Annotation of /trunk/kernel-alx/patches-3.14/0116-3.14.17-all-fixes.patch
Parent Directory | Revision Log
Revision 2506 -
(hide annotations)
(download)
Fri Oct 17 07:55:45 2014 UTC (9 years, 11 months ago) by niro
File size: 59026 byte(s)
Fri Oct 17 07:55:45 2014 UTC (9 years, 11 months ago) by niro
File size: 59026 byte(s)
-patches for 3.14
1 | niro | 2506 | diff --git a/Makefile b/Makefile |
2 | index 8b22e24a2d8e..12aac0325888 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 3 | ||
7 | PATCHLEVEL = 14 | ||
8 | -SUBLEVEL = 16 | ||
9 | +SUBLEVEL = 17 | ||
10 | EXTRAVERSION = | ||
11 | NAME = Remembering Coco | ||
12 | |||
13 | diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h | ||
14 | index 0f9e94537eee..1a49ffdf9da9 100644 | ||
15 | --- a/arch/sparc/include/asm/pgtable_64.h | ||
16 | +++ b/arch/sparc/include/asm/pgtable_64.h | ||
17 | @@ -24,7 +24,8 @@ | ||
18 | |||
19 | /* The kernel image occupies 0x4000000 to 0x6000000 (4MB --> 96MB). | ||
20 | * The page copy blockops can use 0x6000000 to 0x8000000. | ||
21 | - * The TSB is mapped in the 0x8000000 to 0xa000000 range. | ||
22 | + * The 8K TSB is mapped in the 0x8000000 to 0x8400000 range. | ||
23 | + * The 4M TSB is mapped in the 0x8400000 to 0x8800000 range. | ||
24 | * The PROM resides in an area spanning 0xf0000000 to 0x100000000. | ||
25 | * The vmalloc area spans 0x100000000 to 0x200000000. | ||
26 | * Since modules need to be in the lowest 32-bits of the address space, | ||
27 | @@ -33,7 +34,8 @@ | ||
28 | * 0x400000000. | ||
29 | */ | ||
30 | #define TLBTEMP_BASE _AC(0x0000000006000000,UL) | ||
31 | -#define TSBMAP_BASE _AC(0x0000000008000000,UL) | ||
32 | +#define TSBMAP_8K_BASE _AC(0x0000000008000000,UL) | ||
33 | +#define TSBMAP_4M_BASE _AC(0x0000000008400000,UL) | ||
34 | #define MODULES_VADDR _AC(0x0000000010000000,UL) | ||
35 | #define MODULES_LEN _AC(0x00000000e0000000,UL) | ||
36 | #define MODULES_END _AC(0x00000000f0000000,UL) | ||
37 | @@ -71,6 +73,23 @@ | ||
38 | |||
39 | #include <linux/sched.h> | ||
40 | |||
41 | +extern unsigned long sparc64_valid_addr_bitmap[]; | ||
42 | + | ||
43 | +/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */ | ||
44 | +static inline bool __kern_addr_valid(unsigned long paddr) | ||
45 | +{ | ||
46 | + if ((paddr >> MAX_PHYS_ADDRESS_BITS) != 0UL) | ||
47 | + return false; | ||
48 | + return test_bit(paddr >> ILOG2_4MB, sparc64_valid_addr_bitmap); | ||
49 | +} | ||
50 | + | ||
51 | +static inline bool kern_addr_valid(unsigned long addr) | ||
52 | +{ | ||
53 | + unsigned long paddr = __pa(addr); | ||
54 | + | ||
55 | + return __kern_addr_valid(paddr); | ||
56 | +} | ||
57 | + | ||
58 | /* Entries per page directory level. */ | ||
59 | #define PTRS_PER_PTE (1UL << (PAGE_SHIFT-3)) | ||
60 | #define PTRS_PER_PMD (1UL << PMD_BITS) | ||
61 | @@ -79,9 +98,12 @@ | ||
62 | /* Kernel has a separate 44bit address space. */ | ||
63 | #define FIRST_USER_ADDRESS 0 | ||
64 | |||
65 | -#define pte_ERROR(e) __builtin_trap() | ||
66 | -#define pmd_ERROR(e) __builtin_trap() | ||
67 | -#define pgd_ERROR(e) __builtin_trap() | ||
68 | +#define pmd_ERROR(e) \ | ||
69 | + pr_err("%s:%d: bad pmd %p(%016lx) seen at (%pS)\n", \ | ||
70 | + __FILE__, __LINE__, &(e), pmd_val(e), __builtin_return_address(0)) | ||
71 | +#define pgd_ERROR(e) \ | ||
72 | + pr_err("%s:%d: bad pgd %p(%016lx) seen at (%pS)\n", \ | ||
73 | + __FILE__, __LINE__, &(e), pgd_val(e), __builtin_return_address(0)) | ||
74 | |||
75 | #endif /* !(__ASSEMBLY__) */ | ||
76 | |||
77 | @@ -258,8 +280,8 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t prot) | ||
78 | { | ||
79 | unsigned long mask, tmp; | ||
80 | |||
81 | - /* SUN4U: 0x600307ffffffecb8 (negated == 0x9ffcf80000001347) | ||
82 | - * SUN4V: 0x30ffffffffffee17 (negated == 0xcf000000000011e8) | ||
83 | + /* SUN4U: 0x630107ffffffec38 (negated == 0x9cfef800000013c7) | ||
84 | + * SUN4V: 0x33ffffffffffee07 (negated == 0xcc000000000011f8) | ||
85 | * | ||
86 | * Even if we use negation tricks the result is still a 6 | ||
87 | * instruction sequence, so don't try to play fancy and just | ||
88 | @@ -289,10 +311,10 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t prot) | ||
89 | " .previous\n" | ||
90 | : "=r" (mask), "=r" (tmp) | ||
91 | : "i" (_PAGE_PADDR_4U | _PAGE_MODIFIED_4U | _PAGE_ACCESSED_4U | | ||
92 | - _PAGE_CP_4U | _PAGE_CV_4U | _PAGE_E_4U | _PAGE_PRESENT_4U | | ||
93 | + _PAGE_CP_4U | _PAGE_CV_4U | _PAGE_E_4U | | ||
94 | _PAGE_SPECIAL | _PAGE_PMD_HUGE | _PAGE_SZALL_4U), | ||
95 | "i" (_PAGE_PADDR_4V | _PAGE_MODIFIED_4V | _PAGE_ACCESSED_4V | | ||
96 | - _PAGE_CP_4V | _PAGE_CV_4V | _PAGE_E_4V | _PAGE_PRESENT_4V | | ||
97 | + _PAGE_CP_4V | _PAGE_CV_4V | _PAGE_E_4V | | ||
98 | _PAGE_SPECIAL | _PAGE_PMD_HUGE | _PAGE_SZALL_4V)); | ||
99 | |||
100 | return __pte((pte_val(pte) & mask) | (pgprot_val(prot) & ~mask)); | ||
101 | @@ -633,7 +655,7 @@ static inline unsigned long pmd_large(pmd_t pmd) | ||
102 | { | ||
103 | pte_t pte = __pte(pmd_val(pmd)); | ||
104 | |||
105 | - return (pte_val(pte) & _PAGE_PMD_HUGE) && pte_present(pte); | ||
106 | + return pte_val(pte) & _PAGE_PMD_HUGE; | ||
107 | } | ||
108 | |||
109 | #ifdef CONFIG_TRANSPARENT_HUGEPAGE | ||
110 | @@ -719,20 +741,6 @@ static inline pmd_t pmd_mkwrite(pmd_t pmd) | ||
111 | return __pmd(pte_val(pte)); | ||
112 | } | ||
113 | |||
114 | -static inline pmd_t pmd_mknotpresent(pmd_t pmd) | ||
115 | -{ | ||
116 | - unsigned long mask; | ||
117 | - | ||
118 | - if (tlb_type == hypervisor) | ||
119 | - mask = _PAGE_PRESENT_4V; | ||
120 | - else | ||
121 | - mask = _PAGE_PRESENT_4U; | ||
122 | - | ||
123 | - pmd_val(pmd) &= ~mask; | ||
124 | - | ||
125 | - return pmd; | ||
126 | -} | ||
127 | - | ||
128 | static inline pmd_t pmd_mksplitting(pmd_t pmd) | ||
129 | { | ||
130 | pte_t pte = __pte(pmd_val(pmd)); | ||
131 | @@ -757,6 +765,20 @@ static inline int pmd_present(pmd_t pmd) | ||
132 | |||
133 | #define pmd_none(pmd) (!pmd_val(pmd)) | ||
134 | |||
135 | +/* pmd_bad() is only called on non-trans-huge PMDs. Our encoding is | ||
136 | + * very simple, it's just the physical address. PTE tables are of | ||
137 | + * size PAGE_SIZE so make sure the sub-PAGE_SIZE bits are clear and | ||
138 | + * the top bits outside of the range of any physical address size we | ||
139 | + * support are clear as well. We also validate the physical itself. | ||
140 | + */ | ||
141 | +#define pmd_bad(pmd) ((pmd_val(pmd) & ~PAGE_MASK) || \ | ||
142 | + !__kern_addr_valid(pmd_val(pmd))) | ||
143 | + | ||
144 | +#define pud_none(pud) (!pud_val(pud)) | ||
145 | + | ||
146 | +#define pud_bad(pud) ((pud_val(pud) & ~PAGE_MASK) || \ | ||
147 | + !__kern_addr_valid(pud_val(pud))) | ||
148 | + | ||
149 | #ifdef CONFIG_TRANSPARENT_HUGEPAGE | ||
150 | extern void set_pmd_at(struct mm_struct *mm, unsigned long addr, | ||
151 | pmd_t *pmdp, pmd_t pmd); | ||
152 | @@ -790,10 +812,7 @@ static inline unsigned long __pmd_page(pmd_t pmd) | ||
153 | #define pud_page_vaddr(pud) \ | ||
154 | ((unsigned long) __va(pud_val(pud))) | ||
155 | #define pud_page(pud) virt_to_page((void *)pud_page_vaddr(pud)) | ||
156 | -#define pmd_bad(pmd) (0) | ||
157 | #define pmd_clear(pmdp) (pmd_val(*(pmdp)) = 0UL) | ||
158 | -#define pud_none(pud) (!pud_val(pud)) | ||
159 | -#define pud_bad(pud) (0) | ||
160 | #define pud_present(pud) (pud_val(pud) != 0U) | ||
161 | #define pud_clear(pudp) (pud_val(*(pudp)) = 0UL) | ||
162 | |||
163 | @@ -893,6 +912,10 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *); | ||
164 | extern void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr, | ||
165 | pmd_t *pmd); | ||
166 | |||
167 | +#define __HAVE_ARCH_PMDP_INVALIDATE | ||
168 | +extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, | ||
169 | + pmd_t *pmdp); | ||
170 | + | ||
171 | #define __HAVE_ARCH_PGTABLE_DEPOSIT | ||
172 | extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp, | ||
173 | pgtable_t pgtable); | ||
174 | @@ -919,18 +942,6 @@ extern unsigned long pte_file(pte_t); | ||
175 | extern pte_t pgoff_to_pte(unsigned long); | ||
176 | #define PTE_FILE_MAX_BITS (64UL - PAGE_SHIFT - 1UL) | ||
177 | |||
178 | -extern unsigned long sparc64_valid_addr_bitmap[]; | ||
179 | - | ||
180 | -/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */ | ||
181 | -static inline bool kern_addr_valid(unsigned long addr) | ||
182 | -{ | ||
183 | - unsigned long paddr = __pa(addr); | ||
184 | - | ||
185 | - if ((paddr >> 41UL) != 0UL) | ||
186 | - return false; | ||
187 | - return test_bit(paddr >> 22, sparc64_valid_addr_bitmap); | ||
188 | -} | ||
189 | - | ||
190 | extern int page_in_phys_avail(unsigned long paddr); | ||
191 | |||
192 | /* | ||
193 | diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h | ||
194 | index 3c3c89f52643..7f9bab26a499 100644 | ||
195 | --- a/arch/sparc/include/asm/tlbflush_64.h | ||
196 | +++ b/arch/sparc/include/asm/tlbflush_64.h | ||
197 | @@ -34,6 +34,8 @@ static inline void flush_tlb_range(struct vm_area_struct *vma, | ||
198 | { | ||
199 | } | ||
200 | |||
201 | +void flush_tlb_kernel_range(unsigned long start, unsigned long end); | ||
202 | + | ||
203 | #define __HAVE_ARCH_ENTER_LAZY_MMU_MODE | ||
204 | |||
205 | extern void flush_tlb_pending(void); | ||
206 | @@ -48,11 +50,6 @@ extern void __flush_tlb_kernel_range(unsigned long start, unsigned long end); | ||
207 | |||
208 | #ifndef CONFIG_SMP | ||
209 | |||
210 | -#define flush_tlb_kernel_range(start,end) \ | ||
211 | -do { flush_tsb_kernel_range(start,end); \ | ||
212 | - __flush_tlb_kernel_range(start,end); \ | ||
213 | -} while (0) | ||
214 | - | ||
215 | static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr) | ||
216 | { | ||
217 | __flush_tlb_page(CTX_HWBITS(mm->context), vaddr); | ||
218 | @@ -63,11 +60,6 @@ static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vad | ||
219 | extern void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end); | ||
220 | extern void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr); | ||
221 | |||
222 | -#define flush_tlb_kernel_range(start, end) \ | ||
223 | -do { flush_tsb_kernel_range(start,end); \ | ||
224 | - smp_flush_tlb_kernel_range(start, end); \ | ||
225 | -} while (0) | ||
226 | - | ||
227 | #define global_flush_tlb_page(mm, vaddr) \ | ||
228 | smp_flush_tlb_page(mm, vaddr) | ||
229 | |||
230 | diff --git a/arch/sparc/include/asm/tsb.h b/arch/sparc/include/asm/tsb.h | ||
231 | index 2230f80d9fe3..90916f955cac 100644 | ||
232 | --- a/arch/sparc/include/asm/tsb.h | ||
233 | +++ b/arch/sparc/include/asm/tsb.h | ||
234 | @@ -171,7 +171,8 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end; | ||
235 | andcc REG1, REG2, %g0; \ | ||
236 | be,pt %xcc, 700f; \ | ||
237 | sethi %hi(4 * 1024 * 1024), REG2; \ | ||
238 | - andn REG1, REG2, REG1; \ | ||
239 | + brgez,pn REG1, FAIL_LABEL; \ | ||
240 | + andn REG1, REG2, REG1; \ | ||
241 | and VADDR, REG2, REG2; \ | ||
242 | brlz,pt REG1, PTE_LABEL; \ | ||
243 | or REG1, REG2, REG1; \ | ||
244 | diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S | ||
245 | index 26b706a1867d..452f04fe8da6 100644 | ||
246 | --- a/arch/sparc/kernel/head_64.S | ||
247 | +++ b/arch/sparc/kernel/head_64.S | ||
248 | @@ -282,8 +282,8 @@ sun4v_chip_type: | ||
249 | stx %l2, [%l4 + 0x0] | ||
250 | ldx [%sp + 2047 + 128 + 0x50], %l3 ! physaddr low | ||
251 | /* 4MB align */ | ||
252 | - srlx %l3, 22, %l3 | ||
253 | - sllx %l3, 22, %l3 | ||
254 | + srlx %l3, ILOG2_4MB, %l3 | ||
255 | + sllx %l3, ILOG2_4MB, %l3 | ||
256 | stx %l3, [%l4 + 0x8] | ||
257 | |||
258 | /* Leave service as-is, "call-method" */ | ||
259 | diff --git a/arch/sparc/kernel/ktlb.S b/arch/sparc/kernel/ktlb.S | ||
260 | index 542e96ac4d39..605d49204580 100644 | ||
261 | --- a/arch/sparc/kernel/ktlb.S | ||
262 | +++ b/arch/sparc/kernel/ktlb.S | ||
263 | @@ -277,7 +277,7 @@ kvmap_dtlb_load: | ||
264 | #ifdef CONFIG_SPARSEMEM_VMEMMAP | ||
265 | kvmap_vmemmap: | ||
266 | sub %g4, %g5, %g5 | ||
267 | - srlx %g5, 22, %g5 | ||
268 | + srlx %g5, ILOG2_4MB, %g5 | ||
269 | sethi %hi(vmemmap_table), %g1 | ||
270 | sllx %g5, 3, %g5 | ||
271 | or %g1, %lo(vmemmap_table), %g1 | ||
272 | diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c | ||
273 | index e01d75d40329..66dacd56bb10 100644 | ||
274 | --- a/arch/sparc/kernel/ldc.c | ||
275 | +++ b/arch/sparc/kernel/ldc.c | ||
276 | @@ -1336,7 +1336,7 @@ int ldc_connect(struct ldc_channel *lp) | ||
277 | if (!(lp->flags & LDC_FLAG_ALLOCED_QUEUES) || | ||
278 | !(lp->flags & LDC_FLAG_REGISTERED_QUEUES) || | ||
279 | lp->hs_state != LDC_HS_OPEN) | ||
280 | - err = -EINVAL; | ||
281 | + err = ((lp->hs_state > LDC_HS_OPEN) ? 0 : -EINVAL); | ||
282 | else | ||
283 | err = start_handshake(lp); | ||
284 | |||
285 | diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c | ||
286 | index b085311dcd0e..8416d7fadcce 100644 | ||
287 | --- a/arch/sparc/kernel/smp_64.c | ||
288 | +++ b/arch/sparc/kernel/smp_64.c | ||
289 | @@ -151,7 +151,7 @@ void cpu_panic(void) | ||
290 | #define NUM_ROUNDS 64 /* magic value */ | ||
291 | #define NUM_ITERS 5 /* likewise */ | ||
292 | |||
293 | -static DEFINE_SPINLOCK(itc_sync_lock); | ||
294 | +static DEFINE_RAW_SPINLOCK(itc_sync_lock); | ||
295 | static unsigned long go[SLAVE + 1]; | ||
296 | |||
297 | #define DEBUG_TICK_SYNC 0 | ||
298 | @@ -259,7 +259,7 @@ static void smp_synchronize_one_tick(int cpu) | ||
299 | go[MASTER] = 0; | ||
300 | membar_safe("#StoreLoad"); | ||
301 | |||
302 | - spin_lock_irqsave(&itc_sync_lock, flags); | ||
303 | + raw_spin_lock_irqsave(&itc_sync_lock, flags); | ||
304 | { | ||
305 | for (i = 0; i < NUM_ROUNDS*NUM_ITERS; i++) { | ||
306 | while (!go[MASTER]) | ||
307 | @@ -270,7 +270,7 @@ static void smp_synchronize_one_tick(int cpu) | ||
308 | membar_safe("#StoreLoad"); | ||
309 | } | ||
310 | } | ||
311 | - spin_unlock_irqrestore(&itc_sync_lock, flags); | ||
312 | + raw_spin_unlock_irqrestore(&itc_sync_lock, flags); | ||
313 | } | ||
314 | |||
315 | #if defined(CONFIG_SUN_LDOMS) && defined(CONFIG_HOTPLUG_CPU) | ||
316 | diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S | ||
317 | index f7c72b6efc27..d066eb18650c 100644 | ||
318 | --- a/arch/sparc/kernel/sys32.S | ||
319 | +++ b/arch/sparc/kernel/sys32.S | ||
320 | @@ -44,7 +44,7 @@ SIGN1(sys32_timer_settime, compat_sys_timer_settime, %o1) | ||
321 | SIGN1(sys32_io_submit, compat_sys_io_submit, %o1) | ||
322 | SIGN1(sys32_mq_open, compat_sys_mq_open, %o1) | ||
323 | SIGN1(sys32_select, compat_sys_select, %o0) | ||
324 | -SIGN3(sys32_futex, compat_sys_futex, %o1, %o2, %o5) | ||
325 | +SIGN1(sys32_futex, compat_sys_futex, %o1) | ||
326 | SIGN1(sys32_recvfrom, compat_sys_recvfrom, %o0) | ||
327 | SIGN1(sys32_recvmsg, compat_sys_recvmsg, %o0) | ||
328 | SIGN1(sys32_sendmsg, compat_sys_sendmsg, %o0) | ||
329 | diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c | ||
330 | index 3c1a7cb31579..35ab8b60d256 100644 | ||
331 | --- a/arch/sparc/kernel/unaligned_64.c | ||
332 | +++ b/arch/sparc/kernel/unaligned_64.c | ||
333 | @@ -166,17 +166,23 @@ static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs) | ||
334 | unsigned long compute_effective_address(struct pt_regs *regs, | ||
335 | unsigned int insn, unsigned int rd) | ||
336 | { | ||
337 | + int from_kernel = (regs->tstate & TSTATE_PRIV) != 0; | ||
338 | unsigned int rs1 = (insn >> 14) & 0x1f; | ||
339 | unsigned int rs2 = insn & 0x1f; | ||
340 | - int from_kernel = (regs->tstate & TSTATE_PRIV) != 0; | ||
341 | + unsigned long addr; | ||
342 | |||
343 | if (insn & 0x2000) { | ||
344 | maybe_flush_windows(rs1, 0, rd, from_kernel); | ||
345 | - return (fetch_reg(rs1, regs) + sign_extend_imm13(insn)); | ||
346 | + addr = (fetch_reg(rs1, regs) + sign_extend_imm13(insn)); | ||
347 | } else { | ||
348 | maybe_flush_windows(rs1, rs2, rd, from_kernel); | ||
349 | - return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs)); | ||
350 | + addr = (fetch_reg(rs1, regs) + fetch_reg(rs2, regs)); | ||
351 | } | ||
352 | + | ||
353 | + if (!from_kernel && test_thread_flag(TIF_32BIT)) | ||
354 | + addr &= 0xffffffff; | ||
355 | + | ||
356 | + return addr; | ||
357 | } | ||
358 | |||
359 | /* This is just to make gcc think die_if_kernel does return... */ | ||
360 | diff --git a/arch/sparc/lib/NG2memcpy.S b/arch/sparc/lib/NG2memcpy.S | ||
361 | index 2c20ad63ddbf..30eee6e8a81b 100644 | ||
362 | --- a/arch/sparc/lib/NG2memcpy.S | ||
363 | +++ b/arch/sparc/lib/NG2memcpy.S | ||
364 | @@ -236,6 +236,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ | ||
365 | */ | ||
366 | VISEntryHalf | ||
367 | |||
368 | + membar #Sync | ||
369 | alignaddr %o1, %g0, %g0 | ||
370 | |||
371 | add %o1, (64 - 1), %o4 | ||
372 | diff --git a/arch/sparc/math-emu/math_32.c b/arch/sparc/math-emu/math_32.c | ||
373 | index aa4d55b0bdf0..5ce8f2f64604 100644 | ||
374 | --- a/arch/sparc/math-emu/math_32.c | ||
375 | +++ b/arch/sparc/math-emu/math_32.c | ||
376 | @@ -499,7 +499,7 @@ static int do_one_mathemu(u32 insn, unsigned long *pfsr, unsigned long *fregs) | ||
377 | case 0: fsr = *pfsr; | ||
378 | if (IR == -1) IR = 2; | ||
379 | /* fcc is always fcc0 */ | ||
380 | - fsr &= ~0xc00; fsr |= (IR << 10); break; | ||
381 | + fsr &= ~0xc00; fsr |= (IR << 10); | ||
382 | *pfsr = fsr; | ||
383 | break; | ||
384 | case 1: rd->s = IR; break; | ||
385 | diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c | ||
386 | index 69bb818fdd79..4ced3fc66130 100644 | ||
387 | --- a/arch/sparc/mm/fault_64.c | ||
388 | +++ b/arch/sparc/mm/fault_64.c | ||
389 | @@ -96,38 +96,51 @@ static unsigned int get_user_insn(unsigned long tpc) | ||
390 | pte_t *ptep, pte; | ||
391 | unsigned long pa; | ||
392 | u32 insn = 0; | ||
393 | - unsigned long pstate; | ||
394 | |||
395 | - if (pgd_none(*pgdp)) | ||
396 | - goto outret; | ||
397 | + if (pgd_none(*pgdp) || unlikely(pgd_bad(*pgdp))) | ||
398 | + goto out; | ||
399 | pudp = pud_offset(pgdp, tpc); | ||
400 | - if (pud_none(*pudp)) | ||
401 | - goto outret; | ||
402 | - pmdp = pmd_offset(pudp, tpc); | ||
403 | - if (pmd_none(*pmdp)) | ||
404 | - goto outret; | ||
405 | + if (pud_none(*pudp) || unlikely(pud_bad(*pudp))) | ||
406 | + goto out; | ||
407 | |||
408 | /* This disables preemption for us as well. */ | ||
409 | - __asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate)); | ||
410 | - __asm__ __volatile__("wrpr %0, %1, %%pstate" | ||
411 | - : : "r" (pstate), "i" (PSTATE_IE)); | ||
412 | - ptep = pte_offset_map(pmdp, tpc); | ||
413 | - pte = *ptep; | ||
414 | - if (!pte_present(pte)) | ||
415 | - goto out; | ||
416 | + local_irq_disable(); | ||
417 | + | ||
418 | + pmdp = pmd_offset(pudp, tpc); | ||
419 | + if (pmd_none(*pmdp) || unlikely(pmd_bad(*pmdp))) | ||
420 | + goto out_irq_enable; | ||
421 | |||
422 | - pa = (pte_pfn(pte) << PAGE_SHIFT); | ||
423 | - pa += (tpc & ~PAGE_MASK); | ||
424 | +#ifdef CONFIG_TRANSPARENT_HUGEPAGE | ||
425 | + if (pmd_trans_huge(*pmdp)) { | ||
426 | + if (pmd_trans_splitting(*pmdp)) | ||
427 | + goto out_irq_enable; | ||
428 | |||
429 | - /* Use phys bypass so we don't pollute dtlb/dcache. */ | ||
430 | - __asm__ __volatile__("lduwa [%1] %2, %0" | ||
431 | - : "=r" (insn) | ||
432 | - : "r" (pa), "i" (ASI_PHYS_USE_EC)); | ||
433 | + pa = pmd_pfn(*pmdp) << PAGE_SHIFT; | ||
434 | + pa += tpc & ~HPAGE_MASK; | ||
435 | |||
436 | + /* Use phys bypass so we don't pollute dtlb/dcache. */ | ||
437 | + __asm__ __volatile__("lduwa [%1] %2, %0" | ||
438 | + : "=r" (insn) | ||
439 | + : "r" (pa), "i" (ASI_PHYS_USE_EC)); | ||
440 | + } else | ||
441 | +#endif | ||
442 | + { | ||
443 | + ptep = pte_offset_map(pmdp, tpc); | ||
444 | + pte = *ptep; | ||
445 | + if (pte_present(pte)) { | ||
446 | + pa = (pte_pfn(pte) << PAGE_SHIFT); | ||
447 | + pa += (tpc & ~PAGE_MASK); | ||
448 | + | ||
449 | + /* Use phys bypass so we don't pollute dtlb/dcache. */ | ||
450 | + __asm__ __volatile__("lduwa [%1] %2, %0" | ||
451 | + : "=r" (insn) | ||
452 | + : "r" (pa), "i" (ASI_PHYS_USE_EC)); | ||
453 | + } | ||
454 | + pte_unmap(ptep); | ||
455 | + } | ||
456 | +out_irq_enable: | ||
457 | + local_irq_enable(); | ||
458 | out: | ||
459 | - pte_unmap(ptep); | ||
460 | - __asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate)); | ||
461 | -outret: | ||
462 | return insn; | ||
463 | } | ||
464 | |||
465 | @@ -153,7 +166,8 @@ show_signal_msg(struct pt_regs *regs, int sig, int code, | ||
466 | } | ||
467 | |||
468 | static void do_fault_siginfo(int code, int sig, struct pt_regs *regs, | ||
469 | - unsigned int insn, int fault_code) | ||
470 | + unsigned long fault_addr, unsigned int insn, | ||
471 | + int fault_code) | ||
472 | { | ||
473 | unsigned long addr; | ||
474 | siginfo_t info; | ||
475 | @@ -161,10 +175,18 @@ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs, | ||
476 | info.si_code = code; | ||
477 | info.si_signo = sig; | ||
478 | info.si_errno = 0; | ||
479 | - if (fault_code & FAULT_CODE_ITLB) | ||
480 | + if (fault_code & FAULT_CODE_ITLB) { | ||
481 | addr = regs->tpc; | ||
482 | - else | ||
483 | - addr = compute_effective_address(regs, insn, 0); | ||
484 | + } else { | ||
485 | + /* If we were able to probe the faulting instruction, use it | ||
486 | + * to compute a precise fault address. Otherwise use the fault | ||
487 | + * time provided address which may only have page granularity. | ||
488 | + */ | ||
489 | + if (insn) | ||
490 | + addr = compute_effective_address(regs, insn, 0); | ||
491 | + else | ||
492 | + addr = fault_addr; | ||
493 | + } | ||
494 | info.si_addr = (void __user *) addr; | ||
495 | info.si_trapno = 0; | ||
496 | |||
497 | @@ -239,7 +261,7 @@ static void __kprobes do_kernel_fault(struct pt_regs *regs, int si_code, | ||
498 | /* The si_code was set to make clear whether | ||
499 | * this was a SEGV_MAPERR or SEGV_ACCERR fault. | ||
500 | */ | ||
501 | - do_fault_siginfo(si_code, SIGSEGV, regs, insn, fault_code); | ||
502 | + do_fault_siginfo(si_code, SIGSEGV, regs, address, insn, fault_code); | ||
503 | return; | ||
504 | } | ||
505 | |||
506 | @@ -259,18 +281,6 @@ static void noinline __kprobes bogus_32bit_fault_tpc(struct pt_regs *regs) | ||
507 | show_regs(regs); | ||
508 | } | ||
509 | |||
510 | -static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs, | ||
511 | - unsigned long addr) | ||
512 | -{ | ||
513 | - static int times; | ||
514 | - | ||
515 | - if (times++ < 10) | ||
516 | - printk(KERN_ERR "FAULT[%s:%d]: 32-bit process " | ||
517 | - "reports 64-bit fault address [%lx]\n", | ||
518 | - current->comm, current->pid, addr); | ||
519 | - show_regs(regs); | ||
520 | -} | ||
521 | - | ||
522 | asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs) | ||
523 | { | ||
524 | enum ctx_state prev_state = exception_enter(); | ||
525 | @@ -300,10 +310,8 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs) | ||
526 | goto intr_or_no_mm; | ||
527 | } | ||
528 | } | ||
529 | - if (unlikely((address >> 32) != 0)) { | ||
530 | - bogus_32bit_fault_address(regs, address); | ||
531 | + if (unlikely((address >> 32) != 0)) | ||
532 | goto intr_or_no_mm; | ||
533 | - } | ||
534 | } | ||
535 | |||
536 | if (regs->tstate & TSTATE_PRIV) { | ||
537 | @@ -525,7 +533,7 @@ do_sigbus: | ||
538 | * Send a sigbus, regardless of whether we were in kernel | ||
539 | * or user mode. | ||
540 | */ | ||
541 | - do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, insn, fault_code); | ||
542 | + do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, address, insn, fault_code); | ||
543 | |||
544 | /* Kernel mode? Handle exceptions or die */ | ||
545 | if (regs->tstate & TSTATE_PRIV) | ||
546 | diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c | ||
547 | index c4d3da68b800..1aed0432c64b 100644 | ||
548 | --- a/arch/sparc/mm/gup.c | ||
549 | +++ b/arch/sparc/mm/gup.c | ||
550 | @@ -73,7 +73,7 @@ static int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr, | ||
551 | struct page *head, *page, *tail; | ||
552 | int refs; | ||
553 | |||
554 | - if (!pmd_large(pmd)) | ||
555 | + if (!(pmd_val(pmd) & _PAGE_VALID)) | ||
556 | return 0; | ||
557 | |||
558 | if (write && !pmd_write(pmd)) | ||
559 | diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c | ||
560 | index eafbc65c9c47..96862241b342 100644 | ||
561 | --- a/arch/sparc/mm/init_64.c | ||
562 | +++ b/arch/sparc/mm/init_64.c | ||
563 | @@ -350,6 +350,10 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t * | ||
564 | |||
565 | mm = vma->vm_mm; | ||
566 | |||
567 | + /* Don't insert a non-valid PTE into the TSB, we'll deadlock. */ | ||
568 | + if (!pte_accessible(mm, pte)) | ||
569 | + return; | ||
570 | + | ||
571 | spin_lock_irqsave(&mm->context.lock, flags); | ||
572 | |||
573 | #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) | ||
574 | @@ -588,7 +592,7 @@ static void __init remap_kernel(void) | ||
575 | int i, tlb_ent = sparc64_highest_locked_tlbent(); | ||
576 | |||
577 | tte_vaddr = (unsigned long) KERNBASE; | ||
578 | - phys_page = (prom_boot_mapping_phys_low >> 22UL) << 22UL; | ||
579 | + phys_page = (prom_boot_mapping_phys_low >> ILOG2_4MB) << ILOG2_4MB; | ||
580 | tte_data = kern_large_tte(phys_page); | ||
581 | |||
582 | kern_locked_tte_data = tte_data; | ||
583 | @@ -1881,7 +1885,7 @@ void __init paging_init(void) | ||
584 | |||
585 | BUILD_BUG_ON(NR_CPUS > 4096); | ||
586 | |||
587 | - kern_base = (prom_boot_mapping_phys_low >> 22UL) << 22UL; | ||
588 | + kern_base = (prom_boot_mapping_phys_low >> ILOG2_4MB) << ILOG2_4MB; | ||
589 | kern_size = (unsigned long)&_end - (unsigned long)KERNBASE; | ||
590 | |||
591 | /* Invalidate both kernel TSBs. */ | ||
592 | @@ -1937,7 +1941,7 @@ void __init paging_init(void) | ||
593 | shift = kern_base + PAGE_OFFSET - ((unsigned long)KERNBASE); | ||
594 | |||
595 | real_end = (unsigned long)_end; | ||
596 | - num_kernel_image_mappings = DIV_ROUND_UP(real_end - KERNBASE, 1 << 22); | ||
597 | + num_kernel_image_mappings = DIV_ROUND_UP(real_end - KERNBASE, 1 << ILOG2_4MB); | ||
598 | printk("Kernel: Using %d locked TLB entries for main kernel image.\n", | ||
599 | num_kernel_image_mappings); | ||
600 | |||
601 | @@ -2094,7 +2098,7 @@ static void __init setup_valid_addr_bitmap_from_pavail(unsigned long *bitmap) | ||
602 | |||
603 | if (new_start <= old_start && | ||
604 | new_end >= (old_start + PAGE_SIZE)) { | ||
605 | - set_bit(old_start >> 22, bitmap); | ||
606 | + set_bit(old_start >> ILOG2_4MB, bitmap); | ||
607 | goto do_next_page; | ||
608 | } | ||
609 | } | ||
610 | @@ -2143,7 +2147,7 @@ void __init mem_init(void) | ||
611 | addr = PAGE_OFFSET + kern_base; | ||
612 | last = PAGE_ALIGN(kern_size) + addr; | ||
613 | while (addr < last) { | ||
614 | - set_bit(__pa(addr) >> 22, sparc64_valid_addr_bitmap); | ||
615 | + set_bit(__pa(addr) >> ILOG2_4MB, sparc64_valid_addr_bitmap); | ||
616 | addr += PAGE_SIZE; | ||
617 | } | ||
618 | |||
619 | @@ -2267,7 +2271,7 @@ int __meminit vmemmap_populate(unsigned long vstart, unsigned long vend, | ||
620 | void *block; | ||
621 | |||
622 | if (!(*vmem_pp & _PAGE_VALID)) { | ||
623 | - block = vmemmap_alloc_block(1UL << 22, node); | ||
624 | + block = vmemmap_alloc_block(1UL << ILOG2_4MB, node); | ||
625 | if (!block) | ||
626 | return -ENOMEM; | ||
627 | |||
628 | @@ -2614,6 +2618,10 @@ void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr, | ||
629 | |||
630 | pte = pmd_val(entry); | ||
631 | |||
632 | + /* Don't insert a non-valid PMD into the TSB, we'll deadlock. */ | ||
633 | + if (!(pte & _PAGE_VALID)) | ||
634 | + return; | ||
635 | + | ||
636 | /* We are fabricating 8MB pages using 4MB real hw pages. */ | ||
637 | pte |= (addr & (1UL << REAL_HPAGE_SHIFT)); | ||
638 | |||
639 | @@ -2694,3 +2702,26 @@ void hugetlb_setup(struct pt_regs *regs) | ||
640 | } | ||
641 | } | ||
642 | #endif | ||
643 | + | ||
644 | +#ifdef CONFIG_SMP | ||
645 | +#define do_flush_tlb_kernel_range smp_flush_tlb_kernel_range | ||
646 | +#else | ||
647 | +#define do_flush_tlb_kernel_range __flush_tlb_kernel_range | ||
648 | +#endif | ||
649 | + | ||
650 | +void flush_tlb_kernel_range(unsigned long start, unsigned long end) | ||
651 | +{ | ||
652 | + if (start < HI_OBP_ADDRESS && end > LOW_OBP_ADDRESS) { | ||
653 | + if (start < LOW_OBP_ADDRESS) { | ||
654 | + flush_tsb_kernel_range(start, LOW_OBP_ADDRESS); | ||
655 | + do_flush_tlb_kernel_range(start, LOW_OBP_ADDRESS); | ||
656 | + } | ||
657 | + if (end > HI_OBP_ADDRESS) { | ||
658 | + flush_tsb_kernel_range(end, HI_OBP_ADDRESS); | ||
659 | + do_flush_tlb_kernel_range(end, HI_OBP_ADDRESS); | ||
660 | + } | ||
661 | + } else { | ||
662 | + flush_tsb_kernel_range(start, end); | ||
663 | + do_flush_tlb_kernel_range(start, end); | ||
664 | + } | ||
665 | +} | ||
666 | diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c | ||
667 | index b12cb5e72812..b89aba217e3b 100644 | ||
668 | --- a/arch/sparc/mm/tlb.c | ||
669 | +++ b/arch/sparc/mm/tlb.c | ||
670 | @@ -134,7 +134,7 @@ no_cache_flush: | ||
671 | |||
672 | #ifdef CONFIG_TRANSPARENT_HUGEPAGE | ||
673 | static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr, | ||
674 | - pmd_t pmd, bool exec) | ||
675 | + pmd_t pmd) | ||
676 | { | ||
677 | unsigned long end; | ||
678 | pte_t *pte; | ||
679 | @@ -142,8 +142,11 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr, | ||
680 | pte = pte_offset_map(&pmd, vaddr); | ||
681 | end = vaddr + HPAGE_SIZE; | ||
682 | while (vaddr < end) { | ||
683 | - if (pte_val(*pte) & _PAGE_VALID) | ||
684 | + if (pte_val(*pte) & _PAGE_VALID) { | ||
685 | + bool exec = pte_exec(*pte); | ||
686 | + | ||
687 | tlb_batch_add_one(mm, vaddr, exec); | ||
688 | + } | ||
689 | pte++; | ||
690 | vaddr += PAGE_SIZE; | ||
691 | } | ||
692 | @@ -177,19 +180,30 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr, | ||
693 | } | ||
694 | |||
695 | if (!pmd_none(orig)) { | ||
696 | - pte_t orig_pte = __pte(pmd_val(orig)); | ||
697 | - bool exec = pte_exec(orig_pte); | ||
698 | - | ||
699 | addr &= HPAGE_MASK; | ||
700 | if (pmd_trans_huge(orig)) { | ||
701 | + pte_t orig_pte = __pte(pmd_val(orig)); | ||
702 | + bool exec = pte_exec(orig_pte); | ||
703 | + | ||
704 | tlb_batch_add_one(mm, addr, exec); | ||
705 | tlb_batch_add_one(mm, addr + REAL_HPAGE_SIZE, exec); | ||
706 | } else { | ||
707 | - tlb_batch_pmd_scan(mm, addr, orig, exec); | ||
708 | + tlb_batch_pmd_scan(mm, addr, orig); | ||
709 | } | ||
710 | } | ||
711 | } | ||
712 | |||
713 | +void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, | ||
714 | + pmd_t *pmdp) | ||
715 | +{ | ||
716 | + pmd_t entry = *pmdp; | ||
717 | + | ||
718 | + pmd_val(entry) &= ~_PAGE_VALID; | ||
719 | + | ||
720 | + set_pmd_at(vma->vm_mm, address, pmdp, entry); | ||
721 | + flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE); | ||
722 | +} | ||
723 | + | ||
724 | void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp, | ||
725 | pgtable_t pgtable) | ||
726 | { | ||
727 | diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c | ||
728 | index f5d506fdddad..fe19b81acc09 100644 | ||
729 | --- a/arch/sparc/mm/tsb.c | ||
730 | +++ b/arch/sparc/mm/tsb.c | ||
731 | @@ -133,7 +133,19 @@ static void setup_tsb_params(struct mm_struct *mm, unsigned long tsb_idx, unsign | ||
732 | mm->context.tsb_block[tsb_idx].tsb_nentries = | ||
733 | tsb_bytes / sizeof(struct tsb); | ||
734 | |||
735 | - base = TSBMAP_BASE; | ||
736 | + switch (tsb_idx) { | ||
737 | + case MM_TSB_BASE: | ||
738 | + base = TSBMAP_8K_BASE; | ||
739 | + break; | ||
740 | +#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE) | ||
741 | + case MM_TSB_HUGE: | ||
742 | + base = TSBMAP_4M_BASE; | ||
743 | + break; | ||
744 | +#endif | ||
745 | + default: | ||
746 | + BUG(); | ||
747 | + } | ||
748 | + | ||
749 | tte = pgprot_val(PAGE_KERNEL_LOCKED); | ||
750 | tsb_paddr = __pa(mm->context.tsb_block[tsb_idx].tsb); | ||
751 | BUG_ON(tsb_paddr & (tsb_bytes - 1UL)); | ||
752 | diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | ||
753 | index 391f29ef6d2e..1fbeaa9dd202 100644 | ||
754 | --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | ||
755 | +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | ||
756 | @@ -337,6 +337,7 @@ struct sw_tx_bd { | ||
757 | u8 flags; | ||
758 | /* Set on the first BD descriptor when there is a split BD */ | ||
759 | #define BNX2X_TSO_SPLIT_BD (1<<0) | ||
760 | +#define BNX2X_HAS_SECOND_PBD (1<<1) | ||
761 | }; | ||
762 | |||
763 | struct sw_rx_page { | ||
764 | diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | ||
765 | index 5ed512473b12..afa4a1f63270 100644 | ||
766 | --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | ||
767 | +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | ||
768 | @@ -223,6 +223,12 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata, | ||
769 | --nbd; | ||
770 | bd_idx = TX_BD(NEXT_TX_IDX(bd_idx)); | ||
771 | |||
772 | + if (tx_buf->flags & BNX2X_HAS_SECOND_PBD) { | ||
773 | + /* Skip second parse bd... */ | ||
774 | + --nbd; | ||
775 | + bd_idx = TX_BD(NEXT_TX_IDX(bd_idx)); | ||
776 | + } | ||
777 | + | ||
778 | /* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */ | ||
779 | if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) { | ||
780 | tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd; | ||
781 | @@ -3868,6 +3874,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev) | ||
782 | /* set encapsulation flag in start BD */ | ||
783 | SET_FLAG(tx_start_bd->general_data, | ||
784 | ETH_TX_START_BD_TUNNEL_EXIST, 1); | ||
785 | + | ||
786 | + tx_buf->flags |= BNX2X_HAS_SECOND_PBD; | ||
787 | + | ||
788 | nbd++; | ||
789 | } else if (xmit_type & XMIT_CSUM) { | ||
790 | /* Set PBD in checksum offload case w/o encapsulation */ | ||
791 | diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c | ||
792 | index 4ad1187e82fb..669eeb4eb247 100644 | ||
793 | --- a/drivers/net/ethernet/brocade/bna/bnad.c | ||
794 | +++ b/drivers/net/ethernet/brocade/bna/bnad.c | ||
795 | @@ -600,9 +600,9 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget) | ||
796 | prefetch(bnad->netdev); | ||
797 | |||
798 | cq = ccb->sw_q; | ||
799 | - cmpl = &cq[ccb->producer_index]; | ||
800 | |||
801 | while (packets < budget) { | ||
802 | + cmpl = &cq[ccb->producer_index]; | ||
803 | if (!cmpl->valid) | ||
804 | break; | ||
805 | /* The 'valid' field is set by the adapter, only after writing | ||
806 | diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c | ||
807 | index 5adecc5f52b7..7f1abb7c18f2 100644 | ||
808 | --- a/drivers/net/macvlan.c | ||
809 | +++ b/drivers/net/macvlan.c | ||
810 | @@ -548,6 +548,7 @@ static int macvlan_init(struct net_device *dev) | ||
811 | (lowerdev->state & MACVLAN_STATE_MASK); | ||
812 | dev->features = lowerdev->features & MACVLAN_FEATURES; | ||
813 | dev->features |= ALWAYS_ON_FEATURES; | ||
814 | + dev->vlan_features = lowerdev->vlan_features & MACVLAN_FEATURES; | ||
815 | dev->gso_max_size = lowerdev->gso_max_size; | ||
816 | dev->iflink = lowerdev->ifindex; | ||
817 | dev->hard_header_len = lowerdev->hard_header_len; | ||
818 | diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c | ||
819 | index 365375408904..25f74191a788 100644 | ||
820 | --- a/drivers/net/phy/phy_device.c | ||
821 | +++ b/drivers/net/phy/phy_device.c | ||
822 | @@ -353,7 +353,7 @@ int phy_device_register(struct phy_device *phydev) | ||
823 | phydev->bus->phy_map[phydev->addr] = phydev; | ||
824 | |||
825 | /* Run all of the fixups for this PHY */ | ||
826 | - err = phy_init_hw(phydev); | ||
827 | + err = phy_scan_fixups(phydev); | ||
828 | if (err) { | ||
829 | pr_err("PHY %d failed to initialize\n", phydev->addr); | ||
830 | goto out; | ||
831 | diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c | ||
832 | index 01805319e1e0..1aff970be33e 100644 | ||
833 | --- a/drivers/net/ppp/pptp.c | ||
834 | +++ b/drivers/net/ppp/pptp.c | ||
835 | @@ -281,7 +281,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) | ||
836 | nf_reset(skb); | ||
837 | |||
838 | skb->ip_summed = CHECKSUM_NONE; | ||
839 | - ip_select_ident(skb, &rt->dst, NULL); | ||
840 | + ip_select_ident(skb, NULL); | ||
841 | ip_send_check(iph); | ||
842 | |||
843 | ip_local_out(skb); | ||
844 | diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c | ||
845 | index 160e7510aca6..0787b9756165 100644 | ||
846 | --- a/drivers/sbus/char/bbc_envctrl.c | ||
847 | +++ b/drivers/sbus/char/bbc_envctrl.c | ||
848 | @@ -452,6 +452,9 @@ static void attach_one_temp(struct bbc_i2c_bus *bp, struct platform_device *op, | ||
849 | if (!tp) | ||
850 | return; | ||
851 | |||
852 | + INIT_LIST_HEAD(&tp->bp_list); | ||
853 | + INIT_LIST_HEAD(&tp->glob_list); | ||
854 | + | ||
855 | tp->client = bbc_i2c_attach(bp, op); | ||
856 | if (!tp->client) { | ||
857 | kfree(tp); | ||
858 | @@ -497,6 +500,9 @@ static void attach_one_fan(struct bbc_i2c_bus *bp, struct platform_device *op, | ||
859 | if (!fp) | ||
860 | return; | ||
861 | |||
862 | + INIT_LIST_HEAD(&fp->bp_list); | ||
863 | + INIT_LIST_HEAD(&fp->glob_list); | ||
864 | + | ||
865 | fp->client = bbc_i2c_attach(bp, op); | ||
866 | if (!fp->client) { | ||
867 | kfree(fp); | ||
868 | diff --git a/drivers/sbus/char/bbc_i2c.c b/drivers/sbus/char/bbc_i2c.c | ||
869 | index c7763e482eb2..812b5f0361b6 100644 | ||
870 | --- a/drivers/sbus/char/bbc_i2c.c | ||
871 | +++ b/drivers/sbus/char/bbc_i2c.c | ||
872 | @@ -300,13 +300,18 @@ static struct bbc_i2c_bus * attach_one_i2c(struct platform_device *op, int index | ||
873 | if (!bp) | ||
874 | return NULL; | ||
875 | |||
876 | + INIT_LIST_HEAD(&bp->temps); | ||
877 | + INIT_LIST_HEAD(&bp->fans); | ||
878 | + | ||
879 | bp->i2c_control_regs = of_ioremap(&op->resource[0], 0, 0x2, "bbc_i2c_regs"); | ||
880 | if (!bp->i2c_control_regs) | ||
881 | goto fail; | ||
882 | |||
883 | - bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel"); | ||
884 | - if (!bp->i2c_bussel_reg) | ||
885 | - goto fail; | ||
886 | + if (op->num_resources == 2) { | ||
887 | + bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel"); | ||
888 | + if (!bp->i2c_bussel_reg) | ||
889 | + goto fail; | ||
890 | + } | ||
891 | |||
892 | bp->waiting = 0; | ||
893 | init_waitqueue_head(&bp->wq); | ||
894 | diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c | ||
895 | index 80a58eca785b..e8f77606561b 100644 | ||
896 | --- a/drivers/tty/serial/sunsab.c | ||
897 | +++ b/drivers/tty/serial/sunsab.c | ||
898 | @@ -157,6 +157,15 @@ receive_chars(struct uart_sunsab_port *up, | ||
899 | (up->port.line == up->port.cons->index)) | ||
900 | saw_console_brk = 1; | ||
901 | |||
902 | + if (count == 0) { | ||
903 | + if (unlikely(stat->sreg.isr1 & SAB82532_ISR1_BRK)) { | ||
904 | + stat->sreg.isr0 &= ~(SAB82532_ISR0_PERR | | ||
905 | + SAB82532_ISR0_FERR); | ||
906 | + up->port.icount.brk++; | ||
907 | + uart_handle_break(&up->port); | ||
908 | + } | ||
909 | + } | ||
910 | + | ||
911 | for (i = 0; i < count; i++) { | ||
912 | unsigned char ch = buf[i], flag; | ||
913 | |||
914 | diff --git a/fs/xfs/xfs_log.h b/fs/xfs/xfs_log.h | ||
915 | index b0f4ef77fa70..bf9781e9fd92 100644 | ||
916 | --- a/fs/xfs/xfs_log.h | ||
917 | +++ b/fs/xfs/xfs_log.h | ||
918 | @@ -24,7 +24,8 @@ struct xfs_log_vec { | ||
919 | struct xfs_log_iovec *lv_iovecp; /* iovec array */ | ||
920 | struct xfs_log_item *lv_item; /* owner */ | ||
921 | char *lv_buf; /* formatted buffer */ | ||
922 | - int lv_buf_len; /* size of formatted buffer */ | ||
923 | + int lv_bytes; /* accounted space in buffer */ | ||
924 | + int lv_buf_len; /* aligned size of buffer */ | ||
925 | int lv_size; /* size of allocated lv */ | ||
926 | }; | ||
927 | |||
928 | @@ -52,15 +53,21 @@ xlog_prepare_iovec(struct xfs_log_vec *lv, struct xfs_log_iovec **vecp, | ||
929 | return vec->i_addr; | ||
930 | } | ||
931 | |||
932 | +/* | ||
933 | + * We need to make sure the next buffer is naturally aligned for the biggest | ||
934 | + * basic data type we put into it. We already accounted for this padding when | ||
935 | + * sizing the buffer. | ||
936 | + * | ||
937 | + * However, this padding does not get written into the log, and hence we have to | ||
938 | + * track the space used by the log vectors separately to prevent log space hangs | ||
939 | + * due to inaccurate accounting (i.e. a leak) of the used log space through the | ||
940 | + * CIL context ticket. | ||
941 | + */ | ||
942 | static inline void | ||
943 | xlog_finish_iovec(struct xfs_log_vec *lv, struct xfs_log_iovec *vec, int len) | ||
944 | { | ||
945 | - /* | ||
946 | - * We need to make sure the next buffer is naturally aligned for the | ||
947 | - * biggest basic data type we put into it. We already accounted for | ||
948 | - * this when sizing the buffer. | ||
949 | - */ | ||
950 | lv->lv_buf_len += round_up(len, sizeof(uint64_t)); | ||
951 | + lv->lv_bytes += len; | ||
952 | vec->i_len = len; | ||
953 | } | ||
954 | |||
955 | diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c | ||
956 | index 4ef6fdbced78..bcfbaae4702c 100644 | ||
957 | --- a/fs/xfs/xfs_log_cil.c | ||
958 | +++ b/fs/xfs/xfs_log_cil.c | ||
959 | @@ -97,7 +97,7 @@ xfs_cil_prepare_item( | ||
960 | { | ||
961 | /* Account for the new LV being passed in */ | ||
962 | if (lv->lv_buf_len != XFS_LOG_VEC_ORDERED) { | ||
963 | - *diff_len += lv->lv_buf_len; | ||
964 | + *diff_len += lv->lv_bytes; | ||
965 | *diff_iovecs += lv->lv_niovecs; | ||
966 | } | ||
967 | |||
968 | @@ -111,7 +111,7 @@ xfs_cil_prepare_item( | ||
969 | else if (old_lv != lv) { | ||
970 | ASSERT(lv->lv_buf_len != XFS_LOG_VEC_ORDERED); | ||
971 | |||
972 | - *diff_len -= old_lv->lv_buf_len; | ||
973 | + *diff_len -= old_lv->lv_bytes; | ||
974 | *diff_iovecs -= old_lv->lv_niovecs; | ||
975 | kmem_free(old_lv); | ||
976 | } | ||
977 | @@ -239,7 +239,7 @@ xlog_cil_insert_format_items( | ||
978 | * that the space reservation accounting is correct. | ||
979 | */ | ||
980 | *diff_iovecs -= lv->lv_niovecs; | ||
981 | - *diff_len -= lv->lv_buf_len; | ||
982 | + *diff_len -= lv->lv_bytes; | ||
983 | } else { | ||
984 | /* allocate new data chunk */ | ||
985 | lv = kmem_zalloc(buf_size, KM_SLEEP|KM_NOFS); | ||
986 | @@ -259,6 +259,7 @@ xlog_cil_insert_format_items( | ||
987 | |||
988 | /* The allocated data region lies beyond the iovec region */ | ||
989 | lv->lv_buf_len = 0; | ||
990 | + lv->lv_bytes = 0; | ||
991 | lv->lv_buf = (char *)lv + buf_size - nbytes; | ||
992 | ASSERT(IS_ALIGNED((unsigned long)lv->lv_buf, sizeof(uint64_t))); | ||
993 | |||
994 | diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h | ||
995 | index 058271bde27a..823ec7bb9c67 100644 | ||
996 | --- a/include/net/inetpeer.h | ||
997 | +++ b/include/net/inetpeer.h | ||
998 | @@ -41,14 +41,13 @@ struct inet_peer { | ||
999 | struct rcu_head gc_rcu; | ||
1000 | }; | ||
1001 | /* | ||
1002 | - * Once inet_peer is queued for deletion (refcnt == -1), following fields | ||
1003 | - * are not available: rid, ip_id_count | ||
1004 | + * Once inet_peer is queued for deletion (refcnt == -1), following field | ||
1005 | + * is not available: rid | ||
1006 | * We can share memory with rcu_head to help keep inet_peer small. | ||
1007 | */ | ||
1008 | union { | ||
1009 | struct { | ||
1010 | atomic_t rid; /* Frag reception counter */ | ||
1011 | - atomic_t ip_id_count; /* IP ID for the next packet */ | ||
1012 | }; | ||
1013 | struct rcu_head rcu; | ||
1014 | struct inet_peer *gc_next; | ||
1015 | @@ -165,7 +164,7 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout); | ||
1016 | void inetpeer_invalidate_tree(struct inet_peer_base *); | ||
1017 | |||
1018 | /* | ||
1019 | - * temporary check to make sure we dont access rid, ip_id_count, tcp_ts, | ||
1020 | + * temporary check to make sure we dont access rid, tcp_ts, | ||
1021 | * tcp_ts_stamp if no refcount is taken on inet_peer | ||
1022 | */ | ||
1023 | static inline void inet_peer_refcheck(const struct inet_peer *p) | ||
1024 | @@ -173,13 +172,4 @@ static inline void inet_peer_refcheck(const struct inet_peer *p) | ||
1025 | WARN_ON_ONCE(atomic_read(&p->refcnt) <= 0); | ||
1026 | } | ||
1027 | |||
1028 | - | ||
1029 | -/* can be called with or without local BH being disabled */ | ||
1030 | -static inline int inet_getid(struct inet_peer *p, int more) | ||
1031 | -{ | ||
1032 | - more++; | ||
1033 | - inet_peer_refcheck(p); | ||
1034 | - return atomic_add_return(more, &p->ip_id_count) - more; | ||
1035 | -} | ||
1036 | - | ||
1037 | #endif /* _NET_INETPEER_H */ | ||
1038 | diff --git a/include/net/ip.h b/include/net/ip.h | ||
1039 | index 23be0fd37937..937f19681426 100644 | ||
1040 | --- a/include/net/ip.h | ||
1041 | +++ b/include/net/ip.h | ||
1042 | @@ -297,9 +297,10 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb) | ||
1043 | } | ||
1044 | } | ||
1045 | |||
1046 | -void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more); | ||
1047 | +u32 ip_idents_reserve(u32 hash, int segs); | ||
1048 | +void __ip_select_ident(struct iphdr *iph, int segs); | ||
1049 | |||
1050 | -static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk) | ||
1051 | +static inline void ip_select_ident_segs(struct sk_buff *skb, struct sock *sk, int segs) | ||
1052 | { | ||
1053 | struct iphdr *iph = ip_hdr(skb); | ||
1054 | |||
1055 | @@ -309,24 +310,20 @@ static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, s | ||
1056 | * does not change, they drop every other packet in | ||
1057 | * a TCP stream using header compression. | ||
1058 | */ | ||
1059 | - iph->id = (sk && inet_sk(sk)->inet_daddr) ? | ||
1060 | - htons(inet_sk(sk)->inet_id++) : 0; | ||
1061 | - } else | ||
1062 | - __ip_select_ident(iph, dst, 0); | ||
1063 | -} | ||
1064 | - | ||
1065 | -static inline void ip_select_ident_more(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk, int more) | ||
1066 | -{ | ||
1067 | - struct iphdr *iph = ip_hdr(skb); | ||
1068 | - | ||
1069 | - if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) { | ||
1070 | if (sk && inet_sk(sk)->inet_daddr) { | ||
1071 | iph->id = htons(inet_sk(sk)->inet_id); | ||
1072 | - inet_sk(sk)->inet_id += 1 + more; | ||
1073 | - } else | ||
1074 | + inet_sk(sk)->inet_id += segs; | ||
1075 | + } else { | ||
1076 | iph->id = 0; | ||
1077 | - } else | ||
1078 | - __ip_select_ident(iph, dst, more); | ||
1079 | + } | ||
1080 | + } else { | ||
1081 | + __ip_select_ident(iph, segs); | ||
1082 | + } | ||
1083 | +} | ||
1084 | + | ||
1085 | +static inline void ip_select_ident(struct sk_buff *skb, struct sock *sk) | ||
1086 | +{ | ||
1087 | + ip_select_ident_segs(skb, sk, 1); | ||
1088 | } | ||
1089 | |||
1090 | /* | ||
1091 | diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h | ||
1092 | index e77c10405d51..7b9ec5837496 100644 | ||
1093 | --- a/include/net/ip_tunnels.h | ||
1094 | +++ b/include/net/ip_tunnels.h | ||
1095 | @@ -40,6 +40,7 @@ struct ip_tunnel_prl_entry { | ||
1096 | |||
1097 | struct ip_tunnel_dst { | ||
1098 | struct dst_entry __rcu *dst; | ||
1099 | + __be32 saddr; | ||
1100 | }; | ||
1101 | |||
1102 | struct ip_tunnel { | ||
1103 | diff --git a/include/net/ipv6.h b/include/net/ipv6.h | ||
1104 | index 4f541f11ce63..9ac65781d44b 100644 | ||
1105 | --- a/include/net/ipv6.h | ||
1106 | +++ b/include/net/ipv6.h | ||
1107 | @@ -660,8 +660,6 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add | ||
1108 | return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr)); | ||
1109 | } | ||
1110 | |||
1111 | -void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt); | ||
1112 | - | ||
1113 | int ip6_dst_hoplimit(struct dst_entry *dst); | ||
1114 | |||
1115 | /* | ||
1116 | diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h | ||
1117 | index f257486f17be..3f36d45b714a 100644 | ||
1118 | --- a/include/net/secure_seq.h | ||
1119 | +++ b/include/net/secure_seq.h | ||
1120 | @@ -3,8 +3,6 @@ | ||
1121 | |||
1122 | #include <linux/types.h> | ||
1123 | |||
1124 | -__u32 secure_ip_id(__be32 daddr); | ||
1125 | -__u32 secure_ipv6_id(const __be32 daddr[4]); | ||
1126 | u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport); | ||
1127 | u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr, | ||
1128 | __be16 dport); | ||
1129 | diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c | ||
1130 | index cc1cfd60c094..c46387a46535 100644 | ||
1131 | --- a/net/batman-adv/fragmentation.c | ||
1132 | +++ b/net/batman-adv/fragmentation.c | ||
1133 | @@ -128,6 +128,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, | ||
1134 | { | ||
1135 | struct batadv_frag_table_entry *chain; | ||
1136 | struct batadv_frag_list_entry *frag_entry_new = NULL, *frag_entry_curr; | ||
1137 | + struct batadv_frag_list_entry *frag_entry_last = NULL; | ||
1138 | struct batadv_frag_packet *frag_packet; | ||
1139 | uint8_t bucket; | ||
1140 | uint16_t seqno, hdr_size = sizeof(struct batadv_frag_packet); | ||
1141 | @@ -180,11 +181,14 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node, | ||
1142 | ret = true; | ||
1143 | goto out; | ||
1144 | } | ||
1145 | + | ||
1146 | + /* store current entry because it could be the last in list */ | ||
1147 | + frag_entry_last = frag_entry_curr; | ||
1148 | } | ||
1149 | |||
1150 | - /* Reached the end of the list, so insert after 'frag_entry_curr'. */ | ||
1151 | - if (likely(frag_entry_curr)) { | ||
1152 | - hlist_add_after(&frag_entry_curr->list, &frag_entry_new->list); | ||
1153 | + /* Reached the end of the list, so insert after 'frag_entry_last'. */ | ||
1154 | + if (likely(frag_entry_last)) { | ||
1155 | + hlist_add_after(&frag_entry_last->list, &frag_entry_new->list); | ||
1156 | chain->size += skb->len - hdr_size; | ||
1157 | chain->timestamp = jiffies; | ||
1158 | ret = true; | ||
1159 | diff --git a/net/compat.c b/net/compat.c | ||
1160 | index f50161fb812e..cbc1a2a26587 100644 | ||
1161 | --- a/net/compat.c | ||
1162 | +++ b/net/compat.c | ||
1163 | @@ -85,7 +85,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov, | ||
1164 | { | ||
1165 | int tot_len; | ||
1166 | |||
1167 | - if (kern_msg->msg_namelen) { | ||
1168 | + if (kern_msg->msg_name && kern_msg->msg_namelen) { | ||
1169 | if (mode == VERIFY_READ) { | ||
1170 | int err = move_addr_to_kernel(kern_msg->msg_name, | ||
1171 | kern_msg->msg_namelen, | ||
1172 | @@ -93,10 +93,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov, | ||
1173 | if (err < 0) | ||
1174 | return err; | ||
1175 | } | ||
1176 | - if (kern_msg->msg_name) | ||
1177 | - kern_msg->msg_name = kern_address; | ||
1178 | - } else | ||
1179 | + kern_msg->msg_name = kern_address; | ||
1180 | + } else { | ||
1181 | kern_msg->msg_name = NULL; | ||
1182 | + kern_msg->msg_namelen = 0; | ||
1183 | + } | ||
1184 | |||
1185 | tot_len = iov_from_user_compat_to_kern(kern_iov, | ||
1186 | (struct compat_iovec __user *)kern_msg->msg_iov, | ||
1187 | diff --git a/net/core/iovec.c b/net/core/iovec.c | ||
1188 | index b61869429f4c..26dc0062652f 100644 | ||
1189 | --- a/net/core/iovec.c | ||
1190 | +++ b/net/core/iovec.c | ||
1191 | @@ -39,7 +39,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a | ||
1192 | { | ||
1193 | int size, ct, err; | ||
1194 | |||
1195 | - if (m->msg_namelen) { | ||
1196 | + if (m->msg_name && m->msg_namelen) { | ||
1197 | if (mode == VERIFY_READ) { | ||
1198 | void __user *namep; | ||
1199 | namep = (void __user __force *) m->msg_name; | ||
1200 | @@ -48,10 +48,10 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a | ||
1201 | if (err < 0) | ||
1202 | return err; | ||
1203 | } | ||
1204 | - if (m->msg_name) | ||
1205 | - m->msg_name = address; | ||
1206 | + m->msg_name = address; | ||
1207 | } else { | ||
1208 | m->msg_name = NULL; | ||
1209 | + m->msg_namelen = 0; | ||
1210 | } | ||
1211 | |||
1212 | size = m->msg_iovlen * sizeof(struct iovec); | ||
1213 | @@ -107,6 +107,10 @@ EXPORT_SYMBOL(memcpy_toiovecend); | ||
1214 | int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov, | ||
1215 | int offset, int len) | ||
1216 | { | ||
1217 | + /* No data? Done! */ | ||
1218 | + if (len == 0) | ||
1219 | + return 0; | ||
1220 | + | ||
1221 | /* Skip over the finished iovecs */ | ||
1222 | while (offset >= iov->iov_len) { | ||
1223 | offset -= iov->iov_len; | ||
1224 | diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c | ||
1225 | index 897da56f3aff..ba71212f0251 100644 | ||
1226 | --- a/net/core/secure_seq.c | ||
1227 | +++ b/net/core/secure_seq.c | ||
1228 | @@ -85,31 +85,6 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral); | ||
1229 | #endif | ||
1230 | |||
1231 | #ifdef CONFIG_INET | ||
1232 | -__u32 secure_ip_id(__be32 daddr) | ||
1233 | -{ | ||
1234 | - u32 hash[MD5_DIGEST_WORDS]; | ||
1235 | - | ||
1236 | - net_secret_init(); | ||
1237 | - hash[0] = (__force __u32) daddr; | ||
1238 | - hash[1] = net_secret[13]; | ||
1239 | - hash[2] = net_secret[14]; | ||
1240 | - hash[3] = net_secret[15]; | ||
1241 | - | ||
1242 | - md5_transform(hash, net_secret); | ||
1243 | - | ||
1244 | - return hash[0]; | ||
1245 | -} | ||
1246 | - | ||
1247 | -__u32 secure_ipv6_id(const __be32 daddr[4]) | ||
1248 | -{ | ||
1249 | - __u32 hash[4]; | ||
1250 | - | ||
1251 | - net_secret_init(); | ||
1252 | - memcpy(hash, daddr, 16); | ||
1253 | - md5_transform(hash, net_secret); | ||
1254 | - | ||
1255 | - return hash[0]; | ||
1256 | -} | ||
1257 | |||
1258 | __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr, | ||
1259 | __be16 sport, __be16 dport) | ||
1260 | diff --git a/net/core/skbuff.c b/net/core/skbuff.c | ||
1261 | index 7f2e1fce706e..8f6391bbf509 100644 | ||
1262 | --- a/net/core/skbuff.c | ||
1263 | +++ b/net/core/skbuff.c | ||
1264 | @@ -2968,9 +2968,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, | ||
1265 | tail = nskb; | ||
1266 | |||
1267 | __copy_skb_header(nskb, head_skb); | ||
1268 | - nskb->mac_len = head_skb->mac_len; | ||
1269 | |||
1270 | skb_headers_offset_update(nskb, skb_headroom(nskb) - headroom); | ||
1271 | + skb_reset_mac_len(nskb); | ||
1272 | |||
1273 | skb_copy_from_linear_data_offset(head_skb, -tnl_hlen, | ||
1274 | nskb->data - tnl_hlen, | ||
1275 | diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c | ||
1276 | index 9db3b877fcaf..0ffcd4d64e0a 100644 | ||
1277 | --- a/net/ipv4/igmp.c | ||
1278 | +++ b/net/ipv4/igmp.c | ||
1279 | @@ -369,7 +369,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size) | ||
1280 | pip->saddr = fl4.saddr; | ||
1281 | pip->protocol = IPPROTO_IGMP; | ||
1282 | pip->tot_len = 0; /* filled in later */ | ||
1283 | - ip_select_ident(skb, &rt->dst, NULL); | ||
1284 | + ip_select_ident(skb, NULL); | ||
1285 | ((u8 *)&pip[1])[0] = IPOPT_RA; | ||
1286 | ((u8 *)&pip[1])[1] = 4; | ||
1287 | ((u8 *)&pip[1])[2] = 0; | ||
1288 | @@ -714,7 +714,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc, | ||
1289 | iph->daddr = dst; | ||
1290 | iph->saddr = fl4.saddr; | ||
1291 | iph->protocol = IPPROTO_IGMP; | ||
1292 | - ip_select_ident(skb, &rt->dst, NULL); | ||
1293 | + ip_select_ident(skb, NULL); | ||
1294 | ((u8 *)&iph[1])[0] = IPOPT_RA; | ||
1295 | ((u8 *)&iph[1])[1] = 4; | ||
1296 | ((u8 *)&iph[1])[2] = 0; | ||
1297 | diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c | ||
1298 | index 48f424465112..bf2cb4a4714b 100644 | ||
1299 | --- a/net/ipv4/inetpeer.c | ||
1300 | +++ b/net/ipv4/inetpeer.c | ||
1301 | @@ -26,20 +26,7 @@ | ||
1302 | * Theory of operations. | ||
1303 | * We keep one entry for each peer IP address. The nodes contains long-living | ||
1304 | * information about the peer which doesn't depend on routes. | ||
1305 | - * At this moment this information consists only of ID field for the next | ||
1306 | - * outgoing IP packet. This field is incremented with each packet as encoded | ||
1307 | - * in inet_getid() function (include/net/inetpeer.h). | ||
1308 | - * At the moment of writing this notes identifier of IP packets is generated | ||
1309 | - * to be unpredictable using this code only for packets subjected | ||
1310 | - * (actually or potentially) to defragmentation. I.e. DF packets less than | ||
1311 | - * PMTU in size when local fragmentation is disabled use a constant ID and do | ||
1312 | - * not use this code (see ip_select_ident() in include/net/ip.h). | ||
1313 | * | ||
1314 | - * Route cache entries hold references to our nodes. | ||
1315 | - * New cache entries get references via lookup by destination IP address in | ||
1316 | - * the avl tree. The reference is grabbed only when it's needed i.e. only | ||
1317 | - * when we try to output IP packet which needs an unpredictable ID (see | ||
1318 | - * __ip_select_ident() in net/ipv4/route.c). | ||
1319 | * Nodes are removed only when reference counter goes to 0. | ||
1320 | * When it's happened the node may be removed when a sufficient amount of | ||
1321 | * time has been passed since its last use. The less-recently-used entry can | ||
1322 | @@ -62,7 +49,6 @@ | ||
1323 | * refcnt: atomically against modifications on other CPU; | ||
1324 | * usually under some other lock to prevent node disappearing | ||
1325 | * daddr: unchangeable | ||
1326 | - * ip_id_count: atomic value (no lock needed) | ||
1327 | */ | ||
1328 | |||
1329 | static struct kmem_cache *peer_cachep __read_mostly; | ||
1330 | @@ -497,10 +483,6 @@ relookup: | ||
1331 | p->daddr = *daddr; | ||
1332 | atomic_set(&p->refcnt, 1); | ||
1333 | atomic_set(&p->rid, 0); | ||
1334 | - atomic_set(&p->ip_id_count, | ||
1335 | - (daddr->family == AF_INET) ? | ||
1336 | - secure_ip_id(daddr->addr.a4) : | ||
1337 | - secure_ipv6_id(daddr->addr.a6)); | ||
1338 | p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW; | ||
1339 | p->rate_tokens = 0; | ||
1340 | /* 60*HZ is arbitrary, but chosen enough high so that the first | ||
1341 | diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c | ||
1342 | index 73c6b63bba74..ed88d781248f 100644 | ||
1343 | --- a/net/ipv4/ip_output.c | ||
1344 | +++ b/net/ipv4/ip_output.c | ||
1345 | @@ -148,7 +148,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk, | ||
1346 | iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr); | ||
1347 | iph->saddr = saddr; | ||
1348 | iph->protocol = sk->sk_protocol; | ||
1349 | - ip_select_ident(skb, &rt->dst, sk); | ||
1350 | + ip_select_ident(skb, sk); | ||
1351 | |||
1352 | if (opt && opt->opt.optlen) { | ||
1353 | iph->ihl += opt->opt.optlen>>2; | ||
1354 | @@ -386,8 +386,7 @@ packet_routed: | ||
1355 | ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0); | ||
1356 | } | ||
1357 | |||
1358 | - ip_select_ident_more(skb, &rt->dst, sk, | ||
1359 | - (skb_shinfo(skb)->gso_segs ?: 1) - 1); | ||
1360 | + ip_select_ident_segs(skb, sk, skb_shinfo(skb)->gso_segs ?: 1); | ||
1361 | |||
1362 | skb->priority = sk->sk_priority; | ||
1363 | skb->mark = sk->sk_mark; | ||
1364 | @@ -1338,7 +1337,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk, | ||
1365 | iph->ttl = ttl; | ||
1366 | iph->protocol = sk->sk_protocol; | ||
1367 | ip_copy_addrs(iph, fl4); | ||
1368 | - ip_select_ident(skb, &rt->dst, sk); | ||
1369 | + ip_select_ident(skb, sk); | ||
1370 | |||
1371 | if (opt) { | ||
1372 | iph->ihl += opt->optlen>>2; | ||
1373 | diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c | ||
1374 | index 62cd9e0ae35b..0a4af0920af3 100644 | ||
1375 | --- a/net/ipv4/ip_tunnel.c | ||
1376 | +++ b/net/ipv4/ip_tunnel.c | ||
1377 | @@ -69,23 +69,25 @@ static unsigned int ip_tunnel_hash(__be32 key, __be32 remote) | ||
1378 | } | ||
1379 | |||
1380 | static void __tunnel_dst_set(struct ip_tunnel_dst *idst, | ||
1381 | - struct dst_entry *dst) | ||
1382 | + struct dst_entry *dst, __be32 saddr) | ||
1383 | { | ||
1384 | struct dst_entry *old_dst; | ||
1385 | |||
1386 | dst_clone(dst); | ||
1387 | old_dst = xchg((__force struct dst_entry **)&idst->dst, dst); | ||
1388 | dst_release(old_dst); | ||
1389 | + idst->saddr = saddr; | ||
1390 | } | ||
1391 | |||
1392 | -static void tunnel_dst_set(struct ip_tunnel *t, struct dst_entry *dst) | ||
1393 | +static void tunnel_dst_set(struct ip_tunnel *t, | ||
1394 | + struct dst_entry *dst, __be32 saddr) | ||
1395 | { | ||
1396 | - __tunnel_dst_set(this_cpu_ptr(t->dst_cache), dst); | ||
1397 | + __tunnel_dst_set(this_cpu_ptr(t->dst_cache), dst, saddr); | ||
1398 | } | ||
1399 | |||
1400 | static void tunnel_dst_reset(struct ip_tunnel *t) | ||
1401 | { | ||
1402 | - tunnel_dst_set(t, NULL); | ||
1403 | + tunnel_dst_set(t, NULL, 0); | ||
1404 | } | ||
1405 | |||
1406 | void ip_tunnel_dst_reset_all(struct ip_tunnel *t) | ||
1407 | @@ -93,20 +95,25 @@ void ip_tunnel_dst_reset_all(struct ip_tunnel *t) | ||
1408 | int i; | ||
1409 | |||
1410 | for_each_possible_cpu(i) | ||
1411 | - __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL); | ||
1412 | + __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL, 0); | ||
1413 | } | ||
1414 | EXPORT_SYMBOL(ip_tunnel_dst_reset_all); | ||
1415 | |||
1416 | -static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie) | ||
1417 | +static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, | ||
1418 | + u32 cookie, __be32 *saddr) | ||
1419 | { | ||
1420 | + struct ip_tunnel_dst *idst; | ||
1421 | struct dst_entry *dst; | ||
1422 | |||
1423 | rcu_read_lock(); | ||
1424 | - dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst); | ||
1425 | + idst = this_cpu_ptr(t->dst_cache); | ||
1426 | + dst = rcu_dereference(idst->dst); | ||
1427 | if (dst && !atomic_inc_not_zero(&dst->__refcnt)) | ||
1428 | dst = NULL; | ||
1429 | if (dst) { | ||
1430 | - if (dst->obsolete && dst->ops->check(dst, cookie) == NULL) { | ||
1431 | + if (!dst->obsolete || dst->ops->check(dst, cookie)) { | ||
1432 | + *saddr = idst->saddr; | ||
1433 | + } else { | ||
1434 | tunnel_dst_reset(t); | ||
1435 | dst_release(dst); | ||
1436 | dst = NULL; | ||
1437 | @@ -362,7 +369,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev) | ||
1438 | |||
1439 | if (!IS_ERR(rt)) { | ||
1440 | tdev = rt->dst.dev; | ||
1441 | - tunnel_dst_set(tunnel, &rt->dst); | ||
1442 | + tunnel_dst_set(tunnel, &rt->dst, fl4.saddr); | ||
1443 | ip_rt_put(rt); | ||
1444 | } | ||
1445 | if (dev->type != ARPHRD_ETHER) | ||
1446 | @@ -606,7 +613,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, | ||
1447 | init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr, | ||
1448 | tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link); | ||
1449 | |||
1450 | - rt = connected ? tunnel_rtable_get(tunnel, 0) : NULL; | ||
1451 | + rt = connected ? tunnel_rtable_get(tunnel, 0, &fl4.saddr) : NULL; | ||
1452 | |||
1453 | if (!rt) { | ||
1454 | rt = ip_route_output_key(tunnel->net, &fl4); | ||
1455 | @@ -616,7 +623,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, | ||
1456 | goto tx_error; | ||
1457 | } | ||
1458 | if (connected) | ||
1459 | - tunnel_dst_set(tunnel, &rt->dst); | ||
1460 | + tunnel_dst_set(tunnel, &rt->dst, fl4.saddr); | ||
1461 | } | ||
1462 | |||
1463 | if (rt->dst.dev == dev) { | ||
1464 | diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c | ||
1465 | index 8d69626f2206..65b664d30fa1 100644 | ||
1466 | --- a/net/ipv4/ip_tunnel_core.c | ||
1467 | +++ b/net/ipv4/ip_tunnel_core.c | ||
1468 | @@ -74,7 +74,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb, | ||
1469 | iph->daddr = dst; | ||
1470 | iph->saddr = src; | ||
1471 | iph->ttl = ttl; | ||
1472 | - __ip_select_ident(iph, &rt->dst, (skb_shinfo(skb)->gso_segs ?: 1) - 1); | ||
1473 | + __ip_select_ident(iph, skb_shinfo(skb)->gso_segs ?: 1); | ||
1474 | |||
1475 | err = ip_local_out(skb); | ||
1476 | if (unlikely(net_xmit_eval(err))) | ||
1477 | diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c | ||
1478 | index 28863570dd60..1149fc2290e2 100644 | ||
1479 | --- a/net/ipv4/ipmr.c | ||
1480 | +++ b/net/ipv4/ipmr.c | ||
1481 | @@ -1663,7 +1663,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr) | ||
1482 | iph->protocol = IPPROTO_IPIP; | ||
1483 | iph->ihl = 5; | ||
1484 | iph->tot_len = htons(skb->len); | ||
1485 | - ip_select_ident(skb, skb_dst(skb), NULL); | ||
1486 | + ip_select_ident(skb, NULL); | ||
1487 | ip_send_check(iph); | ||
1488 | |||
1489 | memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); | ||
1490 | diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c | ||
1491 | index c04518f4850a..11c8d81fdc59 100644 | ||
1492 | --- a/net/ipv4/raw.c | ||
1493 | +++ b/net/ipv4/raw.c | ||
1494 | @@ -389,7 +389,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4, | ||
1495 | iph->check = 0; | ||
1496 | iph->tot_len = htons(length); | ||
1497 | if (!iph->id) | ||
1498 | - ip_select_ident(skb, &rt->dst, NULL); | ||
1499 | + ip_select_ident(skb, NULL); | ||
1500 | |||
1501 | iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl); | ||
1502 | } | ||
1503 | diff --git a/net/ipv4/route.c b/net/ipv4/route.c | ||
1504 | index 031553f8a306..ca5a01ed8ed6 100644 | ||
1505 | --- a/net/ipv4/route.c | ||
1506 | +++ b/net/ipv4/route.c | ||
1507 | @@ -89,6 +89,7 @@ | ||
1508 | #include <linux/rcupdate.h> | ||
1509 | #include <linux/times.h> | ||
1510 | #include <linux/slab.h> | ||
1511 | +#include <linux/jhash.h> | ||
1512 | #include <net/dst.h> | ||
1513 | #include <net/net_namespace.h> | ||
1514 | #include <net/protocol.h> | ||
1515 | @@ -462,39 +463,45 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst, | ||
1516 | return neigh_create(&arp_tbl, pkey, dev); | ||
1517 | } | ||
1518 | |||
1519 | -/* | ||
1520 | - * Peer allocation may fail only in serious out-of-memory conditions. However | ||
1521 | - * we still can generate some output. | ||
1522 | - * Random ID selection looks a bit dangerous because we have no chances to | ||
1523 | - * select ID being unique in a reasonable period of time. | ||
1524 | - * But broken packet identifier may be better than no packet at all. | ||
1525 | +#define IP_IDENTS_SZ 2048u | ||
1526 | +struct ip_ident_bucket { | ||
1527 | + atomic_t id; | ||
1528 | + u32 stamp32; | ||
1529 | +}; | ||
1530 | + | ||
1531 | +static struct ip_ident_bucket *ip_idents __read_mostly; | ||
1532 | + | ||
1533 | +/* In order to protect privacy, we add a perturbation to identifiers | ||
1534 | + * if one generator is seldom used. This makes hard for an attacker | ||
1535 | + * to infer how many packets were sent between two points in time. | ||
1536 | */ | ||
1537 | -static void ip_select_fb_ident(struct iphdr *iph) | ||
1538 | +u32 ip_idents_reserve(u32 hash, int segs) | ||
1539 | { | ||
1540 | - static DEFINE_SPINLOCK(ip_fb_id_lock); | ||
1541 | - static u32 ip_fallback_id; | ||
1542 | - u32 salt; | ||
1543 | + struct ip_ident_bucket *bucket = ip_idents + hash % IP_IDENTS_SZ; | ||
1544 | + u32 old = ACCESS_ONCE(bucket->stamp32); | ||
1545 | + u32 now = (u32)jiffies; | ||
1546 | + u32 delta = 0; | ||
1547 | + | ||
1548 | + if (old != now && cmpxchg(&bucket->stamp32, old, now) == old) | ||
1549 | + delta = prandom_u32_max(now - old); | ||
1550 | |||
1551 | - spin_lock_bh(&ip_fb_id_lock); | ||
1552 | - salt = secure_ip_id((__force __be32)ip_fallback_id ^ iph->daddr); | ||
1553 | - iph->id = htons(salt & 0xFFFF); | ||
1554 | - ip_fallback_id = salt; | ||
1555 | - spin_unlock_bh(&ip_fb_id_lock); | ||
1556 | + return atomic_add_return(segs + delta, &bucket->id) - segs; | ||
1557 | } | ||
1558 | +EXPORT_SYMBOL(ip_idents_reserve); | ||
1559 | |||
1560 | -void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more) | ||
1561 | +void __ip_select_ident(struct iphdr *iph, int segs) | ||
1562 | { | ||
1563 | - struct net *net = dev_net(dst->dev); | ||
1564 | - struct inet_peer *peer; | ||
1565 | + static u32 ip_idents_hashrnd __read_mostly; | ||
1566 | + u32 hash, id; | ||
1567 | |||
1568 | - peer = inet_getpeer_v4(net->ipv4.peers, iph->daddr, 1); | ||
1569 | - if (peer) { | ||
1570 | - iph->id = htons(inet_getid(peer, more)); | ||
1571 | - inet_putpeer(peer); | ||
1572 | - return; | ||
1573 | - } | ||
1574 | + net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd)); | ||
1575 | |||
1576 | - ip_select_fb_ident(iph); | ||
1577 | + hash = jhash_3words((__force u32)iph->daddr, | ||
1578 | + (__force u32)iph->saddr, | ||
1579 | + iph->protocol, | ||
1580 | + ip_idents_hashrnd); | ||
1581 | + id = ip_idents_reserve(hash, segs); | ||
1582 | + iph->id = htons(id); | ||
1583 | } | ||
1584 | EXPORT_SYMBOL(__ip_select_ident); | ||
1585 | |||
1586 | @@ -2718,6 +2725,12 @@ int __init ip_rt_init(void) | ||
1587 | { | ||
1588 | int rc = 0; | ||
1589 | |||
1590 | + ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL); | ||
1591 | + if (!ip_idents) | ||
1592 | + panic("IP: failed to allocate ip_idents\n"); | ||
1593 | + | ||
1594 | + prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents)); | ||
1595 | + | ||
1596 | #ifdef CONFIG_IP_ROUTE_CLASSID | ||
1597 | ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct)); | ||
1598 | if (!ip_rt_acct) | ||
1599 | diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c | ||
1600 | index 06cae62bf208..6b1a5fd60598 100644 | ||
1601 | --- a/net/ipv4/tcp_vegas.c | ||
1602 | +++ b/net/ipv4/tcp_vegas.c | ||
1603 | @@ -219,7 +219,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked, | ||
1604 | * This is: | ||
1605 | * (actual rate in segments) * baseRTT | ||
1606 | */ | ||
1607 | - target_cwnd = tp->snd_cwnd * vegas->baseRTT / rtt; | ||
1608 | + target_cwnd = (u64)tp->snd_cwnd * vegas->baseRTT; | ||
1609 | + do_div(target_cwnd, rtt); | ||
1610 | |||
1611 | /* Calculate the difference between the window we had, | ||
1612 | * and the window we would like to have. This quantity | ||
1613 | diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c | ||
1614 | index 326475a94865..603ad498e18a 100644 | ||
1615 | --- a/net/ipv4/tcp_veno.c | ||
1616 | +++ b/net/ipv4/tcp_veno.c | ||
1617 | @@ -145,7 +145,7 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 acked, | ||
1618 | |||
1619 | rtt = veno->minrtt; | ||
1620 | |||
1621 | - target_cwnd = (tp->snd_cwnd * veno->basertt); | ||
1622 | + target_cwnd = (u64)tp->snd_cwnd * veno->basertt; | ||
1623 | target_cwnd <<= V_PARAM_SHIFT; | ||
1624 | do_div(target_cwnd, rtt); | ||
1625 | |||
1626 | diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c | ||
1627 | index 31b18152528f..1f564a1487a3 100644 | ||
1628 | --- a/net/ipv4/xfrm4_mode_tunnel.c | ||
1629 | +++ b/net/ipv4/xfrm4_mode_tunnel.c | ||
1630 | @@ -117,12 +117,12 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb) | ||
1631 | |||
1632 | top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ? | ||
1633 | 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF)); | ||
1634 | - ip_select_ident(skb, dst->child, NULL); | ||
1635 | |||
1636 | top_iph->ttl = ip4_dst_hoplimit(dst->child); | ||
1637 | |||
1638 | top_iph->saddr = x->props.saddr.a4; | ||
1639 | top_iph->daddr = x->id.daddr.a4; | ||
1640 | + ip_select_ident(skb, NULL); | ||
1641 | |||
1642 | return 0; | ||
1643 | } | ||
1644 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c | ||
1645 | index a62b610307ec..073e5a6fc631 100644 | ||
1646 | --- a/net/ipv6/ip6_output.c | ||
1647 | +++ b/net/ipv6/ip6_output.c | ||
1648 | @@ -537,6 +537,20 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from) | ||
1649 | skb_copy_secmark(to, from); | ||
1650 | } | ||
1651 | |||
1652 | +static void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) | ||
1653 | +{ | ||
1654 | + static u32 ip6_idents_hashrnd __read_mostly; | ||
1655 | + u32 hash, id; | ||
1656 | + | ||
1657 | + net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd)); | ||
1658 | + | ||
1659 | + hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd); | ||
1660 | + hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash); | ||
1661 | + | ||
1662 | + id = ip_idents_reserve(hash, 1); | ||
1663 | + fhdr->identification = htonl(id); | ||
1664 | +} | ||
1665 | + | ||
1666 | int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) | ||
1667 | { | ||
1668 | struct sk_buff *frag; | ||
1669 | diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c | ||
1670 | index b31a01263185..798eb0f79078 100644 | ||
1671 | --- a/net/ipv6/output_core.c | ||
1672 | +++ b/net/ipv6/output_core.c | ||
1673 | @@ -7,29 +7,6 @@ | ||
1674 | #include <net/ip6_fib.h> | ||
1675 | #include <net/addrconf.h> | ||
1676 | |||
1677 | -void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) | ||
1678 | -{ | ||
1679 | - static atomic_t ipv6_fragmentation_id; | ||
1680 | - int ident; | ||
1681 | - | ||
1682 | -#if IS_ENABLED(CONFIG_IPV6) | ||
1683 | - if (rt && !(rt->dst.flags & DST_NOPEER)) { | ||
1684 | - struct inet_peer *peer; | ||
1685 | - struct net *net; | ||
1686 | - | ||
1687 | - net = dev_net(rt->dst.dev); | ||
1688 | - peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1); | ||
1689 | - if (peer) { | ||
1690 | - fhdr->identification = htonl(inet_getid(peer, 0)); | ||
1691 | - inet_putpeer(peer); | ||
1692 | - return; | ||
1693 | - } | ||
1694 | - } | ||
1695 | -#endif | ||
1696 | - ident = atomic_inc_return(&ipv6_fragmentation_id); | ||
1697 | - fhdr->identification = htonl(ident); | ||
1698 | -} | ||
1699 | -EXPORT_SYMBOL(ipv6_select_ident); | ||
1700 | |||
1701 | int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) | ||
1702 | { | ||
1703 | diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c | ||
1704 | index c47444e4cf8c..7f0e1cf2d7e8 100644 | ||
1705 | --- a/net/netfilter/ipvs/ip_vs_xmit.c | ||
1706 | +++ b/net/netfilter/ipvs/ip_vs_xmit.c | ||
1707 | @@ -883,7 +883,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, | ||
1708 | iph->daddr = cp->daddr.ip; | ||
1709 | iph->saddr = saddr; | ||
1710 | iph->ttl = old_iph->ttl; | ||
1711 | - ip_select_ident(skb, &rt->dst, NULL); | ||
1712 | + ip_select_ident(skb, NULL); | ||
1713 | |||
1714 | /* Another hack: avoid icmp_send in ip_fragment */ | ||
1715 | skb->local_df = 1; | ||
1716 | diff --git a/net/sctp/associola.c b/net/sctp/associola.c | ||
1717 | index a4d570126f5d..5d97d8fe4be7 100644 | ||
1718 | --- a/net/sctp/associola.c | ||
1719 | +++ b/net/sctp/associola.c | ||
1720 | @@ -1151,6 +1151,7 @@ void sctp_assoc_update(struct sctp_association *asoc, | ||
1721 | asoc->c = new->c; | ||
1722 | asoc->peer.rwnd = new->peer.rwnd; | ||
1723 | asoc->peer.sack_needed = new->peer.sack_needed; | ||
1724 | + asoc->peer.auth_capable = new->peer.auth_capable; | ||
1725 | asoc->peer.i = new->peer.i; | ||
1726 | sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL, | ||
1727 | asoc->peer.i.initial_tsn, GFP_ATOMIC); | ||
1728 | diff --git a/net/sctp/output.c b/net/sctp/output.c | ||
1729 | index 0f4d15fc2627..8267b06c3646 100644 | ||
1730 | --- a/net/sctp/output.c | ||
1731 | +++ b/net/sctp/output.c | ||
1732 | @@ -599,7 +599,7 @@ out: | ||
1733 | return err; | ||
1734 | no_route: | ||
1735 | kfree_skb(nskb); | ||
1736 | - IP_INC_STATS_BH(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES); | ||
1737 | + IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES); | ||
1738 | |||
1739 | /* FIXME: Returning the 'err' will effect all the associations | ||
1740 | * associated with a socket, although only one of the paths of the | ||
1741 | diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c | ||
1742 | index b10d04fa3933..3bea4ddc699d 100644 | ||
1743 | --- a/net/xfrm/xfrm_user.c | ||
1744 | +++ b/net/xfrm/xfrm_user.c | ||
1745 | @@ -176,9 +176,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, | ||
1746 | attrs[XFRMA_ALG_AEAD] || | ||
1747 | attrs[XFRMA_ALG_CRYPT] || | ||
1748 | attrs[XFRMA_ALG_COMP] || | ||
1749 | - attrs[XFRMA_TFCPAD] || | ||
1750 | - (ntohl(p->id.spi) >= 0x10000)) | ||
1751 | - | ||
1752 | + attrs[XFRMA_TFCPAD]) | ||
1753 | goto out; | ||
1754 | break; | ||
1755 | |||
1756 | @@ -206,7 +204,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, | ||
1757 | attrs[XFRMA_ALG_AUTH] || | ||
1758 | attrs[XFRMA_ALG_AUTH_TRUNC] || | ||
1759 | attrs[XFRMA_ALG_CRYPT] || | ||
1760 | - attrs[XFRMA_TFCPAD]) | ||
1761 | + attrs[XFRMA_TFCPAD] || | ||
1762 | + (ntohl(p->id.spi) >= 0x10000)) | ||
1763 | goto out; | ||
1764 | break; | ||
1765 |