aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2014-06-26 00:08:24 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2014-06-26 00:08:24 -0400
commitf40ede392d49b14c23418c4802ad078379667f7d (patch)
treec8f230903ddbad68e0e7ebe71c253b9ac72e541a
parentec71feae064cf0e06ad89f9a2fc573de405ad49e (diff)
parentde843723f9b989178762196fb24dd050cbe20ca3 (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) Fix crash in ipvs tot_stats estimator, from Julian Anastasov. 2) Fix OOPS in nf_nat on netns removal, from Florian Westphal. 3) Really really really fix locking issues in slip and slcan tty write wakeups, from Tyler Hall. 4) Fix checksum offloading in fec driver, from Fugang Duan. 5) Off by one in BPF instruction limit test, from Kees Cook. 6) Need to clear all TSO capability flags when doing software TSO in tg3 driver, from Prashant Sreedharan. 7) Fix memory leak in vlan_reorder_header() error path, from Li RongQing. 8) Fix various bugs in xen-netfront and xen-netback multiqueue support, from David Vrabel and Wei Liu. 9) Fix deadlock in cxgb4 driver, from Li RongQing. 10) Prevent double free of no-cache DST entries, from Eric Dumazet. 11) Bad csum_start handling in skb_segment() leads to crashes when forwarding, from Tom Herbert. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (76 commits) net: fix setting csum_start in skb_segment() ipv4: fix dst race in sk_dst_get() net: filter: Use kcalloc/kmalloc_array to allocate arrays trivial: net: filter: Change kerneldoc parameter order trivial: net: filter: Fix typo in comment net: allwinner: emac: Add missing free_irq cxgb4: use dev_port to identify ports xen-netback: bookkeep number of active queues in our own module tg3: Change nvram command timeout value to 50ms cxgb4: Not need to hold the adap_rcu_lock lock when read adap_rcu_list be2net: fix qnq mode detection on VFs of: mdio: fixup of_phy_register_fixed_link parsing of new bindings at86rf230: fix irq setup net: phy: at803x: fix coccinelle warnings net/mlx4_core: Fix the error flow when probing with invalid VF configuration tulip: Poll link status more frequently for Comet chips net: huawei_cdc_ncm: increase command buffer size drivers: net: cpsw: fix dual EMAC stall when connected to same switch xen-netfront: recreate queues correctly when reconnecting xen-netfront: fix oops when disconnected from backend ...
Diffstat
-rw-r--r--Documentation/ptp/testptp.c5
-rw-r--r--MAINTAINERS11
-rw-r--r--drivers/isdn/hisax/Kconfig11
-rw-r--r--drivers/net/bonding/bond_main.c9
-rw-r--r--drivers/net/can/slcan.c37
-rw-r--r--drivers/net/ethernet/allwinner/sun4i-emac.c1
-rw-r--r--drivers/net/ethernet/broadcom/tg3.c8
-rw-r--r--drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c16
-rw-r--r--drivers/net/ethernet/chelsio/cxgb4/t4_hw.c1
-rw-r--r--drivers/net/ethernet/dec/tulip/timer.c2
-rw-r--r--drivers/net/ethernet/emulex/benet/be.h4
-rw-r--r--drivers/net/ethernet/emulex/benet/be_cmds.h2
-rw-r--r--drivers/net/ethernet/emulex/benet/be_main.c4
-rw-r--r--drivers/net/ethernet/freescale/fec_main.c8
-rw-r--r--drivers/net/ethernet/marvell/skge.c7
-rw-r--r--drivers/net/ethernet/mellanox/mlx4/main.c3
-rw-r--r--drivers/net/ethernet/ti/cpsw.c7
-rw-r--r--drivers/net/ethernet/tile/tilegx.c1
-rw-r--r--drivers/net/hyperv/netvsc.c2
-rw-r--r--drivers/net/ieee802154/at86rf230.c5
-rw-r--r--drivers/net/phy/at803x.c195
-rw-r--r--drivers/net/phy/phy.c3
-rw-r--r--drivers/net/slip/slip.c36
-rw-r--r--drivers/net/slip/slip.h1
-rw-r--r--drivers/net/usb/huawei_cdc_ncm.c7
-rw-r--r--drivers/net/vmxnet3/vmxnet3_drv.c7
-rw-r--r--drivers/net/vmxnet3/vmxnet3_ethtool.c12
-rw-r--r--drivers/net/vmxnet3/vmxnet3_int.h5
-rw-r--r--drivers/net/wireless/b43/Kconfig2
-rw-r--r--drivers/net/wireless/b43/main.c1
-rw-r--r--drivers/net/wireless/b43/xmit.c10
-rw-r--r--drivers/net/wireless/mwifiex/pcie.c4
-rw-r--r--drivers/net/wireless/mwifiex/util.h43
-rw-r--r--drivers/net/wireless/rt2x00/rt2500pci.c7
-rw-r--r--drivers/net/wireless/rt2x00/rt2800usb.c39
-rw-r--r--drivers/net/wireless/rt2x00/rt2x00.h1
-rw-r--r--drivers/net/wireless/rt2x00/rt2x00dev.c24
-rw-r--r--drivers/net/wireless/rt2x00/rt2x00mac.c2
-rw-r--r--drivers/net/wireless/rt2x00/rt2x00usb.h1
-rw-r--r--drivers/net/xen-netback/common.h1
-rw-r--r--drivers/net/xen-netback/interface.c49
-rw-r--r--drivers/net/xen-netback/xenbus.c28
-rw-r--r--drivers/net/xen-netfront.c109
-rw-r--r--drivers/of/of_mdio.c8
-rw-r--r--drivers/ptp/Kconfig2
-rw-r--r--include/linux/phy.h9
-rw-r--r--include/net/netfilter/nf_tables.h6
-rw-r--r--include/net/sock.h4
-rw-r--r--net/8021q/vlan_core.c5
-rw-r--r--net/bluetooth/hci_conn.c7
-rw-r--r--net/bluetooth/hci_event.c17
-rw-r--r--net/bluetooth/l2cap_core.c8
-rw-r--r--net/bluetooth/l2cap_sock.c5
-rw-r--r--net/bluetooth/mgmt.c104
-rw-r--r--net/bluetooth/smp.c9
-rw-r--r--net/core/dst.c16
-rw-r--r--net/core/filter.c10
-rw-r--r--net/core/skbuff.c2
-rw-r--r--net/ipv4/ip_tunnel.c14
-rw-r--r--net/ipv4/tcp_fastopen.c2
-rw-r--r--net/ipv4/tcp_input.c2
-rw-r--r--net/netfilter/ipvs/ip_vs_ctl.c2
-rw-r--r--net/netfilter/nf_conntrack_netlink.c20
-rw-r--r--net/netfilter/nf_nat_core.c35
-rw-r--r--net/netfilter/nf_tables_api.c11
-rw-r--r--net/netfilter/nft_compat.c18
-rw-r--r--net/netfilter/nft_nat.c14
-rw-r--r--net/sctp/sysctl.c46
68 files changed, 741 insertions, 366 deletions
diff --git a/Documentation/ptp/testptp.c b/Documentation/ptp/testptp.c
index f1ac2dae999e..ba1d50200c46 100644
--- a/Documentation/ptp/testptp.c
+++ b/Documentation/ptp/testptp.c
@@ -17,6 +17,7 @@
17 * along with this program; if not, write to the Free Software 17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 */ 19 */
20#define _GNU_SOURCE
20#include <errno.h> 21#include <errno.h>
21#include <fcntl.h> 22#include <fcntl.h>
22#include <inttypes.h> 23#include <inttypes.h>
@@ -46,12 +47,14 @@
46#define CLOCK_INVALID -1 47#define CLOCK_INVALID -1
47#endif 48#endif
48 49
49/* When glibc offers the syscall, this will go away. */ 50/* clock_adjtime is not available in GLIBC < 2.14 */
51#if !__GLIBC_PREREQ(2, 14)
50#include <sys/syscall.h> 52#include <sys/syscall.h>
51static int clock_adjtime(clockid_t id, struct timex *tx) 53static int clock_adjtime(clockid_t id, struct timex *tx)
52{ 54{
53 return syscall(__NR_clock_adjtime, id, tx); 55 return syscall(__NR_clock_adjtime, id, tx);
54} 56}
57#endif
55 58
56static clockid_t get_clockid(int fd) 59static clockid_t get_clockid(int fd)
57{ 60{
diff --git a/MAINTAINERS b/MAINTAINERS
index 3cc94fff780f..ebc812827c63 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3189,14 +3189,6 @@ L: linux-scsi@vger.kernel.org
3189S: Maintained 3189S: Maintained
3190F: drivers/scsi/eata_pio.* 3190F: drivers/scsi/eata_pio.*
3191 3191
3192EBTABLES
3193L: netfilter-devel@vger.kernel.org
3194W: http://ebtables.sourceforge.net/
3195S: Orphan
3196F: include/linux/netfilter_bridge/ebt_*.h
3197F: include/uapi/linux/netfilter_bridge/ebt_*.h
3198F: net/bridge/netfilter/ebt*.c
3199
3200EC100 MEDIA DRIVER 3192EC100 MEDIA DRIVER
3201M: Antti Palosaari <crope@iki.fi> 3193M: Antti Palosaari <crope@iki.fi>
3202L: linux-media@vger.kernel.org 3194L: linux-media@vger.kernel.org
@@ -6105,12 +6097,11 @@ F: Documentation/networking/s2io.txt
6105F: Documentation/networking/vxge.txt 6097F: Documentation/networking/vxge.txt
6106F: drivers/net/ethernet/neterion/ 6098F: drivers/net/ethernet/neterion/
6107 6099
6108NETFILTER/IPTABLES 6100NETFILTER ({IP,IP6,ARP,EB,NF}TABLES)
6109M: Pablo Neira Ayuso <pablo@netfilter.org> 6101M: Pablo Neira Ayuso <pablo@netfilter.org>
6110M: Patrick McHardy <kaber@trash.net> 6102M: Patrick McHardy <kaber@trash.net>
6111M: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 6103M: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
6112L: netfilter-devel@vger.kernel.org 6104L: netfilter-devel@vger.kernel.org
6113L: netfilter@vger.kernel.org
6114L: coreteam@netfilter.org 6105L: coreteam@netfilter.org
6115W: http://www.netfilter.org/ 6106W: http://www.netfilter.org/
6116W: http://www.iptables.org/ 6107W: http://www.iptables.org/
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index d9edcc94c2a8..97465ac5a2d5 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -16,7 +16,7 @@ config ISDN_DRV_HISAX
16 also to the configuration option of the driver for your particular 16 also to the configuration option of the driver for your particular
17 card, below. 17 card, below.
18 18
19if ISDN_DRV_HISAX!=n 19if ISDN_DRV_HISAX
20 20
21comment "D-channel protocol features" 21comment "D-channel protocol features"
22 22
@@ -348,10 +348,6 @@ config HISAX_ENTERNOW_PCI
348 This enables HiSax support for the Formula-n enter:now PCI 348 This enables HiSax support for the Formula-n enter:now PCI
349 ISDN card. 349 ISDN card.
350 350
351endif
352
353if ISDN_DRV_HISAX
354
355config HISAX_DEBUG 351config HISAX_DEBUG
356 bool "HiSax debugging" 352 bool "HiSax debugging"
357 help 353 help
@@ -420,11 +416,6 @@ config HISAX_FRITZ_PCIPNP
420 (the latter also needs you to select "ISA Plug and Play support" 416 (the latter also needs you to select "ISA Plug and Play support"
421 from the menu "Plug and Play configuration") 417 from the menu "Plug and Play configuration")
422 418
423config HISAX_AVM_A1_PCMCIA
424 bool
425 depends on HISAX_AVM_A1_CS
426 default y
427
428endif 419endif
429 420
430endmenu 421endmenu
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 04f35f960cb8..3a451b6cd3d5 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1025,10 +1025,14 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
1025 NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \ 1025 NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
1026 NETIF_F_HIGHDMA | NETIF_F_LRO) 1026 NETIF_F_HIGHDMA | NETIF_F_LRO)
1027 1027
1028#define BOND_ENC_FEATURES (NETIF_F_ALL_CSUM | NETIF_F_SG | NETIF_F_RXCSUM |\
1029 NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL)
1030
1028static void bond_compute_features(struct bonding *bond) 1031static void bond_compute_features(struct bonding *bond)
1029{ 1032{
1030 unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE; 1033 unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE;
1031 netdev_features_t vlan_features = BOND_VLAN_FEATURES; 1034 netdev_features_t vlan_features = BOND_VLAN_FEATURES;
1035 netdev_features_t enc_features = BOND_ENC_FEATURES;
1032 struct net_device *bond_dev = bond->dev; 1036 struct net_device *bond_dev = bond->dev;
1033 struct list_head *iter; 1037 struct list_head *iter;
1034 struct slave *slave; 1038 struct slave *slave;
@@ -1044,6 +1048,9 @@ static void bond_compute_features(struct bonding *bond)
1044 vlan_features = netdev_increment_features(vlan_features, 1048 vlan_features = netdev_increment_features(vlan_features,
1045 slave->dev->vlan_features, BOND_VLAN_FEATURES); 1049 slave->dev->vlan_features, BOND_VLAN_FEATURES);
1046 1050
1051 enc_features = netdev_increment_features(enc_features,
1052 slave->dev->hw_enc_features,
1053 BOND_ENC_FEATURES);
1047 dst_release_flag &= slave->dev->priv_flags; 1054 dst_release_flag &= slave->dev->priv_flags;
1048 if (slave->dev->hard_header_len > max_hard_header_len) 1055 if (slave->dev->hard_header_len > max_hard_header_len)
1049 max_hard_header_len = slave->dev->hard_header_len; 1056 max_hard_header_len = slave->dev->hard_header_len;
@@ -1054,6 +1061,7 @@ static void bond_compute_features(struct bonding *bond)
1054 1061
1055done: 1062done:
1056 bond_dev->vlan_features = vlan_features; 1063 bond_dev->vlan_features = vlan_features;
1064 bond_dev->hw_enc_features = enc_features;
1057 bond_dev->hard_header_len = max_hard_header_len; 1065 bond_dev->hard_header_len = max_hard_header_len;
1058 bond_dev->gso_max_segs = gso_max_segs; 1066 bond_dev->gso_max_segs = gso_max_segs;
1059 netif_set_gso_max_size(bond_dev, gso_max_size); 1067 netif_set_gso_max_size(bond_dev, gso_max_size);
@@ -3975,6 +3983,7 @@ void bond_setup(struct net_device *bond_dev)
3975 NETIF_F_HW_VLAN_CTAG_FILTER; 3983 NETIF_F_HW_VLAN_CTAG_FILTER;
3976 3984
3977 bond_dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM); 3985 bond_dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM);
3986 bond_dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
3978 bond_dev->features |= bond_dev->hw_features; 3987 bond_dev->features |= bond_dev->hw_features;
3979} 3988}
3980 3989
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index dcf9196f6316..ea4d4f1a6411 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -52,6 +52,7 @@
52#include <linux/delay.h> 52#include <linux/delay.h>
53#include <linux/init.h> 53#include <linux/init.h>
54#include <linux/kernel.h> 54#include <linux/kernel.h>
55#include <linux/workqueue.h>
55#include <linux/can.h> 56#include <linux/can.h>
56#include <linux/can/skb.h> 57#include <linux/can/skb.h>
57 58
@@ -85,6 +86,7 @@ struct slcan {
85 struct tty_struct *tty; /* ptr to TTY structure */ 86 struct tty_struct *tty; /* ptr to TTY structure */
86 struct net_device *dev; /* easy for intr handling */ 87 struct net_device *dev; /* easy for intr handling */
87 spinlock_t lock; 88 spinlock_t lock;
89 struct work_struct tx_work; /* Flushes transmit buffer */
88 90
89 /* These are pointers to the malloc()ed frame buffers. */ 91 /* These are pointers to the malloc()ed frame buffers. */
90 unsigned char rbuff[SLC_MTU]; /* receiver buffer */ 92 unsigned char rbuff[SLC_MTU]; /* receiver buffer */
@@ -309,36 +311,46 @@ static void slc_encaps(struct slcan *sl, struct can_frame *cf)
309 sl->dev->stats.tx_bytes += cf->can_dlc; 311 sl->dev->stats.tx_bytes += cf->can_dlc;
310} 312}
311 313
312/* 314/* Write out any remaining transmit buffer. Scheduled when tty is writable */
313 * Called by the driver when there's room for more data. If we have 315static void slcan_transmit(struct work_struct *work)
314 * more packets to send, we send them here.
315 */
316static void slcan_write_wakeup(struct tty_struct *tty)
317{ 316{
317 struct slcan *sl = container_of(work, struct slcan, tx_work);
318 int actual; 318 int actual;
319 struct slcan *sl = (struct slcan *) tty->disc_data;
320 319
320 spin_lock_bh(&sl->lock);
321 /* First make sure we're connected. */ 321 /* First make sure we're connected. */
322 if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev)) 322 if (!sl->tty || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev)) {
323 spin_unlock_bh(&sl->lock);
323 return; 324 return;
325 }
324 326
325 spin_lock_bh(&sl->lock);
326 if (sl->xleft <= 0) { 327 if (sl->xleft <= 0) {
327 /* Now serial buffer is almost free & we can start 328 /* Now serial buffer is almost free & we can start
328 * transmission of another packet */ 329 * transmission of another packet */
329 sl->dev->stats.tx_packets++; 330 sl->dev->stats.tx_packets++;
330 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); 331 clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
331 spin_unlock_bh(&sl->lock); 332 spin_unlock_bh(&sl->lock);
332 netif_wake_queue(sl->dev); 333 netif_wake_queue(sl->dev);
333 return; 334 return;
334 } 335 }
335 336
336 actual = tty->ops->write(tty, sl->xhead, sl->xleft); 337 actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
337 sl->xleft -= actual; 338 sl->xleft -= actual;
338 sl->xhead += actual; 339 sl->xhead += actual;
339 spin_unlock_bh(&sl->lock); 340 spin_unlock_bh(&sl->lock);
340} 341}
341 342
343/*
344 * Called by the driver when there's room for more data.
345 * Schedule the transmit.
346 */
347static void slcan_write_wakeup(struct tty_struct *tty)
348{
349 struct slcan *sl = tty->disc_data;
350
351 schedule_work(&sl->tx_work);
352}
353
342/* Send a can_frame to a TTY queue. */ 354/* Send a can_frame to a TTY queue. */
343static netdev_tx_t slc_xmit(struct sk_buff *skb, struct net_device *dev) 355static netdev_tx_t slc_xmit(struct sk_buff *skb, struct net_device *dev)
344{ 356{
@@ -528,6 +540,7 @@ static struct slcan *slc_alloc(dev_t line)
528 sl->magic = SLCAN_MAGIC; 540 sl->magic = SLCAN_MAGIC;
529 sl->dev = dev; 541 sl->dev = dev;
530 spin_lock_init(&sl->lock); 542 spin_lock_init(&sl->lock);
543 INIT_WORK(&sl->tx_work, slcan_transmit);
531 slcan_devs[i] = dev; 544 slcan_devs[i] = dev;
532 545
533 return sl; 546 return sl;
@@ -626,8 +639,12 @@ static void slcan_close(struct tty_struct *tty)
626 if (!sl || sl->magic != SLCAN_MAGIC || sl->tty != tty) 639 if (!sl || sl->magic != SLCAN_MAGIC || sl->tty != tty)
627 return; 640 return;
628 641
642 spin_lock_bh(&sl->lock);
629 tty->disc_data = NULL; 643 tty->disc_data = NULL;
630 sl->tty = NULL; 644 sl->tty = NULL;
645 spin_unlock_bh(&sl->lock);
646
647 flush_work(&sl->tx_work);
631 648
632 /* Flush network side */ 649 /* Flush network side */
633 unregister_netdev(sl->dev); 650 unregister_netdev(sl->dev);
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 28460676b8ca..d81e7167a8b5 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -736,6 +736,7 @@ static int emac_open(struct net_device *dev)
736 736
737 ret = emac_mdio_probe(dev); 737 ret = emac_mdio_probe(dev);
738 if (ret < 0) { 738 if (ret < 0) {
739 free_irq(dev->irq, dev);
739 netdev_err(dev, "cannot probe MDIO bus\n"); 740 netdev_err(dev, "cannot probe MDIO bus\n");
740 return ret; 741 return ret;
741 } 742 }
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index df2792d8383d..8afa579e7c40 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -3224,7 +3224,7 @@ static int tg3_nvram_read_using_eeprom(struct tg3 *tp,
3224 return 0; 3224 return 0;
3225} 3225}
3226 3226
3227#define NVRAM_CMD_TIMEOUT 100 3227#define NVRAM_CMD_TIMEOUT 5000
3228 3228
3229static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd) 3229static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
3230{ 3230{
@@ -3232,7 +3232,7 @@ static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
3232 3232
3233 tw32(NVRAM_CMD, nvram_cmd); 3233 tw32(NVRAM_CMD, nvram_cmd);
3234 for (i = 0; i < NVRAM_CMD_TIMEOUT; i++) { 3234 for (i = 0; i < NVRAM_CMD_TIMEOUT; i++) {
3235 udelay(10); 3235 usleep_range(10, 40);
3236 if (tr32(NVRAM_CMD) & NVRAM_CMD_DONE) { 3236 if (tr32(NVRAM_CMD) & NVRAM_CMD_DONE) {
3237 udelay(10); 3237 udelay(10);
3238 break; 3238 break;
@@ -7854,8 +7854,8 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
7854 netif_wake_queue(tp->dev); 7854 netif_wake_queue(tp->dev);
7855 } 7855 }
7856 7856
7857 segs = skb_gso_segment(skb, tp->dev->features & ~NETIF_F_TSO); 7857 segs = skb_gso_segment(skb, tp->dev->features & ~(NETIF_F_TSO | NETIF_F_TSO6));
7858 if (IS_ERR(segs)) 7858 if (IS_ERR(segs) || !segs)
7859 goto tg3_tso_bug_end; 7859 goto tg3_tso_bug_end;
7860 7860
7861 do { 7861 do {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 2f8d6b910383..a83271cf17c3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4057,22 +4057,19 @@ int cxgb4_unregister_uld(enum cxgb4_uld type)
4057EXPORT_SYMBOL(cxgb4_unregister_uld); 4057EXPORT_SYMBOL(cxgb4_unregister_uld);
4058 4058
4059/* Check if netdev on which event is occured belongs to us or not. Return 4059/* Check if netdev on which event is occured belongs to us or not. Return
4060 * suceess (1) if it belongs otherwise failure (0). 4060 * success (true) if it belongs otherwise failure (false).
4061 * Called with rcu_read_lock() held.
4061 */ 4062 */
4062static int cxgb4_netdev(struct net_device *netdev) 4063static bool cxgb4_netdev(const struct net_device *netdev)
4063{ 4064{
4064 struct adapter *adap; 4065 struct adapter *adap;
4065 int i; 4066 int i;
4066 4067
4067 spin_lock(&adap_rcu_lock);
4068 list_for_each_entry_rcu(adap, &adap_rcu_list, rcu_node) 4068 list_for_each_entry_rcu(adap, &adap_rcu_list, rcu_node)
4069 for (i = 0; i < MAX_NPORTS; i++) 4069 for (i = 0; i < MAX_NPORTS; i++)
4070 if (adap->port[i] == netdev) { 4070 if (adap->port[i] == netdev)
4071 spin_unlock(&adap_rcu_lock); 4071 return true;
4072 return 1; 4072 return false;
4073 }
4074 spin_unlock(&adap_rcu_lock);
4075 return 0;
4076} 4073}
4077 4074
4078static int clip_add(struct net_device *event_dev, struct inet6_ifaddr *ifa, 4075static int clip_add(struct net_device *event_dev, struct inet6_ifaddr *ifa,
@@ -6396,6 +6393,7 @@ static void remove_one(struct pci_dev *pdev)
6396 adapter->flags &= ~DEV_ENABLED; 6393 adapter->flags &= ~DEV_ENABLED;
6397 } 6394 }
6398 pci_release_regions(pdev); 6395 pci_release_regions(pdev);
6396 synchronize_rcu();
6399 kfree(adapter); 6397 kfree(adapter);
6400 } else 6398 } else
6401 pci_release_regions(pdev); 6399 pci_release_regions(pdev);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index bba67681aeaa..931478e7bd28 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3962,6 +3962,7 @@ int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
3962 p->lport = j; 3962 p->lport = j;
3963 p->rss_size = rss_size; 3963 p->rss_size = rss_size;
3964 memcpy(adap->port[i]->dev_addr, addr, ETH_ALEN); 3964 memcpy(adap->port[i]->dev_addr, addr, ETH_ALEN);
3965 adap->port[i]->dev_port = j;
3965 3966
3966 ret = ntohl(c.u.info.lstatus_to_modtype); 3967 ret = ntohl(c.u.info.lstatus_to_modtype);
3967 p->mdio_addr = (ret & FW_PORT_CMD_MDIOCAP) ? 3968 p->mdio_addr = (ret & FW_PORT_CMD_MDIOCAP) ?
diff --git a/drivers/net/ethernet/dec/tulip/timer.c b/drivers/net/ethernet/dec/tulip/timer.c
index 768379b8aee9..523d9dde50a2 100644
--- a/drivers/net/ethernet/dec/tulip/timer.c
+++ b/drivers/net/ethernet/dec/tulip/timer.c
@@ -158,7 +158,7 @@ void comet_timer(unsigned long data)
158{ 158{
159 struct net_device *dev = (struct net_device *)data; 159 struct net_device *dev = (struct net_device *)data;
160 struct tulip_private *tp = netdev_priv(dev); 160 struct tulip_private *tp = netdev_priv(dev);
161 int next_tick = 60*HZ; 161 int next_tick = 2*HZ;
162 162
163 if (tulip_debug > 1) 163 if (tulip_debug > 1)
164 netdev_dbg(dev, "Comet link status %04x partner capability %04x\n", 164 netdev_dbg(dev, "Comet link status %04x partner capability %04x\n",
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 2e7c5553955e..c2f5d2d3b932 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -557,9 +557,7 @@ static inline u16 be_max_qs(struct be_adapter *adapter)
557#define be_pvid_tagging_enabled(adapter) (adapter->pvid) 557#define be_pvid_tagging_enabled(adapter) (adapter->pvid)
558 558
559/* Is BE in QNQ multi-channel mode */ 559/* Is BE in QNQ multi-channel mode */
560#define be_is_qnq_mode(adapter) (adapter->mc_type == FLEX10 || \ 560#define be_is_qnq_mode(adapter) (adapter->function_mode & QNQ_MODE)
561 adapter->mc_type == vNIC1 || \
562 adapter->mc_type == UFP)
563 561
564#define lancer_chip(adapter) (adapter->pdev->device == OC_DEVICE_ID3 || \ 562#define lancer_chip(adapter) (adapter->pdev->device == OC_DEVICE_ID3 || \
565 adapter->pdev->device == OC_DEVICE_ID4) 563 adapter->pdev->device == OC_DEVICE_ID4)
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 3e0a6b243806..59b3c056f329 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1091,7 +1091,7 @@ struct be_cmd_resp_modify_eq_delay {
1091 * based on the skew/IPL. 1091 * based on the skew/IPL.
1092 */ 1092 */
1093#define RDMA_ENABLED 0x4 1093#define RDMA_ENABLED 0x4
1094#define FLEX10_MODE 0x400 1094#define QNQ_MODE 0x400
1095#define VNIC_MODE 0x20000 1095#define VNIC_MODE 0x20000
1096#define UMC_ENABLED 0x1000000 1096#define UMC_ENABLED 0x1000000
1097struct be_cmd_req_query_fw_cfg { 1097struct be_cmd_req_query_fw_cfg {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 6822b3d76d85..34a26e42f19d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3254,9 +3254,9 @@ err:
3254 3254
3255static u8 be_convert_mc_type(u32 function_mode) 3255static u8 be_convert_mc_type(u32 function_mode)
3256{ 3256{
3257 if (function_mode & VNIC_MODE && function_mode & FLEX10_MODE) 3257 if (function_mode & VNIC_MODE && function_mode & QNQ_MODE)
3258 return vNIC1; 3258 return vNIC1;
3259 else if (function_mode & FLEX10_MODE) 3259 else if (function_mode & QNQ_MODE)
3260 return FLEX10; 3260 return FLEX10;
3261 else if (function_mode & VNIC_MODE) 3261 else if (function_mode & VNIC_MODE)
3262 return vNIC2; 3262 return vNIC2;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 38d9d276ab8b..77037fd377b8 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -320,6 +320,11 @@ static void *swap_buffer(void *bufaddr, int len)
320 return bufaddr; 320 return bufaddr;
321} 321}
322 322
323static inline bool is_ipv4_pkt(struct sk_buff *skb)
324{
325 return skb->protocol == htons(ETH_P_IP) && ip_hdr(skb)->version == 4;
326}
327
323static int 328static int
324fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev) 329fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
325{ 330{
@@ -330,7 +335,8 @@ fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
330 if (unlikely(skb_cow_head(skb, 0))) 335 if (unlikely(skb_cow_head(skb, 0)))
331 return -1; 336 return -1;
332 337
333 ip_hdr(skb)->check = 0; 338 if (is_ipv4_pkt(skb))
339 ip_hdr(skb)->check = 0;
334 *(__sum16 *)(skb->head + skb->csum_start + skb->csum_offset) = 0; 340 *(__sum16 *)(skb->head + skb->csum_start + skb->csum_offset) = 0;
335 341
336 return 0; 342 return 0;
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 7f81ae66cc89..e912b6887d40 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4199,6 +4199,13 @@ static struct dmi_system_id skge_32bit_dma_boards[] = {
4199 DMI_MATCH(DMI_BOARD_NAME, "P5NSLI") 4199 DMI_MATCH(DMI_BOARD_NAME, "P5NSLI")
4200 }, 4200 },
4201 }, 4201 },
4202 {
4203 .ident = "FUJITSU SIEMENS A8NE-FM",
4204 .matches = {
4205 DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTek Computer INC."),
4206 DMI_MATCH(DMI_BOARD_NAME, "A8NE-FM")
4207 },
4208 },
4202 {} 4209 {}
4203}; 4210};
4204 4211
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 5f42f6d6e4c6..82ab427290c3 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2439,7 +2439,8 @@ slave_start:
2439 (num_vfs_argc > 1 || probe_vfs_argc > 1)) { 2439 (num_vfs_argc > 1 || probe_vfs_argc > 1)) {
2440 mlx4_err(dev, 2440 mlx4_err(dev,
2441 "Invalid syntax of num_vfs/probe_vfs with IB port - single port VFs syntax is only supported when all ports are configured as ethernet\n"); 2441 "Invalid syntax of num_vfs/probe_vfs with IB port - single port VFs syntax is only supported when all ports are configured as ethernet\n");
2442 goto err_close; 2442 err = -EINVAL;
2443 goto err_master_mfunc;
2443 } 2444 }
2444 for (i = 0; i < sizeof(nvfs)/sizeof(nvfs[0]); i++) { 2445 for (i = 0; i < sizeof(nvfs)/sizeof(nvfs[0]); i++) {
2445 unsigned j; 2446 unsigned j;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index ff380dac6629..b988d16cd34e 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1212,7 +1212,12 @@ static int cpsw_ndo_open(struct net_device *ndev)
1212 for_each_slave(priv, cpsw_slave_open, priv); 1212 for_each_slave(priv, cpsw_slave_open, priv);
1213 1213
1214 /* Add default VLAN */ 1214 /* Add default VLAN */
1215 cpsw_add_default_vlan(priv); 1215 if (!priv->data.dual_emac)
1216 cpsw_add_default_vlan(priv);
1217 else
1218 cpsw_ale_add_vlan(priv->ale, priv->data.default_vlan,
1219 ALE_ALL_PORTS << priv->host_port,
1220 ALE_ALL_PORTS << priv->host_port, 0, 0);
1216 1221
1217 if (!cpsw_common_res_usage_state(priv)) { 1222 if (!cpsw_common_res_usage_state(priv)) {
1218 /* setup tx dma to fixed prio and zero offset */ 1223 /* setup tx dma to fixed prio and zero offset */
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 14389f841d43..4c70360967c2 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2191,7 +2191,6 @@ static void tile_net_setup(struct net_device *dev)
2191static void tile_net_dev_init(const char *name, const uint8_t *mac) 2191static void tile_net_dev_init(const char *name, const uint8_t *mac)
2192{ 2192{
2193 int ret; 2193 int ret;
2194 int i;
2195 struct net_device *dev; 2194 struct net_device *dev;
2196 struct tile_net_priv *priv; 2195 struct tile_net_priv *priv;
2197 2196
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index c041f63a6d30..4ed38eaecea8 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -189,7 +189,7 @@ static int netvsc_destroy_buf(struct netvsc_device *net_device)
189 "unable to teardown send buffer's gpadl\n"); 189 "unable to teardown send buffer's gpadl\n");
190 return ret; 190 return ret;
191 } 191 }
192 net_device->recv_buf_gpadl_handle = 0; 192 net_device->send_buf_gpadl_handle = 0;
193 } 193 }
194 if (net_device->send_buf) { 194 if (net_device->send_buf) {
195 /* Free up the receive buffer */ 195 /* Free up the receive buffer */
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 4517b149ed07..50899416f668 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -1137,6 +1137,8 @@ static int at86rf230_probe(struct spi_device *spi)
1137 dev->flags = IEEE802154_HW_OMIT_CKSUM | IEEE802154_HW_AACK; 1137 dev->flags = IEEE802154_HW_OMIT_CKSUM | IEEE802154_HW_AACK;
1138 1138
1139 irq_type = irq_get_trigger_type(spi->irq); 1139 irq_type = irq_get_trigger_type(spi->irq);
1140 if (!irq_type)
1141 irq_type = IRQF_TRIGGER_RISING;
1140 if (irq_type & (IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING)) { 1142 if (irq_type & (IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING)) {
1141 irq_worker = at86rf230_irqwork; 1143 irq_worker = at86rf230_irqwork;
1142 irq_handler = at86rf230_isr; 1144 irq_handler = at86rf230_isr;
@@ -1168,7 +1170,8 @@ static int at86rf230_probe(struct spi_device *spi)
1168 if (rc) 1170 if (rc)
1169 goto err_hw_init; 1171 goto err_hw_init;
1170 1172
1171 rc = devm_request_irq(&spi->dev, spi->irq, irq_handler, IRQF_SHARED, 1173 rc = devm_request_irq(&spi->dev, spi->irq, irq_handler,
1174 IRQF_SHARED | irq_type,
1172 dev_name(&spi->dev), lp); 1175 dev_name(&spi->dev), lp);
1173 if (rc) 1176 if (rc)
1174 goto err_hw_init; 1177 goto err_hw_init;
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 6c622aedbae1..fdc1b418fa6a 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -16,9 +16,13 @@
16#include <linux/string.h> 16#include <linux/string.h>
17#include <linux/netdevice.h> 17#include <linux/netdevice.h>
18#include <linux/etherdevice.h> 18#include <linux/etherdevice.h>
19#include <linux/of_gpio.h>
20#include <linux/gpio/consumer.h>
19 21
20#define AT803X_INTR_ENABLE 0x12 22#define AT803X_INTR_ENABLE 0x12
21#define AT803X_INTR_STATUS 0x13 23#define AT803X_INTR_STATUS 0x13
24#define AT803X_SMART_SPEED 0x14
25#define AT803X_LED_CONTROL 0x18
22#define AT803X_WOL_ENABLE 0x01 26#define AT803X_WOL_ENABLE 0x01
23#define AT803X_DEVICE_ADDR 0x03 27#define AT803X_DEVICE_ADDR 0x03
24#define AT803X_LOC_MAC_ADDR_0_15_OFFSET 0x804C 28#define AT803X_LOC_MAC_ADDR_0_15_OFFSET 0x804C
@@ -35,10 +39,52 @@
35#define AT803X_DEBUG_SYSTEM_MODE_CTRL 0x05 39#define AT803X_DEBUG_SYSTEM_MODE_CTRL 0x05
36#define AT803X_DEBUG_RGMII_TX_CLK_DLY BIT(8) 40#define AT803X_DEBUG_RGMII_TX_CLK_DLY BIT(8)
37 41
42#define ATH8030_PHY_ID 0x004dd076
43#define ATH8031_PHY_ID 0x004dd074
44#define ATH8035_PHY_ID 0x004dd072
45
38MODULE_DESCRIPTION("Atheros 803x PHY driver"); 46MODULE_DESCRIPTION("Atheros 803x PHY driver");
39MODULE_AUTHOR("Matus Ujhelyi"); 47MODULE_AUTHOR("Matus Ujhelyi");
40MODULE_LICENSE("GPL"); 48MODULE_LICENSE("GPL");
41 49
50struct at803x_priv {
51 bool phy_reset:1;
52 struct gpio_desc *gpiod_reset;
53};
54
55struct at803x_context {
56 u16 bmcr;
57 u16 advertise;
58 u16 control1000;
59 u16 int_enable;
60 u16 smart_speed;
61 u16 led_control;
62};
63
64/* save relevant PHY registers to private copy */
65static void at803x_context_save(struct phy_device *phydev,
66 struct at803x_context *context)
67{
68 context->bmcr = phy_read(phydev, MII_BMCR);
69 context->advertise = phy_read(phydev, MII_ADVERTISE);
70 context->control1000 = phy_read(phydev, MII_CTRL1000);
71 context->int_enable = phy_read(phydev, AT803X_INTR_ENABLE);
72 context->smart_speed = phy_read(phydev, AT803X_SMART_SPEED);
73 context->led_control = phy_read(phydev, AT803X_LED_CONTROL);
74}
75
76/* restore relevant PHY registers from private copy */
77static void at803x_context_restore(struct phy_device *phydev,
78 const struct at803x_context *context)
79{
80 phy_write(phydev, MII_BMCR, context->bmcr);
81 phy_write(phydev, MII_ADVERTISE, context->advertise);
82 phy_write(phydev, MII_CTRL1000, context->control1000);
83 phy_write(phydev, AT803X_INTR_ENABLE, context->int_enable);
84 phy_write(phydev, AT803X_SMART_SPEED, context->smart_speed);
85 phy_write(phydev, AT803X_LED_CONTROL, context->led_control);
86}
87
42static int at803x_set_wol(struct phy_device *phydev, 88static int at803x_set_wol(struct phy_device *phydev,
43 struct ethtool_wolinfo *wol) 89 struct ethtool_wolinfo *wol)
44{ 90{
@@ -142,6 +188,26 @@ static int at803x_resume(struct phy_device *phydev)
142 return 0; 188 return 0;
143} 189}
144 190
191static int at803x_probe(struct phy_device *phydev)
192{
193 struct device *dev = &phydev->dev;
194 struct at803x_priv *priv;
195
196 priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
197 if (!priv)
198 return -ENOMEM;
199
200 priv->gpiod_reset = devm_gpiod_get(dev, "reset");
201 if (IS_ERR(priv->gpiod_reset))
202 priv->gpiod_reset = NULL;
203 else
204 gpiod_direction_output(priv->gpiod_reset, 1);
205
206 phydev->priv = priv;
207
208 return 0;
209}
210
145static int at803x_config_init(struct phy_device *phydev) 211static int at803x_config_init(struct phy_device *phydev)
146{ 212{
147 int ret; 213 int ret;
@@ -189,58 +255,99 @@ static int at803x_config_intr(struct phy_device *phydev)
189 return err; 255 return err;
190} 256}
191 257
258static void at803x_link_change_notify(struct phy_device *phydev)
259{
260 struct at803x_priv *priv = phydev->priv;
261
262 /*
263 * Conduct a hardware reset for AT8030 every time a link loss is
264 * signalled. This is necessary to circumvent a hardware bug that
265 * occurs when the cable is unplugged while TX packets are pending
266 * in the FIFO. In such cases, the FIFO enters an error mode it
267 * cannot recover from by software.
268 */
269 if (phydev->drv->phy_id == ATH8030_PHY_ID) {
270 if (phydev->state == PHY_NOLINK) {
271 if (priv->gpiod_reset && !priv->phy_reset) {
272 struct at803x_context context;
273
274 at803x_context_save(phydev, &context);
275
276 gpiod_set_value(priv->gpiod_reset, 0);
277 msleep(1);
278 gpiod_set_value(priv->gpiod_reset, 1);
279 msleep(1);
280
281 at803x_context_restore(phydev, &context);
282
283 dev_dbg(&phydev->dev, "%s(): phy was reset\n",
284 __func__);
285 priv->phy_reset = true;
286 }
287 } else {
288 priv->phy_reset = false;
289 }
290 }
291}
292
192static struct phy_driver at803x_driver[] = { 293static struct phy_driver at803x_driver[] = {
193{ 294{
194 /* ATHEROS 8035 */ 295 /* ATHEROS 8035 */
195 .phy_id = 0x004dd072, 296 .phy_id = ATH8035_PHY_ID,
196 .name = "Atheros 8035 ethernet", 297 .name = "Atheros 8035 ethernet",
197 .phy_id_mask = 0xffffffef, 298 .phy_id_mask = 0xffffffef,
198 .config_init = at803x_config_init, 299 .probe = at803x_probe,
199 .set_wol = at803x_set_wol, 300 .config_init = at803x_config_init,
200 .get_wol = at803x_get_wol, 301 .link_change_notify = at803x_link_change_notify,
201 .suspend = at803x_suspend, 302 .set_wol = at803x_set_wol,
202 .resume = at803x_resume, 303 .get_wol = at803x_get_wol,
203 .features = PHY_GBIT_FEATURES, 304 .suspend = at803x_suspend,
204 .flags = PHY_HAS_INTERRUPT, 305 .resume = at803x_resume,
205 .config_aneg = genphy_config_aneg, 306 .features = PHY_GBIT_FEATURES,
206 .read_status = genphy_read_status, 307 .flags = PHY_HAS_INTERRUPT,
207 .driver = { 308 .config_aneg = genphy_config_aneg,
309 .read_status = genphy_read_status,
310 .driver = {
208 .owner = THIS_MODULE, 311 .owner = THIS_MODULE,
209 }, 312 },
210}, { 313}, {
211 /* ATHEROS 8030 */ 314 /* ATHEROS 8030 */
212 .phy_id = 0x004dd076, 315 .phy_id = ATH8030_PHY_ID,
213 .name = "Atheros 8030 ethernet", 316 .name = "Atheros 8030 ethernet",
214 .phy_id_mask = 0xffffffef, 317 .phy_id_mask = 0xffffffef,
215 .config_init = at803x_config_init, 318 .probe = at803x_probe,
216 .set_wol = at803x_set_wol, 319 .config_init = at803x_config_init,
217 .get_wol = at803x_get_wol, 320 .link_change_notify = at803x_link_change_notify,
218 .suspend = at803x_suspend, 321 .set_wol = at803x_set_wol,
219 .resume = at803x_resume, 322 .get_wol = at803x_get_wol,
220 .features = PHY_GBIT_FEATURES, 323 .suspend = at803x_suspend,
221 .flags = PHY_HAS_INTERRUPT, 324 .resume = at803x_resume,
222 .config_aneg = genphy_config_aneg, 325 .features = PHY_GBIT_FEATURES,
223 .read_status = genphy_read_status, 326 .flags = PHY_HAS_INTERRUPT,
224 .driver = { 327 .config_aneg = genphy_config_aneg,
328 .read_status = genphy_read_status,
329 .driver = {
225 .owner = THIS_MODULE, 330 .owner = THIS_MODULE,
226 }, 331 },
227}, { 332}, {
228 /* ATHEROS 8031 */ 333 /* ATHEROS 8031 */
229 .phy_id = 0x004dd074, 334 .phy_id = ATH8031_PHY_ID,
230 .name = "Atheros 8031 ethernet", 335 .name = "Atheros 8031 ethernet",
231 .phy_id_mask = 0xffffffef, 336 .phy_id_mask = 0xffffffef,
232 .config_init = at803x_config_init, 337 .probe = at803x_probe,
233 .set_wol = at803x_set_wol, 338 .config_init = at803x_config_init,
234 .get_wol = at803x_get_wol, 339 .link_change_notify = at803x_link_change_notify,
235 .suspend = at803x_suspend, 340 .set_wol = at803x_set_wol,
236 .resume = at803x_resume, 341 .get_wol = at803x_get_wol,
237 .features = PHY_GBIT_FEATURES, 342 .suspend = at803x_suspend,
238 .flags = PHY_HAS_INTERRUPT, 343 .resume = at803x_resume,
239 .config_aneg = genphy_config_aneg, 344 .features = PHY_GBIT_FEATURES,
240 .read_status = genphy_read_status, 345 .flags = PHY_HAS_INTERRUPT,
241 .ack_interrupt = &at803x_ack_interrupt, 346 .config_aneg = genphy_config_aneg,
242 .config_intr = &at803x_config_intr, 347 .read_status = genphy_read_status,
243 .driver = { 348 .ack_interrupt = &at803x_ack_interrupt,
349 .config_intr = &at803x_config_intr,
350 .driver = {
244 .owner = THIS_MODULE, 351 .owner = THIS_MODULE,
245 }, 352 },
246} }; 353} };
@@ -260,9 +367,9 @@ module_init(atheros_init);
260module_exit(atheros_exit); 367module_exit(atheros_exit);
261 368
262static struct mdio_device_id __maybe_unused atheros_tbl[] = { 369static struct mdio_device_id __maybe_unused atheros_tbl[] = {
263 { 0x004dd076, 0xffffffef }, 370 { ATH8030_PHY_ID, 0xffffffef },
264 { 0x004dd074, 0xffffffef }, 371 { ATH8031_PHY_ID, 0xffffffef },
265 { 0x004dd072, 0xffffffef }, 372 { ATH8035_PHY_ID, 0xffffffef },
266 { } 373 { }
267}; 374};
268 375
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 3bc079a67a3d..f7c61812ea4a 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -720,6 +720,9 @@ void phy_state_machine(struct work_struct *work)
720 720
721 mutex_lock(&phydev->lock); 721 mutex_lock(&phydev->lock);
722 722
723 if (phydev->drv->link_change_notify)
724 phydev->drv->link_change_notify(phydev);
725
723 switch (phydev->state) { 726 switch (phydev->state) {
724 case PHY_DOWN: 727 case PHY_DOWN:
725 case PHY_STARTING: 728 case PHY_STARTING:
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index ad4a94e9ff57..87526443841f 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -83,6 +83,7 @@
83#include <linux/delay.h> 83#include <linux/delay.h>
84#include <linux/init.h> 84#include <linux/init.h>
85#include <linux/slab.h> 85#include <linux/slab.h>
86#include <linux/workqueue.h>
86#include "slip.h" 87#include "slip.h"
87#ifdef CONFIG_INET 88#ifdef CONFIG_INET
88#include <linux/ip.h> 89#include <linux/ip.h>
@@ -416,36 +417,46 @@ static void sl_encaps(struct slip *sl, unsigned char *icp, int len)
416#endif 417#endif
417} 418}
418 419
419/* 420/* Write out any remaining transmit buffer. Scheduled when tty is writable */
420 * Called by the driver when there's room for more data. If we have 421static void slip_transmit(struct work_struct *work)
421 * more packets to send, we send them here.
422 */
423static void slip_write_wakeup(struct tty_struct *tty)
424{ 422{
423 struct slip *sl = container_of(work, struct slip, tx_work);
425 int actual; 424 int actual;
426 struct slip *sl = tty->disc_data;
427 425
426 spin_lock_bh(&sl->lock);
428 /* First make sure we're connected. */ 427 /* First make sure we're connected. */
429 if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) 428 if (!sl->tty || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) {
429 spin_unlock_bh(&sl->lock);
430 return; 430 return;
431 }
431 432
432 spin_lock_bh(&sl->lock);
433 if (sl->xleft <= 0) { 433 if (sl->xleft <= 0) {
434 /* Now serial buffer is almost free & we can start 434 /* Now serial buffer is almost free & we can start
435 * transmission of another packet */ 435 * transmission of another packet */
436 sl->dev->stats.tx_packets++; 436 sl->dev->stats.tx_packets++;
437 clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); 437 clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
438 spin_unlock_bh(&sl->lock); 438 spin_unlock_bh(&sl->lock);
439 sl_unlock(sl); 439 sl_unlock(sl);
440 return; 440 return;
441 } 441 }
442 442
443 actual = tty->ops->write(tty, sl->xhead, sl->xleft); 443 actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
444 sl->xleft -= actual; 444 sl->xleft -= actual;
445 sl->xhead += actual; 445 sl->xhead += actual;
446 spin_unlock_bh(&sl->lock); 446 spin_unlock_bh(&sl->lock);
447} 447}
448 448
449/*
450 * Called by the driver when there's room for more data.
451 * Schedule the transmit.
452 */
453static void slip_write_wakeup(struct tty_struct *tty)
454{
455 struct slip *sl = tty->disc_data;
456
457 schedule_work(&sl->tx_work);
458}
459
449static void sl_tx_timeout(struct net_device *dev) 460static void sl_tx_timeout(struct net_device *dev)
450{ 461{
451 struct slip *sl = netdev_priv(dev); 462 struct slip *sl = netdev_priv(dev);
@@ -749,6 +760,7 @@ static struct slip *sl_alloc(dev_t line)
749 sl->magic = SLIP_MAGIC; 760 sl->magic = SLIP_MAGIC;
750 sl->dev = dev; 761 sl->dev = dev;
751 spin_lock_init(&sl->lock); 762 spin_lock_init(&sl->lock);
763 INIT_WORK(&sl->tx_work, slip_transmit);
752 sl->mode = SL_MODE_DEFAULT; 764 sl->mode = SL_MODE_DEFAULT;
753#ifdef CONFIG_SLIP_SMART 765#ifdef CONFIG_SLIP_SMART
754 /* initialize timer_list struct */ 766 /* initialize timer_list struct */
@@ -872,8 +884,12 @@ static void slip_close(struct tty_struct *tty)
872 if (!sl || sl->magic != SLIP_MAGIC || sl->tty != tty) 884 if (!sl || sl->magic != SLIP_MAGIC || sl->tty != tty)
873 return; 885 return;
874 886
887 spin_lock_bh(&sl->lock);
875 tty->disc_data = NULL; 888 tty->disc_data = NULL;
876 sl->tty = NULL; 889 sl->tty = NULL;
890 spin_unlock_bh(&sl->lock);
891
892 flush_work(&sl->tx_work);
877 893
878 /* VSV = very important to remove timers */ 894 /* VSV = very important to remove timers */
879#ifdef CONFIG_SLIP_SMART 895#ifdef CONFIG_SLIP_SMART
diff --git a/drivers/net/slip/slip.h b/drivers/net/slip/slip.h
index 67673cf1266b..cf32aadf508f 100644
--- a/drivers/net/slip/slip.h
+++ b/drivers/net/slip/slip.h
@@ -53,6 +53,7 @@ struct slip {
53 struct tty_struct *tty; /* ptr to TTY structure */ 53 struct tty_struct *tty; /* ptr to TTY structure */
54 struct net_device *dev; /* easy for intr handling */ 54 struct net_device *dev; /* easy for intr handling */
55 spinlock_t lock; 55 spinlock_t lock;
56 struct work_struct tx_work; /* Flushes transmit buffer */
56 57
57#ifdef SL_INCLUDE_CSLIP 58#ifdef SL_INCLUDE_CSLIP
58 struct slcompress *slcomp; /* for header compression */ 59 struct slcompress *slcomp; /* for header compression */
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index f9822bc75425..5d95a13dbe2a 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -84,12 +84,13 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
84 ctx = drvstate->ctx; 84 ctx = drvstate->ctx;
85 85
86 if (usbnet_dev->status) 86 if (usbnet_dev->status)
87 /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 87 /* The wMaxCommand buffer must be big enough to hold
88 * decimal (0x100)" 88 * any message from the modem. Experience has shown
89 * that some replies are more than 256 bytes long
89 */ 90 */
90 subdriver = usb_cdc_wdm_register(ctx->control, 91 subdriver = usb_cdc_wdm_register(ctx->control,
91 &usbnet_dev->status->desc, 92 &usbnet_dev->status->desc,
92 256, /* wMaxCommand */ 93 1024, /* wMaxCommand */
93 huawei_cdc_ncm_wdm_manage_power); 94 huawei_cdc_ncm_wdm_manage_power);
94 if (IS_ERR(subdriver)) { 95 if (IS_ERR(subdriver)) {
95 ret = PTR_ERR(subdriver); 96 ret = PTR_ERR(subdriver);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 97394345e5dd..b76f7dcde0db 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2589,8 +2589,8 @@ vmxnet3_open(struct net_device *netdev)
2589 for (i = 0; i < adapter->num_tx_queues; i++) 2589 for (i = 0; i < adapter->num_tx_queues; i++)
2590 spin_lock_init(&adapter->tx_queue[i].tx_lock); 2590 spin_lock_init(&adapter->tx_queue[i].tx_lock);
2591 2591
2592 err = vmxnet3_create_queues(adapter, VMXNET3_DEF_TX_RING_SIZE, 2592 err = vmxnet3_create_queues(adapter, adapter->tx_ring_size,
2593 VMXNET3_DEF_RX_RING_SIZE, 2593 adapter->rx_ring_size,
2594 VMXNET3_DEF_RX_RING_SIZE); 2594 VMXNET3_DEF_RX_RING_SIZE);
2595 if (err) 2595 if (err)
2596 goto queue_err; 2596 goto queue_err;
@@ -2968,6 +2968,9 @@ vmxnet3_probe_device(struct pci_dev *pdev,
2968 adapter->netdev = netdev; 2968 adapter->netdev = netdev;
2969 adapter->pdev = pdev; 2969 adapter->pdev = pdev;
2970 2970
2971 adapter->tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
2972 adapter->rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
2973
2971 spin_lock_init(&adapter->cmd_lock); 2974 spin_lock_init(&adapter->cmd_lock);
2972 adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter, 2975 adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
2973 sizeof(struct vmxnet3_adapter), 2976 sizeof(struct vmxnet3_adapter),
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index 40c1c7b0d9e0..b725fd9e7803 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -449,8 +449,8 @@ vmxnet3_get_ringparam(struct net_device *netdev,
449 param->rx_mini_max_pending = 0; 449 param->rx_mini_max_pending = 0;
450 param->rx_jumbo_max_pending = 0; 450 param->rx_jumbo_max_pending = 0;
451 451
452 param->rx_pending = adapter->rx_queue[0].rx_ring[0].size; 452 param->rx_pending = adapter->rx_ring_size;
453 param->tx_pending = adapter->tx_queue[0].tx_ring.size; 453 param->tx_pending = adapter->tx_ring_size;
454 param->rx_mini_pending = 0; 454 param->rx_mini_pending = 0;
455 param->rx_jumbo_pending = 0; 455 param->rx_jumbo_pending = 0;
456} 456}
@@ -529,9 +529,11 @@ vmxnet3_set_ringparam(struct net_device *netdev,
529 * size */ 529 * size */
530 netdev_err(netdev, "failed to apply new sizes, " 530 netdev_err(netdev, "failed to apply new sizes, "
531 "try the default ones\n"); 531 "try the default ones\n");
532 new_rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
533 new_tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
532 err = vmxnet3_create_queues(adapter, 534 err = vmxnet3_create_queues(adapter,
533 VMXNET3_DEF_TX_RING_SIZE, 535 new_tx_ring_size,
534 VMXNET3_DEF_RX_RING_SIZE, 536 new_rx_ring_size,
535 VMXNET3_DEF_RX_RING_SIZE); 537 VMXNET3_DEF_RX_RING_SIZE);
536 if (err) { 538 if (err) {
537 netdev_err(netdev, "failed to create queues " 539 netdev_err(netdev, "failed to create queues "
@@ -545,6 +547,8 @@ vmxnet3_set_ringparam(struct net_device *netdev,
545 netdev_err(netdev, "failed to re-activate, error %d." 547 netdev_err(netdev, "failed to re-activate, error %d."
546 " Closing it\n", err); 548 " Closing it\n", err);
547 } 549 }
550 adapter->tx_ring_size = new_tx_ring_size;
551 adapter->rx_ring_size = new_rx_ring_size;
548 552
549out: 553out:
550 clear_bit(VMXNET3_STATE_BIT_RESETTING, &adapter->state); 554 clear_bit(VMXNET3_STATE_BIT_RESETTING, &adapter->state);
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 190569d02450..29ee77f2c97f 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -349,6 +349,11 @@ struct vmxnet3_adapter {
349 u32 link_speed; /* in mbps */ 349 u32 link_speed; /* in mbps */
350 350
351 u64 tx_timeout_count; 351 u64 tx_timeout_count;
352
353 /* Ring sizes */
354 u32 tx_ring_size;
355 u32 rx_ring_size;
356
352 struct work_struct work; 357 struct work_struct work;
353 358
354 unsigned long state; /* VMXNET3_STATE_BIT_xxx */ 359 unsigned long state; /* VMXNET3_STATE_BIT_xxx */
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index e3f67b8d3f80..40fd9b7b1426 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -36,7 +36,7 @@ config B43_SSB
36choice 36choice
37 prompt "Supported bus types" 37 prompt "Supported bus types"
38 depends on B43 38 depends on B43
39 default B43_BCMA_AND_SSB 39 default B43_BUSES_BCMA_AND_SSB
40 40
41config B43_BUSES_BCMA_AND_SSB 41config B43_BUSES_BCMA_AND_SSB
42 bool "BCMA and SSB" 42 bool "BCMA and SSB"
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 32538ac5f7e4..0d6a0bb1f876 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5221,6 +5221,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
5221 /* We don't support 5 GHz on some PHYs yet */ 5221 /* We don't support 5 GHz on some PHYs yet */
5222 switch (dev->phy.type) { 5222 switch (dev->phy.type) {
5223 case B43_PHYTYPE_A: 5223 case B43_PHYTYPE_A:
5224 case B43_PHYTYPE_G:
5224 case B43_PHYTYPE_N: 5225 case B43_PHYTYPE_N:
5225 case B43_PHYTYPE_LP: 5226 case B43_PHYTYPE_LP:
5226 case B43_PHYTYPE_HT: 5227 case B43_PHYTYPE_HT:
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 4f38f19b8e3d..6e6ef3fc2247 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
811 break; 811 break;
812 case B43_PHYTYPE_G: 812 case B43_PHYTYPE_G:
813 status.band = IEEE80211_BAND_2GHZ; 813 status.band = IEEE80211_BAND_2GHZ;
814 /* chanid is the radio channel cookie value as used 814 /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
815 * to tune the radio. */ 815 * has been modified to be compatible with N-PHY and others.
816 status.freq = chanid + 2400; 816 */
817 if (dev->fw.rev >= 508)
818 status.freq = ieee80211_channel_to_frequency(chanid, status.band);
819 else
820 status.freq = chanid + 2400;
817 break; 821 break;
818 case B43_PHYTYPE_N: 822 case B43_PHYTYPE_N:
819 case B43_PHYTYPE_LP: 823 case B43_PHYTYPE_LP:
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 574d4b597468..2cc9b6fca490 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -50,7 +50,7 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
50 return -1; 50 return -1;
51 } 51 }
52 mapping.len = size; 52 mapping.len = size;
53 memcpy(skb->cb, &mapping, sizeof(mapping)); 53 mwifiex_store_mapping(skb, &mapping);
54 return 0; 54 return 0;
55} 55}
56 56
@@ -60,7 +60,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter,
60 struct pcie_service_card *card = adapter->card; 60 struct pcie_service_card *card = adapter->card;
61 struct mwifiex_dma_mapping mapping; 61 struct mwifiex_dma_mapping mapping;
62 62
63 MWIFIEX_SKB_PACB(skb, &mapping); 63 mwifiex_get_mapping(skb, &mapping);
64 pci_unmap_single(card->dev, mapping.addr, mapping.len, flags); 64 pci_unmap_single(card->dev, mapping.addr, mapping.len, flags);
65} 65}
66 66
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index ddae57021397..caadb3737b9e 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -20,32 +20,55 @@
20#ifndef _MWIFIEX_UTIL_H_ 20#ifndef _MWIFIEX_UTIL_H_
21#define _MWIFIEX_UTIL_H_ 21#define _MWIFIEX_UTIL_H_
22 22
23struct mwifiex_dma_mapping {
24 dma_addr_t addr;
25 size_t len;
26};
27
28struct mwifiex_cb {
29 struct mwifiex_dma_mapping dma_mapping;
30 union {
31 struct mwifiex_rxinfo rx_info;
32 struct mwifiex_txinfo tx_info;
33 };
34};
35
23static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb) 36static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb)
24{ 37{
25 return (struct mwifiex_rxinfo *)(skb->cb + sizeof(dma_addr_t)); 38 struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
39
40 BUILD_BUG_ON(sizeof(struct mwifiex_cb) > sizeof(skb->cb));
41 return &cb->rx_info;
26} 42}
27 43
28static inline struct mwifiex_txinfo *MWIFIEX_SKB_TXCB(struct sk_buff *skb) 44static inline struct mwifiex_txinfo *MWIFIEX_SKB_TXCB(struct sk_buff *skb)
29{ 45{
30 return (struct mwifiex_txinfo *)(skb->cb + sizeof(dma_addr_t)); 46 struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
47
48 return &cb->tx_info;
31} 49}
32 50
33struct mwifiex_dma_mapping { 51static inline void mwifiex_store_mapping(struct sk_buff *skb,
34 dma_addr_t addr; 52 struct mwifiex_dma_mapping *mapping)
35 size_t len; 53{
36}; 54 struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
55
56 memcpy(&cb->dma_mapping, mapping, sizeof(*mapping));
57}
37 58
38static inline void MWIFIEX_SKB_PACB(struct sk_buff *skb, 59static inline void mwifiex_get_mapping(struct sk_buff *skb,
39 struct mwifiex_dma_mapping *mapping) 60 struct mwifiex_dma_mapping *mapping)
40{ 61{
41 memcpy(mapping, skb->cb, sizeof(*mapping)); 62 struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
63
64 memcpy(mapping, &cb->dma_mapping, sizeof(*mapping));
42} 65}
43 66
44static inline dma_addr_t MWIFIEX_SKB_DMA_ADDR(struct sk_buff *skb) 67static inline dma_addr_t MWIFIEX_SKB_DMA_ADDR(struct sk_buff *skb)
45{ 68{
46 struct mwifiex_dma_mapping mapping; 69 struct mwifiex_dma_mapping mapping;
47 70
48 MWIFIEX_SKB_PACB(skb, &mapping); 71 mwifiex_get_mapping(skb, &mapping);
49 72
50 return mapping.addr; 73 return mapping.addr;
51} 74}
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 2f1cd929c6f6..a511cccc9f01 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
1681 /* 1681 /*
1682 * Detect if this device has an hardware controlled radio. 1682 * Detect if this device has an hardware controlled radio.
1683 */ 1683 */
1684 if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) 1684 if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
1685 __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags); 1685 __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
1686 /*
1687 * On this device RFKILL initialized during probe does not work.
1688 */
1689 __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
1690 }
1686 1691
1687 /* 1692 /*
1688 * Check if the BBP tuning should be enabled. 1693 * Check if the BBP tuning should be enabled.
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index a49c3d73ea2c..e11dab2216c6 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -229,6 +229,27 @@ static enum hrtimer_restart rt2800usb_tx_sta_fifo_timeout(struct hrtimer *timer)
229/* 229/*
230 * Firmware functions 230 * Firmware functions
231 */ 231 */
232static int rt2800usb_autorun_detect(struct rt2x00_dev *rt2x00dev)
233{
234 __le32 reg;
235 u32 fw_mode;
236
237 /* cannot use rt2x00usb_register_read here as it uses different
238 * mode (MULTI_READ vs. DEVICE_MODE) and does not pass the
239 * magic value USB_MODE_AUTORUN (0x11) to the device, thus the
240 * returned value would be invalid.
241 */
242 rt2x00usb_vendor_request(rt2x00dev, USB_DEVICE_MODE,
243 USB_VENDOR_REQUEST_IN, 0, USB_MODE_AUTORUN,
244 &reg, sizeof(reg), REGISTER_TIMEOUT_FIRMWARE);
245 fw_mode = le32_to_cpu(reg);
246
247 if ((fw_mode & 0x00000003) == 2)
248 return 1;
249
250 return 0;
251}
252
232static char *rt2800usb_get_firmware_name(struct rt2x00_dev *rt2x00dev) 253static char *rt2800usb_get_firmware_name(struct rt2x00_dev *rt2x00dev)
233{ 254{
234 return FIRMWARE_RT2870; 255 return FIRMWARE_RT2870;
@@ -257,8 +278,13 @@ static int rt2800usb_write_firmware(struct rt2x00_dev *rt2x00dev,
257 /* 278 /*
258 * Write firmware to device. 279 * Write firmware to device.
259 */ 280 */
260 rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE, 281 if (rt2800usb_autorun_detect(rt2x00dev)) {
261 data + offset, length); 282 rt2x00_info(rt2x00dev,
283 "Firmware loading not required - NIC in AutoRun mode\n");
284 } else {
285 rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
286 data + offset, length);
287 }
262 288
263 rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0); 289 rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
264 rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0); 290 rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
@@ -735,11 +761,18 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
735/* 761/*
736 * Device probe functions. 762 * Device probe functions.
737 */ 763 */
764static int rt2800usb_efuse_detect(struct rt2x00_dev *rt2x00dev)
765{
766 if (rt2800usb_autorun_detect(rt2x00dev))
767 return 1;
768 return rt2800_efuse_detect(rt2x00dev);
769}
770
738static int rt2800usb_read_eeprom(struct rt2x00_dev *rt2x00dev) 771static int rt2800usb_read_eeprom(struct rt2x00_dev *rt2x00dev)
739{ 772{
740 int retval; 773 int retval;
741 774
742 if (rt2800_efuse_detect(rt2x00dev)) 775 if (rt2800usb_efuse_detect(rt2x00dev))
743 retval = rt2800_read_eeprom_efuse(rt2x00dev); 776 retval = rt2800_read_eeprom_efuse(rt2x00dev);
744 else 777 else
745 retval = rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom, 778 retval = rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 010b76505243..d13f25cd70d5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -693,6 +693,7 @@ enum rt2x00_capability_flags {
693 REQUIRE_SW_SEQNO, 693 REQUIRE_SW_SEQNO,
694 REQUIRE_HT_TX_DESC, 694 REQUIRE_HT_TX_DESC,
695 REQUIRE_PS_AUTOWAKE, 695 REQUIRE_PS_AUTOWAKE,
696 REQUIRE_DELAYED_RFKILL,
696 697
697 /* 698 /*
698 * Capabilities 699 * Capabilities
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 2bde6729f5e6..4fa43a2eeb73 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
1126 return; 1126 return;
1127 1127
1128 /* 1128 /*
1129 * Unregister extra components. 1129 * Stop rfkill polling.
1130 */ 1130 */
1131 rt2x00rfkill_unregister(rt2x00dev); 1131 if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
1132 rt2x00rfkill_unregister(rt2x00dev);
1132 1133
1133 /* 1134 /*
1134 * Allow the HW to uninitialize. 1135 * Allow the HW to uninitialize.
@@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
1166 1167
1167 set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags); 1168 set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
1168 1169
1170 /*
1171 * Start rfkill polling.
1172 */
1173 if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
1174 rt2x00rfkill_register(rt2x00dev);
1175
1169 return 0; 1176 return 0;
1170} 1177}
1171 1178
@@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
1375 rt2x00link_register(rt2x00dev); 1382 rt2x00link_register(rt2x00dev);
1376 rt2x00leds_register(rt2x00dev); 1383 rt2x00leds_register(rt2x00dev);
1377 rt2x00debug_register(rt2x00dev); 1384 rt2x00debug_register(rt2x00dev);
1378 rt2x00rfkill_register(rt2x00dev); 1385
1386 /*
1387 * Start rfkill polling.
1388 */
1389 if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
1390 rt2x00rfkill_register(rt2x00dev);
1379 1391
1380 return 0; 1392 return 0;
1381 1393
@@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
1391 clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags); 1403 clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
1392 1404
1393 /* 1405 /*
1406 * Stop rfkill polling.
1407 */
1408 if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
1409 rt2x00rfkill_unregister(rt2x00dev);
1410
1411 /*
1394 * Disable radio. 1412 * Disable radio.
1395 */ 1413 */
1396 rt2x00lib_disable_radio(rt2x00dev); 1414 rt2x00lib_disable_radio(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 212ac4842c16..004dff9b962d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
487 crypto.cipher = rt2x00crypto_key_to_cipher(key); 487 crypto.cipher = rt2x00crypto_key_to_cipher(key);
488 if (crypto.cipher == CIPHER_NONE) 488 if (crypto.cipher == CIPHER_NONE)
489 return -EOPNOTSUPP; 489 return -EOPNOTSUPP;
490 if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
491 return -EOPNOTSUPP;
490 492
491 crypto.cmd = cmd; 493 crypto.cmd = cmd;
492 494
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index e7bcf62347d5..831b65f93feb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -93,6 +93,7 @@ enum rt2x00usb_mode_offset {
93 USB_MODE_SLEEP = 7, /* RT73USB */ 93 USB_MODE_SLEEP = 7, /* RT73USB */
94 USB_MODE_FIRMWARE = 8, /* RT73USB */ 94 USB_MODE_FIRMWARE = 8, /* RT73USB */
95 USB_MODE_WAKEUP = 9, /* RT73USB */ 95 USB_MODE_WAKEUP = 9, /* RT73USB */
96 USB_MODE_AUTORUN = 17, /* RT2800USB */
96}; 97};
97 98
98/** 99/**
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 4dd7c4a1923b..2532ce85d718 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -222,6 +222,7 @@ struct xenvif {
222 222
223 /* Queues */ 223 /* Queues */
224 struct xenvif_queue *queues; 224 struct xenvif_queue *queues;
225 unsigned int num_queues; /* active queues, resource allocated */
225 226
226 /* Miscellaneous private stuff. */ 227 /* Miscellaneous private stuff. */
227 struct net_device *dev; 228 struct net_device *dev;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 852da34b8961..9e97c7ca0ddd 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -137,32 +137,11 @@ static void xenvif_wake_queue_callback(unsigned long data)
137 } 137 }
138} 138}
139 139
140static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
141 void *accel_priv, select_queue_fallback_t fallback)
142{
143 unsigned int num_queues = dev->real_num_tx_queues;
144 u32 hash;
145 u16 queue_index;
146
147 /* First, check if there is only one queue to optimise the
148 * single-queue or old frontend scenario.
149 */
150 if (num_queues == 1) {
151 queue_index = 0;
152 } else {
153 /* Use skb_get_hash to obtain an L4 hash if available */
154 hash = skb_get_hash(skb);
155 queue_index = hash % num_queues;
156 }
157
158 return queue_index;
159}
160
161static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev) 140static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
162{ 141{
163 struct xenvif *vif = netdev_priv(dev); 142 struct xenvif *vif = netdev_priv(dev);
164 struct xenvif_queue *queue = NULL; 143 struct xenvif_queue *queue = NULL;
165 unsigned int num_queues = dev->real_num_tx_queues; 144 unsigned int num_queues = vif->num_queues;
166 u16 index; 145 u16 index;
167 int min_slots_needed; 146 int min_slots_needed;
168 147
@@ -225,7 +204,7 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
225{ 204{
226 struct xenvif *vif = netdev_priv(dev); 205 struct xenvif *vif = netdev_priv(dev);
227 struct xenvif_queue *queue = NULL; 206 struct xenvif_queue *queue = NULL;
228 unsigned int num_queues = dev->real_num_tx_queues; 207 unsigned int num_queues = vif->num_queues;
229 unsigned long rx_bytes = 0; 208 unsigned long rx_bytes = 0;
230 unsigned long rx_packets = 0; 209 unsigned long rx_packets = 0;
231 unsigned long tx_bytes = 0; 210 unsigned long tx_bytes = 0;
@@ -256,7 +235,7 @@ out:
256static void xenvif_up(struct xenvif *vif) 235static void xenvif_up(struct xenvif *vif)
257{ 236{
258 struct xenvif_queue *queue = NULL; 237 struct xenvif_queue *queue = NULL;
259 unsigned int num_queues = vif->dev->real_num_tx_queues; 238 unsigned int num_queues = vif->num_queues;
260 unsigned int queue_index; 239 unsigned int queue_index;
261 240
262 for (queue_index = 0; queue_index < num_queues; ++queue_index) { 241 for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -272,7 +251,7 @@ static void xenvif_up(struct xenvif *vif)
272static void xenvif_down(struct xenvif *vif) 251static void xenvif_down(struct xenvif *vif)
273{ 252{
274 struct xenvif_queue *queue = NULL; 253 struct xenvif_queue *queue = NULL;
275 unsigned int num_queues = vif->dev->real_num_tx_queues; 254 unsigned int num_queues = vif->num_queues;
276 unsigned int queue_index; 255 unsigned int queue_index;
277 256
278 for (queue_index = 0; queue_index < num_queues; ++queue_index) { 257 for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -379,7 +358,7 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
379 struct ethtool_stats *stats, u64 * data) 358 struct ethtool_stats *stats, u64 * data)
380{ 359{
381 struct xenvif *vif = netdev_priv(dev); 360 struct xenvif *vif = netdev_priv(dev);
382 unsigned int num_queues = dev->real_num_tx_queues; 361 unsigned int num_queues = vif->num_queues;
383 int i; 362 int i;
384 unsigned int queue_index; 363 unsigned int queue_index;
385 struct xenvif_stats *vif_stats; 364 struct xenvif_stats *vif_stats;
@@ -424,7 +403,6 @@ static const struct net_device_ops xenvif_netdev_ops = {
424 .ndo_fix_features = xenvif_fix_features, 403 .ndo_fix_features = xenvif_fix_features,
425 .ndo_set_mac_address = eth_mac_addr, 404 .ndo_set_mac_address = eth_mac_addr,
426 .ndo_validate_addr = eth_validate_addr, 405 .ndo_validate_addr = eth_validate_addr,
427 .ndo_select_queue = xenvif_select_queue,
428}; 406};
429 407
430struct xenvif *xenvif_alloc(struct device *parent, domid_t domid, 408struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
@@ -438,7 +416,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
438 snprintf(name, IFNAMSIZ - 1, "vif%u.%u", domid, handle); 416 snprintf(name, IFNAMSIZ - 1, "vif%u.%u", domid, handle);
439 /* Allocate a netdev with the max. supported number of queues. 417 /* Allocate a netdev with the max. supported number of queues.
440 * When the guest selects the desired number, it will be updated 418 * When the guest selects the desired number, it will be updated
441 * via netif_set_real_num_tx_queues(). 419 * via netif_set_real_num_*_queues().
442 */ 420 */
443 dev = alloc_netdev_mq(sizeof(struct xenvif), name, ether_setup, 421 dev = alloc_netdev_mq(sizeof(struct xenvif), name, ether_setup,
444 xenvif_max_queues); 422 xenvif_max_queues);
@@ -458,11 +436,9 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
458 vif->dev = dev; 436 vif->dev = dev;
459 vif->disabled = false; 437 vif->disabled = false;
460 438
461 /* Start out with no queues. The call below does not require 439 /* Start out with no queues. */
462 * rtnl_lock() as it happens before register_netdev().
463 */
464 vif->queues = NULL; 440 vif->queues = NULL;
465 netif_set_real_num_tx_queues(dev, 0); 441 vif->num_queues = 0;
466 442
467 dev->netdev_ops = &xenvif_netdev_ops; 443 dev->netdev_ops = &xenvif_netdev_ops;
468 dev->hw_features = NETIF_F_SG | 444 dev->hw_features = NETIF_F_SG |
@@ -677,7 +653,7 @@ static void xenvif_wait_unmap_timeout(struct xenvif_queue *queue,
677void xenvif_disconnect(struct xenvif *vif) 653void xenvif_disconnect(struct xenvif *vif)
678{ 654{
679 struct xenvif_queue *queue = NULL; 655 struct xenvif_queue *queue = NULL;
680 unsigned int num_queues = vif->dev->real_num_tx_queues; 656 unsigned int num_queues = vif->num_queues;
681 unsigned int queue_index; 657 unsigned int queue_index;
682 658
683 if (netif_carrier_ok(vif->dev)) 659 if (netif_carrier_ok(vif->dev))
@@ -724,7 +700,7 @@ void xenvif_deinit_queue(struct xenvif_queue *queue)
724void xenvif_free(struct xenvif *vif) 700void xenvif_free(struct xenvif *vif)
725{ 701{
726 struct xenvif_queue *queue = NULL; 702 struct xenvif_queue *queue = NULL;
727 unsigned int num_queues = vif->dev->real_num_tx_queues; 703 unsigned int num_queues = vif->num_queues;
728 unsigned int queue_index; 704 unsigned int queue_index;
729 /* Here we want to avoid timeout messages if an skb can be legitimately 705 /* Here we want to avoid timeout messages if an skb can be legitimately
730 * stuck somewhere else. Realistically this could be an another vif's 706 * stuck somewhere else. Realistically this could be an another vif's
@@ -748,12 +724,9 @@ void xenvif_free(struct xenvif *vif)
748 xenvif_deinit_queue(queue); 724 xenvif_deinit_queue(queue);
749 } 725 }
750 726
751 /* Free the array of queues. The call below does not require
752 * rtnl_lock() because it happens after unregister_netdev().
753 */
754 netif_set_real_num_tx_queues(vif->dev, 0);
755 vfree(vif->queues); 727 vfree(vif->queues);
756 vif->queues = NULL; 728 vif->queues = NULL;
729 vif->num_queues = 0;
757 730
758 free_netdev(vif->dev); 731 free_netdev(vif->dev);
759 732
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 96c63dc2509e..3d85acd84bad 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -527,9 +527,7 @@ static void connect(struct backend_info *be)
527 /* Use the number of queues requested by the frontend */ 527 /* Use the number of queues requested by the frontend */
528 be->vif->queues = vzalloc(requested_num_queues * 528 be->vif->queues = vzalloc(requested_num_queues *
529 sizeof(struct xenvif_queue)); 529 sizeof(struct xenvif_queue));
530 rtnl_lock(); 530 be->vif->num_queues = requested_num_queues;
531 netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
532 rtnl_unlock();
533 531
534 for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) { 532 for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) {
535 queue = &be->vif->queues[queue_index]; 533 queue = &be->vif->queues[queue_index];
@@ -546,9 +544,7 @@ static void connect(struct backend_info *be)
546 * earlier queues can be destroyed using the regular 544 * earlier queues can be destroyed using the regular
547 * disconnect logic. 545 * disconnect logic.
548 */ 546 */
549 rtnl_lock(); 547 be->vif->num_queues = queue_index;
550 netif_set_real_num_tx_queues(be->vif->dev, queue_index);
551 rtnl_unlock();
552 goto err; 548 goto err;
553 } 549 }
554 550
@@ -561,13 +557,19 @@ static void connect(struct backend_info *be)
561 * and also clean up any previously initialised queues. 557 * and also clean up any previously initialised queues.
562 */ 558 */
563 xenvif_deinit_queue(queue); 559 xenvif_deinit_queue(queue);
564 rtnl_lock(); 560 be->vif->num_queues = queue_index;
565 netif_set_real_num_tx_queues(be->vif->dev, queue_index);
566 rtnl_unlock();
567 goto err; 561 goto err;
568 } 562 }
569 } 563 }
570 564
565 /* Initialisation completed, tell core driver the number of
566 * active queues.
567 */
568 rtnl_lock();
569 netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
570 netif_set_real_num_rx_queues(be->vif->dev, requested_num_queues);
571 rtnl_unlock();
572
571 xenvif_carrier_on(be->vif); 573 xenvif_carrier_on(be->vif);
572 574
573 unregister_hotplug_status_watch(be); 575 unregister_hotplug_status_watch(be);
@@ -582,13 +584,11 @@ static void connect(struct backend_info *be)
582 return; 584 return;
583 585
584err: 586err:
585 if (be->vif->dev->real_num_tx_queues > 0) 587 if (be->vif->num_queues > 0)
586 xenvif_disconnect(be->vif); /* Clean up existing queues */ 588 xenvif_disconnect(be->vif); /* Clean up existing queues */
587 vfree(be->vif->queues); 589 vfree(be->vif->queues);
588 be->vif->queues = NULL; 590 be->vif->queues = NULL;
589 rtnl_lock(); 591 be->vif->num_queues = 0;
590 netif_set_real_num_tx_queues(be->vif->dev, 0);
591 rtnl_unlock();
592 return; 592 return;
593} 593}
594 594
@@ -596,7 +596,7 @@ err:
596static int connect_rings(struct backend_info *be, struct xenvif_queue *queue) 596static int connect_rings(struct backend_info *be, struct xenvif_queue *queue)
597{ 597{
598 struct xenbus_device *dev = be->dev; 598 struct xenbus_device *dev = be->dev;
599 unsigned int num_queues = queue->vif->dev->real_num_tx_queues; 599 unsigned int num_queues = queue->vif->num_queues;
600 unsigned long tx_ring_ref, rx_ring_ref; 600 unsigned long tx_ring_ref, rx_ring_ref;
601 unsigned int tx_evtchn, rx_evtchn; 601 unsigned int tx_evtchn, rx_evtchn;
602 int err; 602 int err;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 5a7872ac3566..2ccb4a02368b 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1287,7 +1287,7 @@ static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
1287 1287
1288 if (likely(netif_carrier_ok(dev) && 1288 if (likely(netif_carrier_ok(dev) &&
1289 RING_HAS_UNCONSUMED_RESPONSES(&queue->rx))) 1289 RING_HAS_UNCONSUMED_RESPONSES(&queue->rx)))
1290 napi_schedule(&queue->napi); 1290 napi_schedule(&queue->napi);
1291 1291
1292 return IRQ_HANDLED; 1292 return IRQ_HANDLED;
1293} 1293}
@@ -1437,10 +1437,11 @@ static void xennet_end_access(int ref, void *page)
1437static void xennet_disconnect_backend(struct netfront_info *info) 1437static void xennet_disconnect_backend(struct netfront_info *info)
1438{ 1438{
1439 unsigned int i = 0; 1439 unsigned int i = 0;
1440 struct netfront_queue *queue = NULL;
1441 unsigned int num_queues = info->netdev->real_num_tx_queues; 1440 unsigned int num_queues = info->netdev->real_num_tx_queues;
1442 1441
1443 for (i = 0; i < num_queues; ++i) { 1442 for (i = 0; i < num_queues; ++i) {
1443 struct netfront_queue *queue = &info->queues[i];
1444
1444 /* Stop old i/f to prevent errors whilst we rebuild the state. */ 1445 /* Stop old i/f to prevent errors whilst we rebuild the state. */
1445 spin_lock_bh(&queue->rx_lock); 1446 spin_lock_bh(&queue->rx_lock);
1446 spin_lock_irq(&queue->tx_lock); 1447 spin_lock_irq(&queue->tx_lock);
@@ -1698,8 +1699,6 @@ static int xennet_init_queue(struct netfront_queue *queue)
1698 goto exit_free_tx; 1699 goto exit_free_tx;
1699 } 1700 }
1700 1701
1701 netif_napi_add(queue->info->netdev, &queue->napi, xennet_poll, 64);
1702
1703 return 0; 1702 return 0;
1704 1703
1705 exit_free_tx: 1704 exit_free_tx:
@@ -1790,6 +1789,70 @@ error:
1790 return err; 1789 return err;
1791} 1790}
1792 1791
1792static void xennet_destroy_queues(struct netfront_info *info)
1793{
1794 unsigned int i;
1795
1796 rtnl_lock();
1797
1798 for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
1799 struct netfront_queue *queue = &info->queues[i];
1800
1801 if (netif_running(info->netdev))
1802 napi_disable(&queue->napi);
1803 netif_napi_del(&queue->napi);
1804 }
1805
1806 rtnl_unlock();
1807
1808 kfree(info->queues);
1809 info->queues = NULL;
1810}
1811
1812static int xennet_create_queues(struct netfront_info *info,
1813 unsigned int num_queues)
1814{
1815 unsigned int i;
1816 int ret;
1817
1818 info->queues = kcalloc(num_queues, sizeof(struct netfront_queue),
1819 GFP_KERNEL);
1820 if (!info->queues)
1821 return -ENOMEM;
1822
1823 rtnl_lock();
1824
1825 for (i = 0; i < num_queues; i++) {
1826 struct netfront_queue *queue = &info->queues[i];
1827
1828 queue->id = i;
1829 queue->info = info;
1830
1831 ret = xennet_init_queue(queue);
1832 if (ret < 0) {
1833 dev_warn(&info->netdev->dev, "only created %d queues\n",
1834 num_queues);
1835 num_queues = i;
1836 break;
1837 }
1838
1839 netif_napi_add(queue->info->netdev, &queue->napi,
1840 xennet_poll, 64);
1841 if (netif_running(info->netdev))
1842 napi_enable(&queue->napi);
1843 }
1844
1845 netif_set_real_num_tx_queues(info->netdev, num_queues);
1846
1847 rtnl_unlock();
1848
1849 if (num_queues == 0) {
1850 dev_err(&info->netdev->dev, "no queues\n");
1851 return -EINVAL;
1852 }
1853 return 0;
1854}
1855
1793/* Common code used when first setting up, and when resuming. */ 1856/* Common code used when first setting up, and when resuming. */
1794static int talk_to_netback(struct xenbus_device *dev, 1857static int talk_to_netback(struct xenbus_device *dev,
1795 struct netfront_info *info) 1858 struct netfront_info *info)
@@ -1826,42 +1889,20 @@ static int talk_to_netback(struct xenbus_device *dev,
1826 goto out; 1889 goto out;
1827 } 1890 }
1828 1891
1829 /* Allocate array of queues */ 1892 if (info->queues)
1830 info->queues = kcalloc(num_queues, sizeof(struct netfront_queue), GFP_KERNEL); 1893 xennet_destroy_queues(info);
1831 if (!info->queues) { 1894
1832 err = -ENOMEM; 1895 err = xennet_create_queues(info, num_queues);
1833 goto out; 1896 if (err < 0)
1834 } 1897 goto destroy_ring;
1835 rtnl_lock();
1836 netif_set_real_num_tx_queues(info->netdev, num_queues);
1837 rtnl_unlock();
1838 1898
1839 /* Create shared ring, alloc event channel -- for each queue */ 1899 /* Create shared ring, alloc event channel -- for each queue */
1840 for (i = 0; i < num_queues; ++i) { 1900 for (i = 0; i < num_queues; ++i) {
1841 queue = &info->queues[i]; 1901 queue = &info->queues[i];
1842 queue->id = i;
1843 queue->info = info;
1844 err = xennet_init_queue(queue);
1845 if (err) {
1846 /* xennet_init_queue() cleans up after itself on failure,
1847 * but we still have to clean up any previously initialised
1848 * queues. If i > 0, set num_queues to i, then goto
1849 * destroy_ring, which calls xennet_disconnect_backend()
1850 * to tidy up.
1851 */
1852 if (i > 0) {
1853 rtnl_lock();
1854 netif_set_real_num_tx_queues(info->netdev, i);
1855 rtnl_unlock();
1856 goto destroy_ring;
1857 } else {
1858 goto out;
1859 }
1860 }
1861 err = setup_netfront(dev, queue, feature_split_evtchn); 1902 err = setup_netfront(dev, queue, feature_split_evtchn);
1862 if (err) { 1903 if (err) {
1863 /* As for xennet_init_queue(), setup_netfront() will tidy 1904 /* setup_netfront() will tidy up the current
1864 * up the current queue on error, but we need to clean up 1905 * queue on error, but we need to clean up
1865 * those already allocated. 1906 * those already allocated.
1866 */ 1907 */
1867 if (i > 0) { 1908 if (i > 0) {
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index fb4a59830648..a3bf2122a8d5 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -323,11 +323,13 @@ int of_phy_register_fixed_link(struct device_node *np)
323 fixed_link_node = of_get_child_by_name(np, "fixed-link"); 323 fixed_link_node = of_get_child_by_name(np, "fixed-link");
324 if (fixed_link_node) { 324 if (fixed_link_node) {
325 status.link = 1; 325 status.link = 1;
326 status.duplex = of_property_read_bool(np, "full-duplex"); 326 status.duplex = of_property_read_bool(fixed_link_node,
327 "full-duplex");
327 if (of_property_read_u32(fixed_link_node, "speed", &status.speed)) 328 if (of_property_read_u32(fixed_link_node, "speed", &status.speed))
328 return -EINVAL; 329 return -EINVAL;
329 status.pause = of_property_read_bool(np, "pause"); 330 status.pause = of_property_read_bool(fixed_link_node, "pause");
330 status.asym_pause = of_property_read_bool(np, "asym-pause"); 331 status.asym_pause = of_property_read_bool(fixed_link_node,
332 "asym-pause");
331 of_node_put(fixed_link_node); 333 of_node_put(fixed_link_node);
332 return fixed_phy_register(PHY_POLL, &status, np); 334 return fixed_phy_register(PHY_POLL, &status, np);
333 } 335 }
diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig
index 6aea373547f6..ee3de3421f2d 100644
--- a/drivers/ptp/Kconfig
+++ b/drivers/ptp/Kconfig
@@ -74,7 +74,7 @@ config DP83640_PHY
74 74
75config PTP_1588_CLOCK_PCH 75config PTP_1588_CLOCK_PCH
76 tristate "Intel PCH EG20T as PTP clock" 76 tristate "Intel PCH EG20T as PTP clock"
77 depends on X86 || COMPILE_TEST 77 depends on X86_32 || COMPILE_TEST
78 depends on HAS_IOMEM && NET 78 depends on HAS_IOMEM && NET
79 select PTP_1588_CLOCK 79 select PTP_1588_CLOCK
80 help 80 help
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 864ddafad8cc..68041446c450 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -536,6 +536,15 @@ struct phy_driver {
536 /* See set_wol, but for checking whether Wake on LAN is enabled. */ 536 /* See set_wol, but for checking whether Wake on LAN is enabled. */
537 void (*get_wol)(struct phy_device *dev, struct ethtool_wolinfo *wol); 537 void (*get_wol)(struct phy_device *dev, struct ethtool_wolinfo *wol);
538 538
539 /*
540 * Called to inform a PHY device driver when the core is about to
541 * change the link state. This callback is supposed to be used as
542 * fixup hook for drivers that need to take action when the link
543 * state changes. Drivers are by no means allowed to mess with the
544 * PHY device structure in their implementations.
545 */
546 void (*link_change_notify)(struct phy_device *dev);
547
539 struct device_driver driver; 548 struct device_driver driver;
540}; 549};
541#define to_phy_driver(d) container_of(d, struct phy_driver, driver) 550#define to_phy_driver(d) container_of(d, struct phy_driver, driver)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 7ee6ce6564ae..713b0b88bd5a 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -503,9 +503,9 @@ enum nft_chain_flags {
503 * @net: net namespace that this chain belongs to 503 * @net: net namespace that this chain belongs to
504 * @table: table that this chain belongs to 504 * @table: table that this chain belongs to
505 * @handle: chain handle 505 * @handle: chain handle
506 * @flags: bitmask of enum nft_chain_flags
507 * @use: number of jump references to this chain 506 * @use: number of jump references to this chain
508 * @level: length of longest path to this chain 507 * @level: length of longest path to this chain
508 * @flags: bitmask of enum nft_chain_flags
509 * @name: name of the chain 509 * @name: name of the chain
510 */ 510 */
511struct nft_chain { 511struct nft_chain {
@@ -514,9 +514,9 @@ struct nft_chain {
514 struct net *net; 514 struct net *net;
515 struct nft_table *table; 515 struct nft_table *table;
516 u64 handle; 516 u64 handle;
517 u8 flags; 517 u32 use;
518 u16 use;
519 u16 level; 518 u16 level;
519 u8 flags;
520 char name[NFT_CHAIN_MAXNAMELEN]; 520 char name[NFT_CHAIN_MAXNAMELEN];
521}; 521};
522 522
diff --git a/include/net/sock.h b/include/net/sock.h
index 07b7fcd60d80..173cae485de1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1730,8 +1730,8 @@ sk_dst_get(struct sock *sk)
1730 1730
1731 rcu_read_lock(); 1731 rcu_read_lock();
1732 dst = rcu_dereference(sk->sk_dst_cache); 1732 dst = rcu_dereference(sk->sk_dst_cache);
1733 if (dst) 1733 if (dst && !atomic_inc_not_zero(&dst->__refcnt))
1734 dst_hold(dst); 1734 dst = NULL;
1735 rcu_read_unlock(); 1735 rcu_read_unlock();
1736 return dst; 1736 return dst;
1737} 1737}
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 9012b1c922b6..75d427763992 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -114,8 +114,11 @@ EXPORT_SYMBOL(vlan_dev_vlan_proto);
114 114
115static struct sk_buff *vlan_reorder_header(struct sk_buff *skb) 115static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)
116{ 116{
117 if (skb_cow(skb, skb_headroom(skb)) < 0) 117 if (skb_cow(skb, skb_headroom(skb)) < 0) {
118 kfree_skb(skb);
118 return NULL; 119 return NULL;
120 }
121
119 memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN); 122 memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
120 skb->mac_header += VLAN_HLEN; 123 skb->mac_header += VLAN_HLEN;
121 return skb; 124 return skb;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 8671bc79a35b..ca01d1861854 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -610,11 +610,6 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
610 if (hci_update_random_address(req, false, &own_addr_type)) 610 if (hci_update_random_address(req, false, &own_addr_type))
611 return; 611 return;
612 612
613 /* Save the address type used for this connnection attempt so we able
614 * to retrieve this information if we need it.
615 */
616 conn->src_type = own_addr_type;
617
618 cp.scan_interval = cpu_to_le16(hdev->le_scan_interval); 613 cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
619 cp.scan_window = cpu_to_le16(hdev->le_scan_window); 614 cp.scan_window = cpu_to_le16(hdev->le_scan_window);
620 bacpy(&cp.peer_addr, &conn->dst); 615 bacpy(&cp.peer_addr, &conn->dst);
@@ -894,7 +889,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
894 /* If we're already encrypted set the REAUTH_PEND flag, 889 /* If we're already encrypted set the REAUTH_PEND flag,
895 * otherwise set the ENCRYPT_PEND. 890 * otherwise set the ENCRYPT_PEND.
896 */ 891 */
897 if (conn->key_type != 0xff) 892 if (conn->link_mode & HCI_LM_ENCRYPT)
898 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); 893 set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
899 else 894 else
900 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); 895 set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 21e5913d12e0..640c54ec1bd2 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -48,6 +48,10 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
48 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */ 48 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
49 wake_up_bit(&hdev->flags, HCI_INQUIRY); 49 wake_up_bit(&hdev->flags, HCI_INQUIRY);
50 50
51 hci_dev_lock(hdev);
52 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
53 hci_dev_unlock(hdev);
54
51 hci_conn_check_pending(hdev); 55 hci_conn_check_pending(hdev);
52} 56}
53 57
@@ -3537,7 +3541,11 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3537 cp.authentication = conn->auth_type; 3541 cp.authentication = conn->auth_type;
3538 3542
3539 /* Request MITM protection if our IO caps allow it 3543 /* Request MITM protection if our IO caps allow it
3540 * except for the no-bonding case 3544 * except for the no-bonding case.
3545 * conn->auth_type is not updated here since
3546 * that might cause the user confirmation to be
3547 * rejected in case the remote doesn't have the
3548 * IO capabilities for MITM.
3541 */ 3549 */
3542 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT && 3550 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
3543 cp.authentication != HCI_AT_NO_BONDING) 3551 cp.authentication != HCI_AT_NO_BONDING)
@@ -3628,8 +3636,11 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3628 3636
3629 /* If we're not the initiators request authorization to 3637 /* If we're not the initiators request authorization to
3630 * proceed from user space (mgmt_user_confirm with 3638 * proceed from user space (mgmt_user_confirm with
3631 * confirm_hint set to 1). */ 3639 * confirm_hint set to 1). The exception is if neither
3632 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) { 3640 * side had MITM in which case we do auto-accept.
3641 */
3642 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
3643 (loc_mitm || rem_mitm)) {
3633 BT_DBG("Confirming auto-accept as acceptor"); 3644 BT_DBG("Confirming auto-accept as acceptor");
3634 confirm_hint = 1; 3645 confirm_hint = 1;
3635 goto confirm; 3646 goto confirm;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 6eabbe05fe54..323f23cd2c37 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1663,7 +1663,13 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
1663 kfree_skb(conn->rx_skb); 1663 kfree_skb(conn->rx_skb);
1664 1664
1665 skb_queue_purge(&conn->pending_rx); 1665 skb_queue_purge(&conn->pending_rx);
1666 flush_work(&conn->pending_rx_work); 1666
1667 /* We can not call flush_work(&conn->pending_rx_work) here since we
1668 * might block if we are running on a worker from the same workqueue
1669 * pending_rx_work is waiting on.
1670 */
1671 if (work_pending(&conn->pending_rx_work))
1672 cancel_work_sync(&conn->pending_rx_work);
1667 1673
1668 l2cap_unregister_all_users(conn); 1674 l2cap_unregister_all_users(conn);
1669 1675
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index ade3fb4c23bc..e1378693cc90 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -787,11 +787,6 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
787 787
788 /*change security for LE channels */ 788 /*change security for LE channels */
789 if (chan->scid == L2CAP_CID_ATT) { 789 if (chan->scid == L2CAP_CID_ATT) {
790 if (!conn->hcon->out) {
791 err = -EINVAL;
792 break;
793 }
794
795 if (smp_conn_security(conn->hcon, sec.level)) 790 if (smp_conn_security(conn->hcon, sec.level))
796 break; 791 break;
797 sk->sk_state = BT_CONFIG; 792 sk->sk_state = BT_CONFIG;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 0fce54412ffd..af8e0a6243b7 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1047,6 +1047,43 @@ static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1047 } 1047 }
1048} 1048}
1049 1049
1050static void hci_stop_discovery(struct hci_request *req)
1051{
1052 struct hci_dev *hdev = req->hdev;
1053 struct hci_cp_remote_name_req_cancel cp;
1054 struct inquiry_entry *e;
1055
1056 switch (hdev->discovery.state) {
1057 case DISCOVERY_FINDING:
1058 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1059 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1060 } else {
1061 cancel_delayed_work(&hdev->le_scan_disable);
1062 hci_req_add_le_scan_disable(req);
1063 }
1064
1065 break;
1066
1067 case DISCOVERY_RESOLVING:
1068 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1069 NAME_PENDING);
1070 if (!e)
1071 return;
1072
1073 bacpy(&cp.bdaddr, &e->data.bdaddr);
1074 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1075 &cp);
1076
1077 break;
1078
1079 default:
1080 /* Passive scanning */
1081 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1082 hci_req_add_le_scan_disable(req);
1083 break;
1084 }
1085}
1086
1050static int clean_up_hci_state(struct hci_dev *hdev) 1087static int clean_up_hci_state(struct hci_dev *hdev)
1051{ 1088{
1052 struct hci_request req; 1089 struct hci_request req;
@@ -1063,9 +1100,7 @@ static int clean_up_hci_state(struct hci_dev *hdev)
1063 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) 1100 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1064 disable_advertising(&req); 1101 disable_advertising(&req);
1065 1102
1066 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) { 1103 hci_stop_discovery(&req);
1067 hci_req_add_le_scan_disable(&req);
1068 }
1069 1104
1070 list_for_each_entry(conn, &hdev->conn_hash.list, list) { 1105 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1071 struct hci_cp_disconnect dc; 1106 struct hci_cp_disconnect dc;
@@ -2996,8 +3031,13 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2996 } 3031 }
2997 3032
2998 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3033 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2999 /* Continue with pairing via SMP */ 3034 /* Continue with pairing via SMP. The hdev lock must be
3035 * released as SMP may try to recquire it for crypto
3036 * purposes.
3037 */
3038 hci_dev_unlock(hdev);
3000 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3039 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3040 hci_dev_lock(hdev);
3001 3041
3002 if (!err) 3042 if (!err)
3003 err = cmd_complete(sk, hdev->id, mgmt_op, 3043 err = cmd_complete(sk, hdev->id, mgmt_op,
@@ -3574,8 +3614,6 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3574{ 3614{
3575 struct mgmt_cp_stop_discovery *mgmt_cp = data; 3615 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3576 struct pending_cmd *cmd; 3616 struct pending_cmd *cmd;
3577 struct hci_cp_remote_name_req_cancel cp;
3578 struct inquiry_entry *e;
3579 struct hci_request req; 3617 struct hci_request req;
3580 int err; 3618 int err;
3581 3619
@@ -3605,52 +3643,22 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3605 3643
3606 hci_req_init(&req, hdev); 3644 hci_req_init(&req, hdev);
3607 3645
3608 switch (hdev->discovery.state) { 3646 hci_stop_discovery(&req);
3609 case DISCOVERY_FINDING:
3610 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3611 hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3612 } else {
3613 cancel_delayed_work(&hdev->le_scan_disable);
3614
3615 hci_req_add_le_scan_disable(&req);
3616 }
3617
3618 break;
3619 3647
3620 case DISCOVERY_RESOLVING: 3648 err = hci_req_run(&req, stop_discovery_complete);
3621 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, 3649 if (!err) {
3622 NAME_PENDING); 3650 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3623 if (!e) {
3624 mgmt_pending_remove(cmd);
3625 err = cmd_complete(sk, hdev->id,
3626 MGMT_OP_STOP_DISCOVERY, 0,
3627 &mgmt_cp->type,
3628 sizeof(mgmt_cp->type));
3629 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3630 goto unlock;
3631 }
3632
3633 bacpy(&cp.bdaddr, &e->data.bdaddr);
3634 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3635 &cp);
3636
3637 break;
3638
3639 default:
3640 BT_DBG("unknown discovery state %u", hdev->discovery.state);
3641
3642 mgmt_pending_remove(cmd);
3643 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3644 MGMT_STATUS_FAILED, &mgmt_cp->type,
3645 sizeof(mgmt_cp->type));
3646 goto unlock; 3651 goto unlock;
3647 } 3652 }
3648 3653
3649 err = hci_req_run(&req, stop_discovery_complete); 3654 mgmt_pending_remove(cmd);
3650 if (err < 0) 3655
3651 mgmt_pending_remove(cmd); 3656 /* If no HCI commands were sent we're done */
3652 else 3657 if (err == -ENODATA) {
3653 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 3658 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3659 &mgmt_cp->type, sizeof(mgmt_cp->type));
3660 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3661 }
3654 3662
3655unlock: 3663unlock:
3656 hci_dev_unlock(hdev); 3664 hci_dev_unlock(hdev);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 3d1cc164557d..f2829a7932e2 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -544,7 +544,7 @@ static u8 smp_random(struct smp_chan *smp)
544 hci_le_start_enc(hcon, ediv, rand, stk); 544 hci_le_start_enc(hcon, ediv, rand, stk);
545 hcon->enc_key_size = smp->enc_key_size; 545 hcon->enc_key_size = smp->enc_key_size;
546 } else { 546 } else {
547 u8 stk[16]; 547 u8 stk[16], auth;
548 __le64 rand = 0; 548 __le64 rand = 0;
549 __le16 ediv = 0; 549 __le16 ediv = 0;
550 550
@@ -556,8 +556,13 @@ static u8 smp_random(struct smp_chan *smp)
556 memset(stk + smp->enc_key_size, 0, 556 memset(stk + smp->enc_key_size, 0,
557 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size); 557 SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
558 558
559 if (hcon->pending_sec_level == BT_SECURITY_HIGH)
560 auth = 1;
561 else
562 auth = 0;
563
559 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type, 564 hci_add_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
560 HCI_SMP_STK_SLAVE, 0, stk, smp->enc_key_size, 565 HCI_SMP_STK_SLAVE, auth, stk, smp->enc_key_size,
561 ediv, rand); 566 ediv, rand);
562 } 567 }
563 568
diff --git a/net/core/dst.c b/net/core/dst.c
index 80d6286c8b62..a028409ee438 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -269,6 +269,15 @@ again:
269} 269}
270EXPORT_SYMBOL(dst_destroy); 270EXPORT_SYMBOL(dst_destroy);
271 271
272static void dst_destroy_rcu(struct rcu_head *head)
273{
274 struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head);
275
276 dst = dst_destroy(dst);
277 if (dst)
278 __dst_free(dst);
279}
280
272void dst_release(struct dst_entry *dst) 281void dst_release(struct dst_entry *dst)
273{ 282{
274 if (dst) { 283 if (dst) {
@@ -276,11 +285,8 @@ void dst_release(struct dst_entry *dst)
276 285
277 newrefcnt = atomic_dec_return(&dst->__refcnt); 286 newrefcnt = atomic_dec_return(&dst->__refcnt);
278 WARN_ON(newrefcnt < 0); 287 WARN_ON(newrefcnt < 0);
279 if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) { 288 if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
280 dst = dst_destroy(dst); 289 call_rcu(&dst->rcu_head, dst_destroy_rcu);
281 if (dst)
282 __dst_free(dst);
283 }
284 } 290 }
285} 291}
286EXPORT_SYMBOL(dst_release); 292EXPORT_SYMBOL(dst_release);
diff --git a/net/core/filter.c b/net/core/filter.c
index 735fad897496..1dbf6462f766 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -840,11 +840,11 @@ int sk_convert_filter(struct sock_filter *prog, int len,
840 BUILD_BUG_ON(BPF_MEMWORDS * sizeof(u32) > MAX_BPF_STACK); 840 BUILD_BUG_ON(BPF_MEMWORDS * sizeof(u32) > MAX_BPF_STACK);
841 BUILD_BUG_ON(BPF_REG_FP + 1 != MAX_BPF_REG); 841 BUILD_BUG_ON(BPF_REG_FP + 1 != MAX_BPF_REG);
842 842
843 if (len <= 0 || len >= BPF_MAXINSNS) 843 if (len <= 0 || len > BPF_MAXINSNS)
844 return -EINVAL; 844 return -EINVAL;
845 845
846 if (new_prog) { 846 if (new_prog) {
847 addrs = kzalloc(len * sizeof(*addrs), GFP_KERNEL); 847 addrs = kcalloc(len, sizeof(*addrs), GFP_KERNEL);
848 if (!addrs) 848 if (!addrs)
849 return -ENOMEM; 849 return -ENOMEM;
850 } 850 }
@@ -1101,7 +1101,7 @@ static int check_load_and_stores(struct sock_filter *filter, int flen)
1101 1101
1102 BUILD_BUG_ON(BPF_MEMWORDS > 16); 1102 BUILD_BUG_ON(BPF_MEMWORDS > 16);
1103 1103
1104 masks = kmalloc(flen * sizeof(*masks), GFP_KERNEL); 1104 masks = kmalloc_array(flen, sizeof(*masks), GFP_KERNEL);
1105 if (!masks) 1105 if (!masks)
1106 return -ENOMEM; 1106 return -ENOMEM;
1107 1107
@@ -1382,7 +1382,7 @@ static struct sk_filter *__sk_migrate_realloc(struct sk_filter *fp,
1382 fp_new = sock_kmalloc(sk, len, GFP_KERNEL); 1382 fp_new = sock_kmalloc(sk, len, GFP_KERNEL);
1383 if (fp_new) { 1383 if (fp_new) {
1384 *fp_new = *fp; 1384 *fp_new = *fp;
1385 /* As we're kepping orig_prog in fp_new along, 1385 /* As we're keeping orig_prog in fp_new along,
1386 * we need to make sure we're not evicting it 1386 * we need to make sure we're not evicting it
1387 * from the old fp. 1387 * from the old fp.
1388 */ 1388 */
@@ -1524,8 +1524,8 @@ static struct sk_filter *__sk_prepare_filter(struct sk_filter *fp,
1524 1524
1525/** 1525/**
1526 * sk_unattached_filter_create - create an unattached filter 1526 * sk_unattached_filter_create - create an unattached filter
1527 * @fprog: the filter program
1528 * @pfp: the unattached filter that is created 1527 * @pfp: the unattached filter that is created
1528 * @fprog: the filter program
1529 * 1529 *
1530 * Create a filter independent of any socket. We first run some 1530 * Create a filter independent of any socket. We first run some
1531 * sanity checks on it to make sure it does not explode on us later. 1531 * sanity checks on it to make sure it does not explode on us later.
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9cd5344fad73..c1a33033cbe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2993,7 +2993,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
2993 skb_put(nskb, len), 2993 skb_put(nskb, len),
2994 len, 0); 2994 len, 0);
2995 SKB_GSO_CB(nskb)->csum_start = 2995 SKB_GSO_CB(nskb)->csum_start =
2996 skb_headroom(nskb) + offset; 2996 skb_headroom(nskb) + doffset;
2997 continue; 2997 continue;
2998 } 2998 }
2999 2999
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 097b3e7c1e8f..54b6731dab55 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -73,12 +73,7 @@ static void __tunnel_dst_set(struct ip_tunnel_dst *idst,
73{ 73{
74 struct dst_entry *old_dst; 74 struct dst_entry *old_dst;
75 75
76 if (dst) { 76 dst_clone(dst);
77 if (dst->flags & DST_NOCACHE)
78 dst = NULL;
79 else
80 dst_clone(dst);
81 }
82 old_dst = xchg((__force struct dst_entry **)&idst->dst, dst); 77 old_dst = xchg((__force struct dst_entry **)&idst->dst, dst);
83 dst_release(old_dst); 78 dst_release(old_dst);
84} 79}
@@ -108,13 +103,14 @@ static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
108 103
109 rcu_read_lock(); 104 rcu_read_lock();
110 dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst); 105 dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst);
106 if (dst && !atomic_inc_not_zero(&dst->__refcnt))
107 dst = NULL;
111 if (dst) { 108 if (dst) {
112 if (dst->obsolete && dst->ops->check(dst, cookie) == NULL) { 109 if (dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
113 rcu_read_unlock();
114 tunnel_dst_reset(t); 110 tunnel_dst_reset(t);
115 return NULL; 111 dst_release(dst);
112 dst = NULL;
116 } 113 }
117 dst_hold(dst);
118 } 114 }
119 rcu_read_unlock(); 115 rcu_read_unlock();
120 return (struct rtable *)dst; 116 return (struct rtable *)dst;
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 62e48cf84e60..9771563ab564 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -131,7 +131,7 @@ static bool tcp_fastopen_create_child(struct sock *sk,
131 struct dst_entry *dst, 131 struct dst_entry *dst,
132 struct request_sock *req) 132 struct request_sock *req)
133{ 133{
134 struct tcp_sock *tp = tcp_sk(sk); 134 struct tcp_sock *tp;
135 struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; 135 struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
136 struct sock *child; 136 struct sock *child;
137 137
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 40661fc1e233..b5c23756965a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1162,7 +1162,7 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
1162 unsigned int new_len = (pkt_len / mss) * mss; 1162 unsigned int new_len = (pkt_len / mss) * mss;
1163 if (!in_sack && new_len < pkt_len) { 1163 if (!in_sack && new_len < pkt_len) {
1164 new_len += mss; 1164 new_len += mss;
1165 if (new_len > skb->len) 1165 if (new_len >= skb->len)
1166 return 0; 1166 return 0;
1167 } 1167 }
1168 pkt_len = new_len; 1168 pkt_len = new_len;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c42e83d2751c..581a6584ed0c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3778,6 +3778,7 @@ static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
3778 cancel_delayed_work_sync(&ipvs->defense_work); 3778 cancel_delayed_work_sync(&ipvs->defense_work);
3779 cancel_work_sync(&ipvs->defense_work.work); 3779 cancel_work_sync(&ipvs->defense_work.work);
3780 unregister_net_sysctl_table(ipvs->sysctl_hdr); 3780 unregister_net_sysctl_table(ipvs->sysctl_hdr);
3781 ip_vs_stop_estimator(net, &ipvs->tot_stats);
3781} 3782}
3782 3783
3783#else 3784#else
@@ -3840,7 +3841,6 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
3840 struct netns_ipvs *ipvs = net_ipvs(net); 3841 struct netns_ipvs *ipvs = net_ipvs(net);
3841 3842
3842 ip_vs_trash_cleanup(net); 3843 ip_vs_trash_cleanup(net);
3843 ip_vs_stop_estimator(net, &ipvs->tot_stats);
3844 ip_vs_control_net_cleanup_sysctl(net); 3844 ip_vs_control_net_cleanup_sysctl(net);
3845 remove_proc_entry("ip_vs_stats_percpu", net->proc_net); 3845 remove_proc_entry("ip_vs_stats_percpu", net->proc_net);
3846 remove_proc_entry("ip_vs_stats", net->proc_net); 3846 remove_proc_entry("ip_vs_stats", net->proc_net);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 58579634427d..300ed1eec729 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -597,6 +597,9 @@ ctnetlink_nlmsg_size(const struct nf_conn *ct)
597#ifdef CONFIG_NF_CONNTRACK_MARK 597#ifdef CONFIG_NF_CONNTRACK_MARK
598 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */ 598 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
599#endif 599#endif
600#ifdef CONFIG_NF_CONNTRACK_ZONES
601 + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE */
602#endif
600 + ctnetlink_proto_size(ct) 603 + ctnetlink_proto_size(ct)
601 + ctnetlink_label_size(ct) 604 + ctnetlink_label_size(ct)
602 ; 605 ;
@@ -1150,7 +1153,7 @@ static int ctnetlink_done_list(struct netlink_callback *cb)
1150static int 1153static int
1151ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying) 1154ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying)
1152{ 1155{
1153 struct nf_conn *ct, *last = NULL; 1156 struct nf_conn *ct, *last;
1154 struct nf_conntrack_tuple_hash *h; 1157 struct nf_conntrack_tuple_hash *h;
1155 struct hlist_nulls_node *n; 1158 struct hlist_nulls_node *n;
1156 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1159 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
@@ -1163,8 +1166,7 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
1163 if (cb->args[2]) 1166 if (cb->args[2])
1164 return 0; 1167 return 0;
1165 1168
1166 if (cb->args[0] == nr_cpu_ids) 1169 last = (struct nf_conn *)cb->args[1];
1167 return 0;
1168 1170
1169 for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) { 1171 for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
1170 struct ct_pcpu *pcpu; 1172 struct ct_pcpu *pcpu;
@@ -1174,7 +1176,6 @@ ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying
1174 1176
1175 pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu); 1177 pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
1176 spin_lock_bh(&pcpu->lock); 1178 spin_lock_bh(&pcpu->lock);
1177 last = (struct nf_conn *)cb->args[1];
1178 list = dying ? &pcpu->dying : &pcpu->unconfirmed; 1179 list = dying ? &pcpu->dying : &pcpu->unconfirmed;
1179restart: 1180restart:
1180 hlist_nulls_for_each_entry(h, n, list, hnnode) { 1181 hlist_nulls_for_each_entry(h, n, list, hnnode) {
@@ -1193,7 +1194,9 @@ restart:
1193 ct); 1194 ct);
1194 rcu_read_unlock(); 1195 rcu_read_unlock();
1195 if (res < 0) { 1196 if (res < 0) {
1196 nf_conntrack_get(&ct->ct_general); 1197 if (!atomic_inc_not_zero(&ct->ct_general.use))
1198 continue;
1199 cb->args[0] = cpu;
1197 cb->args[1] = (unsigned long)ct; 1200 cb->args[1] = (unsigned long)ct;
1198 spin_unlock_bh(&pcpu->lock); 1201 spin_unlock_bh(&pcpu->lock);
1199 goto out; 1202 goto out;
@@ -1202,10 +1205,10 @@ restart:
1202 if (cb->args[1]) { 1205 if (cb->args[1]) {
1203 cb->args[1] = 0; 1206 cb->args[1] = 0;
1204 goto restart; 1207 goto restart;
1205 } else 1208 }
1206 cb->args[2] = 1;
1207 spin_unlock_bh(&pcpu->lock); 1209 spin_unlock_bh(&pcpu->lock);
1208 } 1210 }
1211 cb->args[2] = 1;
1209out: 1212out:
1210 if (last) 1213 if (last)
1211 nf_ct_put(last); 1214 nf_ct_put(last);
@@ -2040,6 +2043,9 @@ ctnetlink_nfqueue_build_size(const struct nf_conn *ct)
2040#ifdef CONFIG_NF_CONNTRACK_MARK 2043#ifdef CONFIG_NF_CONNTRACK_MARK
2041 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */ 2044 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
2042#endif 2045#endif
2046#ifdef CONFIG_NF_CONNTRACK_ZONES
2047 + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE */
2048#endif
2043 + ctnetlink_proto_size(ct) 2049 + ctnetlink_proto_size(ct)
2044 ; 2050 ;
2045} 2051}
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 09096a670c45..a49907b1dabc 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -525,6 +525,39 @@ static int nf_nat_proto_remove(struct nf_conn *i, void *data)
525 return i->status & IPS_NAT_MASK ? 1 : 0; 525 return i->status & IPS_NAT_MASK ? 1 : 0;
526} 526}
527 527
528static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
529{
530 struct nf_conn_nat *nat = nfct_nat(ct);
531
532 if (nf_nat_proto_remove(ct, data))
533 return 1;
534
535 if (!nat || !nat->ct)
536 return 0;
537
538 /* This netns is being destroyed, and conntrack has nat null binding.
539 * Remove it from bysource hash, as the table will be freed soon.
540 *
541 * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
542 * will delete entry from already-freed table.
543 */
544 if (!del_timer(&ct->timeout))
545 return 1;
546
547 spin_lock_bh(&nf_nat_lock);
548 hlist_del_rcu(&nat->bysource);
549 ct->status &= ~IPS_NAT_DONE_MASK;
550 nat->ct = NULL;
551 spin_unlock_bh(&nf_nat_lock);
552
553 add_timer(&ct->timeout);
554
555 /* don't delete conntrack. Although that would make things a lot
556 * simpler, we'd end up flushing all conntracks on nat rmmod.
557 */
558 return 0;
559}
560
528static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto) 561static void nf_nat_l4proto_clean(u8 l3proto, u8 l4proto)
529{ 562{
530 struct nf_nat_proto_clean clean = { 563 struct nf_nat_proto_clean clean = {
@@ -795,7 +828,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
795{ 828{
796 struct nf_nat_proto_clean clean = {}; 829 struct nf_nat_proto_clean clean = {};
797 830
798 nf_ct_iterate_cleanup(net, &nf_nat_proto_remove, &clean, 0, 0); 831 nf_ct_iterate_cleanup(net, nf_nat_proto_clean, &clean, 0, 0);
799 synchronize_rcu(); 832 synchronize_rcu();
800 nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size); 833 nf_ct_free_hashtable(net->ct.nat_bysource, net->ct.nat_htable_size);
801} 834}
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 624e083125b9..ab4566cfcbe4 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1730,6 +1730,9 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
1730 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE) 1730 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
1731 return -EINVAL; 1731 return -EINVAL;
1732 handle = nf_tables_alloc_handle(table); 1732 handle = nf_tables_alloc_handle(table);
1733
1734 if (chain->use == UINT_MAX)
1735 return -EOVERFLOW;
1733 } 1736 }
1734 1737
1735 if (nla[NFTA_RULE_POSITION]) { 1738 if (nla[NFTA_RULE_POSITION]) {
@@ -1789,14 +1792,15 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
1789 1792
1790 if (nlh->nlmsg_flags & NLM_F_REPLACE) { 1793 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
1791 if (nft_rule_is_active_next(net, old_rule)) { 1794 if (nft_rule_is_active_next(net, old_rule)) {
1792 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, 1795 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
1793 old_rule); 1796 old_rule);
1794 if (trans == NULL) { 1797 if (trans == NULL) {
1795 err = -ENOMEM; 1798 err = -ENOMEM;
1796 goto err2; 1799 goto err2;
1797 } 1800 }
1798 nft_rule_disactivate_next(net, old_rule); 1801 nft_rule_disactivate_next(net, old_rule);
1799 list_add_tail(&rule->list, &old_rule->list); 1802 chain->use--;
1803 list_add_tail_rcu(&rule->list, &old_rule->list);
1800 } else { 1804 } else {
1801 err = -ENOENT; 1805 err = -ENOENT;
1802 goto err2; 1806 goto err2;
@@ -1826,6 +1830,7 @@ err3:
1826 list_del_rcu(&nft_trans_rule(trans)->list); 1830 list_del_rcu(&nft_trans_rule(trans)->list);
1827 nft_rule_clear(net, nft_trans_rule(trans)); 1831 nft_rule_clear(net, nft_trans_rule(trans));
1828 nft_trans_destroy(trans); 1832 nft_trans_destroy(trans);
1833 chain->use++;
1829 } 1834 }
1830err2: 1835err2:
1831 nf_tables_rule_destroy(&ctx, rule); 1836 nf_tables_rule_destroy(&ctx, rule);
@@ -2845,7 +2850,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
2845 goto nla_put_failure; 2850 goto nla_put_failure;
2846 2851
2847 nfmsg = nlmsg_data(nlh); 2852 nfmsg = nlmsg_data(nlh);
2848 nfmsg->nfgen_family = NFPROTO_UNSPEC; 2853 nfmsg->nfgen_family = ctx.afi->family;
2849 nfmsg->version = NFNETLINK_V0; 2854 nfmsg->version = NFNETLINK_V0;
2850 nfmsg->res_id = 0; 2855 nfmsg->res_id = 0;
2851 2856
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 8a779be832fb..1840989092ed 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -195,6 +195,15 @@ static void
195nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) 195nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
196{ 196{
197 struct xt_target *target = expr->ops->data; 197 struct xt_target *target = expr->ops->data;
198 void *info = nft_expr_priv(expr);
199 struct xt_tgdtor_param par;
200
201 par.net = ctx->net;
202 par.target = target;
203 par.targinfo = info;
204 par.family = ctx->afi->family;
205 if (par.target->destroy != NULL)
206 par.target->destroy(&par);
198 207
199 module_put(target->me); 208 module_put(target->me);
200} 209}
@@ -382,6 +391,15 @@ static void
382nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) 391nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
383{ 392{
384 struct xt_match *match = expr->ops->data; 393 struct xt_match *match = expr->ops->data;
394 void *info = nft_expr_priv(expr);
395 struct xt_mtdtor_param par;
396
397 par.net = ctx->net;
398 par.match = match;
399 par.matchinfo = info;
400 par.family = ctx->afi->family;
401 if (par.match->destroy != NULL)
402 par.match->destroy(&par);
385 403
386 module_put(match->me); 404 module_put(match->me);
387} 405}
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index a0195d28bcfc..79ff58cd36dc 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -175,12 +175,14 @@ static int nft_nat_dump(struct sk_buff *skb, const struct nft_expr *expr)
175 if (nla_put_be32(skb, 175 if (nla_put_be32(skb,
176 NFTA_NAT_REG_ADDR_MAX, htonl(priv->sreg_addr_max))) 176 NFTA_NAT_REG_ADDR_MAX, htonl(priv->sreg_addr_max)))
177 goto nla_put_failure; 177 goto nla_put_failure;
178 if (nla_put_be32(skb, 178 if (priv->sreg_proto_min) {
179 NFTA_NAT_REG_PROTO_MIN, htonl(priv->sreg_proto_min))) 179 if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MIN,
180 goto nla_put_failure; 180 htonl(priv->sreg_proto_min)))
181 if (nla_put_be32(skb, 181 goto nla_put_failure;
182 NFTA_NAT_REG_PROTO_MAX, htonl(priv->sreg_proto_max))) 182 if (nla_put_be32(skb, NFTA_NAT_REG_PROTO_MAX,
183 goto nla_put_failure; 183 htonl(priv->sreg_proto_max)))
184 goto nla_put_failure;
185 }
184 return 0; 186 return 0;
185 187
186nla_put_failure: 188nla_put_failure:
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index dcb19592761e..12c7e01c2677 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -321,41 +321,40 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
321 loff_t *ppos) 321 loff_t *ppos)
322{ 322{
323 struct net *net = current->nsproxy->net_ns; 323 struct net *net = current->nsproxy->net_ns;
324 char tmp[8];
325 struct ctl_table tbl; 324 struct ctl_table tbl;
326 int ret; 325 bool changed = false;
327 int changed = 0;
328 char *none = "none"; 326 char *none = "none";
327 char tmp[8];
328 int ret;
329 329
330 memset(&tbl, 0, sizeof(struct ctl_table)); 330 memset(&tbl, 0, sizeof(struct ctl_table));
331 331
332 if (write) { 332 if (write) {
333 tbl.data = tmp; 333 tbl.data = tmp;
334 tbl.maxlen = 8; 334 tbl.maxlen = sizeof(tmp);
335 } else { 335 } else {
336 tbl.data = net->sctp.sctp_hmac_alg ? : none; 336 tbl.data = net->sctp.sctp_hmac_alg ? : none;
337 tbl.maxlen = strlen(tbl.data); 337 tbl.maxlen = strlen(tbl.data);
338 } 338 }
339 ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
340 339
341 if (write) { 340 ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
341 if (write && ret == 0) {
342#ifdef CONFIG_CRYPTO_MD5 342#ifdef CONFIG_CRYPTO_MD5
343 if (!strncmp(tmp, "md5", 3)) { 343 if (!strncmp(tmp, "md5", 3)) {
344 net->sctp.sctp_hmac_alg = "md5"; 344 net->sctp.sctp_hmac_alg = "md5";
345 changed = 1; 345 changed = true;
346 } 346 }
347#endif 347#endif
348#ifdef CONFIG_CRYPTO_SHA1 348#ifdef CONFIG_CRYPTO_SHA1
349 if (!strncmp(tmp, "sha1", 4)) { 349 if (!strncmp(tmp, "sha1", 4)) {
350 net->sctp.sctp_hmac_alg = "sha1"; 350 net->sctp.sctp_hmac_alg = "sha1";
351 changed = 1; 351 changed = true;
352 } 352 }
353#endif 353#endif
354 if (!strncmp(tmp, "none", 4)) { 354 if (!strncmp(tmp, "none", 4)) {
355 net->sctp.sctp_hmac_alg = NULL; 355 net->sctp.sctp_hmac_alg = NULL;
356 changed = 1; 356 changed = true;
357 } 357 }
358
359 if (!changed) 358 if (!changed)
360 ret = -EINVAL; 359 ret = -EINVAL;
361 } 360 }
@@ -368,11 +367,10 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
368 loff_t *ppos) 367 loff_t *ppos)
369{ 368{
370 struct net *net = current->nsproxy->net_ns; 369 struct net *net = current->nsproxy->net_ns;
371 int new_value;
372 struct ctl_table tbl;
373 unsigned int min = *(unsigned int *) ctl->extra1; 370 unsigned int min = *(unsigned int *) ctl->extra1;
374 unsigned int max = *(unsigned int *) ctl->extra2; 371 unsigned int max = *(unsigned int *) ctl->extra2;
375 int ret; 372 struct ctl_table tbl;
373 int ret, new_value;
376 374
377 memset(&tbl, 0, sizeof(struct ctl_table)); 375 memset(&tbl, 0, sizeof(struct ctl_table));
378 tbl.maxlen = sizeof(unsigned int); 376 tbl.maxlen = sizeof(unsigned int);
@@ -381,12 +379,15 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
381 tbl.data = &new_value; 379 tbl.data = &new_value;
382 else 380 else
383 tbl.data = &net->sctp.rto_min; 381 tbl.data = &net->sctp.rto_min;
382
384 ret = proc_dointvec(&tbl, write, buffer, lenp, ppos); 383 ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
385 if (write) { 384 if (write && ret == 0) {
386 if (ret || new_value > max || new_value < min) 385 if (new_value > max || new_value < min)
387 return -EINVAL; 386 return -EINVAL;
387
388 net->sctp.rto_min = new_value; 388 net->sctp.rto_min = new_value;
389 } 389 }
390
390 return ret; 391 return ret;
391} 392}
392 393
@@ -395,11 +396,10 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
395 loff_t *ppos) 396 loff_t *ppos)
396{ 397{
397 struct net *net = current->nsproxy->net_ns; 398 struct net *net = current->nsproxy->net_ns;
398 int new_value;
399 struct ctl_table tbl;
400 unsigned int min = *(unsigned int *) ctl->extra1; 399 unsigned int min = *(unsigned int *) ctl->extra1;
401 unsigned int max = *(unsigned int *) ctl->extra2; 400 unsigned int max = *(unsigned int *) ctl->extra2;
402 int ret; 401 struct ctl_table tbl;
402 int ret, new_value;
403 403
404 memset(&tbl, 0, sizeof(struct ctl_table)); 404 memset(&tbl, 0, sizeof(struct ctl_table));
405 tbl.maxlen = sizeof(unsigned int); 405 tbl.maxlen = sizeof(unsigned int);
@@ -408,12 +408,15 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
408 tbl.data = &new_value; 408 tbl.data = &new_value;
409 else 409 else
410 tbl.data = &net->sctp.rto_max; 410 tbl.data = &net->sctp.rto_max;
411
411 ret = proc_dointvec(&tbl, write, buffer, lenp, ppos); 412 ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
412 if (write) { 413 if (write && ret == 0) {
413 if (ret || new_value > max || new_value < min) 414 if (new_value > max || new_value < min)
414 return -EINVAL; 415 return -EINVAL;
416
415 net->sctp.rto_max = new_value; 417 net->sctp.rto_max = new_value;
416 } 418 }
419
417 return ret; 420 return ret;
418} 421}
419 422
@@ -444,8 +447,7 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int write,
444 tbl.data = &net->sctp.auth_enable; 447 tbl.data = &net->sctp.auth_enable;
445 448
446 ret = proc_dointvec(&tbl, write, buffer, lenp, ppos); 449 ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
447 450 if (write && ret == 0) {
448 if (write) {
449 struct sock *sk = net->sctp.ctl_sock; 451 struct sock *sk = net->sctp.ctl_sock;
450 452
451 net->sctp.auth_enable = new_value; 453 net->sctp.auth_enable = new_value;
generated by cgit v1.2.2 (git 2.25.0) at 2025-08-16 05:23:36 -0400