summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-05-20NFC: st21nfca: Improve load_sessionChristophe Ricard
In case anybody uses previous patchset with the CLF, add a check to make sure missing pipe are created. st21nfca returns its pipe list in the creation order (most recent latest). Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-20NFC: dts: st21nfca_i2c: Add DTS DocumentationChristophe Ricard
Describe the properties used by the st21nfca NFC controller driver. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-20NFC: dts: st21nfca: Add device-tree (Open Firmware) support to st21nfcaChristophe Ricard
Add functions to recover hardware resources from the device-tree when not provided by the platform data. Based on pn544 devicetree implementation Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-20NFC: NCI: Send all NCI frames to raw socketsHiren Tandel
So that anyone listening on SOCKPROTO_RAW for raw frames will get all NCI frames, in both directions. This actually implements userspace NFC NCI sniffing. It's now up to userspace to decode those frames. Signed-off-by: Hiren Tandel <hirent@marvell.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-20NFC: Add RAW socket type support for SOCKPROTO_RAWHiren Tandel
This allows for a more generic NFC sniffing by using SOCKPROTO_RAW SOCK_RAW to read RAW NFC frames. This is for sniffing anything but LLCP (HCI, NCI, etc...). Signed-off-by: Hiren Tandel <hirent@marvell.com> Signed-off-by: Rahul Tank <rahult@marvell.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-19NFC: NCI: No need to reverse ATR_RES ResponseHiren Tandel
ATR_RES response received within Activation Parameters is already in correct order. Reversing it fails LLCP magic number check and so P2P functionality fails. Signed-off-by: Hiren Tandel <hirent@marvell.com> Signed-off-by: Rahul Tank <rahult@marvell.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-19NFC: digital: Handle multiple SENSF_REQ framesMark A. Greer
According to section 5.15.1.3 of the NFC Activity Specification, multiple SENSF_REQ commands can be received by a target before it receives an ATR_REQ command. To handle this, add a routine that checks whether a SENSF_REQ or ATR_REQ has been recieved. If its a SENSF_REQ, respond appropriately and continue waiting for a ATR_REQ. If its an ATR_REQ, handle it as before. CC: Thierry Escande <thierry.escande@linux.intel.com> Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-19NFC: digital: SENSF_RES excludes RD when SENSF_REQ RC is zeroMark A. Greer
The check in digital_tg_send_sensf_res() that excludes the 'RD' field from the SENSF_RES is inverted. The 'RD' field should be excluded when the SENSF_REQ 'RC' field is equal to DIGITAL_SENSF_REQ_RC_NONE instead of when its not equal. This is described in section 6.6.2.11 of the NFC Digital Specification. CC: Thierry Escande <thierry.escande@linux.intel.com> Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-05NFC: st21nfca: Free buffer when a bad frame is detectedChristophe Ricard
When a bad frame is detected for a bad crc. We were reallocating and loosing the previous frame pointer. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-05NFC: st21nfca: Synchronize i2c Tx and Rx pathChristophe Ricard
Stabilize communication by using a mutex. This avoids running a write transaction during a read retry or a read transaction during a write retry. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-05NFC: st21nfca: Improved i2c Rx data correctness checkChristophe Ricard
A frame starts with ST21NFCA_SOF_EOF(0x7e) + 0x00. A frame ends with ST21NFCA_SOF_EOF(0x7e). It is possible that the i2c macrocell is stopped for other communication interfaces with highest priority(RF or SWP). This can be seen with some 0xFF data at the end of a received shdlc buffer. If this happen we need to discard the frame because the CLF will repeat it. In order to push accurate data to hci layer, we add the following fix: - Instead of looking for the first 0x7e in the frame, check that the last received byte is 0x7e. - Check that the first frame reception block start with start of frame(0x7e 0x00). If not, clear the buffer. - Check that the next frame reception block do not start with start of frame(0x7e). If so, clear the buffer. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-05NFC: st21nfca: Fix st21nfca_hci_remove_len_crc tail room handlingChristophe Ricard
There is no byte stuffing when data are stored in skb. TAILROOM is 2 byte crc + 1 byte eof. st21nfca_hci_remove_len_crc was doing an incorrect operation on the TAILROOM data. If shdlc timer T2 is triggered, it will request to send the same data. Before every hci data was lost after st21nfca_hci_remove_len_crc. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-05NFC: st21nfca: Fix incorrect byte stuffing revocationChristophe Ricard
Byte stuffing was not correctly removed after a i2c read operation. This was causing improper crc calculation when byte stuffing was applied to more than 1 byte. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-05-05NFC: st21nfca: Remove few useless includeChristophe Ricard
Remove unneeded includes from i2c.c Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: st21nfca: Improve st21nfca initialization by handling reboot properlyChristophe Ricard
Change in st21nfca_hci_platform_init in order to handle in a better way the internal reboot command. Once the reboot is completed, the driver expect to receive a 0x7e filled buffer. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: st21nfca: Reworked st21nfca_request_resourcesChristophe Ricard
Remove struct st21nfca_i2c_phy* as this parameter can be retrieve through i2c_get_clientdata(client) Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: st21nfca: st21nfca_hci_i2c_probe returns st21nfca_hci_probe result.Christophe Ricard
st21nfca_hci_probe return 0 in case of successful call and a different value in any other cases. There is no need to check for st21nfca_hci_probe return as this will be checked after st21nfca_hci_i2c_probe is completed. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: st21nfca: Add __packed to struct st21nfca_pipe_infoChristophe Ricard
Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: st21nfca: Remove sporadic wait_tab variable from functions.Christophe Ricard
wait_tab variable is already global and may create conflicts. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: st21nfca: Fix warning: array subscript is above array boundsChristophe Ricard
Fix "warning: array subscript is above array bounds" in load_session Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: hci: Fix sparse: cast to restricted __be16Christophe Ricard
Fixing "sparse: cast to restricted __be16" message when building with make C=1 CF=-D__CHECK_ENDIAN__ Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: st21nfca: Fix sparse: cast to restricted __be16Christophe Ricard
Fixing "sparse: cast to restricted __be16" message when building with make C=1 CF=-D__CHECK_ENDIAN__ Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: pn544_i2c: Fix null pointer exception when not using platform dataClement Perrochaud
Fixes a null pointer exception occurring when the IRQ request in pn544_hci_i2c_probe fails and no platform data is available. Signed-off-by: Clément Perrochaud <clement.perrochaud@nxp.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Add support for the ISO/IEC 14443-B and Type 4B tagsMark A. Greer
Now that the NFC digital layer has support for the ISO/IEC 14443-B protocol and type 4B tags, add the corresponding support to the trf7970a driver. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: digital: Add support for ISO/IEC 14443-B ProtocolMark A. Greer
Add support for the ISO/IEC 14443-B protocol and Type 4B tags. It is expected that there will be only one tag within range so the full anticollision scheme is not implemented. Only the SENSB_REQ/SENSB_RES and ATTRIB_REQ/ATTRIB_RES are implemented. CC: Thierry Escande <thierry.escande@linux.intel.com> Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: digital: Add macros for the ISO/IEC 14443-B ProtocolMark A. Greer
Add RF tech and framing macros for the ISO/IEC 14443-B Protocol. Cc: Thierry Escande <thierry.escande@linux.intel.com> Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Document the 'autosuspend-delay' DTS propertyMark A. Greer
The trf7970a driver recently had support added for the 'autosuspend-delay' property so document it. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Add 'autosuspend-delay' DTS propertyMark A. Greer
The trf7970a driver currently uses a fixed autosuspend delay of 30 seconds. To enable users to customize the delay as they see fit, add support for the new 'autosuspend-delay' DTS property (part of the nfc node) which can override the default 30 seconds. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Don't return value from trf7970a_switch_rf_on()Mark A. Greer
trf7970a_switch_rf_on() no longer returns anything other than 0 so make it void and clean up the code that checks for errors when its called. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Add pm_runtime supportMark A. Greer
Add pm_runtime support by moving the code that enables the trf7970a to the pm_runtime hook routines. The pm_runtime 'autosuspend' feature is used so that the device isn't disabled until at least 30 seconds have passed since trf7970a_switch_rf_off() was last called. The result is that when trf7970a_switch_rf_on() is called, the device will be enabled and initialized (if it isn't already). When trf7970a_switch_rf_off() is called, it will turn off the RF immediately but leave the device enabled for at least 30 seconds. If 30 seconds have passed and the pm_runtime facility decides to suspend the driver, the device will be disabled then. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Turn RF on after hardware is configuredMark A. Greer
The NFC digital layer calls the 'switch_rf' hook to turn the RF on before it configures the RF technology and framing. There is potential to confuse a tag doing it this way so don't enable the RF until the RF technology and initial framing have been configured. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Set correct Vin voltage in Chip Status Control registerMark A. Greer
Currently, the trf7970a driver assumes that the Vin voltage is 5V when it writes to the 'Chip Status Control' register. That may not be correct so use the regulator facility to get the Vin voltage and set the VRS5_3 bit correctly when writing to that register. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Allow different Modulator and SYS_CLK Control register valuesMark A. Greer
Currently the driver writes the same value to the 'Modulator and SYS_CLK Control' register no matter what RF technology is being used. That works for now but new RF technologies (e.g., ISO/IEC 14443-B) will require different values to be written to that register. To support this, add a member to the trf7970a structure which is set by the RF technology handling code and used by the framing code when it writes to that register. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Set 'Modulator and SYS_CLK Control' after 'ISO Control'Mark A. Greer
Writing to the 'ISO Control' register may cause the contents of the 'Modulator and SYS_CLK Control' register to change so be sure to write to 'Modulator and SYS_CLK Control' after writing to 'ISO Control'. Note that writing to the 'Modulator and SYS_CLK Control' register shouldn't be necessary at all according to the trf790a manual but testing shows that it is necessary. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Only write 'ISO Control' when its changingMark A. Greer
The current code always writes to the 'ISO Control' register when the RF framing is set. That's not necessary since the register's value doesn't always change. Instead, only write to it when its value is actually being changed. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Reset FIFO when 'End of TX' Interrupt OccursMark A. Greer
Sometimes after sending a frame there is tx data leftover in the FIFO which the driver will think is part of the receive frame. That data can be cleared when an 'End of TX' interrupt is received by issuing the 'FIFO Reset' command. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Clear 'NFC Target Detection Level' registerMark A. Greer
Due to a trf7970a erratum, the 'NFC Target Detection Level' register (0x18) must be cleared after power-up. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Only abort a command if one is activeMark A. Greer
Only initiate the abort command process when there is an active command. If the abort process were started and there wasn't an active command then the next command issued by the digital layer would be incorrectly aborted. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: trf7970a: Increase TRF7970A_WAIT_FOR_RX_DATA_TIMEOUT to 20 msMark A. Greer
After further testing periods of ~16 ms have been observed between interrupts indicating that there is receive data in the FIFO. To accomodate that, increase the time the driver waits before deciding there is no more data to receive to 20 ms. The macro that represents that delay is 'TRF7970A_WAIT_FOR_RX_DATA_TIMEOUT'. Signed-off-by: Mark A. Greer <mgreer@animalcreek.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: pn544: i2c: Add DTS DocumentationClement Perrochaud
Describe the properties used by the PN544 NFC controller driver. Signed-off-by: Clément Perrochaud <clement.perrochaud@nxp.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: pn544: i2c: Add device-tree (Open Firmware) support to PN544Clement Perrochaud
Add functions to recover hardware resources from the device-tree when not provided by the platform data. Signed-off-by: Clément Perrochaud <clement.perrochaud@nxp.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: st21nfca: Implement load_session HCI hookChristophe Ricard
This implementation rely on the ST21NFCA_DEVICE_MGNT_GATE and ST21NFCA_DM_GETINFO proprietary gates commands. First we are retrieving a pipe list available on the CLF with the ST21NFCA_DM_GETINFO_PIPE_LIST parameter. A gate<->pipe table match is done with ST21NFCA_DM_GETINFO_PIPE_INFO for each pipe. If the pipe is created and open, we fill st21nfca_gates table. If the pipe is create but closed or is not created we keep the gate with NFC_HCI_INVALID_PIPE. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: hci: Add load_session HCI operandChristophe Ricard
load_session allows a CLF to restore the gate <-> pipe table from some proprietary location. The main advantage to add this function is to reduce the memory wear by running pipe creation (and storing) only once. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: hci: Extend command execution delayChristophe Ricard
Extend it up to the maximum FWI value 4949 ms defined by the ISO14443-3 specification. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-22NFC: ST21NFCA: Add driver for STMicroelectronics ST21NFCA NFC ChipChristophe Ricard
Add driver for STMicroelectronics ST21NFCA NFC controller. ST21NFCA is using HCI protocol, shdlc as LLC layer & I2C as communication protocol. Adding support for Reader/Writer mode with Tag type 1/2/3/4 A & B. It is using proprietary gate 15 for ISO14443-3 such as type 1 & type 2 tags. It is using proprietary gate 14 for type F tags. ST21NFCA_DEVICE_MGNT_GATE gives access to proprietary CLF configuration. Standard gate for ISO14443-4 A (13) & B (11) are also used. ST21NFCA specific mecanism: One particular point to notice for the data handling is that frame does not contain any length value. Therefore the i2c part of this driver is managing the reception with a read length sequence until the end of frame (0x7e) is reached. In order to avoid conflict between sof & eof a mecanism called byte stuffing concist of an escape byte (0x7d) insertion before special byte (0x7e, 0x7d). The special byte is then xored with 0x20. In this driver, When data are available in the CLF, the interrupt gpio is driven to active state and triggered an interrupt. Once the i2c_master_recv start, the interrupt gpio is driven to idle state until its complete. If the frame is incomplete or data are still available, interrupts will be triggered again. Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2014-04-12Merge branch 'misc' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild Pull misc kbuild changes from Michal Marek: "Here is the non-critical part of kbuild: - One bogus coccinelle check removed, one check fixed not to suggest the obsolete PTR_RET macro - scripts/tags.sh does not index the generated *.mod.c files - new objdiff tool to list differences between two versions of an object file - A fix for scripts/bootgraph.pl" * 'misc' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild: scripts/coccinelle: Use PTR_ERR_OR_ZERO scripts/bootgraph.pl: Add graphic header scripts: objdiff: detect object code changes between two commits Coccicheck: Remove memcpy to struct assignment test scripts/tags.sh: Ignore *.mod.c
2014-04-12sym53c8xx_2: Set DID_REQUEUE return code when aborting squeueMikulas Patocka
This patch fixes I/O errors with the sym53c8xx_2 driver when the disk returns QUEUE FULL status. When the controller encounters an error (including QUEUE FULL or BUSY status), it aborts all not yet submitted requests in the function sym_dequeue_from_squeue. This function aborts them with DID_SOFT_ERROR. If the disk has full tag queue, the request that caused the overflow is aborted with QUEUE FULL status (and the scsi midlayer properly retries it until it is accepted by the disk), but the sym53c8xx_2 driver aborts the following requests with DID_SOFT_ERROR --- for them, the midlayer does just a few retries and then signals the error up to sd. The result is that disk returning QUEUE FULL causes request failures. The error was reproduced on 53c895 with COMPAQ BD03685A24 disk (rebranded ST336607LC) with command queue 48 or 64 tags. The disk has 64 tags, but under some access patterns it return QUEUE FULL when there are less than 64 pending tags. The SCSI specification allows returning QUEUE FULL anytime and it is up to the host to retry. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Cc: Matthew Wilcox <matthew@wil.cx> Cc: James Bottomley <JBottomley@Parallels.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-12powerpc: Don't try to set LPCR unless we're in hypervisor modePaul Mackerras
Commit 8f619b5429d9 ("powerpc/ppc64: Do not turn AIL (reloc-on interrupts) too early") added code to set the AIL bit in the LPCR without checking whether the kernel is running in hypervisor mode. The result is that when the kernel is running as a guest (i.e., under PowerKVM or PowerVM), the processor takes a privileged instruction interrupt at that point, causing a panic. The visible result is that the kernel hangs after printing "returning from prom_init". This fixes it by checking for hypervisor mode being available before setting LPCR. If we are not in hypervisor mode, we enable relocation-on interrupts later in pSeries_setup_arch using the H_SET_MODE hcall. Signed-off-by: Paul Mackerras <paulus@samba.org> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-12futex: update documentation for ordering guaranteesDavidlohr Bueso
Commits 11d4616bd07f ("futex: revert back to the explicit waiter counting code") and 69cd9eba3886 ("futex: avoid race between requeue and wake") changed some of the finer details of how we think about futexes. One was a late fix and the other a consequence of overlooking the whole requeuing logic. The first change caused our documentation to be incorrect, and the second made us aware that we need to explicitly add more details to it. Signed-off-by: Davidlohr Bueso <davidlohr@hp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-04-12Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netLinus Torvalds
Pull yet more networking updates from David Miller: 1) Various fixes to the new Redpine Signals wireless driver, from Fariya Fatima. 2) L2TP PPP connect code takes PMTU from the wrong socket, fix from Dmitry Petukhov. 3) UFO and TSO packets differ in whether they include the protocol header in gso_size, account for that in skb_gso_transport_seglen(). From Florian Westphal. 4) If VLAN untagging fails, we double free the SKB in the bridging output path. From Toshiaki Makita. 5) Several call sites of sk->sk_data_ready() were referencing an SKB just added to the socket receive queue in order to calculate the second argument via skb->len. This is dangerous because the moment the skb is added to the receive queue it can be consumed in another context and freed up. It turns out also that none of the sk->sk_data_ready() implementations even care about this second argument. So just kill it off and thus fix all these use-after-free bugs as a side effect. 6) Fix inverted test in tcp_v6_send_response(), from Lorenzo Colitti. 7) pktgen needs to do locking properly for LLTX devices, from Daniel Borkmann. 8) xen-netfront driver initializes TX array entries in RX loop :-) From Vincenzo Maffione. 9) After refactoring, some tunnel drivers allow a tunnel to be configured on top itself. Fix from Nicolas Dichtel. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (46 commits) vti: don't allow to add the same tunnel twice gre: don't allow to add the same tunnel twice drivers: net: xen-netfront: fix array initialization bug pktgen: be friendly to LLTX devices r8152: check RTL8152_UNPLUG net: sun4i-emac: add promiscuous support net/apne: replace IS_ERR and PTR_ERR with PTR_ERR_OR_ZERO net: ipv6: Fix oif in TCP SYN+ACK route lookup. drivers: net: cpsw: enable interrupts after napi enable and clearing previous interrupts drivers: net: cpsw: discard all packets received when interface is down net: Fix use after free by removing length arg from sk_data_ready callbacks. Drivers: net: hyperv: Address UDP checksum issues Drivers: net: hyperv: Negotiate suitable ndis version for offload support Drivers: net: hyperv: Allocate memory for all possible per-pecket information bridge: Fix double free and memory leak around br_allowed_ingress bonding: Remove debug_fs files when module init fails i40evf: program RSS LUT correctly i40evf: remove open-coded skb_cow_head ixgb: remove open-coded skb_cow_head igbvf: remove open-coded skb_cow_head ...