	242	return 0;
243		243
244	sband = dev->hw->wiphy->bands[status->band];	244	sband = dev->hw->wiphy->bands[status->band];
245	if (!sband \|\| status->rate_idx > sband->n_bitrates)	245	if (!sband \|\| status->rate_idx >= sband->n_bitrates)
246	return 0;	246	return 0;
247		247
248	rate = &sband->bitrates[status->rate_idx];	248	rate = &sband->bitrates[status->rate_idx];

drivers/net/wireless/mediatek/mt76/mac80211.c+2−1

@@ -378,7 +378,8 @@ void mt76_unregister_device(struct mt76_dev *dev) · 377 unmodified lines
378	{	378	{
379	struct ieee80211_hw *hw = dev->hw;	379	struct ieee80211_hw *hw = dev->hw;
380		380
381	mt76_led_cleanup(dev);	381	if (IS_ENABLED(CONFIG_MT76_LEDS))
		382	mt76_led_cleanup(dev);
382	mt76_tx_status_check(dev, NULL, true);	383	mt76_tx_status_check(dev, NULL, true);
383	ieee80211_unregister_hw(hw);	384	ieee80211_unregister_hw(hw);
384	}	385	}

include/linux/netdevice.h+2−0

 int dev_get_alias(const struct net_device *, char *, size_t);
 int dev_change_net_namespace(struct net_device *, struct net *, const char *);
 int __dev_set_mtu(struct net_device *, int);
+int dev_validate_mtu(struct net_device *dev, int mtu,
+		     struct netlink_ext_ack *extack);
 int dev_set_mtu_ext(struct net_device *dev, int mtu,
 		    struct netlink_ext_ack *extack);
 int dev_set_mtu(struct net_device *, int);

include/linux/netfilter/ipset/ip_set.h+0−7

@@ -426,13 +426,6 @@ ip6addrptr(const struct sk_buff skb, bool src, struct in6_addr addr) · 425 unmodified lines
426	sizeof(*addr));	426	sizeof(*addr));
427	}	427	}
428		428
429	/* Calculate the bytes required to store the inclusive range of a-b */
430	static inline int
431	bitmap_bytes(u32 a, u32 b)
432	{
433	return 4 * ((((b - a + 8) / 8) + 3) / 4);
434	}
435
436	/* How often should the gc be run by default */	429	/* How often should the gc be run by default */
437	#define IPSET_GC_TIME (3 * 60)	430	#define IPSET_GC_TIME (3 * 60)
438		431

include/linux/netfilter/nfnetlink.h+1−1

@@ -31,7 +31,7 @@ struct nfnetlink_subsystem { · 30 unmodified lines
31	const struct nfnl_callback cb; / callback for individual types */	31	const struct nfnl_callback cb; / callback for individual types */
32	struct module *owner;	32	struct module *owner;
33	int (commit)(struct net net, struct sk_buff *skb);	33	int (commit)(struct net net, struct sk_buff *skb);
34	int (abort)(struct net net, struct sk_buff *skb);	34	int (abort)(struct net net, struct sk_buff *skb, bool autoload);
35	void (cleanup)(struct net net);	35	void (cleanup)(struct net net);
36	bool (valid_genid)(struct net net, u32 genid);	36	bool (valid_genid)(struct net net, u32 genid);
37	};	37	};

include/net/netns/nftables.h+1−0

@@ -7,6 +7,7 @@ · 6 unmodified lines
7	struct netns_nftables {	7	struct netns_nftables {
8	struct list_head tables;	8	struct list_head tables;
9	struct list_head commit_list;	9	struct list_head commit_list;
		10	struct list_head module_list;
10	struct mutex commit_mutex;	11	struct mutex commit_mutex;
11	unsigned int base_seq;	12	unsigned int base_seq;
12	u8 gencursor;	13	u8 gencursor;

net/atm/proc.c+1−2

@@ -134,8 +134,7 @@ static void vcc_seq_stop(struct seq_file seq, void v) · 133 unmodified lines
134	static void vcc_seq_next(struct seq_file seq, void v, loff_t pos)	134	static void vcc_seq_next(struct seq_file seq, void v, loff_t pos)
135	{	135	{
136	v = vcc_walk(seq, 1);	136	v = vcc_walk(seq, 1);
137	if (v)	137	(*pos)++;
138	(*pos)++;
139	return v;	138	return v;
140	}	139	}
141		140

net/caif/caif_usb.c+1−1

@@ -62,7 +62,7 @@ static int cfusbl_transmit(struct cflayer layr, struct cfpkt pkt) · 61 unmodified lines
62	hpad = (info->hdr_len + CFUSB_PAD_DESCR_SZ) & (CFUSB_ALIGNMENT - 1);	62	hpad = (info->hdr_len + CFUSB_PAD_DESCR_SZ) & (CFUSB_ALIGNMENT - 1);
63		63
64	if (skb_headroom(skb) < ETH_HLEN + CFUSB_PAD_DESCR_SZ + hpad) {	64	if (skb_headroom(skb) < ETH_HLEN + CFUSB_PAD_DESCR_SZ + hpad) {
65	pr_warn("Headroom to small\n");	65	pr_warn("Headroom too small\n");
66	kfree_skb(skb);	66	kfree_skb(skb);
67	return -EIO;	67	return -EIO;
68	}	68	}

net/core/dev.c+55−42

 	put_online_cpus();
 }
+/* Pass the currently batched GRO_NORMAL SKBs up to the stack. */
+static void gro_normal_list(struct napi_struct *napi)
+{
+	if (!napi->rx_count)
+		return;
+	netif_receive_skb_list_internal(&napi->rx_list);
+	INIT_LIST_HEAD(&napi->rx_list);
+	napi->rx_count = 0;
+}
+/* Queue one GRO_NORMAL SKB up for list processing. If batch size exceeded,
+ * pass the whole batch up to the stack.
+ */
+static void gro_normal_one(struct napi_struct *napi, struct sk_buff *skb)
+{
+	list_add_tail(&skb->list, &napi->rx_list);
+	if (++napi->rx_count >= gro_normal_batch)
+		gro_normal_list(napi);
+}
 INDIRECT_CALLABLE_DECLARE(int inet_gro_complete(struct sk_buff *, int));
 INDIRECT_CALLABLE_DECLARE(int ipv6_gro_complete(struct sk_buff *, int));
-static int napi_gro_complete(struct sk_buff *skb)
+static int napi_gro_complete(struct napi_struct *napi, struct sk_buff *skb)
 {
 	struct packet_offload *ptype;
 	__be16 type = skb->protocol;
 	}
 out:
-	return netif_receive_skb_internal(skb);
+	gro_normal_one(napi, skb);
+	return NET_RX_SUCCESS;
 }
 static void __napi_gro_flush_chain(struct napi_struct *napi, u32 index,
 		if (flush_old && NAPI_GRO_CB(skb)->age == jiffies)
 			return;
 		skb_list_del_init(skb);
-		napi_gro_complete(skb);
+		napi_gro_complete(napi, skb);
 		napi->gro_hash[index].count--;
 	}
 	}
 }
-static void gro_flush_oldest(struct list_head *head)
+static void gro_flush_oldest(struct napi_struct *napi, struct list_head *head)
 {
 	struct sk_buff *oldest;
 	 * SKB to the chain.
 	 */
 	skb_list_del_init(oldest);
-	napi_gro_complete(oldest);
+	napi_gro_complete(napi, oldest);
 }
 INDIRECT_CALLABLE_DECLARE(struct sk_buff *inet_gro_receive(struct list_head *,
 	if (pp) {
 		skb_list_del_init(pp);
-		napi_gro_complete(pp);
+		napi_gro_complete(napi, pp);
 		napi->gro_hash[hash].count--;
 	}
 		goto normal;
 	if (unlikely(napi->gro_hash[hash].count >= MAX_GRO_SKBS)) {
-		gro_flush_oldest(gro_head);
+		gro_flush_oldest(napi, gro_head);
 	} else {
 		napi->gro_hash[hash].count++;
 	}
 }
 EXPORT_SYMBOL(gro_find_complete_by_type);
-/* Pass the currently batched GRO_NORMAL SKBs up to the stack. */
-static void gro_normal_list(struct napi_struct *napi)
-{
-	if (!napi->rx_count)
-		return;
-	netif_receive_skb_list_internal(&napi->rx_list);
-	INIT_LIST_HEAD(&napi->rx_list);
-	napi->rx_count = 0;
-}
-/* Queue one GRO_NORMAL SKB up for list processing. If batch size exceeded,
- * pass the whole batch up to the stack.
- */
-static void gro_normal_one(struct napi_struct *napi, struct sk_buff *skb)
-{
-	list_add_tail(&skb->list, &napi->rx_list);
-	if (++napi->rx_count >= gro_normal_batch)
-		gro_normal_list(napi);
-}
 static void napi_skb_free_stolen_head(struct sk_buff *skb)
 {
 	skb_dst_drop(skb);
 				 NAPIF_STATE_IN_BUSY_POLL)))
 		return false;
-	gro_normal_list(n);
 	if (n->gro_bitmask) {
 		unsigned long timeout = 0;
 			hrtimer_start(&n->timer, ns_to_ktime(timeout),
 				      HRTIMER_MODE_REL_PINNED);
 	}
+	gro_normal_list(n);
 	if (unlikely(!list_empty(&n->poll_list))) {
 		/* If n->poll_list is not empty, we need to mask irqs */
 		local_irq_save(flags);
 		goto out_unlock;
 	}
-	gro_normal_list(n);
 	if (n->gro_bitmask) {
 		/* flush too old packets
 		 * If HZ < 1000, flush all packets.
 		napi_gro_flush(n, HZ >= 1000);
 	}
+	gro_normal_list(n);
 	/* Some drivers may have called napi_schedule
 	 * prior to exhausting their budget.
 	 */
 }
 EXPORT_SYMBOL(__dev_set_mtu);
+int dev_validate_mtu(struct net_device *dev, int new_mtu,
+		     struct netlink_ext_ack *extack)
+{
+	/* MTU must be positive, and in range */
+	if (new_mtu < 0 || new_mtu < dev->min_mtu) {
+		NL_SET_ERR_MSG(extack, "mtu less than device minimum");
+		return -EINVAL;
+	}
+	if (dev->max_mtu > 0 && new_mtu > dev->max_mtu) {
+		NL_SET_ERR_MSG(extack, "mtu greater than device maximum");
+		return -EINVAL;
+	}
+	return 0;
+}
 /**
  *	dev_set_mtu_ext - Change maximum transfer unit
  *	@dev: device
 	if (new_mtu == dev->mtu)
 		return 0;
-	/* MTU must be positive, and in range */
+	err = dev_validate_mtu(dev, new_mtu, extack);
-	if (new_mtu < 0 || new_mtu < dev->min_mtu) {
+	if (err)
-		NL_SET_ERR_MSG(extack, "mtu less than device minimum");
+		return err;
-		return -EINVAL;
-	}
-	if (dev->max_mtu > 0 && new_mtu > dev->max_mtu) {
-		NL_SET_ERR_MSG(extack, "mtu greater than device maximum");
-		return -EINVAL;
-	}
 	if (!netif_device_present(dev))
 		return -ENODEV;
 		goto err_uninit;
 	ret = netdev_register_kobject(dev);
-	if (ret)
+	if (ret) {
+		dev->reg_state = NETREG_UNREGISTERED;
 		goto err_uninit;
+	}
 	dev->reg_state = NETREG_REGISTERED;
 	__netdev_update_features(dev);

net/core/neighbour.c+1−0

@@ -3290,6 +3290,7 @@ static void neigh_stat_seq_next(struct seq_file seq, void v, loff_t pos) · 3289 unmodified lines
3290	*pos = cpu+1;	3290	*pos = cpu+1;
3291	return per_cpu_ptr(tbl->stats, cpu);	3291	return per_cpu_ptr(tbl->stats, cpu);
3292	}	3292	}
		3293	(*pos)++;
3293	return NULL;	3294	return NULL;
3294	}	3295	}
3295		3296

net/core/rtnetlink.c+11−2

@@ -3048,8 +3048,17 @@ struct net_device rtnl_create_link(struct net net, const char *ifname, · 3047 unmodified lines
3048	dev->rtnl_link_ops = ops;	3048	dev->rtnl_link_ops = ops;
3049	dev->rtnl_link_state = RTNL_LINK_INITIALIZING;	3049	dev->rtnl_link_state = RTNL_LINK_INITIALIZING;
3050		3050
3051	if (tb[IFLA_MTU])	3051	if (tb[IFLA_MTU]) {
3052	dev->mtu = nla_get_u32(tb[IFLA_MTU]);	3052	u32 mtu = nla_get_u32(tb[IFLA_MTU]);
		3053	int err;
		3054
		3055	err = dev_validate_mtu(dev, mtu, extack);
		3056	if (err) {
		3057	free_netdev(dev);
		3058	return ERR_PTR(err);
		3059	}
		3060	dev->mtu = mtu;
		3061	}
3053	if (tb[IFLA_ADDRESS]) {	3062	if (tb[IFLA_ADDRESS]) {
3054	memcpy(dev->dev_addr, nla_data(tb[IFLA_ADDRESS]),	3063	memcpy(dev->dev_addr, nla_data(tb[IFLA_ADDRESS]),
3055	nla_len(tb[IFLA_ADDRESS]));	3064	nla_len(tb[IFLA_ADDRESS]));

net/core/skmsg.c+0−2

@@ -594,8 +594,6 @@ EXPORT_SYMBOL_GPL(sk_psock_destroy); · 593 unmodified lines
594		594
595	void sk_psock_drop(struct sock sk, struct sk_psock psock)	595	void sk_psock_drop(struct sock sk, struct sk_psock psock)
596	{	596	{
597	sock_owned_by_me(sk);
598
599	sk_psock_cork_free(psock);	597	sk_psock_cork_free(psock);
600	sk_psock_zap_ingress(psock);	598	sk_psock_zap_ingress(psock);
601		599

net/core/utils.c+17−3

@@ -438,6 +438,23 @@ void inet_proto_csum_replace4(__sum16 sum, struct sk_buff skb, · 437 unmodified lines
438	}	438	}
439	EXPORT_SYMBOL(inet_proto_csum_replace4);	439	EXPORT_SYMBOL(inet_proto_csum_replace4);
440		440
		441	/**
		442	* inet_proto_csum_replace16 - update layer 4 header checksum field
		443	* @sum: Layer 4 header checksum field
		444	* @skb: sk_buff for the packet
		445	* @from: old IPv6 address
		446	* @to: new IPv6 address
		447	* @pseudohdr: True if layer 4 header checksum includes pseudoheader
		448	*
		449	* Update layer 4 header as per the update in IPv6 src/dst address.
		450	*
		451	* There is no need to update skb->csum in this function, because update in two
		452	* fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other
		453	* for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to
		454	* update skb->csum, because update in 3 fields a.) IPv4 src/dst address,
		455	* b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as
		456	* L4 Header checksum for skb->csum calculation.
		457	*/
441	void inet_proto_csum_replace16(__sum16 sum, struct sk_buff skb,	458	void inet_proto_csum_replace16(__sum16 sum, struct sk_buff skb,
442	const __be32 from, const __be32 to,	459	const __be32 from, const __be32 to,
443	bool pseudohdr)	460	bool pseudohdr)
@@ -449,9 +466,6 @@ void inet_proto_csum_replace16(__sum16 sum, struct sk_buff skb, · 5 unmodified lines
449	if (skb->ip_summed != CHECKSUM_PARTIAL) {	466	if (skb->ip_summed != CHECKSUM_PARTIAL) {
450	*sum = csum_fold(csum_partial(diff, sizeof(diff),	467	*sum = csum_fold(csum_partial(diff, sizeof(diff),
451	~csum_unfold(*sum)));	468	~csum_unfold(*sum)));
452	if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
453	skb->csum = ~csum_partial(diff, sizeof(diff),
454	~skb->csum);
455	} else if (pseudohdr)	469	} else if (pseudohdr)
456	*sum = ~csum_fold(csum_partial(diff, sizeof(diff),	470	*sum = ~csum_fold(csum_partial(diff, sizeof(diff),
457	csum_unfold(*sum)));	471	csum_unfold(*sum)));

net/hsr/hsr_main.h+1−1

@@ -191,7 +191,7 @@ void hsr_debugfs_term(struct hsr_priv *priv); · 190 unmodified lines
191	void hsr_debugfs_create_root(void);	191	void hsr_debugfs_create_root(void);
192	void hsr_debugfs_remove_root(void);	192	void hsr_debugfs_remove_root(void);
193	#else	193	#else
194	static inline void void hsr_debugfs_rename(struct net_device *dev)	194	static inline void hsr_debugfs_rename(struct net_device *dev)
195	{	195	{
196	}	196	}
197	static inline void hsr_debugfs_init(struct hsr_priv *priv,	197	static inline void hsr_debugfs_init(struct hsr_priv *priv,

net/ipv4/esp4_offload.c+2−0

@@ -57,6 +57,8 @@ static struct sk_buff esp4_gro_receive(struct list_head head, · 56 unmodified lines
57	if (!x)	57	if (!x)
58	goto out_reset;	58	goto out_reset;
59		59
		60	skb->mark = xfrm_smark_get(skb->mark, x);
		61
60	sp->xvec[sp->len++] = x;	62	sp->xvec[sp->len++] = x;
61	sp->olen++;	63	sp->olen++;
62		64

net/ipv4/fou.c+2−2

@@ -662,8 +662,8 @@ static const struct nla_policy fou_nl_policy[FOU_ATTR_MAX + 1] = { · 661 unmodified lines
662	[FOU_ATTR_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG, },	662	[FOU_ATTR_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG, },
663	[FOU_ATTR_LOCAL_V4] = { .type = NLA_U32, },	663	[FOU_ATTR_LOCAL_V4] = { .type = NLA_U32, },
664	[FOU_ATTR_PEER_V4] = { .type = NLA_U32, },	664	[FOU_ATTR_PEER_V4] = { .type = NLA_U32, },
665	[FOU_ATTR_LOCAL_V6] = { .type = sizeof(struct in6_addr), },	665	[FOU_ATTR_LOCAL_V6] = { .len = sizeof(struct in6_addr), },
666	[FOU_ATTR_PEER_V6] = { .type = sizeof(struct in6_addr), },	666	[FOU_ATTR_PEER_V6] = { .len = sizeof(struct in6_addr), },
667	[FOU_ATTR_PEER_PORT] = { .type = NLA_U16, },	667	[FOU_ATTR_PEER_PORT] = { .type = NLA_U16, },
668	[FOU_ATTR_IFINDEX] = { .type = NLA_S32, },	668	[FOU_ATTR_IFINDEX] = { .type = NLA_S32, },
669	};	669	};

net/ipv4/ip_tunnel.c+1−3

 	iph->version		= 4;
 	iph->ihl		= 5;
-	if (tunnel->collect_md) {
+	if (tunnel->collect_md)
-		dev->features |= NETIF_F_NETNS_LOCAL;
 		netif_keep_dst(dev);
-	}
 	return 0;
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_init);

net/ipv4/ip_vti.c+11−2

@@ -187,8 +187,17 @@ static netdev_tx_t vti_xmit(struct sk_buff skb, struct net_device dev, · 186 unmodified lines
187	int mtu;	187	int mtu;
188		188
189	if (!dst) {	189	if (!dst) {
190	dev->stats.tx_carrier_errors++;	190	struct rtable *rt;
191	goto tx_error_icmp;	191
		192	fl->u.ip4.flowi4_oif = dev->ifindex;
		193	fl->u.ip4.flowi4_flags \|= FLOWI_FLAG_ANYSRC;
		194	rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
		195	if (IS_ERR(rt)) {
		196	dev->stats.tx_carrier_errors++;
		197	goto tx_error_icmp;
		198	}
		199	dst = &rt->dst;
		200	skb_dst_set(skb, dst);
192	}	201	}
193		202
194	dst_hold(dst);	203	dst_hold(dst);

net/ipv4/route.c+1−0

@@ -271,6 +271,7 @@ static void rt_cpu_seq_next(struct seq_file seq, void v, loff_t pos) · 270 unmodified lines
271	*pos = cpu+1;	271	*pos = cpu+1;
272	return &per_cpu(rt_cache_stat, cpu);	272	return &per_cpu(rt_cache_stat, cpu);
273	}	273	}
		274	(*pos)++;
274	return NULL;	275	return NULL;
275		276
276	}	277	}

net/ipv4/tcp.c+1−1

 {
 	struct rb_node *p = rb_first(&sk->tcp_rtx_queue);
+	tcp_sk(sk)->highest_sack = NULL;
 	while (p) {
 		struct sk_buff *skb = rb_to_skb(p);
 	WRITE_ONCE(tp->write_seq, seq);
 	icsk->icsk_backoff = 0;
-	tp->snd_cwnd = 2;
 	icsk->icsk_probes_out = 0;
 	icsk->icsk_rto = TCP_TIMEOUT_INIT;
 	tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;

net/ipv4/tcp_bbr.c+1−2

@@ -779,8 +779,7 @@ static void bbr_update_bw(struct sock sk, const struct rate_sample rs) · 778 unmodified lines
779	* bandwidth sample. Delivered is in packets and interval_us in uS and	779	* bandwidth sample. Delivered is in packets and interval_us in uS and
780	* ratio will be <<1 for most connections. So delivered is first scaled.	780	* ratio will be <<1 for most connections. So delivered is first scaled.
781	*/	781	*/
782	bw = (u64)rs->delivered * BW_UNIT;	782	bw = div64_long((u64)rs->delivered * BW_UNIT, rs->interval_us);
783	do_div(bw, rs->interval_us);
784		783
785	/* If this sample is application-limited, it is likely to have a very	784	/* If this sample is application-limited, it is likely to have a very
786	* low delivered count that represents application behavior rather than	785	* low delivered count that represents application behavior rather than

net/ipv4/tcp_input.c+1−0

@@ -3164,6 +3164,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack, · 3163 unmodified lines
3164	tp->retransmit_skb_hint = NULL;	3164	tp->retransmit_skb_hint = NULL;
3165	if (unlikely(skb == tp->lost_skb_hint))	3165	if (unlikely(skb == tp->lost_skb_hint))
3166	tp->lost_skb_hint = NULL;	3166	tp->lost_skb_hint = NULL;
		3167	tcp_highest_sack_replace(sk, skb, next);
3167	tcp_rtx_queue_unlink_and_free(skb, sk);	3168	tcp_rtx_queue_unlink_and_free(skb, sk);
3168	}	3169	}
3169		3170

net/ipv4/tcp_output.c+1−0

@@ -3232,6 +3232,7 @@ int tcp_send_synack(struct sock *sk) · 3231 unmodified lines
3232	if (!nskb)	3232	if (!nskb)
3233	return -ENOMEM;	3233	return -ENOMEM;
3234	INIT_LIST_HEAD(&nskb->tcp_tsorted_anchor);	3234	INIT_LIST_HEAD(&nskb->tcp_tsorted_anchor);
		3235	tcp_highest_sack_replace(sk, skb, nskb);
3235	tcp_rtx_queue_unlink_and_free(skb, sk);	3236	tcp_rtx_queue_unlink_and_free(skb, sk);
3236	__skb_header_release(nskb);	3237	__skb_header_release(nskb);
3237	tcp_rbtree_insert(&sk->tcp_rtx_queue, nskb);	3238	tcp_rbtree_insert(&sk->tcp_rtx_queue, nskb);

net/ipv4/udp.c+2−1

 	if (likely(partial)) {
 		up->forward_deficit += size;
 		size = up->forward_deficit;
-		if (size < (sk->sk_rcvbuf >> 2))
+		if (size < (sk->sk_rcvbuf >> 2) &&
+		    !skb_queue_empty(&up->reader_queue))
 			return;
 	} else {
 		size += up->forward_deficit;

net/ipv6/esp6_offload.c+2−0

@@ -79,6 +79,8 @@ static struct sk_buff esp6_gro_receive(struct list_head head, · 78 unmodified lines
79	if (!x)	79	if (!x)
80	goto out_reset;	80	goto out_reset;
81		81
		82	skb->mark = xfrm_smark_get(skb->mark, x);
		83
82	sp->xvec[sp->len++] = x;	84	sp->xvec[sp->len++] = x;
83	sp->olen++;	85	sp->olen++;
84		86

net/ipv6/ip6_fib.c+2−5

 	struct net *net = seq_file_net(seq);
 	struct ipv6_route_iter *iter = seq->private;
+	++(*pos);
 	if (!v)
 		goto iter_table;
 	n = rcu_dereference_bh(((struct fib6_info *)v)->fib6_next);
-	if (n) {
+	if (n)
-		++*pos;
 		return n;
-	}
 iter_table:
 	ipv6_route_check_sernum(iter);
 	r = fib6_walk_continue(&iter->w);
 	spin_unlock_bh(&iter->tbl->tb6_lock);
 	if (r > 0) {
-		if (v)
-			++*pos;
 		return iter->w.leaf;
 	} else if (r < 0) {
 		fib6_walker_unlink(net, &iter->w);

net/ipv6/ip6_gre.c+0−3

 		dev->mtu -= 8;
 	if (tunnel->parms.collect_md) {
-		dev->features |= NETIF_F_NETNS_LOCAL;
 		netif_keep_dst(dev);
 	}
 	ip6gre_tnl_init_features(dev);
 	dev->needs_free_netdev = true;
 	dev->priv_destructor = ip6gre_dev_free;
-	dev->features |= NETIF_F_NETNS_LOCAL;
 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
 	dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 	netif_keep_dst(dev);
 	dev->needs_free_netdev = true;
 	dev->priv_destructor = ip6gre_dev_free;
-	dev->features |= NETIF_F_NETNS_LOCAL;
 	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
 	dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 	netif_keep_dst(dev);

net/ipv6/ip6_tunnel.c+1−3

 	if (err)
 		return err;
 	ip6_tnl_link_config(t);
-	if (t->parms.collect_md) {
+	if (t->parms.collect_md)
-		dev->features |= NETIF_F_NETNS_LOCAL;
 		netif_keep_dst(dev);
-	}
 	return 0;
 }

net/ipv6/ip6_vti.c+11−2

@@ -449,8 +449,17 @@ vti6_xmit(struct sk_buff skb, struct net_device dev, struct flowi *fl) · 448 unmodified lines
449	int err = -1;	449	int err = -1;
450	int mtu;	450	int mtu;
451		451
452	if (!dst)	452	if (!dst) {
453	goto tx_err_link_failure;	453	fl->u.ip6.flowi6_oif = dev->ifindex;
		454	fl->u.ip6.flowi6_flags \|= FLOWI_FLAG_ANYSRC;
		455	dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
		456	if (dst->error) {
		457	dst_release(dst);
		458	dst = NULL;
		459	goto tx_err_link_failure;
		460	}
		461	skb_dst_set(skb, dst);
		462	}
454		463
455	dst_hold(dst);	464	dst_hold(dst);
456	dst = xfrm_lookup(t->net, dst, fl, NULL, 0);	465	dst = xfrm_lookup(t->net, dst, fl, NULL, 0);

net/ipv6/seg6_local.c+3−1

 #include <net/addrconf.h>
 #include <net/ip6_route.h>
 #include <net/dst_cache.h>
+#include <net/ip_tunnels.h>
 #ifdef CONFIG_IPV6_SEG6_HMAC
 #include <net/seg6_hmac.h>
 #endif
 	skb_reset_network_header(skb);
 	skb_reset_transport_header(skb);
-	skb->encapsulation = 0;
+	if (iptunnel_pull_offloads(skb))
+		return false;
 	return true;
 }

net/netfilter/ipset/ip_set_bitmap_gen.h+1−1

@@ -75,7 +75,7 @@ mtype_flush(struct ip_set *set) · 74 unmodified lines
75		75
76	if (set->extensions & IPSET_EXT_DESTROY)	76	if (set->extensions & IPSET_EXT_DESTROY)
77	mtype_ext_cleanup(set);	77	mtype_ext_cleanup(set);
78	memset(map->members, 0, map->memsize);	78	bitmap_zero(map->members, map->elements);
79	set->elements = 0;	79	set->elements = 0;
80	set->ext_size = 0;	80	set->ext_size = 0;
81	}	81	}

net/netfilter/ipset/ip_set_bitmap_ip.c+3−3

@@ -37,7 +37,7 @@ MODULE_ALIAS("ip_set_bitmap:ip"); · 36 unmodified lines
37		37
38	/* Type structure */	38	/* Type structure */
39	struct bitmap_ip {	39	struct bitmap_ip {
40	void members; / the set members */	40	unsigned long members; / the set members */
41	u32 first_ip; /* host byte order, included in range */	41	u32 first_ip; /* host byte order, included in range */
42	u32 last_ip; /* host byte order, included in range */	42	u32 last_ip; /* host byte order, included in range */
43	u32 elements; /* number of max elements in the set */	43	u32 elements; /* number of max elements in the set */
@@ -220,7 +220,7 @@ init_map_ip(struct ip_set set, struct bitmap_ip map, · 176 unmodified lines
220	u32 first_ip, u32 last_ip,	220	u32 first_ip, u32 last_ip,
221	u32 elements, u32 hosts, u8 netmask)	221	u32 elements, u32 hosts, u8 netmask)
222	{	222	{
223	map->members = ip_set_alloc(map->memsize);	223	map->members = bitmap_zalloc(elements, GFP_KERNEL \| __GFP_NOWARN);
224	if (!map->members)	224	if (!map->members)
225	return false;	225	return false;
226	map->first_ip = first_ip;	226	map->first_ip = first_ip;
@@ -322,7 +322,7 @@ bitmap_ip_create(struct net net, struct ip_set set, struct nlattr *tb[], · 95 unmodified lines
322	if (!map)	322	if (!map)
323	return -ENOMEM;	323	return -ENOMEM;
324		324
325	map->memsize = bitmap_bytes(0, elements - 1);	325	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
326	set->variant = &bitmap_ip;	326	set->variant = &bitmap_ip;
327	if (!init_map_ip(set, map, first_ip, last_ip,	327	if (!init_map_ip(set, map, first_ip, last_ip,
328	elements, hosts, netmask)) {	328	elements, hosts, netmask)) {

net/netfilter/ipset/ip_set_bitmap_ipmac.c+3−3

@@ -42,7 +42,7 @@ enum { · 41 unmodified lines
42		42
43	/* Type structure */	43	/* Type structure */
44	struct bitmap_ipmac {	44	struct bitmap_ipmac {
45	void members; / the set members */	45	unsigned long members; / the set members */
46	u32 first_ip; /* host byte order, included in range */	46	u32 first_ip; /* host byte order, included in range */
47	u32 last_ip; /* host byte order, included in range */	47	u32 last_ip; /* host byte order, included in range */
48	u32 elements; /* number of max elements in the set */	48	u32 elements; /* number of max elements in the set */
@@ -299,7 +299,7 @@ static bool · 250 unmodified lines
299	init_map_ipmac(struct ip_set set, struct bitmap_ipmac map,	299	init_map_ipmac(struct ip_set set, struct bitmap_ipmac map,
300	u32 first_ip, u32 last_ip, u32 elements)	300	u32 first_ip, u32 last_ip, u32 elements)
301	{	301	{
302	map->members = ip_set_alloc(map->memsize);	302	map->members = bitmap_zalloc(elements, GFP_KERNEL \| __GFP_NOWARN);
303	if (!map->members)	303	if (!map->members)
304	return false;	304	return false;
305	map->first_ip = first_ip;	305	map->first_ip = first_ip;
@@ -360,7 +360,7 @@ bitmap_ipmac_create(struct net net, struct ip_set set, struct nlattr *tb[], · 54 unmodified lines
360	if (!map)	360	if (!map)
361	return -ENOMEM;	361	return -ENOMEM;
362		362
363	map->memsize = bitmap_bytes(0, elements - 1);	363	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
364	set->variant = &bitmap_ipmac;	364	set->variant = &bitmap_ipmac;
365	if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {	365	if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) {
366	kfree(map);	366	kfree(map);

net/netfilter/ipset/ip_set_bitmap_port.c+3−3

@@ -30,7 +30,7 @@ MODULE_ALIAS("ip_set_bitmap:port"); · 29 unmodified lines
30		30
31	/* Type structure */	31	/* Type structure */
32	struct bitmap_port {	32	struct bitmap_port {
33	void members; / the set members */	33	unsigned long members; / the set members */
34	u16 first_port; /* host byte order, included in range */	34	u16 first_port; /* host byte order, included in range */
35	u16 last_port; /* host byte order, included in range */	35	u16 last_port; /* host byte order, included in range */
36	u32 elements; /* number of max elements in the set */	36	u32 elements; /* number of max elements in the set */
@@ -231,7 +231,7 @@ static bool · 194 unmodified lines
231	init_map_port(struct ip_set set, struct bitmap_port map,	231	init_map_port(struct ip_set set, struct bitmap_port map,
232	u16 first_port, u16 last_port)	232	u16 first_port, u16 last_port)
233	{	233	{
234	map->members = ip_set_alloc(map->memsize);	234	map->members = bitmap_zalloc(map->elements, GFP_KERNEL \| __GFP_NOWARN);
235	if (!map->members)	235	if (!map->members)
236	return false;	236	return false;
237	map->first_port = first_port;	237	map->first_port = first_port;
@@ -271,7 +271,7 @@ bitmap_port_create(struct net net, struct ip_set set, struct nlattr *tb[], · 33 unmodified lines
271	return -ENOMEM;	271	return -ENOMEM;
272		272
273	map->elements = elements;	273	map->elements = elements;
274	map->memsize = bitmap_bytes(0, map->elements);	274	map->memsize = BITS_TO_LONGS(elements) * sizeof(unsigned long);
275	set->variant = &bitmap_port;	275	set->variant = &bitmap_port;
276	if (!init_map_port(set, map, first_port, last_port)) {	276	if (!init_map_port(set, map, first_port, last_port)) {
277	kfree(map);	277	kfree(map);

net/netfilter/ipvs/ip_vs_sync.c+1−1

@@ -1239,7 +1239,7 @@ static void ip_vs_process_message(struct netns_ipvs ipvs, __u8 buffer, · 1238 unmodified lines
1239		1239
1240	p = msg_end;	1240	p = msg_end;
1241	if (p + sizeof(s->v4) > buffer+buflen) {	1241	if (p + sizeof(s->v4) > buffer+buflen) {
1242	IP_VS_ERR_RL("BACKUP, Dropping buffer, to small\n");	1242	IP_VS_ERR_RL("BACKUP, Dropping buffer, too small\n");
1243	return;	1243	return;
1244	}	1244	}
1245	s = (union ip_vs_sync_conn *)p;	1245	s = (union ip_vs_sync_conn *)p;

net/netfilter/nf_conntrack_proto_sctp.c+3−3

net/netfilter/nf_tables_api.c+107−48

@@ -552,48 +552,71 @@ static inline u64 nf_tables_alloc_handle(struct nft_table *table) · 551 unmodified lines
552		552
553	static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];	553	static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
554		554
		555	static const struct nft_chain_type *
		556	__nft_chain_type_get(u8 family, enum nft_chain_types type)
		557	{
		558	if (family >= NFPROTO_NUMPROTO \|\|
		559	type >= NFT_CHAIN_T_MAX)
		560	return NULL;
		561
		562	return chain_type[family][type];
		563	}
		564
555	static const struct nft_chain_type *	565	static const struct nft_chain_type *
556	__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)	566	__nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
557	{	567	{
		568	const struct nft_chain_type *type;
558	int i;	569	int i;
559		570
560	for (i = 0; i < NFT_CHAIN_T_MAX; i++) {	571	for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
561	if (chain_type[family][i] != NULL &&	572	type = __nft_chain_type_get(family, i);
562	!nla_strcmp(nla, chain_type[family][i]->name))	573	if (!type)
563	return chain_type[family][i];	574	continue;
		575	if (!nla_strcmp(nla, type->name))
		576	return type;
564	}	577	}
565	return NULL;	578	return NULL;
566	}	579	}
567		580
568	/*	581	struct nft_module_request {
569	* Loading a module requires dropping mutex that guards the transaction.	582	struct list_head list;
570	* A different client might race to start a new transaction meanwhile. Zap the	583	char module[MODULE_NAME_LEN];
571	* list of pending transaction and then restore it once the mutex is grabbed	584	bool done;
572	* again. Users of this function return EAGAIN which implicitly triggers the	585	};
573	* transaction abort path to clean up the list of pending transactions.	586
574	*/
575	#ifdef CONFIG_MODULES	587	#ifdef CONFIG_MODULES
576	static void nft_request_module(struct net net, const char fmt, ...)	588	static int nft_request_module(struct net net, const char fmt, ...)
577	{	589	{
578	char module_name[MODULE_NAME_LEN];	590	char module_name[MODULE_NAME_LEN];
579	LIST_HEAD(commit_list);	591	struct nft_module_request *req;
580	va_list args;	592	va_list args;
581	int ret;	593	int ret;
582		594
583	list_splice_init(&net->nft.commit_list, &commit_list);
584
585	va_start(args, fmt);	595	va_start(args, fmt);
586	ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);	596	ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
587	va_end(args);	597	va_end(args);
588	if (ret >= MODULE_NAME_LEN)	598	if (ret >= MODULE_NAME_LEN)
589	return;	599	return 0;
590		600
591	mutex_unlock(&net->nft.commit_mutex);	601	list_for_each_entry(req, &net->nft.module_list, list) {
592	request_module("%s", module_name);	602	if (!strcmp(req->module, module_name)) {
593	mutex_lock(&net->nft.commit_mutex);	603	if (req->done)
		604	return 0;
594		605
595	WARN_ON_ONCE(!list_empty(&net->nft.commit_list));	606	/* A request to load this module already exists. */
596	list_splice(&commit_list, &net->nft.commit_list);	607	return -EAGAIN;
		608	}
		609	}
		610
		611	req = kmalloc(sizeof(*req), GFP_KERNEL);
		612	if (!req)
		613	return -ENOMEM;
		614
		615	req->done = false;
		616	strlcpy(req->module, module_name, MODULE_NAME_LEN);
		617	list_add_tail(&req->list, &net->nft.module_list);
		618
		619	return -EAGAIN;
597	}	620	}
598	#endif	621	#endif
599		622
@@ -617,10 +640,9 @@ nf_tables_chain_type_lookup(struct net net, const struct nlattr nla, · 17 unmodified lines
617	lockdep_nfnl_nft_mutex_not_held();	640	lockdep_nfnl_nft_mutex_not_held();
618	#ifdef CONFIG_MODULES	641	#ifdef CONFIG_MODULES
619	if (autoload) {	642	if (autoload) {
620	nft_request_module(net, "nft-chain-%u-%.*s", family,	643	if (nft_request_module(net, "nft-chain-%u-%.*s", family,
621	nla_len(nla), (const char *)nla_data(nla));	644	nla_len(nla),
622	type = __nf_tables_chain_type_lookup(nla, family);	645	(const char *)nla_data(nla)) == -EAGAIN)
623	if (type != NULL)
624	return ERR_PTR(-EAGAIN);	646	return ERR_PTR(-EAGAIN);
625	}	647	}
626	#endif	648	#endif
@@ -1162,11 +1184,8 @@ static void nf_tables_table_destroy(struct nft_ctx *ctx) · 535 unmodified lines
1162		1184
1163	void nft_register_chain_type(const struct nft_chain_type *ctype)	1185	void nft_register_chain_type(const struct nft_chain_type *ctype)
1164	{	1186	{
1165	if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
1166	return;
1167
1168	nfnl_lock(NFNL_SUBSYS_NFTABLES);	1187	nfnl_lock(NFNL_SUBSYS_NFTABLES);
1169	if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {	1188	if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) {
1170	nfnl_unlock(NFNL_SUBSYS_NFTABLES);	1189	nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1171	return;	1190	return;
1172	}	1191	}
@@ -1768,7 +1787,10 @@ static int nft_chain_parse_hook(struct net *net, · 595 unmodified lines
1768	hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));	1787	hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1769	hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));	1788	hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1770		1789
1771	type = chain_type[family][NFT_CHAIN_T_DEFAULT];	1790	type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
		1791	if (!type)
		1792	return -EOPNOTSUPP;
		1793
1772	if (nla[NFTA_CHAIN_TYPE]) {	1794	if (nla[NFTA_CHAIN_TYPE]) {
1773	type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],	1795	type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
1774	family, autoload);	1796	family, autoload);
@@ -2328,9 +2350,8 @@ static const struct nft_expr_type *__nft_expr_type_get(u8 family, · 553 unmodified lines
2328	static int nft_expr_type_request_module(struct net *net, u8 family,	2350	static int nft_expr_type_request_module(struct net *net, u8 family,
2329	struct nlattr *nla)	2351	struct nlattr *nla)
2330	{	2352	{
2331	nft_request_module(net, "nft-expr-%u-%.*s", family,	2353	if (nft_request_module(net, "nft-expr-%u-%.*s", family,
2332	nla_len(nla), (char *)nla_data(nla));	2354	nla_len(nla), (char *)nla_data(nla)) == -EAGAIN)
2333	if (__nft_expr_type_get(family, nla))
2334	return -EAGAIN;	2355	return -EAGAIN;
2335		2356
2336	return 0;	2357	return 0;
@@ -2356,9 +2377,9 @@ static const struct nft_expr_type nft_expr_type_get(struct net net, · 19 unmodified lines
2356	if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)	2377	if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)
2357	return ERR_PTR(-EAGAIN);	2378	return ERR_PTR(-EAGAIN);
2358		2379
2359	nft_request_module(net, "nft-expr-%.*s",	2380	if (nft_request_module(net, "nft-expr-%.*s",
2360	nla_len(nla), (char *)nla_data(nla));	2381	nla_len(nla),
2361	if (__nft_expr_type_get(family, nla))	2382	(char *)nla_data(nla)) == -EAGAIN)
2362	return ERR_PTR(-EAGAIN);	2383	return ERR_PTR(-EAGAIN);
2363	}	2384	}
2364	#endif	2385	#endif
@@ -2449,9 +2470,10 @@ static int nf_tables_expr_parse(const struct nft_ctx *ctx, · 84 unmodified lines
2449	err = PTR_ERR(ops);	2470	err = PTR_ERR(ops);
2450	#ifdef CONFIG_MODULES	2471	#ifdef CONFIG_MODULES
2451	if (err == -EAGAIN)	2472	if (err == -EAGAIN)
2452	nft_expr_type_request_module(ctx->net,	2473	if (nft_expr_type_request_module(ctx->net,
2453	ctx->family,	2474	ctx->family,
2454	tb[NFTA_EXPR_NAME]);	2475	tb[NFTA_EXPR_NAME]) != -EAGAIN)
		2476	err = -ENOENT;
2455	#endif	2477	#endif
2456	goto err1;	2478	goto err1;
2457	}	2479	}
@@ -3288,8 +3310,7 @@ nft_select_set_ops(const struct nft_ctx *ctx, · 830 unmodified lines
3288	lockdep_nfnl_nft_mutex_not_held();	3310	lockdep_nfnl_nft_mutex_not_held();
3289	#ifdef CONFIG_MODULES	3311	#ifdef CONFIG_MODULES
3290	if (list_empty(&nf_tables_set_types)) {	3312	if (list_empty(&nf_tables_set_types)) {
3291	nft_request_module(ctx->net, "nft-set");	3313	if (nft_request_module(ctx->net, "nft-set") == -EAGAIN)
3292	if (!list_empty(&nf_tables_set_types))
3293	return ERR_PTR(-EAGAIN);	3314	return ERR_PTR(-EAGAIN);
3294	}	3315	}
3295	#endif	3316	#endif
@@ -5415,8 +5436,7 @@ nft_obj_type_get(struct net *net, u32 objtype) · 2119 unmodified lines
5415	lockdep_nfnl_nft_mutex_not_held();	5436	lockdep_nfnl_nft_mutex_not_held();
5416	#ifdef CONFIG_MODULES	5437	#ifdef CONFIG_MODULES
5417	if (type == NULL) {	5438	if (type == NULL) {
5418	nft_request_module(net, "nft-obj-%u", objtype);	5439	if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN)
5419	if (__nft_obj_type_get(objtype))
5420	return ERR_PTR(-EAGAIN);	5440	return ERR_PTR(-EAGAIN);
5421	}	5441	}
5422	#endif	5442	#endif
@@ -5989,8 +6009,7 @@ nft_flowtable_type_get(struct net *net, u8 family) · 566 unmodified lines
5989	lockdep_nfnl_nft_mutex_not_held();	6009	lockdep_nfnl_nft_mutex_not_held();
5990	#ifdef CONFIG_MODULES	6010	#ifdef CONFIG_MODULES
5991	if (type == NULL) {	6011	if (type == NULL) {
5992	nft_request_module(net, "nf-flowtable-%u", family);	6012	if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN)
5993	if (__nft_flowtable_type_get(family))
5994	return ERR_PTR(-EAGAIN);	6013	return ERR_PTR(-EAGAIN);
5995	}	6014	}
5996	#endif	6015	#endif
@@ -6992,6 +7011,18 @@ static void nft_chain_del(struct nft_chain *chain) · 995 unmodified lines
6992	list_del_rcu(&chain->list);	7011	list_del_rcu(&chain->list);
6993	}	7012	}
6994		7013
		7014	static void nf_tables_module_autoload_cleanup(struct net *net)
		7015	{
		7016	struct nft_module_request req, next;
		7017
		7018	WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
		7019	list_for_each_entry_safe(req, next, &net->nft.module_list, list) {
		7020	WARN_ON_ONCE(!req->done);
		7021	list_del(&req->list);
		7022	kfree(req);
		7023	}
		7024	}
		7025
6995	static void nf_tables_commit_release(struct net *net)	7026	static void nf_tables_commit_release(struct net *net)
6996	{	7027	{
6997	struct nft_trans *trans;	7028	struct nft_trans *trans;
@@ -7004,6 +7035,7 @@ static void nf_tables_commit_release(struct net *net) · 6 unmodified lines
7004	* to prevent expensive synchronize_rcu() in commit phase.	7035	* to prevent expensive synchronize_rcu() in commit phase.
7005	*/	7036	*/
7006	if (list_empty(&net->nft.commit_list)) {	7037	if (list_empty(&net->nft.commit_list)) {
		7038	nf_tables_module_autoload_cleanup(net);
7007	mutex_unlock(&net->nft.commit_mutex);	7039	mutex_unlock(&net->nft.commit_mutex);
7008	return;	7040	return;
7009	}	7041	}
@@ -7018,6 +7050,7 @@ static void nf_tables_commit_release(struct net *net) · 8 unmodified lines
7018	list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);	7050	list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
7019	spin_unlock(&nf_tables_destroy_list_lock);	7051	spin_unlock(&nf_tables_destroy_list_lock);
7020		7052
		7053	nf_tables_module_autoload_cleanup(net);
7021	mutex_unlock(&net->nft.commit_mutex);	7054	mutex_unlock(&net->nft.commit_mutex);
7022		7055
7023	schedule_work(&trans_destroy_work);	7056	schedule_work(&trans_destroy_work);
@@ -7209,6 +7242,26 @@ static int nf_tables_commit(struct net net, struct sk_buff skb) · 185 unmodified lines
7209	return 0;	7242	return 0;
7210	}	7243	}
7211		7244
		7245	static void nf_tables_module_autoload(struct net *net)
		7246	{
		7247	struct nft_module_request req, next;
		7248	LIST_HEAD(module_list);
		7249
		7250	list_splice_init(&net->nft.module_list, &module_list);
		7251	mutex_unlock(&net->nft.commit_mutex);
		7252	list_for_each_entry_safe(req, next, &module_list, list) {
		7253	if (req->done) {
		7254	list_del(&req->list);
		7255	kfree(req);
		7256	} else {
		7257	request_module("%s", req->module);
		7258	req->done = true;
		7259	}
		7260	}
		7261	mutex_lock(&net->nft.commit_mutex);
		7262	list_splice(&module_list, &net->nft.module_list);
		7263	}
		7264
7212	static void nf_tables_abort_release(struct nft_trans *trans)	7265	static void nf_tables_abort_release(struct nft_trans *trans)
7213	{	7266	{
7214	switch (trans->msg_type) {	7267	switch (trans->msg_type) {
@@ -7238,7 +7291,7 @@ static void nf_tables_abort_release(struct nft_trans *trans) · 23 unmodified lines
7238	kfree(trans);	7291	kfree(trans);
7239	}	7292	}
7240		7293
7241	static int __nf_tables_abort(struct net *net)	7294	static int __nf_tables_abort(struct net *net, bool autoload)
7242	{	7295	{
7243	struct nft_trans trans, next;	7296	struct nft_trans trans, next;
7244	struct nft_trans_elem *te;	7297	struct nft_trans_elem *te;
@@ -7360,6 +7413,11 @@ static int __nf_tables_abort(struct net *net) · 115 unmodified lines
7360	nf_tables_abort_release(trans);	7413	nf_tables_abort_release(trans);
7361	}	7414	}
7362		7415
		7416	if (autoload)
		7417	nf_tables_module_autoload(net);
		7418	else
		7419	nf_tables_module_autoload_cleanup(net);
		7420
7363	return 0;	7421	return 0;
7364	}	7422	}
7365		7423
@@ -7368,9 +7426,9 @@ static void nf_tables_cleanup(struct net *net) · 2 unmodified lines
7368	nft_validate_state_update(net, NFT_VALIDATE_SKIP);	7426	nft_validate_state_update(net, NFT_VALIDATE_SKIP);
7369	}	7427	}
7370		7428
7371	static int nf_tables_abort(struct net net, struct sk_buff skb)	7429	static int nf_tables_abort(struct net net, struct sk_buff skb, bool autoload)
7372	{	7430	{
7373	int ret = __nf_tables_abort(net);	7431	int ret = __nf_tables_abort(net, autoload);
7374		7432
7375	mutex_unlock(&net->nft.commit_mutex);	7433	mutex_unlock(&net->nft.commit_mutex);
7376		7434
@@ -7965,6 +8023,7 @@ static int __net_init nf_tables_init_net(struct net *net) · 588 unmodified lines
7965	{	8023	{
7966	INIT_LIST_HEAD(&net->nft.tables);	8024	INIT_LIST_HEAD(&net->nft.tables);
7967	INIT_LIST_HEAD(&net->nft.commit_list);	8025	INIT_LIST_HEAD(&net->nft.commit_list);
		8026	INIT_LIST_HEAD(&net->nft.module_list);
7968	mutex_init(&net->nft.commit_mutex);	8027	mutex_init(&net->nft.commit_mutex);
7969	net->nft.base_seq = 1;	8028	net->nft.base_seq = 1;
7970	net->nft.validate_state = NFT_VALIDATE_SKIP;	8029	net->nft.validate_state = NFT_VALIDATE_SKIP;
@@ -7976,7 +8035,7 @@ static void __net_exit nf_tables_exit_net(struct net *net) · 5 unmodified lines
7976	{	8035	{
7977	mutex_lock(&net->nft.commit_mutex);	8036	mutex_lock(&net->nft.commit_mutex);
7978	if (!list_empty(&net->nft.commit_list))	8037	if (!list_empty(&net->nft.commit_list))
7979	__nf_tables_abort(net);	8038	__nf_tables_abort(net, false);
7980	__nft_release_tables(net);	8039	__nft_release_tables(net);
7981	mutex_unlock(&net->nft.commit_mutex);	8040	mutex_unlock(&net->nft.commit_mutex);
7982	WARN_ON_ONCE(!list_empty(&net->nft.tables));	8041	WARN_ON_ONCE(!list_empty(&net->nft.tables));

net/netfilter/nf_tables_offload.c+1−1

@@ -564,7 +564,7 @@ static void nft_indr_block_cb(struct net_device *dev, · 563 unmodified lines
564		564
565	mutex_lock(&net->nft.commit_mutex);	565	mutex_lock(&net->nft.commit_mutex);
566	chain = __nft_offload_get_chain(dev);	566	chain = __nft_offload_get_chain(dev);
567	if (chain) {	567	if (chain && chain->flags & NFT_CHAIN_HW_OFFLOAD) {
568	struct nft_base_chain *basechain;	568	struct nft_base_chain *basechain;
569		569
570	basechain = nft_base_chain(chain);	570	basechain = nft_base_chain(chain);

net/netfilter/nfnetlink.c+3−3

@@ -476,7 +476,7 @@ ack: · 475 unmodified lines
476	}	476	}
477	done:	477	done:
478	if (status & NFNL_BATCH_REPLAY) {	478	if (status & NFNL_BATCH_REPLAY) {
479	ss->abort(net, oskb);	479	ss->abort(net, oskb, true);
480	nfnl_err_reset(&err_list);	480	nfnl_err_reset(&err_list);
481	kfree_skb(skb);	481	kfree_skb(skb);
482	module_put(ss->owner);	482	module_put(ss->owner);
@@ -487,11 +487,11 @@ done: · 4 unmodified lines
487	status \|= NFNL_BATCH_REPLAY;	487	status \|= NFNL_BATCH_REPLAY;
488	goto done;	488	goto done;
489	} else if (err) {	489	} else if (err) {
490	ss->abort(net, oskb);	490	ss->abort(net, oskb, false);
491	netlink_ack(oskb, nlmsg_hdr(oskb), err, NULL);	491	netlink_ack(oskb, nlmsg_hdr(oskb), err, NULL);
492	}	492	}
493	} else {	493	} else {
494	ss->abort(net, oskb);	494	ss->abort(net, oskb, false);
495	}	495	}
496	if (ss->cleanup)	496	if (ss->cleanup)
497	ss->cleanup(net);	497	ss->cleanup(net);

net/netfilter/nft_osf.c+3−0

@@ -61,6 +61,9 @@ static int nft_osf_init(const struct nft_ctx *ctx, · 60 unmodified lines
61	int err;	61	int err;
62	u8 ttl;	62	u8 ttl;
63		63
		64	if (!tb[NFTA_OSF_DREG])
		65	return -EINVAL;
		66
64	if (tb[NFTA_OSF_TTL]) {	67	if (tb[NFTA_OSF_TTL]) {
65	ttl = nla_get_u8(tb[NFTA_OSF_TTL]);	68	ttl = nla_get_u8(tb[NFTA_OSF_TTL]);
66	if (ttl > 2)	69	if (ttl > 2)

net/rose/af_rose.c+1−1

@@ -1475,7 +1475,7 @@ static int __init rose_proto_init(void) · 1474 unmodified lines
1475	int rc;	1475	int rc;
1476		1476
1477	if (rose_ndevs > 0x7FFFFFFF/sizeof(struct net_device *)) {	1477	if (rose_ndevs > 0x7FFFFFFF/sizeof(struct net_device *)) {
1478	printk(KERN_ERR "ROSE: rose_proto_init - rose_ndevs parameter to large\n");	1478	printk(KERN_ERR "ROSE: rose_proto_init - rose_ndevs parameter too large\n");
1479	rc = -EINVAL;	1479	rc = -EINVAL;
1480	goto out;	1480	goto out;
1481	}	1481	}

net/sched/cls_api.c+2−3

 							       &chain_info));
 		mutex_unlock(&chain->filter_chain_lock);
-		tp_new = tcf_proto_create(nla_data(tca[TCA_KIND]),
+		tp_new = tcf_proto_create(name, protocol, prio, chain,
-					  protocol, prio, chain, rtnl_held,
+					  rtnl_held, extack);
-					  extack);
 		if (IS_ERR(tp_new)) {
 			err = PTR_ERR(tp_new);
 			goto errout_tp;

net/sched/ematch.c+1−1

 				}
 				em->data = (unsigned long) v;
 			}
+			em->datalen = data_len;
 		}
 	}
 	em->matchid = em_hdr->matchid;
 	em->flags = em_hdr->flags;
-	em->datalen = data_len;
 	em->net = net;
 	err = 0;

net/xfrm/xfrm_interface.c+26−8

 	int err = -1;
 	int mtu;
-	if (!dst)
-		goto tx_err_link_failure;
 	dst_hold(dst);
 	dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
 	if (IS_ERR(dst)) {
 	mtu = dst_mtu(dst);
 	if (!skb->ignore_df && skb->len > mtu) {
-		skb_dst_update_pmtu(skb, mtu);
+		skb_dst_update_pmtu_no_confirm(skb, mtu);
 		if (skb->protocol == htons(ETH_P_IPV6)) {
 			if (mtu < IPV6_MIN_MTU)
 {
 	struct xfrm_if *xi = netdev_priv(dev);
 	struct net_device_stats *stats = &xi->dev->stats;
+	struct dst_entry *dst = skb_dst(skb);
 	struct flowi fl;
 	int ret;
 	case htons(ETH_P_IPV6):
 		xfrm_decode_session(skb, &fl, AF_INET6);
 		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+		if (!dst) {
+			fl.u.ip6.flowi6_oif = dev->ifindex;
+			fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
+			dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
+			if (dst->error) {
+				dst_release(dst);
+				stats->tx_carrier_errors++;
+				goto tx_err;
+			}
+			skb_dst_set(skb, dst);
+		}
 		break;
 	case htons(ETH_P_IP):
 		xfrm_decode_session(skb, &fl, AF_INET);
 		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+		if (!dst) {
+			struct rtable *rt;
+			fl.u.ip4.flowi4_oif = dev->ifindex;
+			fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
+			rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
+			if (IS_ERR(rt)) {
+				stats->tx_carrier_errors++;
+				goto tx_err;
+			}
+			skb_dst_set(skb, &rt->dst);
+		}
 		break;
 	default:
 		goto tx_err;
 {
 	dev->netdev_ops 	= &xfrmi_netdev_ops;
 	dev->type		= ARPHRD_NONE;
-	dev->hard_header_len 	= ETH_HLEN;
-	dev->min_header_len	= ETH_HLEN;
 	dev->mtu		= ETH_DATA_LEN;
 	dev->min_mtu		= ETH_MIN_MTU;
-	dev->max_mtu		= ETH_DATA_LEN;
+	dev->max_mtu		= IP_MAX_MTU;
-	dev->addr_len		= ETH_ALEN;
 	dev->flags 		= IFF_NOARP;
 	dev->needs_free_netdev	= true;
 	dev->priv_destructor	= xfrmi_dev_free;

@@ -114,7 +114,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = { · 113 unmodified lines
114	{	114	{
115	/* ORIGINAL */	115	/* ORIGINAL */
116	/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */	116	/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */
117	/* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA},	117	/* init */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA},
118	/* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},	118	/* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},
119	/* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},	119	/* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
120	/* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS},	120	/* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS},
@@ -130,7 +130,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = { · 9 unmodified lines
130	/* REPLY */	130	/* REPLY */
131	/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */	131	/* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */
132	/* init / {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/ INIT in sCL Big TODO */	132	/* init / {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/ INIT in sCL Big TODO */
133	/* init_ack */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},	133	/* init_ack */ {sIV, sCW, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},
134	/* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV, sCL},	134	/* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV, sCL},
135	/* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV, sSR},	135	/* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV, sSR},
136	/* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV, sHA},	136	/* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV, sHA},
@@ -316,7 +316,7 @@ sctp_new(struct nf_conn ct, const struct sk_buff skb, · 179 unmodified lines
316	ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;	316	ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
317	}	317	}
318		318
319	ct->proto.sctp.state = new_state;	319	ct->proto.sctp.state = SCTP_CONNTRACK_NONE;
320	}	320	}
321		321
322	return true;	322	return true;