linux.git/drivers/net, branch v3.13-rc3

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2013-12-02T18:09:07+00:00

Pull networking updates from David Miller:
 "Here is a pile of bug fixes that accumulated while I was in Europe"

 1) In fixing kernel leaks to userspace during copying of socket
    addresses, we broke a case that used to work, namely the user
    providing a buffer larger than the in-kernel generic socket address
    structure.  This broke Ruby amongst other things.  Fix from Dan
    Carpenter.

 2) Fix regression added by byte queue limit support in 8139cp driver,
    from Yang Yingliang.

 3) The addition of MSG_SENDPAGE_NOTLAST buggered up a few sendpage
    implementations, they should just treat it the same as MSG_MORE.
    Fix from Richard Weinberger and Shawn Landden.

 4) Handle icmpv4 errors received on ipv6 SIT tunnels correctly, from
    Oussama Ghorbel.  In particular we should send an ICMPv6 unreachable
    in such situations.

 5) Fix some regressions in the recent genetlink fixes, in particular
    get the pmcraid driver to use the new safer interfaces correctly.
    From Johannes Berg.

 6) macvtap was converted to use a per-cpu set of statistics, but some
    code was still bumping tx_dropped elsewhere.  From Jason Wang.

 7) Fix build failure of xen-netback due to missing include on some
    architectures, from Andy Whitecroft.

 8) macvtap double counts received packets in statistics, fix from Vlad
    Yasevich.

 9) Fix various cases of using *_STATS_BH() when *_STATS() is more
    appropriate.  From Eric Dumazet and Hannes Frederic Sowa.

10) Pktgen ipsec mode doesn't update the ipv4 header length and checksum
    properly after encapsulation.  Fix from Fan Du.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (61 commits)
  net/mlx4_en: Remove selftest TX queues empty condition
  {pktgen, xfrm} Update IPv4 header total len and checksum after tranformation
  virtio_net: make all RX paths handle erors consistently
  virtio_net: fix error handling for mergeable buffers
  virtio_net: Fixed a trivial typo (fitler --> filter)
  netem: fix gemodel loss generator
  netem: fix loss 4 state model
  netem: missing break in ge loss generator
  net/hsr: Support iproute print_opt ('ip -details ...')
  net/hsr: Very small fix of comment style.
  MAINTAINERS: Added net/hsr/ maintainer
  ipv6: fix possible seqlock deadlock in ip6_finish_output2
  ixgbe: Make ixgbe_identify_qsfp_module_generic static
  ixgbe: turn NETIF_F_HW_L2FW_DOFFLOAD off by default
  ixgbe: ixgbe_fwd_ring_down needs to be static
  e1000: fix possible reset_task running after adapter down
  e1000: fix lockdep warning in e1000_reset_task
  e1000: prevent oops when adapter is being closed and reset simultaneously
  igb: Fixed Wake On LAN support
  inet: fix possible seqlock deadlocks
  ...

net/mlx4_en: Remove selftest TX queues empty condition

2013-12-02T01:36:07+00:00

Remove waiting for TX queues to become empty during selftest.
This check is not necessary for any purpose, and might put
the driver into an infinite loop.

Signed-off-by: Eugenia Emantayev 
Signed-off-by: Amir Vadai 
Signed-off-by: David S. Miller

virtio_net: make all RX paths handle erors consistently

2013-12-02T01:27:16+00:00

receive mergeable now handles errors internally.
Do same for big and small packet paths, otherwise
the logic is too hard to follow.

Signed-off-by: Michael S. Tsirkin 
Acked-by: Jason Wang 
Signed-off-by: David S. Miller

virtio_net: fix error handling for mergeable buffers

2013-12-02T01:27:16+00:00

Eric Dumazet noticed that if we encounter an error
when processing a mergeable buffer, we don't
dequeue all of the buffers from this packet,
the result is almost sure to be loss of networking.

Jason Wang noticed that we also leak a page and that we don't decrement
the rq buf count, so we won't repost buffers (a resource leak).

Fix both issues.

Cc: Rusty Russell 
Cc: Michael Dalton 
Reported-by: Eric Dumazet 
Reported-by: Jason Wang 
Signed-off-by: Michael S. Tsirkin 
Acked-by: Jason Wang 
Signed-off-by: David S. Miller

virtio_net: Fixed a trivial typo (fitler --> filter)

2013-11-30T21:14:24+00:00

"MAC filter" sounds more reasonable than "MAC fitler".

Signed-off-by: Thomas Huth 
Signed-off-by: David S. Miller

ixgbe: Make ixgbe_identify_qsfp_module_generic static

2013-11-30T08:21:47+00:00

Correct a namespace complaint by making the function static
and moving the prototype into the .c file.

Signed-off-by: Mark Rustad 
Tested-by: Phil Schmitt 
Signed-off-by: Jeff Kirsher

ixgbe: turn NETIF_F_HW_L2FW_DOFFLOAD off by default

2013-11-30T08:15:16+00:00

NETIF_F_HW_L2FW_DOFFLOAD allows upper layer net devices such
as macvlan to use queues in the hardware to directly submit and
receive skbs.

This creates a subtle change in the datapath though. One change
being the skb may no longer use the root devices qdisc.

Because users may not expect this we can't enable the feature
by default unless the hardware can offload all the software
functionality above it. So for now disable it by default and
let users opt in.

Signed-off-by: John Fastabend 
Tested-by: Phil Schmitt 
Signed-off-by: Jeff Kirsher

ixgbe: ixgbe_fwd_ring_down needs to be static

2013-11-30T08:08:45+00:00

When compiling with -Wstrict-prototypes gcc catches a static
I missed.

./ixgbe_main.c:4254: warning: no previous prototype for 'ixgbe_fwd_ring_down'

Reported-by: Phillip Schmitt 
Signed-off-by: John Fastabend 
Tested-by: Phil Schmitt 
Signed-off-by: Jeff Kirsher

e1000: fix possible reset_task running after adapter down

2013-11-30T08:02:12+00:00

On e1000_down(), we should ensure every asynchronous work is canceled
before proceeding. Since the watchdog_task can schedule other works
apart from itself, it should be stopped first, but currently it is
stopped after the reset_task. This can result in the following race
leading to the reset_task running after the module unload:

e1000_down_and_stop():			e1000_watchdog():
----------------------			-----------------

cancel_work_sync(reset_task)
					schedule_work(reset_task)
cancel_delayed_work_sync(watchdog_task)

The patch moves cancel_delayed_work_sync(watchdog_task) at the beginning
of e1000_down_and_stop() thus ensuring the race is impossible.

Cc: Tushar Dave 
Cc: Patrick McHardy 
Signed-off-by: Vladimir Davydov 
Tested-by: Aaron Brown 
Signed-off-by: Jeff Kirsher

e1000: fix lockdep warning in e1000_reset_task

2013-11-30T07:55:40+00:00

The patch fixes the following lockdep warning, which is 100%
reproducible on network restart:

======================================================
[ INFO: possible circular locking dependency detected ]
3.12.0+ #47 Tainted: GF
-------------------------------------------------------
kworker/1:1/27 is trying to acquire lock:
 ((&(&adapter->watchdog_task)->work)){+.+...}, at: [] flush_work+0x0/0x70

but task is already holding lock:
 (&adapter->mutex){+.+...}, at: [] e1000_reset_task+0x4a/0xa0 [e1000]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (&adapter->mutex){+.+...}:
       [] lock_acquire+0x9d/0x120
       [] mutex_lock_nested+0x4c/0x390
       [] e1000_watchdog+0x7d/0x5b0 [e1000]
       [] process_one_work+0x1d2/0x510
       [] worker_thread+0x120/0x3a0
       [] kthread+0xee/0x110
       [] ret_from_fork+0x7c/0xb0

-> #0 ((&(&adapter->watchdog_task)->work)){+.+...}:
       [] __lock_acquire+0x1710/0x1810
       [] lock_acquire+0x9d/0x120
       [] flush_work+0x3b/0x70
       [] __cancel_work_timer+0x98/0x140
       [] cancel_delayed_work_sync+0x13/0x20
       [] e1000_down_and_stop+0x3c/0x60 [e1000]
       [] e1000_down+0x131/0x220 [e1000]
       [] e1000_reset_task+0x52/0xa0 [e1000]
       [] process_one_work+0x1d2/0x510
       [] worker_thread+0x120/0x3a0
       [] kthread+0xee/0x110
       [] ret_from_fork+0x7c/0xb0

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&adapter->mutex);
                               lock((&(&adapter->watchdog_task)->work));
                               lock(&adapter->mutex);
  lock((&(&adapter->watchdog_task)->work));

 *** DEADLOCK ***

3 locks held by kworker/1:1/27:
 #0:  (events){.+.+.+}, at: [] process_one_work+0x166/0x510
 #1:  ((&adapter->reset_task)){+.+...}, at: [] process_one_work+0x166/0x510
 #2:  (&adapter->mutex){+.+...}, at: [] e1000_reset_task+0x4a/0xa0 [e1000]

stack backtrace:
CPU: 1 PID: 27 Comm: kworker/1:1 Tainted: GF            3.12.0+ #47
Hardware name: System manufacturer System Product Name/P5B-VM SE, BIOS 0501    05/31/2007
Workqueue: events e1000_reset_task [e1000]
 ffffffff820f6000 ffff88007b9dba98 ffffffff816b54a2 0000000000000002
 ffffffff820f5e50 ffff88007b9dbae8 ffffffff810ba936 ffff88007b9dbac8
 ffff88007b9dbb48 ffff88007b9d8f00 ffff88007b9d8780 ffff88007b9d8f00
Call Trace:
 [] dump_stack+0x49/0x5f
 [] print_circular_bug+0x216/0x310
 [] __lock_acquire+0x1710/0x1810
 [] ? __flush_work+0x250/0x250
 [] lock_acquire+0x9d/0x120
 [] ? __flush_work+0x250/0x250
 [] flush_work+0x3b/0x70
 [] ? __flush_work+0x250/0x250
 [] __cancel_work_timer+0x98/0x140
 [] cancel_delayed_work_sync+0x13/0x20
 [] e1000_down_and_stop+0x3c/0x60 [e1000]
 [] e1000_down+0x131/0x220 [e1000]
 [] e1000_reset_task+0x52/0xa0 [e1000]
 [] process_one_work+0x1d2/0x510
 [] ? process_one_work+0x166/0x510
 [] worker_thread+0x120/0x3a0
 [] ? manage_workers+0x2c0/0x2c0
 [] kthread+0xee/0x110
 [] ? __init_kthread_worker+0x70/0x70
 [] ret_from_fork+0x7c/0xb0
 [] ? __init_kthread_worker+0x70/0x70

== The issue background ==

The problem occurs, because e1000_down(), which is called under
adapter->mutex by e1000_reset_task(), tries to synchronously cancel
e1000 auxiliary works (reset_task, watchdog_task, phy_info_task,
fifo_stall_task), which take adapter->mutex in their handlers. So the
question is what does adapter->mutex protect there?

The adapter->mutex was introduced by commit 0ef4ee ("e1000: convert to
private mutex from rtnl") as a replacement for rtnl_lock() taken in the
asynchronous handlers. It targeted on fixing a similar lockdep warning
issued when e1000_down() was called under rtnl_lock(), and it fixed it,
but unfortunately it introduced the lockdep warning described above.
Anyway, that said the source of this bug is that the asynchronous works
were made to take rtnl_lock() some time ago, so let's look deeper and
find why it was added there.

The rtnl_lock() was added to asynchronous handlers by commit 338c15
("e1000: fix occasional panic on unload") in order to prevent
asynchronous handlers from execution after the module is unloaded
(e1000_down() is called) as it follows from the comment to the commit:

> Net drivers in general have an issue where timers fired
> by mod_timer or work threads with schedule_work are running
> outside of the rtnl_lock.
>
> With no other lock protection these routines are vulnerable
> to races with driver unload or reset paths.
>
> The longer term solution to this might be a redesign with
> safer locks being taken in the driver to guarantee no
> reentrance, but for now a safe and effective fix is
> to take the rtnl_lock in these routines.

I'm not sure if this locking scheme fixed the problem or just made it
unlikely, although I incline to the latter. Anyway, this was long time
ago when e1000 auxiliary works were implemented as timers scheduling
real work handlers in their routines. The e1000_down() function only
canceled the timers, but left the real handlers running if they were
running, which could result in work execution after module unload.
Today, the e1000 driver uses sane delayed works instead of the pair
timer+work to implement its delayed asynchronous handlers, and the
e1000_down() synchronously cancels all the works so that the problem
that commit 338c15 tried to cope with disappeared, and we don't need any
locks in the handlers any more. Moreover, any locking there can
potentially result in a deadlock.

So, this patch reverts commits 0ef4ee and 338c15.

Fixes: 0ef4eedc2e98 ("e1000: convert to private mutex from rtnl")
Fixes: 338c15e470d8 ("e1000: fix occasional panic on unload")
Cc: Tushar Dave 
Cc: Patrick McHardy 
Signed-off-by: Vladimir Davydov 
Tested-by: Aaron Brown 
Signed-off-by: Jeff Kirsher