linux-toradex.git/drivers/net/ethernet, branch v3.18.3

net: mvneta: fix race condition in mvneta_tx()

2014-12-16T17:39:05+00:00

[ Upstream commit 5f478b41033606d325e420df693162e2524c2b94 ]

mvneta_tx() dereferences skb to get skb->len too late,
as hardware might have completed the transmit and TX completion
could have freed the skb from another cpu.

Fixes: 71f6d1b31fb1 ("net: mvneta: replace Tx timer with a real interrupt")
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: mvneta: fix Tx interrupt delay

2014-12-16T17:39:05+00:00

[ Upstream commit aebea2ba0f7495e1a1c9ea5e753d146cb2f6b845 ]

The mvneta driver sets the amount of Tx coalesce packets to 16 by
default. Normally that does not cause any trouble since the driver
uses a much larger Tx ring size (532 packets). But some sockets
might run with very small buffers, much smaller than the equivalent
of 16 packets. This is what ping is doing for example, by setting
SNDBUF to 324 bytes rounded up to 2kB by the kernel.

The problem is that there is no documented method to force a specific
packet to emit an interrupt (eg: the last of the ring) nor is it
possible to make the NIC emit an interrupt after a given delay.

In this case, it causes trouble, because when ping sends packets over
its raw socket, the few first packets leave the system, and the first
15 packets will be emitted without an IRQ being generated, so without
the skbs being freed. And since the socket's buffer is small, there's
no way to reach that amount of packets, and the ping ends up with
"send: no buffer available" after sending 6 packets. Running with 3
instances of ping in parallel is enough to hide the problem, because
with 6 packets per instance, that's 18 packets total, which is enough
to grant a Tx interrupt before all are sent.

The original driver in the LSP kernel worked around this design flaw
by using a software timer to clean up the Tx descriptors. This timer
was slow and caused terrible network performance on some Tx-bound
workloads (such as routing) but was enough to make tools like ping
work correctly.

Instead here, we simply set the packet counts before interrupt to 1.
This ensures that each packet sent will produce an interrupt. NAPI
takes care of coalescing interrupts since the interrupt is disabled
once generated.

No measurable performance impact nor CPU usage were observed on small
nor large packets, including when saturating the link on Tx, and this
fixes tools like ping which rely on too small a send buffer. If one
wants to increase this value for certain workloads where it is safe
to do so, "ethtool -C $dev tx-frames" will override this default
setting.

This fix needs to be applied to stable kernels starting with 3.10.

Tested-By: Maggie Mae Roxas 
Signed-off-by: Willy Tarreau 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

cxgb4: Fill in supported link mode for SFP modules

2014-12-03T03:57:49+00:00

Signed-off-by: Hariprasad Shenai 
Signed-off-by: David S. Miller

sh_eth: Fix sleeping function called from invalid context

2014-11-30T05:16:54+00:00

This resolves the following bug which can be reproduced by building the
kernel with CONFIG_DEBUG_ATOMIC_SLEEP=y and reading network statistics
while the network interface is down.

e.g.:

ifconfig eth0 down
cat /sys/class/net/eth0/statistics/tx_errors

----
[ 1238.161349] BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:952
[ 1238.188279] in_atomic(): 1, irqs_disabled(): 0, pid: 1388, name: cat
[ 1238.207425] CPU: 0 PID: 1388 Comm: cat Not tainted 3.10.31-ltsi-00046-gefa0b46 #1087
[ 1238.230737] Backtrace:
[ 1238.238123] [] (dump_backtrace+0x0/0x10c) from [] (show_stack+0x18/0x1c)
[ 1238.263499]  r6:000003b8 r5:c06160c0 r4:c0669e00 r3:00404000
[ 1238.280583] [] (show_stack+0x0/0x1c) from [] (dump_stack+0x20/0x28)
[ 1238.304631] [] (dump_stack+0x0/0x28) from [] (__might_sleep+0xf8/0x118)
[ 1238.329734] [] (__might_sleep+0x0/0x118) from [] (__pm_runtime_resume+0x38/0x90)
[ 1238.357170]  r7:d616f000 r6:c049c458 r5:00000004 r4:d6a17210
[ 1238.374251] [] (__pm_runtime_resume+0x0/0x90) from [] (sh_eth_get_stats+0x44/0x280)
[ 1238.402468]  r7:d616f000 r6:c049c458 r5:d5c21000 r4:d5c21000
[ 1238.419552] [] (sh_eth_get_stats+0x0/0x280) from [] (dev_get_stats+0x54/0x88)
[ 1238.446204]  r5:d5c21000 r4:d5ed7e08
[ 1238.456980] [] (dev_get_stats+0x0/0x88) from [] (netstat_show.isra.15+0x54/0x9c)
[ 1238.484413]  r6:d5c21000 r5:d5c21238 r4:00000028 r3:00000001
[ 1238.501495] [] (netstat_show.isra.15+0x0/0x9c) from [] (show_tx_errors+0x18/0x1c)
[ 1238.529196]  r7:d5f945d8 r6:d5f945c0 r5:c049716c r4:c0650e7c
[ 1238.546279] [] (show_tx_errors+0x0/0x1c) from [] (dev_attr_show+0x24/0x50)
[ 1238.572157] [] (dev_attr_show+0x0/0x50) from [] (sysfs_read_file+0xb0/0x140)
[ 1238.598554]  r5:c049716c r4:d5c21240
[ 1238.609326] [] (sysfs_read_file+0x0/0x140) from [] (vfs_read+0xb0/0x13c)
[ 1238.634679] [] (vfs_read+0x0/0x13c) from [] (SyS_read+0x44/0x74)
[ 1238.657944]  r8:bef45bf0 r7:00000000 r6:d6ac0600 r5:00000000 r4:00000000
[ 1238.678172] [] (SyS_read+0x0/0x74) from [] (ret_fast_syscall+0x0/0x30)
----

Signed-off-by: Mitsuhiro Kimura 
Signed-off-by: Yoshihiro Kaneko 
Signed-off-by: Simon Horman 
Signed-off-by: David S. Miller

stmmac: platform: Move plat_dat checking earlier

2014-11-30T05:11:16+00:00

Original code only check/alloc plat_dat for the CONFIG_OF case, this
patch check/alloc it earlier and unconditionally to avoid kernel build
warnings:

drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c:275
stmmac_pltfr_probe() warn: variable dereferenced before check 'plat_dat'

V2: Fix coding style.

Signed-off-by: Huacai Chen 
Signed-off-by: David S. Miller

sh_eth: Fix skb alloc size and alignment adjust rule.

2014-11-30T05:09:38+00:00

In the current driver, allocation size of skb does not care the alignment
adjust after allocation.
And also, in the current implementation, buffer alignment method by
sh_eth_set_receive_align function has a bug that this function displace
buffer start address forcedly when the alignment is corrected.
In the result, tail of the skb will exceed allocated area and kernel panic
will be occurred.
This patch fix this issue.

Signed-off-by: Mitsuhiro Kimura 
Signed-off-by: Yoshihiro Kaneko 
Signed-off-by: David S. Miller

net: Check for presence of IFLA_AF_SPEC

2014-11-26T20:29:01+00:00

ndo_bridge_setlink() is currently only called on the slave if
IFLA_AF_SPEC is set but this is a very fragile assumption and may
change in the future.

Cc: Ajit Khaparde 
Cc: John Fastabend 
Signed-off-by: Thomas Graf 
Acked-by: Jeff Kirsher 
Signed-off-by: David S. Miller

net: Validate IFLA_BRIDGE_MODE attribute length

2014-11-26T20:29:00+00:00

Payload is currently accessed blindly and may exceed valid message
boundaries.

Fixes: a77dcb8c8 ("be2net: set and query VEB/VEPA mode of the PF interface")
Fixes: 815cccbf1 ("ixgbe: add setlink, getlink support to ixgbe and ixgbevf")
Cc: Ajit Khaparde 
Cc: John Fastabend 
Signed-off-by: Thomas Graf 
Acked-by: Jeff Kirsher 
Acked-by: John Fastabend 
Signed-off-by: David S. Miller

stmmac: platform: fix default values of the filter bins setting

2014-11-26T17:28:45+00:00

The commit 3b57de958e2a brought the support for a different amount of
the filter bins, but didn't update the platform driver that without
CONFIG_OF.

Fixes: 3b57de958e2a (net: stmmac: Support devicetree configs for mcast
and ucast filter entries)

Signed-off-by: Huacai Chen 
Acked-by: Giuseppe Cavallaro 
Signed-off-by: David S. Miller

net/mlx4_core: Limit count field to 24 bits in qp_alloc_res

2014-11-26T17:04:49+00:00

Some VF drivers use the upper byte of "param1" (the qp count field)
in mlx4_qp_reserve_range() to pass flags which are used to optimize
the range allocation.

Under the current code, if any of these flags are set, the 32-bit
count field yields a count greater than 2^24, which is out of range,
and this VF fails.

As these flags represent a "best-effort" allocation hint anyway, they may
safely be ignored. Therefore, the PF driver may simply mask out the bits.

Fixes: c82e9aa0a8 "mlx4_core: resource tracking for HCA resources used by guests"
Signed-off-by: Jack Morgenstein 
Signed-off-by: Or Gerlitz 
Signed-off-by: David S. Miller