1. 17 11月, 2015 1 次提交
  2. 11 11月, 2015 2 次提交
  3. 06 11月, 2015 1 次提交
    • P
      USB: qmi_wwan: Add quirk for Quectel EC20 Mini PCIe module · b3d8cf01
      Petr Štetiar 提交于
      This device has same vendor and product IDs as G2K devices, but it has
      different number of interfaces(4 vs 5) and also different interface
      layout where EC20 has QMI on interface 4 instead of 0.
      
      lsusb output:
      
      	Bus 002 Device 003: ID 05c6:9215 Qualcomm, Inc. Acer Gobi 2000
      	Device Descriptor:
      	  bLength                18
      	  bDescriptorType         1
      	  bcdUSB               2.00
      	  bDeviceClass            0 (Defined at Interface level)
      	  bDeviceSubClass         0
      	  bDeviceProtocol         0
      	  bMaxPacketSize0        64
      	  idVendor           0x05c6 Qualcomm, Inc.
      	  idProduct          0x9215 Acer Gobi 2000 Wireless Modem
      	  bcdDevice            2.32
      	  iManufacturer           1 Quectel
      	  iProduct                2 Quectel LTE Module
      	  iSerial                 0
      	  bNumConfigurations      1
      	  Configuration Descriptor:
      	    bLength                 9
      	    bDescriptorType         2
      	    wTotalLength          209
      	    bNumInterfaces          5
      	    bConfigurationValue     1
      	    iConfiguration          0
      	    bmAttributes         0xa0
      	      (Bus Powered)
      	      Remote Wakeup
      	    MaxPower              500mA
      Signed-off-by: NPetr Štetiar <ynezz@true.cz>
      Acked-by: NBjørn Mork <bjorn@mork.no>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b3d8cf01
  4. 03 11月, 2015 1 次提交
  5. 22 10月, 2015 1 次提交
  6. 19 10月, 2015 1 次提交
  7. 16 10月, 2015 1 次提交
  8. 05 10月, 2015 6 次提交
    • D
      asix: Continue processing URB if no RX netdev buffer · 6a570814
      Dean Jenkins 提交于
      Avoid a loss of synchronisation of the Ethernet Data header 32-bit
      word due to a failure to get a netdev socket buffer.
      
      The ASIX RX handling algorithm returned 0 upon a failure to get
      an allocation of a netdev socket buffer. This causes the URB
      processing to stop which potentially causes a loss of synchronisation
      with the Ethernet Data header 32-bit word. Therefore, subsequent
      processing of URBs may be rejected due to a loss of synchronisation.
      This may cause additional good Ethernet frames to be discarded
      along with outputting of synchronisation error messages.
      
      Implement a solution which checks whether a netdev socket buffer
      has been allocated before trying to copy the Ethernet frame into
      the netdev socket buffer. But continue to process the URB so that
      synchronisation is maintained. Therefore, only a single Ethernet
      frame is discarded when no netdev socket buffer is available.
      Signed-off-by: NDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: NMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      6a570814
    • D
      asix: On RX avoid creating bad Ethernet frames · 3f30b158
      Dean Jenkins 提交于
      When RX Ethernet frames span multiple URB socket buffers,
      the data stream may suffer a discontinuity which will cause
      the current Ethernet frame in the netdev socket buffer
      to be incomplete. This frame needs to be discarded instead
      of appending unrelated data from the current URB socket buffer
      to the Ethernet frame in the netdev socket buffer. This avoids
      creating a corrupted Ethernet frame in the netdev socket buffer.
      
      A discontinuity can occur when the previous URB socket buffer
      held an incomplete Ethernet frame due to truncation or a
      URB socket buffer containing the end of the Ethernet frame
      was missing.
      
      Therefore, add a sanity test for when an Ethernet frame
      spans multiple URB socket buffers to check that the remaining
      bytes of the currently received Ethernet frame point to
      a good Data header 32-bit word of the next Ethernet
      frame. Upon error, reset the remaining bytes variable to
      zero and discard the current netdev socket buffer.
      Assume that the Data header is located at the start of
      the current socket buffer and attempt to process the next
      Ethernet frame from there. This avoids unnecessarily
      discarding a good URB socket buffer that contains a new
      Ethernet frame.
      Signed-off-by: NDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: NMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3f30b158
    • D
      asix: Simplify asix_rx_fixup_internal() netdev alloc · 9a5ccd8e
      Dean Jenkins 提交于
      The code is checking that the Ethernet frame will fit into a
      netdev allocated socket buffer within the constraints of MTU size,
      Ethernet header length plus VLAN header length.
      
      The original code was checking rx->remaining each loop of the while
      loop that processes multiple Ethernet frames per URB and/or Ethernet
      frames that span across URBs. rx->remaining decreases per while loop
      so there is no point in potentially checking multiple times that the
      Ethernet frame (remaining part) will fit into the netdev socket buffer.
      
      The modification checks that the size of the Ethernet frame will fit
      the netdev socket buffer before allocating the netdev socket buffer.
      This avoids grabbing memory and then deciding that the Ethernet frame
      is too big and then freeing the memory.
      Signed-off-by: NDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: NMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      9a5ccd8e
    • D
      asix: Tidy-up 32-bit header word synchronisation · 3bfc69ab
      Dean Jenkins 提交于
      Tidy-up the Data header 32-bit word synchronisation logic in
      asix_rx_fixup_internal() by removing redundant logic tests.
      
      The code is looking at the following cases of the Data header
      32-bit word that is present before each Ethernet frame:
      
      a) all 32 bits of the Data header word are in the URB socket buffer
      b) first 16 bits of the Data header word are at the end of the URB
         socket buffer
      c) last 16 bits of the Data header word are at the start of the URB
         socket buffer eg. split_head = true
      
      Note that the lifetime of rx->split_head exists outside of the
      function call and is accessed per processing of each URB. Therefore,
      split_head being true acts on the next URB to be processed.
      
      To check for b) the offset will be 16 bits (2 bytes) from the end of
      the buffer then indicate split_head is true.
      To check for c) split_head must be true because the first 16 bits
      have been found.
      To check for a) else c)
      
      Note that the || logic of the old code included the state
      (skb->len - offset == sizeof(u16) && rx->split_head) which is not
      possible because the split_head cannot be true whilst checking for b).
      This is because the split_head indicates that the first 16 bits have
      been found and that is not possible whilst checking for the first 16
      bits. Therefore simplify the logic.
      Signed-off-by: NDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: NMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      3bfc69ab
    • D
      asix: Rename remaining and size for clarity · 7b0378f5
      Dean Jenkins 提交于
      The Data header synchronisation is easier to understand
      if the variables "remaining" and "size" are renamed.
      
      Therefore, the lifetime of the "remaining" variable exists
      outside of asix_rx_fixup_internal() and is used to indicate
      any remaining pending bytes of the Ethernet frame that need
      to be obtained from the next socket buffer. This allows an
      Ethernet frame to span across multiple socket buffers.
      
      "size" is now local to asix_rx_fixup_internal() and contains
      the size read from the Data header 32-bit word.
      
      Add "copy_length" to hold the number of the Ethernet frame
      bytes (maybe a part of a full frame) that are to be copied
      out of the socket buffer.
      Signed-off-by: NDean Jenkins <Dean_Jenkins@mentor.com>
      Signed-off-by: NMark Craske <Mark_Craske@mentor.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7b0378f5
    • D
      net: usb: asix: Fix crash on skb alloc failure · f6194bcf
      David B. Robins 提交于
      If asix_rx_fixup_internal() fails to allocate rx->ax_skb, it will return
      but not clear rx->size. rx points to driver private data. A later call
      assumes that nonzero size means ax_skb was allocated and passes a null
      ax_skb to skb_put. Changed allocation failure return to clear size first.
      
      Found testing board with AX88772B devices.
      Signed-off-by: NDavid B. Robins <linux@davidrobins.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      f6194bcf
  9. 29 9月, 2015 1 次提交
  10. 25 9月, 2015 1 次提交
  11. 23 9月, 2015 2 次提交
  12. 22 9月, 2015 1 次提交
    • M
      usbnet: New driver for QinHeng CH9200 devices · 4a476bd6
      Matthew Garrett 提交于
      There's a bunch of cheap USB 10/100 devices based on QinHeng chipsets. The
      vendor driver supports the CH9100 and CH9200 devices, but the majority of
      the code is of the if (ch9100) {} else {} form, with the most significant
      difference being that CH9200 provides a real MII interface but CH9100 fakes
      one with a bunch of global variables and magic commands. I don't have a
      CH9100, so it's probably better if someone who does provides an independent
      driver for it. In any case, this is a lightly cleaned up version of the
      vendor driver with all the CH9100 code dropped.
      Signed-off-by: NMatthew Garrett <mjg59@srcf.ucam.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4a476bd6
  13. 18 9月, 2015 6 次提交
  14. 17 9月, 2015 1 次提交
  15. 16 9月, 2015 5 次提交
  16. 10 9月, 2015 2 次提交
  17. 09 9月, 2015 1 次提交
    • E
      usbnet: Fix a race between usbnet_stop() and the BH · fcb0bb6a
      Eugene Shatokhin 提交于
      The race may happen when a device (e.g. YOTA 4G LTE Modem) is
      unplugged while the system is downloading a large file from the Net.
      
      Hardware breakpoints and Kprobes with delays were used to confirm that
      the race does actually happen.
      
      The race is on skb_queue ('next' pointer) between usbnet_stop()
      and rx_complete(), which, in turn, calls usbnet_bh().
      
      Here is a part of the call stack with the code where the changes to the
      queue happen. The line numbers are for the kernel 4.1.0:
      
      *0 __skb_unlink (skbuff.h:1517)
          prev->next = next;
      *1 defer_bh (usbnet.c:430)
          spin_lock_irqsave(&list->lock, flags);
          old_state = entry->state;
          entry->state = state;
          __skb_unlink(skb, list);
          spin_unlock(&list->lock);
          spin_lock(&dev->done.lock);
          __skb_queue_tail(&dev->done, skb);
          if (dev->done.qlen == 1)
              tasklet_schedule(&dev->bh);
          spin_unlock_irqrestore(&dev->done.lock, flags);
      *2 rx_complete (usbnet.c:640)
          state = defer_bh(dev, skb, &dev->rxq, state);
      
      At the same time, the following code repeatedly checks if the queue is
      empty and reads these values concurrently with the above changes:
      
      *0  usbnet_terminate_urbs (usbnet.c:765)
          /* maybe wait for deletions to finish. */
          while (!skb_queue_empty(&dev->rxq)
              && !skb_queue_empty(&dev->txq)
              && !skb_queue_empty(&dev->done)) {
                  schedule_timeout(msecs_to_jiffies(UNLINK_TIMEOUT_MS));
                  set_current_state(TASK_UNINTERRUPTIBLE);
                  netif_dbg(dev, ifdown, dev->net,
                        "waited for %d urb completions\n", temp);
          }
      *1  usbnet_stop (usbnet.c:806)
          if (!(info->flags & FLAG_AVOID_UNLINK_URBS))
              usbnet_terminate_urbs(dev);
      
      As a result, it is possible, for example, that the skb is removed from
      dev->rxq by __skb_unlink() before the check
      "!skb_queue_empty(&dev->rxq)" in usbnet_terminate_urbs() is made. It is
      also possible in this case that the skb is added to dev->done queue
      after "!skb_queue_empty(&dev->done)" is checked. So
      usbnet_terminate_urbs() may stop waiting and return while dev->done
      queue still has an item.
      
      Locking in defer_bh() and usbnet_terminate_urbs() was revisited to avoid
      this race.
      Signed-off-by: NEugene Shatokhin <eugene.shatokhin@rosalab.ru>
      Reviewed-by: NBjørn Mork <bjorn@mork.no>
      Acked-by: NOliver Neukum <oneukum@suse.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      fcb0bb6a
  18. 07 9月, 2015 1 次提交
    • G
      lan78xx: Fix ladv/radv error handling in lan78xx_link_reset() · 99c79ece
      Geert Uytterhoeven 提交于
      net/usb/lan78xx.c: In function ‘lan78xx_link_reset’:
      net/usb/lan78xx.c:1107: warning: comparison is always false due to limited range of data type
      net/usb/lan78xx.c:1111: warning: comparison is always false due to limited range of data type
      
      Assigning return values that can be negative error codes to "u16"
      variables makes them positive, ignoring the errors.  Hence use "int"
      instead.
      
      Drop the "unlikely"s (unlikely considered harmful) and propagate the
      actual error values instead of overriding them to -EIO while we're at
      it.
      Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      99c79ece
  19. 01 9月, 2015 1 次提交
  20. 26 8月, 2015 1 次提交
  21. 18 8月, 2015 1 次提交
  22. 13 8月, 2015 2 次提交