Skip to content
  1. Jan 27, 2015
    • Ben Hutchings's avatar
      sh_eth: Fix DMA-API usage for RX buffers · 52b9fa36
      Ben Hutchings authored
      
      
      - Use the return value of dma_map_single(), rather than calling
        virt_to_page() separately
      - Check for mapping failue
      - Call dma_unmap_single() rather than dma_sync_single_for_cpu()
      
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      52b9fa36
    • Ben Hutchings's avatar
      sh_eth: Check for DMA mapping errors on transmit · aa3933b8
      Ben Hutchings authored
      
      
      dma_map_single() may fail if an IOMMU or swiotlb is in use, so
      we need to check for this.
      
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      aa3933b8
    • Ben Hutchings's avatar
      sh_eth: Ensure DMA engines are stopped before freeing buffers · 740c7f31
      Ben Hutchings authored
      
      
      Currently we try to clear EDRRR and EDTRR and immediately continue to
      free buffers.  This is unsafe because:
      
      - In general, register writes are not serialised with DMA, so we still
        have to wait for DMA to complete somehow
      - The R8A7790 (R-Car H2) manual states that the TX running flag cannot
        be cleared by writing to EDTRR
      - The same manual states that clearing the RX running flag only stops
        RX DMA at the next packet boundary
      
      I applied this patch to the driver to detect DMA writes to freed
      buffers:
      
      > --- a/drivers/net/ethernet/renesas/sh_eth.c
      > +++ b/drivers/net/ethernet/renesas/sh_eth.c
      > @@ -1098,7 +1098,14 @@ static void sh_eth_ring_free(struct net_device *ndev)
      >  	/* Free Rx skb ringbuffer */
      >  	if (mdp->rx_skbuff) {
      >  		for (i = 0; i < mdp->num_rx_ring; i++)
      > +			memcpy(mdp->rx_skbuff[i]->data,
      > +			       "Hello, world", 12);
      > +		msleep(100);
      > +		for (i = 0; i < mdp->num_rx_ring; i++) {
      > +			WARN_ON(memcmp(mdp->rx_skbuff[i]->data,
      > +				       "Hello, world", 12));
      >  			dev_kfree_skb(mdp->rx_skbuff[i]);
      > +		}
      >  	}
      >  	kfree(mdp->rx_skbuff);
      >  	mdp->rx_skbuff = NULL;
      
      then ran the loop:
      
          while ethtool -G eth0 rx 128 ; ethtool -G eth0 rx 64; do echo -n .; done
      
      and 'ping -f' toward the sh_eth port from another machine.  The
      warning fired several times a minute.
      
      To fix these issues:
      
      - Deactivate all TX descriptors rather than writing to EDTRR
      - As there seems to be no way of telling when RX DMA is stopped,
        perform a soft reset to ensure that both DMA enginess are stopped
      - To reduce the possibility of the reset truncating a transmitted
        frame, disable egress and wait a reasonable time to reach a
        packet boundary before resetting
      - Update statistics before resetting
      
      (The 'reasonable time' does not allow for CS/CD in half-duplex
      mode, but half-duplex no longer seems reasonable!)
      
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      740c7f31
    • Ben Hutchings's avatar
      sh_eth: Remove RX overflow log messages · dc1d0e6d
      Ben Hutchings authored
      
      
      If RX traffic is overflowing the FIFO or DMA ring, logging every time
      this happens just makes things worse.  These errors are visible in the
      statistics anyway.
      
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      dc1d0e6d
    • Ahmed S. Darwish's avatar
      can: kvaser_usb: Fix state handling upon BUS_ERROR events · e638642b
      Ahmed S. Darwish authored
      
      
      While being in an ERROR_WARNING state, and receiving further
      bus error events with error counters still in the ERROR_WARNING
      range of 97-127 inclusive, the state handling code erroneously
      reverts back to ERROR_ACTIVE.
      
      Per the CAN standard, only revert to ERROR_ACTIVE when the
      error counters are less than 96.
      
      Moreover, in certain Kvaser models, the BUS_ERROR flag is
      always set along with undefined bits in the M16C status
      register. Thus use bitwise operators instead of full equality
      for checking that register against bus errors.
      
      Signed-off-by: default avatarAhmed S. Darwish <ahmed.darwish@valeo.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      e638642b
    • Ahmed S. Darwish's avatar
      can: kvaser_usb: Retry the first bulk transfer on -ETIMEDOUT · 14c10c2a
      Ahmed S. Darwish authored
      
      
      On some x86 laptops, plugging a Kvaser device again after an
      unplug makes the firmware always ignore the very first command.
      For such a case, provide some room for retries instead of
      completely exiting the driver init code.
      
      Signed-off-by: default avatarAhmed S. Darwish <ahmed.darwish@valeo.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      14c10c2a
    • Ahmed S. Darwish's avatar
      can: kvaser_usb: Send correct context to URB completion · 3803fa69
      Ahmed S. Darwish authored
      
      
      Send expected argument to the URB completion hander: a CAN
      netdevice instead of the network interface private context
      `kvaser_usb_net_priv'.
      
      This was discovered by having some garbage in the kernel
      log in place of the netdevice names: can0 and can1.
      
      Signed-off-by: default avatarAhmed S. Darwish <ahmed.darwish@valeo.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      3803fa69
    • Ahmed S. Darwish's avatar
      can: kvaser_usb: Do not sleep in atomic context · ded50066
      Ahmed S. Darwish authored
      Upon receiving a hardware event with the BUS_RESET flag set,
      the driver kills all of its anchored URBs and resets all of
      its transmit URB contexts.
      
      Unfortunately it does so under the context of URB completion
      handler `kvaser_usb_read_bulk_callback()', which is often
      called in an atomic context.
      
      While the device is flooded with many received error packets,
      usb_kill_urb() typically sleeps/reschedules till the transfer
      request of each killed URB in question completes, leading to
      the sleep in atomic bug. [3]
      
      In v2 submission of the original driver patch [1], it was
      stated that the URBs kill and tx contexts reset was needed
      since we don't receive any tx acknowledgments later and thus
      such resources will be locked down forever. Fortunately this
      is no longer needed since an earlier bugfix in this patch
      series is now applied: all tx URB contexts are reset upon CAN
      channel close. [2]
      
      Moreover, a BUS_RESET is now treated _exactly_ like a BUS_OFF
      event, which is the recommended handling method advised by
      the device manufacturer.
      
      [1] http://article.gmane.org/gmane.linux.network/239442
          http://www.webcitation.org/6Vr2yagAQ
      
      
      
      [2] can: kvaser_usb: Reset all URB tx contexts upon channel close
          889b77f7
      
      [3] Stacktrace:
      
       <IRQ>  [<ffffffff8158de87>] dump_stack+0x45/0x57
       [<ffffffff8158b60c>] __schedule_bug+0x41/0x4f
       [<ffffffff815904b1>] __schedule+0x5f1/0x700
       [<ffffffff8159360a>] ? _raw_spin_unlock_irqrestore+0xa/0x10
       [<ffffffff81590684>] schedule+0x24/0x70
       [<ffffffff8147d0a5>] usb_kill_urb+0x65/0xa0
       [<ffffffff81077970>] ? prepare_to_wait_event+0x110/0x110
       [<ffffffff8147d7d8>] usb_kill_anchored_urbs+0x48/0x80
       [<ffffffffa01f4028>] kvaser_usb_unlink_tx_urbs+0x18/0x50 [kvaser_usb]
       [<ffffffffa01f45d0>] kvaser_usb_rx_error+0xc0/0x400 [kvaser_usb]
       [<ffffffff8108b14a>] ? vprintk_default+0x1a/0x20
       [<ffffffffa01f5241>] kvaser_usb_read_bulk_callback+0x4c1/0x5f0 [kvaser_usb]
       [<ffffffff8147a73e>] __usb_hcd_giveback_urb+0x5e/0xc0
       [<ffffffff8147a8a1>] usb_hcd_giveback_urb+0x41/0x110
       [<ffffffffa0008748>] finish_urb+0x98/0x180 [ohci_hcd]
       [<ffffffff810cd1a7>] ? acct_account_cputime+0x17/0x20
       [<ffffffff81069f65>] ? local_clock+0x15/0x30
       [<ffffffffa000a36b>] ohci_work+0x1fb/0x5a0 [ohci_hcd]
       [<ffffffff814fbb31>] ? process_backlog+0xb1/0x130
       [<ffffffffa000cd5b>] ohci_irq+0xeb/0x270 [ohci_hcd]
       [<ffffffff81479fc1>] usb_hcd_irq+0x21/0x30
       [<ffffffff8108bfd3>] handle_irq_event_percpu+0x43/0x120
       [<ffffffff8108c0ed>] handle_irq_event+0x3d/0x60
       [<ffffffff8108ec84>] handle_fasteoi_irq+0x74/0x110
       [<ffffffff81004dfd>] handle_irq+0x1d/0x30
       [<ffffffff81004727>] do_IRQ+0x57/0x100
       [<ffffffff8159482a>] common_interrupt+0x6a/0x6a
      
      Signed-off-by: default avatarAhmed S. Darwish <ahmed.darwish@valeo.com>
      Cc: linux-stable <stable@vger.kernel.org>
      Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
      ded50066
    • Ezequiel Garcia's avatar
      net: mv643xx_eth: Fix highmem support in non-TSO egress path · 9e911414
      Ezequiel Garcia authored
      
      
      Commit 69ad0dd7
      Author: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
      Date:   Mon May 19 13:59:59 2014 -0300
      
          net: mv643xx_eth: Use dma_map_single() to map the skb fragments
      
      caused a nasty regression by removing the support for highmem skb
      fragments. By using page_address() to get the address of a fragment's
      page, we are assuming a lowmem page. However, such assumption is incorrect,
      as fragments can be in highmem pages, resulting in very nasty issues.
      
      This commit fixes this by using the skb_frag_dma_map() helper,
      which takes care of mapping the skb fragment properly. Additionally,
      the type of mapping is now tracked, so it can be unmapped using
      dma_unmap_page or dma_unmap_single when appropriate.
      
      This commit also fixes the error path in txq_init() to release the
      resources properly.
      
      Fixes: 69ad0dd7 ("net: mv643xx_eth: Use dma_map_single() to map the skb fragments")
      Reported-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
      Signed-off-by: default avatarEzequiel Garcia <ezequiel.garcia@free-electrons.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      9e911414
    • Ben Hutchings's avatar
      sh_eth: Fix serialisation of interrupt disable with interrupt & NAPI handlers · 283e38db
      Ben Hutchings authored
      
      
      In order to stop the RX path accessing the RX ring while it's being
      stopped or resized, we clear the interrupt mask (EESIPR) and then call
      free_irq() or synchronise_irq().  This is insufficient because the
      interrupt handler or NAPI poller may set EESIPR again after we clear
      it.  Also, in sh_eth_set_ringparam() we currently don't disable NAPI
      polling at all.
      
      I could easily trigger a crash by running the loop:
      
         while ethtool -G eth0 rx 128 && ethtool -G eth0 rx 64; do echo -n .; done
      
      and 'ping -f' toward the sh_eth port from another machine.
      
      To fix this:
      - Add a software flag (irq_enabled) to signal whether interrupts
        should be enabled
      - In the interrupt handler, if the flag is clear then clear EESIPR
        and return
      - In the NAPI poller, if the flag is clear then don't set EESIPR
      - Set the flag before enabling interrupts in sh_eth_dev_init() and
        sh_eth_set_ringparam()
      - Clear the flag and serialise with the interrupt and NAPI
        handlers before clearing EESIPR in sh_eth_close() and
        sh_eth_set_ringparam()
      
      After this, I could run the loop for 100,000 iterations successfully.
      
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      283e38db
    • Ben Hutchings's avatar
      sh_eth: Fix crash or memory leak when resizing rings on device that is down · 084236d8
      Ben Hutchings authored
      
      
      If the device is down then no packet buffers should be allocated.
      We also must not touch its registers as it may be powered off.
      
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      084236d8
    • Ben Hutchings's avatar
      sh_eth: Detach net device when stopping queue to resize DMA rings · bd888916
      Ben Hutchings authored
      
      
      We must only ever stop TX queues when they are full or the net device
      is not 'ready' so far as the net core, and specifically the watchdog,
      is concerned.  Otherwise, the watchdog may fire *immediately* if no
      packets have been added to the queue in the last 5 seconds.
      
      What's more, sh_eth_tx_timeout() will likely crash if called while
      we're resizing the TX ring.
      
      I could easily trigger this by running the loop:
      
         while ethtool -G eth0 rx 128 && ethtool -G eth0 rx 64; do echo -n .; done
      
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      bd888916
    • Ben Hutchings's avatar
      sh_eth: Fix padding of short frames on TX · eebfb643
      Ben Hutchings authored
      
      
      If an skb to be transmitted is shorter than the minimum Ethernet frame
      length, we currently set the DMA descriptor length to the minimum but
      do not add zero-padding.  This could result in leaking sensitive
      data.  We also pass different lengths to dma_map_single() and
      dma_unmap_single().
      
      Use skb_padto() to pad properly, before calling dma_map_single().
      
      Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      eebfb643
    • Mugunthan V N's avatar
      drivers: net: cpsw: discard dual emac default vlan configuration · 02a54164
      Mugunthan V N authored
      
      
      In Dual EMAC, the default VLANs are used to segregate Rx packets between
      the ports, so adding the same default VLAN to the switch will affect the
      normal packet transfers. So returning error on addition of dual EMAC
      default VLANs.
      
      Even if EMAC 0 default port VLAN is added to EMAC 1, it will lead to
      break dual EMAC port separations.
      
      Fixes: d9ba8f9e (driver: net: ethernet: cpsw: dual emac interface implementation)
      Cc: <stable@vger.kernel.org> # v3.9+
      Reported-by: default avatarFelipe Balbi <balbi@ti.com>
      Signed-off-by: default avatarMugunthan V N <mugunthanvnm@ti.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      02a54164
  2. Jan 26, 2015
    • Thomas Richter's avatar
      390/qeth: Fix locking warning during qeth device setup · 1aec42bc
      Thomas Richter authored
      
      
      Do not wait for channel command buffers in IPA commands.
      The potential wait could be done while holding a spin lock and causes
      in recent kernels such a bug if kernel lock debugging is enabled:
      
      kernel: BUG: sleeping function called from invalid context at drivers/s390/net/qeth_core_main.c:
      794
      kernel: in_atomic(): 1, irqs_disabled(): 0, pid: 2031, name: NetworkManager
      kernel: 2 locks held by NetworkManager/2031:
      kernel:  #0:  (rtnl_mutex){+.+.+.}, at: [<00000000006e0d7a>] rtnetlink_rcv+0x32/0x50
      kernel:  #1:  (_xmit_ETHER){+.....}, at: [<00000000006cfe90>] dev_set_rx_mode+0x30/0x50
      kernel: CPU: 0 PID: 2031 Comm: NetworkManager Not tainted 3.18.0-rc5-next-20141124 #1
      kernel:        00000000275fb1f0 00000000275fb280 0000000000000002 0000000000000000
                     00000000275fb320 00000000275fb298 00000000275fb298 00000000007e326a
                     0000000000000000 000000000099ce2c 00000000009b4988 000000000000000b
                     00000000275fb2e0 00000000275fb280 0000000000000000 0000000000000000
                     0000000000000000 00000000001129c8 00000000275fb280 00000000275fb2e0
      kernel: Call Trace:
      kernel: ([<00000000001128b0>] show_trace+0xf8/0x158)
      kernel:  [<000000000011297a>] show_stack+0x6a/0xe8
      kernel:  [<00000000007e995a>] dump_stack+0x82/0xb0
      kernel:  [<000000000017d668>] ___might_sleep+0x170/0x228
      kernel:  [<000003ff80026f0e>] qeth_wait_for_buffer+0x36/0xd0 [qeth]
      kernel:  [<000003ff80026fe2>] qeth_get_ipacmd_buffer+0x3a/0xc0 [qeth]
      kernel:  [<000003ff80105078>] qeth_l3_send_setdelmc+0x58/0xf8 [qeth_l3]
      kernel:  [<000003ff8010b1fe>] qeth_l3_set_ip_addr_list+0x2c6/0x848 [qeth_l3]
      kernel:  [<000003ff8010bbb4>] qeth_l3_set_multicast_list+0x434/0xc48 [qeth_l3]
      kernel:  [<00000000006cfe9a>] dev_set_rx_mode+0x3a/0x50
      kernel:  [<00000000006cff90>] __dev_open+0xe0/0x140
      kernel:  [<00000000006d02a0>] __dev_change_flags+0xa0/0x178
      kernel:  [<00000000006d03a8>] dev_change_flags+0x30/0x70
      kernel:  [<00000000006e14ee>] do_setlink+0x346/0x9a0
      ...
      
      The device driver has plenty of command buffers available
      per channel for channel command communication.
      In the extremely rare case when there is no command buffer
      available, return a NULL pointer and issue a warning
      in the kernel log. The caller handles the case when
      a NULL pointer is encountered and returns an error.
      
      In the case the wait for command buffer is possible
      (because no lock is held as in the OSN case), still wait
      until a channel command buffer is available.
      
      Signed-off-by: default avatarThomas Richter <tmricht@linux.vnet.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ursula.braun@de.ibm.com>
      Reviewed-by: default avatarEugene Crosser <Eugene.Crosser@ru.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1aec42bc
    • Eugene Crosser's avatar
      qeth: clean up error handling · efbbc1d5
      Eugene Crosser authored
      
      
      In the functions that are registering and unregistering MAC
      addresses in the qeth-handled hardware, remove callback functions
      that are unnesessary, as only the return code is analyzed.
      Translate hardware response codes to semi-standard 'errno'-like
      codes for readability.
      
      Add kernel-doc description to the internal API function
      qeth_send_control_data().
      
      Signed-off-by: default avatarEugene Crosser <Eugene.Crosser@ru.ibm.com>
      Signed-off-by: default avatarUrsula Braun <ursula.braun@de.ibm.com>
      Reviewed-by: default avatarThomas-Mich Richter <tmricht@linux.vnet.ibm.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      efbbc1d5
  3. Jan 25, 2015
  4. Jan 24, 2015
  5. Jan 21, 2015
  6. Jan 20, 2015
  7. Jan 19, 2015
  8. Jan 18, 2015
    • Emmanuel Grumbach's avatar
      iwlwifi: mvm: abort scheduled scan upon RFKILL · 90ea15c1
      Emmanuel Grumbach authored
      When we have an active scheduled scan, and the RFKILL
      interrupt kicks in, the stack will cancel the scheduled
      scan as part of the down flow. But cancelling scheduled
      scan usually implies sending a command to the firwmare
      which has been killed as part of the RFKILL interrupt
      handling.
      Because of that, we returned an error to mac80211 when
      it asked to stop the scheduled scan and didn't notify the
      end of the scheduled scan. Besides a fat warning, this led
      to a situation in which cfg80211 would refuse any new scan
      request.
      
      To disentangle this, fake that the scheduled scan has been
      stopped without sending the command to the firwmare, return
      0 after having properly let cfg80211 know that the scan
      has been cancelled.
      
      This is basically the same as:
      commit 9b520d84
      Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
      Date:   Tue Nov 4 15:54:11 2014 +0200
      
          iwlwifi: mvm: abort scan upon RFKILL
      
          This code existed but not for all the different FW APIs
          we support.
          Fix this.
      
      but for the scheduled scan case.
      
      Link: http://permalink.gmane.org/gmane.linux.kernel.wireless.general/133232
      
      
      Reported-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
      90ea15c1
  9. Jan 17, 2015
  10. Jan 16, 2015
Loading