Update to 3.16.7-ckt3
- Drop various patches that were applied upstream - Refresh the big firmware logging patch - Fix/ignore ABI changes as appropriate svn path=/dists/sid/linux/; revision=22238
This commit is contained in:
parent
b84001ac07
commit
f75504c2b3
|
@ -1,11 +1,99 @@
|
|||
linux (3.16.7-ckt2-2) UNRELEASED; urgency=medium
|
||||
linux (3.16.7-ckt3-1) UNRELEASED; urgency=medium
|
||||
|
||||
* New upstream stable update:
|
||||
http://kernel.ubuntu.com/stable/ChangeLog-3.16.7-ckt3
|
||||
- [x86] kvm: use alternatives for VMCALL vs. VMMCALL if kernel text is
|
||||
read-only
|
||||
- [sparc*] Fix constraints on swab helpers.
|
||||
- inetdevice: fixed signed integer overflow
|
||||
- ieee802154: fix error handling in ieee802154fake_probe()
|
||||
- bonding: fix curr_active_slave/carrier with loadbalance arp monitoring
|
||||
(regression in 3.14)
|
||||
- pptp: fix stack info leak in pptp_getname()
|
||||
- ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg
|
||||
- net/mlx4_en: Add VXLAN ndo calls to the PF net device ops too
|
||||
(regression in 3.15)
|
||||
- net/mlx4_en: Advertize encapsulation offloads features only when VXLAN
|
||||
tunnel is set (regression in 3.15)
|
||||
- target: Don't call TFO->write_pending if data_length == 0
|
||||
- vhost-scsi: Take configfs group dependency during VHOST_SCSI_SET_ENDPOINT
|
||||
- iser-target: Handle DEVICE_REMOVAL event on network portal listener
|
||||
correctly
|
||||
- ASoC: dpcm: Fix race between FE/BE updates and trigger
|
||||
- mac80211: Fix regression that triggers a kernel BUG with CCMP
|
||||
(regression in 3.13)
|
||||
- rt2x00: do not align payload on modern H/W
|
||||
- bitops: Fix shift overflow in GENMASK macros
|
||||
- [x86] Require exact match for 'noxsave' command line option
|
||||
- [x86] drm/i915: Kick fbdev before vgacon (regression in 3.16)
|
||||
- can: dev: avoid calling kfree_skb() from interrupt context
|
||||
- [x86] mm: Set NX across entire PMD at boot
|
||||
- of: Fix crash if an earlycon driver is not found
|
||||
- btrfs: fix lockups from btrfs_clear_path_blocking
|
||||
- [i386/686-pae,armhf/armmp-lpae] PCI: Support 64-bit bridge windows if we
|
||||
have 64-bit dma_addr_t (regression in 3.14)
|
||||
- ACPI / PM: Ignore wakeup setting if the ACPI companion can't wake up
|
||||
(regression in 3.13)
|
||||
- drm/radeon: fix endian swapping in vbios fetch for tdp table
|
||||
- Bluetooth: Fix endian and alignment issue with ath3k version handling
|
||||
- nfs: Don't busy-wait on SIGKILL in __nfs_iocounter_wait
|
||||
- [armhf] 8109/1: mm: Modify pte_write and pmd_write logic for LPAE
|
||||
- aio: fix incorrect dirty pages accouting when truncating AIO ring buffer
|
||||
(regression in 3.12)
|
||||
- [armel,armhf] mvebu: add missing of_node_put() call in coherency.c
|
||||
(regression in 3.16)
|
||||
- iio: Fix IIO_EVENT_CODE_EXTRACT_DIR bit mask
|
||||
- spi: Fix mapping from vmalloc-ed buffer to scatter list
|
||||
- SUNRPC: Fix locking around callback channel reply receive
|
||||
- nfsd: Fix slot wake up race in the nfsv4.1 callback code
|
||||
- bnx2fc: do not add shared skbs to the fcoe_rx_list
|
||||
- Revert "xhci: clear root port wake on bits if controller isn't wake-up
|
||||
capable" (regression in 3.16)
|
||||
- usb: xhci: rework root port wake bits if controller isn't allowed to
|
||||
wakeup
|
||||
- ixgbe: Correctly disable VLAN filter in promiscuous mode
|
||||
(regression in 3.16)
|
||||
- ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe
|
||||
(regression in 3.15)
|
||||
- ALSA: hda - Limit 40bit DMA for AMD HDMI controllers
|
||||
- PCI/MSI: Add device flag indicating that 64-bit MSIs don't work
|
||||
- gpu/radeon: Set flag to indicate broken 64-bit MSI
|
||||
- sound/radeon: Move 64-bit MSI quirk from arch to driver
|
||||
- [powerpc*] pseries: Honor the generic "no_64bit_msi" flag
|
||||
- [mips*] fix EVA & non-SMP non-FPU FP context signal handling
|
||||
(regression in 3.15)
|
||||
- [x86] drm/i915: Ignore SURFLIVE and flip counter when the GPU gets reset
|
||||
(regression in 3.16)
|
||||
- [powerpc*] 32 bit getcpu VDSO function uses 64 bit instructions
|
||||
- [armhf] 8222/1: mvebu: enable strex backoff delay
|
||||
- [armel,armhf] 8226/1: cacheflush: get rid of restarting block
|
||||
- btrfs: zero out left over bytes after processing compression streams
|
||||
- [armhf] net: sun4i-emac: fix memory leak on bad packet
|
||||
- [armhf] i2c: omap: fix NACK and Arbitration Lost irq handling
|
||||
- [media] s2255drv: fix payload size for JPG, MJPEG (regression in 3.15)
|
||||
- nouveau: move the hotplug ignore to correct place. (regression in 3.16.4)
|
||||
- mm: frontswap: invalidate expired data on a dup-store failure
|
||||
- mm/vmpressure.c: fix race in vmpressure_work_fn()
|
||||
- xen-netfront: Remove BUGs on paged skb data which crosses a page boundary
|
||||
- drivers/input/evdev.c: don't kfree() a vmalloc address
|
||||
(regression in 3.13)
|
||||
- mm: fix anon_vma_clone() error treatment (regression in 3.12)
|
||||
- ip_tunnel: the lack of vti_link_ops' dellink() cause kernel panic
|
||||
- vxlan: Fix race condition between vxlan_sock_add and vxlan_sock_release
|
||||
- bond: Check length of IFLA_BOND_ARP_IP_TARGET attributes
|
||||
- gre: Set inner mac header in gro complete (regression in 3.16.7-ckt1)
|
||||
- [mips*] bpf: Fix broken BPF_MOD
|
||||
|
||||
[ Ben Hutchings ]
|
||||
* [sh4] Build with gcc-4.8 (Closes: #772602)
|
||||
* Fix inconsistent ABI name generation in
|
||||
debian/bin/{abiupdate,buildcheck,gencontrol}.py (Closes: #773233)
|
||||
* iov: Revert unwanted ABI 'fix' in 3.16.7-ckt2-1
|
||||
* Ignore ABI changes in mm, of functions not really used by modules
|
||||
* [armel,armhf] thread_info: Fix ABI change in 3.16.7-ckt3
|
||||
* PCI: Fix ABI change in 3.16.7-ckt3
|
||||
* Ignore some ABI changes that don't appear to affect OOT modules:
|
||||
- Removal of __add_pages(), __remove_pages(), of_device_is_stdout_path()
|
||||
- Changes to ASoC functions
|
||||
* [arm64] Enable PSTORE as built-in and EFI_VARS_PSTORE as module;
|
||||
ensure efivars and efi-pstore are loaded on EFI systems (Closes: #773309)
|
||||
|
||||
|
|
|
@ -9,6 +9,7 @@ ignore-changes:
|
|||
__add_pages
|
||||
__remove_pages
|
||||
of_device_is_stdout_path
|
||||
module:sound/soc/*
|
||||
|
||||
[base]
|
||||
arches:
|
||||
|
|
|
@ -1,212 +0,0 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Date: Thu, 30 Oct 2014 18:27:12 +0000
|
||||
Subject: [1/2] drivers/net: Disable UFO through virtio
|
||||
Origin: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit?id=3d0ad09412ffe00c9afa201d01effdb6023d09b4
|
||||
|
||||
IPv6 does not allow fragmentation by routers, so there is no
|
||||
fragmentation ID in the fixed header. UFO for IPv6 requires the ID to
|
||||
be passed separately, but there is no provision for this in the virtio
|
||||
net protocol.
|
||||
|
||||
Until recently our software implementation of UFO/IPv6 generated a new
|
||||
ID, but this was a bug. Now we will use ID=0 for any UFO/IPv6 packet
|
||||
passed through a tap, which is even worse.
|
||||
|
||||
Unfortunately there is no distinction between UFO/IPv4 and v6
|
||||
features, so disable UFO on taps and virtio_net completely until we
|
||||
have a proper solution.
|
||||
|
||||
We cannot depend on VM managers respecting the tap feature flags, so
|
||||
keep accepting UFO packets but log a warning the first time we do
|
||||
this.
|
||||
|
||||
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||||
Fixes: 916e4cf46d02 ("ipv6: reuse ip6_frag_id from ip6_ufo_append_data")
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
drivers/net/macvtap.c | 13 +++++--------
|
||||
drivers/net/tun.c | 19 +++++++++++--------
|
||||
drivers/net/virtio_net.c | 24 ++++++++++++++----------
|
||||
3 files changed, 30 insertions(+), 26 deletions(-)
|
||||
|
||||
--- a/drivers/net/macvtap.c
|
||||
+++ b/drivers/net/macvtap.c
|
||||
@@ -65,7 +65,7 @@ static struct cdev macvtap_cdev;
|
||||
static const struct proto_ops macvtap_socket_ops;
|
||||
|
||||
#define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
|
||||
- NETIF_F_TSO6 | NETIF_F_UFO)
|
||||
+ NETIF_F_TSO6)
|
||||
#define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
|
||||
#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
|
||||
|
||||
@@ -569,6 +569,8 @@ static int macvtap_skb_from_vnet_hdr(str
|
||||
gso_type = SKB_GSO_TCPV6;
|
||||
break;
|
||||
case VIRTIO_NET_HDR_GSO_UDP:
|
||||
+ pr_warn_once("macvtap: %s: using disabled UFO feature; please fix this program\n",
|
||||
+ current->comm);
|
||||
gso_type = SKB_GSO_UDP;
|
||||
break;
|
||||
default:
|
||||
@@ -614,8 +616,6 @@ static void macvtap_skb_to_vnet_hdr(cons
|
||||
vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
|
||||
else if (sinfo->gso_type & SKB_GSO_TCPV6)
|
||||
vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
|
||||
- else if (sinfo->gso_type & SKB_GSO_UDP)
|
||||
- vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP;
|
||||
else
|
||||
BUG();
|
||||
if (sinfo->gso_type & SKB_GSO_TCP_ECN)
|
||||
@@ -950,9 +950,6 @@ static int set_offload(struct macvtap_qu
|
||||
if (arg & TUN_F_TSO6)
|
||||
feature_mask |= NETIF_F_TSO6;
|
||||
}
|
||||
-
|
||||
- if (arg & TUN_F_UFO)
|
||||
- feature_mask |= NETIF_F_UFO;
|
||||
}
|
||||
|
||||
/* tun/tap driver inverts the usage for TSO offloads, where
|
||||
@@ -963,7 +960,7 @@ static int set_offload(struct macvtap_qu
|
||||
* When user space turns off TSO, we turn off GSO/LRO so that
|
||||
* user-space will not receive TSO frames.
|
||||
*/
|
||||
- if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_UFO))
|
||||
+ if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6))
|
||||
features |= RX_OFFLOADS;
|
||||
else
|
||||
features &= ~RX_OFFLOADS;
|
||||
@@ -1064,7 +1061,7 @@ static long macvtap_ioctl(struct file *f
|
||||
case TUNSETOFFLOAD:
|
||||
/* let the user check for future flags */
|
||||
if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
|
||||
- TUN_F_TSO_ECN | TUN_F_UFO))
|
||||
+ TUN_F_TSO_ECN))
|
||||
return -EINVAL;
|
||||
|
||||
rtnl_lock();
|
||||
--- a/drivers/net/tun.c
|
||||
+++ b/drivers/net/tun.c
|
||||
@@ -174,7 +174,7 @@ struct tun_struct {
|
||||
struct net_device *dev;
|
||||
netdev_features_t set_features;
|
||||
#define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
|
||||
- NETIF_F_TSO6|NETIF_F_UFO)
|
||||
+ NETIF_F_TSO6)
|
||||
|
||||
int vnet_hdr_sz;
|
||||
int sndbuf;
|
||||
@@ -1149,8 +1149,18 @@ static ssize_t tun_get_user(struct tun_s
|
||||
skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
|
||||
break;
|
||||
case VIRTIO_NET_HDR_GSO_UDP:
|
||||
+ {
|
||||
+ static bool warned;
|
||||
+
|
||||
+ if (!warned) {
|
||||
+ warned = true;
|
||||
+ netdev_warn(tun->dev,
|
||||
+ "%s: using disabled UFO feature; please fix this program\n",
|
||||
+ current->comm);
|
||||
+ }
|
||||
skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
|
||||
break;
|
||||
+ }
|
||||
default:
|
||||
tun->dev->stats.rx_frame_errors++;
|
||||
kfree_skb(skb);
|
||||
@@ -1251,8 +1261,6 @@ static ssize_t tun_put_user(struct tun_s
|
||||
gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
|
||||
else if (sinfo->gso_type & SKB_GSO_TCPV6)
|
||||
gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
|
||||
- else if (sinfo->gso_type & SKB_GSO_UDP)
|
||||
- gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
|
||||
else {
|
||||
pr_err("unexpected GSO type: "
|
||||
"0x%x, gso_size %d, hdr_len %d\n",
|
||||
@@ -1761,11 +1769,6 @@ static int set_offload(struct tun_struct
|
||||
features |= NETIF_F_TSO6;
|
||||
arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
|
||||
}
|
||||
-
|
||||
- if (arg & TUN_F_UFO) {
|
||||
- features |= NETIF_F_UFO;
|
||||
- arg &= ~TUN_F_UFO;
|
||||
- }
|
||||
}
|
||||
|
||||
/* This gives the user a way to test for new features in future by
|
||||
--- a/drivers/net/virtio_net.c
|
||||
+++ b/drivers/net/virtio_net.c
|
||||
@@ -496,8 +496,17 @@ static void receive_buf(struct receive_q
|
||||
skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
|
||||
break;
|
||||
case VIRTIO_NET_HDR_GSO_UDP:
|
||||
+ {
|
||||
+ static bool warned;
|
||||
+
|
||||
+ if (!warned) {
|
||||
+ warned = true;
|
||||
+ netdev_warn(dev,
|
||||
+ "host using disabled UFO feature; please fix it\n");
|
||||
+ }
|
||||
skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
|
||||
break;
|
||||
+ }
|
||||
case VIRTIO_NET_HDR_GSO_TCPV6:
|
||||
skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
|
||||
break;
|
||||
@@ -836,8 +845,6 @@ static int xmit_skb(struct send_queue *s
|
||||
hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
|
||||
else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
|
||||
hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
|
||||
- else if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
|
||||
- hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_UDP;
|
||||
else
|
||||
BUG();
|
||||
if (skb_shinfo(skb)->gso_type & SKB_GSO_TCP_ECN)
|
||||
@@ -1657,7 +1664,7 @@ static int virtnet_probe(struct virtio_d
|
||||
dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
|
||||
|
||||
if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
|
||||
- dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
|
||||
+ dev->hw_features |= NETIF_F_TSO
|
||||
| NETIF_F_TSO_ECN | NETIF_F_TSO6;
|
||||
}
|
||||
/* Individual feature bits: what can host handle? */
|
||||
@@ -1667,11 +1674,9 @@ static int virtnet_probe(struct virtio_d
|
||||
dev->hw_features |= NETIF_F_TSO6;
|
||||
if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_ECN))
|
||||
dev->hw_features |= NETIF_F_TSO_ECN;
|
||||
- if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_UFO))
|
||||
- dev->hw_features |= NETIF_F_UFO;
|
||||
|
||||
if (gso)
|
||||
- dev->features |= dev->hw_features & (NETIF_F_ALL_TSO|NETIF_F_UFO);
|
||||
+ dev->features |= dev->hw_features & NETIF_F_ALL_TSO;
|
||||
/* (!csum && gso) case will be fixed by register_netdev() */
|
||||
}
|
||||
if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_CSUM))
|
||||
@@ -1711,8 +1716,7 @@ static int virtnet_probe(struct virtio_d
|
||||
/* If we can receive ANY GSO packets, we must allocate large ones. */
|
||||
if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
|
||||
virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
|
||||
- virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
|
||||
- virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
|
||||
+ virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
|
||||
vi->big_packets = true;
|
||||
|
||||
if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
|
||||
@@ -1910,9 +1914,9 @@ static struct virtio_device_id id_table[
|
||||
static unsigned int features[] = {
|
||||
VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM,
|
||||
VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
|
||||
- VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
|
||||
+ VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_TSO6,
|
||||
VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
|
||||
- VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO,
|
||||
+ VIRTIO_NET_F_GUEST_ECN,
|
||||
VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ,
|
||||
VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN,
|
||||
VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ,
|
|
@ -1,135 +0,0 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Date: Thu, 30 Oct 2014 18:27:17 +0000
|
||||
Subject: [2/2] drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO
|
||||
packets
|
||||
Origin: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit?id=5188cd44c55db3e92cd9e77a40b5baa7ed4340f7
|
||||
|
||||
UFO is now disabled on all drivers that work with virtio net headers,
|
||||
but userland may try to send UFO/IPv6 packets anyway. Instead of
|
||||
sending with ID=0, we should select identifiers on their behalf (as we
|
||||
used to).
|
||||
|
||||
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||||
Fixes: 916e4cf46d02 ("ipv6: reuse ip6_frag_id from ip6_ufo_append_data")
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
drivers/net/macvtap.c | 3 +++
|
||||
drivers/net/tun.c | 6 +++++-
|
||||
include/net/ipv6.h | 2 ++
|
||||
net/ipv6/output_core.c | 34 ++++++++++++++++++++++++++++++++++
|
||||
4 files changed, 44 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/drivers/net/macvtap.c
|
||||
+++ b/drivers/net/macvtap.c
|
||||
@@ -16,6 +16,7 @@
|
||||
#include <linux/idr.h>
|
||||
#include <linux/fs.h>
|
||||
|
||||
+#include <net/ipv6.h>
|
||||
#include <net/net_namespace.h>
|
||||
#include <net/rtnetlink.h>
|
||||
#include <net/sock.h>
|
||||
@@ -572,6 +573,8 @@ static int macvtap_skb_from_vnet_hdr(str
|
||||
pr_warn_once("macvtap: %s: using disabled UFO feature; please fix this program\n",
|
||||
current->comm);
|
||||
gso_type = SKB_GSO_UDP;
|
||||
+ if (skb->protocol == htons(ETH_P_IPV6))
|
||||
+ ipv6_proxy_select_ident(skb);
|
||||
break;
|
||||
default:
|
||||
return -EINVAL;
|
||||
--- a/drivers/net/tun.c
|
||||
+++ b/drivers/net/tun.c
|
||||
@@ -65,6 +65,7 @@
|
||||
#include <linux/nsproxy.h>
|
||||
#include <linux/virtio_net.h>
|
||||
#include <linux/rcupdate.h>
|
||||
+#include <net/ipv6.h>
|
||||
#include <net/net_namespace.h>
|
||||
#include <net/netns/generic.h>
|
||||
#include <net/rtnetlink.h>
|
||||
@@ -1139,6 +1140,8 @@ static ssize_t tun_get_user(struct tun_s
|
||||
break;
|
||||
}
|
||||
|
||||
+ skb_reset_network_header(skb);
|
||||
+
|
||||
if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
|
||||
pr_debug("GSO!\n");
|
||||
switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
|
||||
@@ -1159,6 +1162,8 @@ static ssize_t tun_get_user(struct tun_s
|
||||
current->comm);
|
||||
}
|
||||
skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
|
||||
+ if (skb->protocol == htons(ETH_P_IPV6))
|
||||
+ ipv6_proxy_select_ident(skb);
|
||||
break;
|
||||
}
|
||||
default:
|
||||
@@ -1189,7 +1194,6 @@ static ssize_t tun_get_user(struct tun_s
|
||||
skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
|
||||
}
|
||||
|
||||
- skb_reset_network_header(skb);
|
||||
skb_probe_transport_header(skb, 0);
|
||||
|
||||
rxhash = skb_get_hash(skb);
|
||||
--- a/include/net/ipv6.h
|
||||
+++ b/include/net/ipv6.h
|
||||
@@ -668,6 +668,8 @@ static inline int ipv6_addr_diff(const s
|
||||
return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
|
||||
}
|
||||
|
||||
+void ipv6_proxy_select_ident(struct sk_buff *skb);
|
||||
+
|
||||
int ip6_dst_hoplimit(struct dst_entry *dst);
|
||||
|
||||
static inline int ip6_sk_dst_hoplimit(struct ipv6_pinfo *np, struct flowi6 *fl6,
|
||||
--- a/net/ipv6/output_core.c
|
||||
+++ b/net/ipv6/output_core.c
|
||||
@@ -3,11 +3,45 @@
|
||||
* not configured or static. These functions are needed by GSO/GRO implementation.
|
||||
*/
|
||||
#include <linux/export.h>
|
||||
+#include <net/ip.h>
|
||||
#include <net/ipv6.h>
|
||||
#include <net/ip6_fib.h>
|
||||
#include <net/addrconf.h>
|
||||
#include <net/secure_seq.h>
|
||||
|
||||
+/* This function exists only for tap drivers that must support broken
|
||||
+ * clients requesting UFO without specifying an IPv6 fragment ID.
|
||||
+ *
|
||||
+ * This is similar to ipv6_select_ident() but we use an independent hash
|
||||
+ * seed to limit information leakage.
|
||||
+ *
|
||||
+ * The network header must be set before calling this.
|
||||
+ */
|
||||
+void ipv6_proxy_select_ident(struct sk_buff *skb)
|
||||
+{
|
||||
+ static u32 ip6_proxy_idents_hashrnd __read_mostly;
|
||||
+ struct in6_addr buf[2];
|
||||
+ struct in6_addr *addrs;
|
||||
+ u32 hash, id;
|
||||
+
|
||||
+ addrs = skb_header_pointer(skb,
|
||||
+ skb_network_offset(skb) +
|
||||
+ offsetof(struct ipv6hdr, saddr),
|
||||
+ sizeof(buf), buf);
|
||||
+ if (!addrs)
|
||||
+ return;
|
||||
+
|
||||
+ net_get_random_once(&ip6_proxy_idents_hashrnd,
|
||||
+ sizeof(ip6_proxy_idents_hashrnd));
|
||||
+
|
||||
+ hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd);
|
||||
+ hash = __ipv6_addr_jhash(&addrs[0], hash);
|
||||
+
|
||||
+ id = ip_idents_reserve(hash, 1);
|
||||
+ skb_shinfo(skb)->ip6_frag_id = htonl(id);
|
||||
+}
|
||||
+EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident);
|
||||
+
|
||||
int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
|
||||
{
|
||||
u16 offset = sizeof(struct ipv6hdr);
|
|
@ -96,8 +96,8 @@ upstream submission.
|
|||
fw_size = firmware->size / sizeof(u32);
|
||||
--- a/drivers/bluetooth/ath3k.c
|
||||
+++ b/drivers/bluetooth/ath3k.c
|
||||
@@ -370,10 +370,8 @@ static int ath3k_load_patch(struct usb_d
|
||||
le32_to_cpu(fw_version.rom_version));
|
||||
@@ -377,10 +377,8 @@ static int ath3k_load_patch(struct usb_d
|
||||
le32_to_cpu(fw_version.rom_version));
|
||||
|
||||
ret = request_firmware(&firmware, filename, &udev->dev);
|
||||
- if (ret < 0) {
|
||||
|
@ -106,9 +106,9 @@ upstream submission.
|
|||
return ret;
|
||||
- }
|
||||
|
||||
pt_version.rom_version = *(int *)(firmware->data + firmware->size - 8);
|
||||
pt_version.build_version = *(int *)
|
||||
@@ -432,10 +430,8 @@ static int ath3k_load_syscfg(struct usb_
|
||||
pt_rom_version = get_unaligned_le32(firmware->data +
|
||||
firmware->size - 8);
|
||||
@@ -440,10 +438,8 @@ static int ath3k_load_syscfg(struct usb_
|
||||
le32_to_cpu(fw_version.rom_version), clk_value, ".dfu");
|
||||
|
||||
ret = request_firmware(&firmware, filename, &udev->dev);
|
||||
|
@ -168,7 +168,7 @@ upstream submission.
|
|||
|
||||
--- a/drivers/bluetooth/btmrvl_sdio.c
|
||||
+++ b/drivers/bluetooth/btmrvl_sdio.c
|
||||
@@ -288,8 +288,6 @@ static int btmrvl_sdio_download_helper(s
|
||||
@@ -293,8 +293,6 @@ static int btmrvl_sdio_download_helper(s
|
||||
ret = request_firmware(&fw_helper, card->helper,
|
||||
&card->func->dev);
|
||||
if ((ret < 0) || !fw_helper) {
|
||||
|
@ -177,7 +177,7 @@ upstream submission.
|
|||
ret = -ENOENT;
|
||||
goto done;
|
||||
}
|
||||
@@ -388,8 +386,6 @@ static int btmrvl_sdio_download_fw_w_hel
|
||||
@@ -393,8 +391,6 @@ static int btmrvl_sdio_download_fw_w_hel
|
||||
ret = request_firmware(&fw_firmware, card->firmware,
|
||||
&card->func->dev);
|
||||
if ((ret < 0) || !fw_firmware) {
|
||||
|
@ -203,7 +203,7 @@ upstream submission.
|
|||
fw->size, fw_name);
|
||||
--- a/drivers/dma/imx-sdma.c
|
||||
+++ b/drivers/dma/imx-sdma.c
|
||||
@@ -1269,10 +1269,8 @@ static void sdma_load_firmware(const str
|
||||
@@ -1281,10 +1281,8 @@ static void sdma_load_firmware(const str
|
||||
const struct sdma_script_start_addrs *addr;
|
||||
unsigned short *ram_code;
|
||||
|
||||
|
@ -232,7 +232,7 @@ upstream submission.
|
|||
where = 0;
|
||||
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
|
||||
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
|
||||
@@ -1221,10 +1221,8 @@ nvc0_graph_ctor_fw(struct nvc0_graph_pri
|
||||
@@ -1248,10 +1248,8 @@ nvc0_graph_ctor_fw(struct nvc0_graph_pri
|
||||
if (ret) {
|
||||
snprintf(f, sizeof(f), "nouveau/%s", fwname);
|
||||
ret = request_firmware(&fw, f, nv_device_base(device));
|
||||
|
@ -274,7 +274,7 @@ upstream submission.
|
|||
release_firmware(rdev->me_fw);
|
||||
--- a/drivers/gpu/drm/radeon/r100.c
|
||||
+++ b/drivers/gpu/drm/radeon/r100.c
|
||||
@@ -1036,10 +1036,7 @@ static int r100_cp_init_microcode(struct
|
||||
@@ -1017,10 +1017,7 @@ static int r100_cp_init_microcode(struct
|
||||
}
|
||||
|
||||
err = request_firmware(&rdev->me_fw, fw_name, rdev->dev);
|
||||
|
@ -288,7 +288,7 @@ upstream submission.
|
|||
rdev->me_fw->size, fw_name);
|
||||
--- a/drivers/gpu/drm/radeon/r600.c
|
||||
+++ b/drivers/gpu/drm/radeon/r600.c
|
||||
@@ -2434,10 +2434,6 @@ int r600_init_microcode(struct radeon_de
|
||||
@@ -2427,10 +2427,6 @@ int r600_init_microcode(struct radeon_de
|
||||
|
||||
out:
|
||||
if (err) {
|
||||
|
@ -685,7 +685,7 @@ upstream submission.
|
|||
printk(KERN_INFO "tda1004x: please rename the firmware file to %s\n",
|
||||
--- a/drivers/media/dvb-frontends/tda10071.c
|
||||
+++ b/drivers/media/dvb-frontends/tda10071.c
|
||||
@@ -952,12 +952,8 @@ static int tda10071_init(struct dvb_fron
|
||||
@@ -956,12 +956,8 @@ static int tda10071_init(struct dvb_fron
|
||||
|
||||
/* request the firmware, this will block and timeout */
|
||||
ret = request_firmware(&fw, fw_file, priv->i2c->dev.parent);
|
||||
|
@ -835,7 +835,7 @@ upstream submission.
|
|||
fw_data = (void *)fw_entry->data;
|
||||
--- a/drivers/media/pci/bt8xx/bttv-cards.c
|
||||
+++ b/drivers/media/pci/bt8xx/bttv-cards.c
|
||||
@@ -3814,10 +3814,8 @@ static int pvr_boot(struct bttv *btv)
|
||||
@@ -3834,10 +3834,8 @@ static int pvr_boot(struct bttv *btv)
|
||||
int rc;
|
||||
|
||||
rc = request_firmware(&fw_entry, "hcwamc.rbf", &btv->c.pci->dev);
|
||||
|
@ -1061,7 +1061,7 @@ upstream submission.
|
|||
|
||||
--- a/drivers/media/usb/s2255/s2255drv.c
|
||||
+++ b/drivers/media/usb/s2255/s2255drv.c
|
||||
@@ -2306,10 +2306,8 @@ static int s2255_probe(struct usb_interf
|
||||
@@ -2305,10 +2305,8 @@ static int s2255_probe(struct usb_interf
|
||||
}
|
||||
/* load the first chunk */
|
||||
if (request_firmware(&dev->fw_data->fw,
|
||||
|
@ -1240,7 +1240,7 @@ upstream submission.
|
|||
if (bp->mips_firmware->size < sizeof(*mips_fw) ||
|
||||
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
|
||||
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
|
||||
@@ -12775,11 +12775,8 @@ static int bnx2x_init_firmware(struct bn
|
||||
@@ -12738,11 +12738,8 @@ static int bnx2x_init_firmware(struct bn
|
||||
BNX2X_DEV_INFO("Loading %s\n", fw_file_name);
|
||||
|
||||
rc = request_firmware(&bp->firmware, fw_file_name, &bp->pdev->dev);
|
||||
|
@ -1255,7 +1255,7 @@ upstream submission.
|
|||
if (rc) {
|
||||
--- a/drivers/net/ethernet/broadcom/tg3.c
|
||||
+++ b/drivers/net/ethernet/broadcom/tg3.c
|
||||
@@ -11286,11 +11286,8 @@ static int tg3_request_firmware(struct t
|
||||
@@ -11323,11 +11323,8 @@ static int tg3_request_firmware(struct t
|
||||
{
|
||||
const struct tg3_firmware_hdr *fw_hdr;
|
||||
|
||||
|
@ -1431,7 +1431,7 @@ upstream submission.
|
|||
} else
|
||||
--- a/drivers/net/wireless/at76c50x-usb.c
|
||||
+++ b/drivers/net/wireless/at76c50x-usb.c
|
||||
@@ -1553,13 +1553,8 @@ static struct fwentry *at76_load_firmwar
|
||||
@@ -1622,13 +1622,8 @@ static struct fwentry *at76_load_firmwar
|
||||
|
||||
at76_dbg(DBG_FW, "downloading firmware %s", fwe->fwname);
|
||||
ret = request_firmware(&fwe->fw, fwe->fwname, &udev->dev);
|
||||
|
@ -1464,7 +1464,7 @@ upstream submission.
|
|||
&hif_dev->udev->dev);
|
||||
--- a/drivers/net/wireless/ath/carl9170/usb.c
|
||||
+++ b/drivers/net/wireless/ath/carl9170/usb.c
|
||||
@@ -1025,7 +1025,6 @@ static void carl9170_usb_firmware_step2(
|
||||
@@ -1032,7 +1032,6 @@ static void carl9170_usb_firmware_step2(
|
||||
return;
|
||||
}
|
||||
|
||||
|
@ -1490,7 +1490,7 @@ upstream submission.
|
|||
int success = 0;
|
||||
--- a/drivers/net/wireless/b43/main.c
|
||||
+++ b/drivers/net/wireless/b43/main.c
|
||||
@@ -2160,19 +2160,8 @@ int b43_do_request_fw(struct b43_request
|
||||
@@ -2154,19 +2154,8 @@ int b43_do_request_fw(struct b43_request
|
||||
}
|
||||
err = request_firmware(&ctx->blob, ctx->fwname,
|
||||
ctx->dev->dev->dev);
|
||||
|
@ -1714,7 +1714,7 @@ upstream submission.
|
|||
|
||||
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
|
||||
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
|
||||
@@ -1690,7 +1690,6 @@ static int ezusb_probe(struct usb_interf
|
||||
@@ -1676,7 +1676,6 @@ static int ezusb_probe(struct usb_interf
|
||||
if (ezusb_firmware_download(upriv, &firmware) < 0)
|
||||
goto error;
|
||||
} else {
|
||||
|
@ -1968,7 +1968,7 @@ upstream submission.
|
|||
|
||||
--- a/drivers/scsi/pm8001/pm8001_ctl.c
|
||||
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
|
||||
@@ -676,9 +676,6 @@ static ssize_t pm8001_store_update_fw(st
|
||||
@@ -679,9 +679,6 @@ static ssize_t pm8001_store_update_fw(st
|
||||
pm8001_ha->dev);
|
||||
|
||||
if (err) {
|
||||
|
@ -1991,7 +1991,7 @@ upstream submission.
|
|||
}
|
||||
--- a/drivers/scsi/qla2xxx/qla_init.c
|
||||
+++ b/drivers/scsi/qla2xxx/qla_init.c
|
||||
@@ -5358,8 +5358,6 @@ qla2x00_load_risc(scsi_qla_host_t *vha,
|
||||
@@ -5352,8 +5352,6 @@ qla2x00_load_risc(scsi_qla_host_t *vha,
|
||||
/* Load firmware blob. */
|
||||
blob = qla2x00_request_firmware(vha);
|
||||
if (!blob) {
|
||||
|
@ -2000,7 +2000,7 @@ upstream submission.
|
|||
ql_log(ql_log_info, vha, 0x0084,
|
||||
"Firmware images can be retrieved from: "QLA_FW_URL ".\n");
|
||||
return QLA_FUNCTION_FAILED;
|
||||
@@ -5461,8 +5459,6 @@ qla24xx_load_risc_blob(scsi_qla_host_t *
|
||||
@@ -5455,8 +5453,6 @@ qla24xx_load_risc_blob(scsi_qla_host_t *
|
||||
/* Load firmware blob. */
|
||||
blob = qla2x00_request_firmware(vha);
|
||||
if (!blob) {
|
||||
|
@ -2011,7 +2011,7 @@ upstream submission.
|
|||
QLA_FW_URL ".\n");
|
||||
--- a/drivers/scsi/qla2xxx/qla_nx.c
|
||||
+++ b/drivers/scsi/qla2xxx/qla_nx.c
|
||||
@@ -2449,11 +2449,8 @@ try_blob_fw:
|
||||
@@ -2459,11 +2459,8 @@ try_blob_fw:
|
||||
|
||||
/* Load firmware blob. */
|
||||
blob = ha->hablob = qla2x00_request_firmware(vha);
|
||||
|
@ -2026,7 +2026,7 @@ upstream submission.
|
|||
if (qla82xx_validate_firmware_blob(vha,
|
||||
--- a/drivers/scsi/qla2xxx/qla_os.c
|
||||
+++ b/drivers/scsi/qla2xxx/qla_os.c
|
||||
@@ -5393,8 +5393,6 @@ qla2x00_request_firmware(scsi_qla_host_t
|
||||
@@ -5403,8 +5403,6 @@ qla2x00_request_firmware(scsi_qla_host_t
|
||||
goto out;
|
||||
|
||||
if (request_firmware(&blob->fw, blob->name, &ha->pdev->dev)) {
|
||||
|
@ -2208,7 +2208,7 @@ upstream submission.
|
|||
usb_set_intfdata(pusb_intf, NULL);
|
||||
--- a/drivers/staging/slicoss/slicoss.c
|
||||
+++ b/drivers/staging/slicoss/slicoss.c
|
||||
@@ -402,11 +402,8 @@ static int slic_card_download_gbrcv(stru
|
||||
@@ -393,11 +393,8 @@ static int slic_card_download_gbrcv(stru
|
||||
}
|
||||
|
||||
ret = request_firmware(&fw, file, &adapter->pcidev->dev);
|
||||
|
@ -2221,7 +2221,7 @@ upstream submission.
|
|||
|
||||
rcvucodelen = *(u32 *)(fw->data + index);
|
||||
index += 4;
|
||||
@@ -480,11 +477,8 @@ static int slic_card_download(struct ada
|
||||
@@ -471,11 +468,8 @@ static int slic_card_download(struct ada
|
||||
return -ENOENT;
|
||||
}
|
||||
ret = request_firmware(&fw, file, &adapter->pcidev->dev);
|
||||
|
@ -2236,7 +2236,7 @@ upstream submission.
|
|||
for (i = 0; i < numsects; i++) {
|
||||
--- a/drivers/staging/vt6656/firmware.c
|
||||
+++ b/drivers/staging/vt6656/firmware.c
|
||||
@@ -57,11 +57,8 @@ int FIRMWAREbDownload(struct vnt_private
|
||||
@@ -56,11 +56,8 @@ int FIRMWAREbDownload(struct vnt_private
|
||||
DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---->Download firmware\n");
|
||||
|
||||
rc = request_firmware(&fw, FIRMWARE_NAME, dev);
|
||||
|
@ -2657,7 +2657,7 @@ upstream submission.
|
|||
filename, emu->firmware->size);
|
||||
--- a/sound/pci/hda/hda_intel.c
|
||||
+++ b/sound/pci/hda/hda_intel.c
|
||||
@@ -1407,10 +1407,8 @@ static void azx_firmware_cb(const struct
|
||||
@@ -1449,10 +1449,8 @@ static void azx_firmware_cb(const struct
|
||||
struct azx *chip = card->private_data;
|
||||
struct pci_dev *pci = chip->pci;
|
||||
|
||||
|
|
|
@ -1,41 +0,0 @@
|
|||
From: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
Date: Wed, 24 Sep 2014 12:27:39 -0700
|
||||
Subject: fold swapping ->d_name.hash into switch_names()
|
||||
Origin: https://git.kernel.org/linus/a28ddb87cdddb0db57466ba7f59f831002f4340c
|
||||
|
||||
and do it along with ->d_name.len there
|
||||
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
||||
[bwh: Backported to 3.16: change __d_materialise_dentry() as well]
|
||||
---
|
||||
fs/dcache.c | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
--- a/fs/dcache.c
|
||||
+++ b/fs/dcache.c
|
||||
@@ -2441,7 +2441,7 @@ static void switch_names(struct dentry *
|
||||
}
|
||||
}
|
||||
}
|
||||
- swap(dentry->d_name.len, target->d_name.len);
|
||||
+ swap(dentry->d_name.hash_len, target->d_name.hash_len);
|
||||
}
|
||||
|
||||
static void dentry_lock_for_move(struct dentry *dentry, struct dentry *target)
|
||||
@@ -2540,7 +2540,6 @@ static void __d_move(struct dentry *dent
|
||||
|
||||
/* Switch the names.. */
|
||||
switch_names(dentry, target);
|
||||
- swap(dentry->d_name.hash, target->d_name.hash);
|
||||
|
||||
/* ... and switch the parents */
|
||||
if (IS_ROOT(dentry)) {
|
||||
@@ -2679,7 +2678,6 @@ static void __d_materialise_dentry(struc
|
||||
dparent = dentry->d_parent;
|
||||
|
||||
switch_names(dentry, anon);
|
||||
- swap(dentry->d_name.hash, anon->d_name.hash);
|
||||
|
||||
dentry->d_parent = dentry;
|
||||
list_del_init(&dentry->d_u.d_child);
|
|
@ -1,53 +0,0 @@
|
|||
From a636289fb6037392c3551aeed1033576c3aef426 Mon Sep 17 00:00:00 2001
|
||||
From: Ian Campbell <ian.campbell@citrix.com>
|
||||
Date: Tue, 25 Nov 2014 15:05:13 +0000
|
||||
Subject: [PATCH] of/fdt: memblock_reserve /memreserve/ regions in the case of
|
||||
partial overlap
|
||||
Origin: https://git.kernel.org/cgit/linux/kernel/git/glikely/linux.git/commit/?h=devicetree/merge&id=094cb98179f19b75acf9ff471daabf3948ce98e6
|
||||
|
||||
memblock_is_region_reserved() returns true in the case of a partial
|
||||
overlap, meaning that the current code fails to reserve the
|
||||
non-overlapping portion.
|
||||
|
||||
This call was introduced as part of d1552ce449eb "of/fdt: move
|
||||
memreserve and dtb memory reservations into core" which went into
|
||||
v3.16.
|
||||
|
||||
I observed this causing a Midway system with a buggy fdt (the header
|
||||
declares itself to be larger than it really is) failing to boot
|
||||
because the over-inflated size of the fdt was causing it to seem to
|
||||
run into the swapper_pg_dir region, meaning the DT wasn't reserved.
|
||||
The symptoms were failing to find an disks or network and failing to
|
||||
boot.
|
||||
|
||||
However given the ambiguity of whether things like the initrd are
|
||||
covered by /memreserve/ and similar I think it is best to also
|
||||
register the region rather than just ignoring it.
|
||||
|
||||
Since memblock_reserve() handles overlaps just fine lets just warn and
|
||||
carry on.
|
||||
|
||||
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
|
||||
Signed-off-by: Grant Likely <grant.likely@linaro.org>
|
||||
Cc: Rob Herring <robh+dt@kernel.org>
|
||||
Cc: stable@vger.kernel.org # v3.16+
|
||||
---
|
||||
drivers/of/fdt.c | 2 --
|
||||
1 file changed, 2 deletions(-)
|
||||
|
||||
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
|
||||
index 379ad4f..94a8511 100644
|
||||
--- a/drivers/of/fdt.c
|
||||
+++ b/drivers/of/fdt.c
|
||||
@@ -960,8 +960,6 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size)
|
||||
int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
|
||||
phys_addr_t size, bool nomap)
|
||||
{
|
||||
- if (memblock_is_region_reserved(base, size))
|
||||
- return -EBUSY;
|
||||
if (nomap)
|
||||
return memblock_remove(base, size);
|
||||
return memblock_reserve(base, size);
|
||||
--
|
||||
2.1.3
|
||||
|
|
@ -1,129 +0,0 @@
|
|||
Subject: Revert "drivers/net: Disable UFO through virtio" in macvtap and tun
|
||||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Date: Tue, 11 Nov 2014 17:12:58 +0000
|
||||
|
||||
This reverts commit 88e0e0e5aa722b193c8758c8b45d041de5316924 for
|
||||
the tap drivers, but leaves UFO disabled in virtio_net.
|
||||
|
||||
libvirt at least assumes that tap features will never be dropped
|
||||
in new kernel versions, and doing so prevents migration of VMs to
|
||||
the never kernel version while they are running with virtio net
|
||||
devices.
|
||||
|
||||
Fixes: 88e0e0e5aa7a ("drivers/net: Disable UFO through virtio")
|
||||
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||||
---
|
||||
drivers/net/macvtap.c | 13 ++++++++-----
|
||||
drivers/net/tun.c | 19 ++++++++-----------
|
||||
2 files changed, 16 insertions(+), 16 deletions(-)
|
||||
|
||||
--- a/drivers/net/macvtap.c
|
||||
+++ b/drivers/net/macvtap.c
|
||||
@@ -66,7 +66,7 @@ static struct cdev macvtap_cdev;
|
||||
static const struct proto_ops macvtap_socket_ops;
|
||||
|
||||
#define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
|
||||
- NETIF_F_TSO6)
|
||||
+ NETIF_F_TSO6 | NETIF_F_UFO)
|
||||
#define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
|
||||
#define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
|
||||
|
||||
@@ -570,8 +570,6 @@ static int macvtap_skb_from_vnet_hdr(str
|
||||
gso_type = SKB_GSO_TCPV6;
|
||||
break;
|
||||
case VIRTIO_NET_HDR_GSO_UDP:
|
||||
- pr_warn_once("macvtap: %s: using disabled UFO feature; please fix this program\n",
|
||||
- current->comm);
|
||||
gso_type = SKB_GSO_UDP;
|
||||
if (skb->protocol == htons(ETH_P_IPV6))
|
||||
ipv6_proxy_select_ident(skb);
|
||||
@@ -619,6 +617,8 @@ static void macvtap_skb_to_vnet_hdr(cons
|
||||
vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
|
||||
else if (sinfo->gso_type & SKB_GSO_TCPV6)
|
||||
vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
|
||||
+ else if (sinfo->gso_type & SKB_GSO_UDP)
|
||||
+ vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP;
|
||||
else
|
||||
BUG();
|
||||
if (sinfo->gso_type & SKB_GSO_TCP_ECN)
|
||||
@@ -955,6 +955,9 @@ static int set_offload(struct macvtap_qu
|
||||
if (arg & TUN_F_TSO6)
|
||||
feature_mask |= NETIF_F_TSO6;
|
||||
}
|
||||
+
|
||||
+ if (arg & TUN_F_UFO)
|
||||
+ feature_mask |= NETIF_F_UFO;
|
||||
}
|
||||
|
||||
/* tun/tap driver inverts the usage for TSO offloads, where
|
||||
@@ -965,7 +968,7 @@ static int set_offload(struct macvtap_qu
|
||||
* When user space turns off TSO, we turn off GSO/LRO so that
|
||||
* user-space will not receive TSO frames.
|
||||
*/
|
||||
- if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6))
|
||||
+ if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_UFO))
|
||||
features |= RX_OFFLOADS;
|
||||
else
|
||||
features &= ~RX_OFFLOADS;
|
||||
@@ -1066,7 +1069,7 @@ static long macvtap_ioctl(struct file *f
|
||||
case TUNSETOFFLOAD:
|
||||
/* let the user check for future flags */
|
||||
if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
|
||||
- TUN_F_TSO_ECN))
|
||||
+ TUN_F_TSO_ECN | TUN_F_UFO))
|
||||
return -EINVAL;
|
||||
|
||||
rtnl_lock();
|
||||
--- a/drivers/net/tun.c
|
||||
+++ b/drivers/net/tun.c
|
||||
@@ -175,7 +175,7 @@ struct tun_struct {
|
||||
struct net_device *dev;
|
||||
netdev_features_t set_features;
|
||||
#define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
|
||||
- NETIF_F_TSO6)
|
||||
+ NETIF_F_TSO6|NETIF_F_UFO)
|
||||
|
||||
int vnet_hdr_sz;
|
||||
int sndbuf;
|
||||
@@ -1152,20 +1152,10 @@ static ssize_t tun_get_user(struct tun_s
|
||||
skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
|
||||
break;
|
||||
case VIRTIO_NET_HDR_GSO_UDP:
|
||||
- {
|
||||
- static bool warned;
|
||||
-
|
||||
- if (!warned) {
|
||||
- warned = true;
|
||||
- netdev_warn(tun->dev,
|
||||
- "%s: using disabled UFO feature; please fix this program\n",
|
||||
- current->comm);
|
||||
- }
|
||||
skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
|
||||
if (skb->protocol == htons(ETH_P_IPV6))
|
||||
ipv6_proxy_select_ident(skb);
|
||||
break;
|
||||
- }
|
||||
default:
|
||||
tun->dev->stats.rx_frame_errors++;
|
||||
kfree_skb(skb);
|
||||
@@ -1269,6 +1259,8 @@ static ssize_t tun_put_user(struct tun_s
|
||||
gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
|
||||
else if (sinfo->gso_type & SKB_GSO_TCPV6)
|
||||
gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
|
||||
+ else if (sinfo->gso_type & SKB_GSO_UDP)
|
||||
+ gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
|
||||
else {
|
||||
pr_err("unexpected GSO type: "
|
||||
"0x%x, gso_size %d, hdr_len %d\n",
|
||||
@@ -1775,6 +1767,11 @@ static int set_offload(struct tun_struct
|
||||
features |= NETIF_F_TSO6;
|
||||
arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
|
||||
}
|
||||
+
|
||||
+ if (arg & TUN_F_UFO) {
|
||||
+ features |= NETIF_F_UFO;
|
||||
+ arg &= ~TUN_F_UFO;
|
||||
+ }
|
||||
}
|
||||
|
||||
/* This gives the user a way to test for new features in future by
|
|
@ -1,115 +0,0 @@
|
|||
From: Mikhail Efremov <sem@altlinux.org>
|
||||
Date: Wed, 24 Sep 2014 22:14:33 +0400
|
||||
Subject: vfs: Don't exchange "short" filenames unconditionally.
|
||||
Origin: https://git.kernel.org/linus/d2fa4a8476b911782f7e5167db18770222ac40c3
|
||||
|
||||
Only exchange source and destination filenames
|
||||
if flags contain RENAME_EXCHANGE.
|
||||
In case if executable file was running and replaced by
|
||||
other file /proc/PID/exe should still show correct file name,
|
||||
not the old name of the file by which it was replaced.
|
||||
|
||||
The scenario when this bug manifests itself was like this:
|
||||
* ALT Linux uses rpm and start-stop-daemon;
|
||||
* during a package upgrade rpm creates a temporary file
|
||||
for an executable to rename it upon successful unpacking;
|
||||
* start-stop-daemon is run subsequently and it obtains
|
||||
the (nonexistant) temporary filename via /proc/PID/exe
|
||||
thus failing to identify the running process.
|
||||
|
||||
Note that "long" filenames (> DNAiME_INLINE_LEN) are still
|
||||
exchanged without RENAME_EXCHANGE and this behaviour exists
|
||||
long enough (should be fixed too apparently).
|
||||
So this patch is just an interim workaround that restores
|
||||
behavior for "short" names as it was before changes
|
||||
introduced by commit da1ce0670c14 ("vfs: add cross-rename").
|
||||
|
||||
See https://lkml.org/lkml/2014/9/7/6 for details.
|
||||
|
||||
AV: the comments about being more careful with ->d_name.hash
|
||||
than with ->d_name.name are from back in 2.3.40s; they
|
||||
became obsolete by 2.3.60s, when we started to unhash the
|
||||
target instead of swapping hash chain positions followed
|
||||
by d_delete() as we used to do when dcache was first
|
||||
introduced.
|
||||
|
||||
Acked-by: Miklos Szeredi <mszeredi@suse.cz>
|
||||
Cc: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
|
||||
Cc: linux-fsdevel@vger.kernel.org
|
||||
Cc: stable@vger.kernel.org
|
||||
Fixes: da1ce0670c14 "vfs: add cross-rename"
|
||||
Signed-off-by: Mikhail Efremov <sem@altlinux.org>
|
||||
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
||||
[bwh: Backported to 3.16:
|
||||
- Adjust context
|
||||
- Change __d_materialise_dentry() as well]
|
||||
---
|
||||
fs/dcache.c | 27 ++++++++++++++++++---------
|
||||
1 file changed, 18 insertions(+), 9 deletions(-)
|
||||
|
||||
--- a/fs/dcache.c
|
||||
+++ b/fs/dcache.c
|
||||
@@ -2401,7 +2401,8 @@ void dentry_update_name_case(struct dent
|
||||
}
|
||||
EXPORT_SYMBOL(dentry_update_name_case);
|
||||
|
||||
-static void switch_names(struct dentry *dentry, struct dentry *target)
|
||||
+static void switch_names(struct dentry *dentry, struct dentry *target,
|
||||
+ bool exchange)
|
||||
{
|
||||
if (dname_external(target)) {
|
||||
if (dname_external(dentry)) {
|
||||
@@ -2435,6 +2436,12 @@ static void switch_names(struct dentry *
|
||||
*/
|
||||
unsigned int i;
|
||||
BUILD_BUG_ON(!IS_ALIGNED(DNAME_INLINE_LEN, sizeof(long)));
|
||||
+ if (!exchange) {
|
||||
+ memcpy(dentry->d_iname, target->d_name.name,
|
||||
+ target->d_name.len + 1);
|
||||
+ dentry->d_name.hash_len = target->d_name.hash_len;
|
||||
+ return;
|
||||
+ }
|
||||
for (i = 0; i < DNAME_INLINE_LEN / sizeof(long); i++) {
|
||||
swap(((long *) &dentry->d_iname)[i],
|
||||
((long *) &target->d_iname)[i]);
|
||||
@@ -2484,12 +2491,15 @@ static void dentry_unlock_parents_for_mo
|
||||
* When switching names, the actual string doesn't strictly have to
|
||||
* be preserved in the target - because we're dropping the target
|
||||
* anyway. As such, we can just do a simple memcpy() to copy over
|
||||
- * the new name before we switch.
|
||||
- *
|
||||
- * Note that we have to be a lot more careful about getting the hash
|
||||
- * switched - we have to switch the hash value properly even if it
|
||||
- * then no longer matches the actual (corrupted) string of the target.
|
||||
- * The hash value has to match the hash queue that the dentry is on..
|
||||
+ * the new name before we switch, unless we are going to rehash
|
||||
+ * it. Note that if we *do* unhash the target, we are not allowed
|
||||
+ * to rehash it without giving it a new name/hash key - whether
|
||||
+ * we swap or overwrite the names here, resulting name won't match
|
||||
+ * the reality in filesystem; it's only there for d_path() purposes.
|
||||
+ * Note that all of this is happening under rename_lock, so the
|
||||
+ * any hash lookup seeing it in the middle of manipulations will
|
||||
+ * be discarded anyway. So we do not care what happens to the hash
|
||||
+ * key in that case.
|
||||
*/
|
||||
/*
|
||||
* __d_move - move a dentry
|
||||
@@ -2539,7 +2549,7 @@ static void __d_move(struct dentry *dent
|
||||
list_del(&target->d_u.d_child);
|
||||
|
||||
/* Switch the names.. */
|
||||
- switch_names(dentry, target);
|
||||
+ switch_names(dentry, target, exchange);
|
||||
|
||||
/* ... and switch the parents */
|
||||
if (IS_ROOT(dentry)) {
|
||||
@@ -2677,7 +2687,7 @@ static void __d_materialise_dentry(struc
|
||||
|
||||
dparent = dentry->d_parent;
|
||||
|
||||
- switch_names(dentry, anon);
|
||||
+ switch_names(dentry, anon, false);
|
||||
|
||||
dentry->d_parent = dentry;
|
||||
list_del_init(&dentry->d_u.d_child);
|
|
@ -1,37 +0,0 @@
|
|||
From: Andreas Schwab <schwab@suse.de>
|
||||
Date: Thu, 24 Jul 2014 17:03:26 +0100
|
||||
Subject: [PATCH] arm64/crypto: fix makefile rule for aes-glue-%.o
|
||||
Origin: https://git.kernel.org/linus/7c2105fbe9658d6cee18751568e29579bb58bfec
|
||||
|
||||
This fixes the following build failure when building with CONFIG_MODVERSIONS
|
||||
enabled:
|
||||
|
||||
CC [M] arch/arm64/crypto/aes-glue-ce.o
|
||||
ld: cannot find arch/arm64/crypto/aes-glue-ce.o: No such file or directory
|
||||
make[1]: *** [arch/arm64/crypto/aes-ce-blk.o] Error 1
|
||||
make: *** [arch/arm64/crypto] Error 2
|
||||
|
||||
The $(obj)/aes-glue-%.o rule only creates $(obj)/.tmp_aes-glue-ce.o, it
|
||||
should use if_changed_rule instead of if_changed_dep.
|
||||
|
||||
Signed-off-by: Andreas Schwab <schwab@suse.de>
|
||||
[ardb: mention CONFIG_MODVERSIONS in commit log]
|
||||
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
|
||||
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
|
||||
---
|
||||
arch/arm64/crypto/Makefile | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile
|
||||
index 2070a56..a3f935f 100644
|
||||
--- a/arch/arm64/crypto/Makefile
|
||||
+++ b/arch/arm64/crypto/Makefile
|
||||
@@ -35,4 +35,4 @@ AFLAGS_aes-neon.o := -DINTERLEAVE=4
|
||||
CFLAGS_aes-glue-ce.o := -DUSE_V8_CRYPTO_EXTENSIONS
|
||||
|
||||
$(obj)/aes-glue-%.o: $(src)/aes-glue.c FORCE
|
||||
- $(call if_changed_dep,cc_o_c)
|
||||
+ $(call if_changed_rule,cc_o_c)
|
||||
--
|
||||
2.1.0
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
From: Andy Lutomirski <luto@amacapital.net>
|
||||
Date: Mon, 24 Nov 2014 17:39:06 -0800
|
||||
Subject: x86/asm/traps: Disable tracing and kprobes in fixup_bad_iret and
|
||||
sync_regs
|
||||
Origin: https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit?id=7ddc6a2199f1da405a2fb68c40db8899b1a8cd87
|
||||
|
||||
These functions can be executed on the int3 stack, so kprobes
|
||||
are dangerous. Tracing is probably a bad idea, too.
|
||||
|
||||
Fixes: b645af2d5905 ("x86_64, traps: Rework bad_iret")
|
||||
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
|
||||
Cc: <stable@vger.kernel.org> # Backport as far back as it would apply
|
||||
Cc: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
Cc: Steven Rostedt <rostedt@goodmis.org>
|
||||
Link: http://lkml.kernel.org/r/50e33d26adca60816f3ba968875801652507d0c4.1416870125.git.luto@amacapital.net
|
||||
Signed-off-by: Ingo Molnar <mingo@kernel.org>
|
||||
---
|
||||
arch/x86/kernel/traps.c | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
|
||||
index de801f2..07ab8e9 100644
|
||||
--- a/arch/x86/kernel/traps.c
|
||||
+++ b/arch/x86/kernel/traps.c
|
||||
@@ -387,7 +387,7 @@ NOKPROBE_SYMBOL(do_int3);
|
||||
* for scheduling or signal handling. The actual stack switch is done in
|
||||
* entry.S
|
||||
*/
|
||||
-asmlinkage __visible struct pt_regs *sync_regs(struct pt_regs *eregs)
|
||||
+asmlinkage __visible notrace struct pt_regs *sync_regs(struct pt_regs *eregs)
|
||||
{
|
||||
struct pt_regs *regs = eregs;
|
||||
/* Did already sync */
|
||||
@@ -413,7 +413,7 @@ struct bad_iret_stack {
|
||||
struct pt_regs regs;
|
||||
};
|
||||
|
||||
-asmlinkage __visible
|
||||
+asmlinkage __visible notrace
|
||||
struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
|
||||
{
|
||||
/*
|
||||
@@ -436,6 +436,7 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
|
||||
BUG_ON(!user_mode_vm(&new_stack->regs));
|
||||
return new_stack;
|
||||
}
|
||||
+NOKPROBE_SYMBOL(fixup_bad_iret);
|
||||
#endif
|
||||
|
||||
/*
|
|
@ -1,111 +0,0 @@
|
|||
From: Andy Lutomirski <luto@amacapital.net>
|
||||
Date: Sat, 22 Nov 2014 18:00:31 -0800
|
||||
Subject: x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C
|
||||
Origin: https://git.kernel.org/linus/af726f21ed8af2cdaa4e93098dc211521218ae65
|
||||
|
||||
There's nothing special enough about the espfix64 double fault fixup to
|
||||
justify writing it in assembly. Move it to C.
|
||||
|
||||
This also fixes a bug: if the double fault came from an IST stack, the
|
||||
old asm code would return to a partially uninitialized stack frame.
|
||||
|
||||
Fixes: 3891a04aafd668686239349ea58f3314ea2af86b
|
||||
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
|
||||
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
arch/x86/kernel/entry_64.S | 34 ++--------------------------------
|
||||
arch/x86/kernel/traps.c | 24 ++++++++++++++++++++++++
|
||||
2 files changed, 26 insertions(+), 32 deletions(-)
|
||||
|
||||
--- a/arch/x86/kernel/entry_64.S
|
||||
+++ b/arch/x86/kernel/entry_64.S
|
||||
@@ -860,6 +860,7 @@ ENTRY(native_iret)
|
||||
jnz native_irq_return_ldt
|
||||
#endif
|
||||
|
||||
+.global native_irq_return_iret
|
||||
native_irq_return_iret:
|
||||
iretq
|
||||
_ASM_EXTABLE(native_irq_return_iret, bad_iret)
|
||||
@@ -954,37 +955,6 @@ ENTRY(retint_kernel)
|
||||
CFI_ENDPROC
|
||||
END(common_interrupt)
|
||||
|
||||
- /*
|
||||
- * If IRET takes a fault on the espfix stack, then we
|
||||
- * end up promoting it to a doublefault. In that case,
|
||||
- * modify the stack to make it look like we just entered
|
||||
- * the #GP handler from user space, similar to bad_iret.
|
||||
- */
|
||||
-#ifdef CONFIG_X86_ESPFIX64
|
||||
- ALIGN
|
||||
-__do_double_fault:
|
||||
- XCPT_FRAME 1 RDI+8
|
||||
- movq RSP(%rdi),%rax /* Trap on the espfix stack? */
|
||||
- sarq $PGDIR_SHIFT,%rax
|
||||
- cmpl $ESPFIX_PGD_ENTRY,%eax
|
||||
- jne do_double_fault /* No, just deliver the fault */
|
||||
- cmpl $__KERNEL_CS,CS(%rdi)
|
||||
- jne do_double_fault
|
||||
- movq RIP(%rdi),%rax
|
||||
- cmpq $native_irq_return_iret,%rax
|
||||
- jne do_double_fault /* This shouldn't happen... */
|
||||
- movq PER_CPU_VAR(kernel_stack),%rax
|
||||
- subq $(6*8-KERNEL_STACK_OFFSET),%rax /* Reset to original stack */
|
||||
- movq %rax,RSP(%rdi)
|
||||
- movq $0,(%rax) /* Missing (lost) #GP error code */
|
||||
- movq $general_protection,RIP(%rdi)
|
||||
- retq
|
||||
- CFI_ENDPROC
|
||||
-END(__do_double_fault)
|
||||
-#else
|
||||
-# define __do_double_fault do_double_fault
|
||||
-#endif
|
||||
-
|
||||
/*
|
||||
* APIC interrupts.
|
||||
*/
|
||||
@@ -1156,7 +1126,7 @@ idtentry overflow do_overflow has_error_
|
||||
idtentry bounds do_bounds has_error_code=0
|
||||
idtentry invalid_op do_invalid_op has_error_code=0
|
||||
idtentry device_not_available do_device_not_available has_error_code=0
|
||||
-idtentry double_fault __do_double_fault has_error_code=1 paranoid=1
|
||||
+idtentry double_fault do_double_fault has_error_code=1 paranoid=1
|
||||
idtentry coprocessor_segment_overrun do_coprocessor_segment_overrun has_error_code=0
|
||||
idtentry invalid_TSS do_invalid_TSS has_error_code=1
|
||||
idtentry segment_not_present do_segment_not_present has_error_code=1
|
||||
--- a/arch/x86/kernel/traps.c
|
||||
+++ b/arch/x86/kernel/traps.c
|
||||
@@ -243,6 +243,30 @@ dotraplinkage void do_double_fault(struc
|
||||
static const char str[] = "double fault";
|
||||
struct task_struct *tsk = current;
|
||||
|
||||
+#ifdef CONFIG_X86_ESPFIX64
|
||||
+ extern unsigned char native_irq_return_iret[];
|
||||
+
|
||||
+ /*
|
||||
+ * If IRET takes a non-IST fault on the espfix64 stack, then we
|
||||
+ * end up promoting it to a doublefault. In that case, modify
|
||||
+ * the stack to make it look like we just entered the #GP
|
||||
+ * handler from user space, similar to bad_iret.
|
||||
+ */
|
||||
+ if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
|
||||
+ regs->cs == __KERNEL_CS &&
|
||||
+ regs->ip == (unsigned long)native_irq_return_iret)
|
||||
+ {
|
||||
+ struct pt_regs *normal_regs = task_pt_regs(current);
|
||||
+
|
||||
+ /* Fake a #GP(0) from userspace. */
|
||||
+ memmove(&normal_regs->ip, (void *)regs->sp, 5*8);
|
||||
+ normal_regs->orig_ax = 0; /* Missing (lost) #GP error code */
|
||||
+ regs->ip = (unsigned long)general_protection;
|
||||
+ regs->sp = (unsigned long)&normal_regs->orig_ax;
|
||||
+ return;
|
||||
+ }
|
||||
+#endif
|
||||
+
|
||||
exception_enter();
|
||||
/* Return not checked because double check cannot be ignored */
|
||||
notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);
|
|
@ -1,154 +0,0 @@
|
|||
From: Andy Lutomirski <luto@amacapital.net>
|
||||
Date: Sat, 22 Nov 2014 18:00:33 -0800
|
||||
Subject: x86_64, traps: Rework bad_iret
|
||||
Origin: https://git.kernel.org/linus/b645af2d5905c4e32399005b867987919cbfc3ae
|
||||
|
||||
It's possible for iretq to userspace to fail. This can happen because
|
||||
of a bad CS, SS, or RIP.
|
||||
|
||||
Historically, we've handled it by fixing up an exception from iretq to
|
||||
land at bad_iret, which pretends that the failed iret frame was really
|
||||
the hardware part of #GP(0) from userspace. To make this work, there's
|
||||
an extra fixup to fudge the gs base into a usable state.
|
||||
|
||||
This is suboptimal because it loses the original exception. It's also
|
||||
buggy because there's no guarantee that we were on the kernel stack to
|
||||
begin with. For example, if the failing iret happened on return from an
|
||||
NMI, then we'll end up executing general_protection on the NMI stack.
|
||||
This is bad for several reasons, the most immediate of which is that
|
||||
general_protection, as a non-paranoid idtentry, will try to deliver
|
||||
signals and/or schedule from the wrong stack.
|
||||
|
||||
This patch throws out bad_iret entirely. As a replacement, it augments
|
||||
the existing swapgs fudge into a full-blown iret fixup, mostly written
|
||||
in C. It's should be clearer and more correct.
|
||||
|
||||
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
|
||||
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
[bwh: Backported to 3.16: adjust context]
|
||||
---
|
||||
arch/x86/kernel/entry_64.S | 45 +++++++++++++++++++--------------------------
|
||||
arch/x86/kernel/traps.c | 29 +++++++++++++++++++++++++++++
|
||||
2 files changed, 48 insertions(+), 26 deletions(-)
|
||||
|
||||
--- a/arch/x86/kernel/entry_64.S
|
||||
+++ b/arch/x86/kernel/entry_64.S
|
||||
@@ -862,8 +862,13 @@ ENTRY(native_iret)
|
||||
|
||||
.global native_irq_return_iret
|
||||
native_irq_return_iret:
|
||||
+ /*
|
||||
+ * This may fault. Non-paranoid faults on return to userspace are
|
||||
+ * handled by fixup_bad_iret. These include #SS, #GP, and #NP.
|
||||
+ * Double-faults due to espfix64 are handled in do_double_fault.
|
||||
+ * Other faults here are fatal.
|
||||
+ */
|
||||
iretq
|
||||
- _ASM_EXTABLE(native_irq_return_iret, bad_iret)
|
||||
|
||||
#ifdef CONFIG_X86_ESPFIX64
|
||||
native_irq_return_ldt:
|
||||
@@ -891,25 +896,6 @@ native_irq_return_ldt:
|
||||
jmp native_irq_return_iret
|
||||
#endif
|
||||
|
||||
- .section .fixup,"ax"
|
||||
-bad_iret:
|
||||
- /*
|
||||
- * The iret traps when the %cs or %ss being restored is bogus.
|
||||
- * We've lost the original trap vector and error code.
|
||||
- * #GPF is the most likely one to get for an invalid selector.
|
||||
- * So pretend we completed the iret and took the #GPF in user mode.
|
||||
- *
|
||||
- * We are now running with the kernel GS after exception recovery.
|
||||
- * But error_entry expects us to have user GS to match the user %cs,
|
||||
- * so swap back.
|
||||
- */
|
||||
- pushq $0
|
||||
-
|
||||
- SWAPGS
|
||||
- jmp general_protection
|
||||
-
|
||||
- .previous
|
||||
-
|
||||
/* edi: workmask, edx: work */
|
||||
retint_careful:
|
||||
CFI_RESTORE_STATE
|
||||
@@ -1401,16 +1387,15 @@ error_sti:
|
||||
|
||||
/*
|
||||
* There are two places in the kernel that can potentially fault with
|
||||
- * usergs. Handle them here. The exception handlers after iret run with
|
||||
- * kernel gs again, so don't set the user space flag. B stepping K8s
|
||||
- * sometimes report an truncated RIP for IRET exceptions returning to
|
||||
- * compat mode. Check for these here too.
|
||||
+ * usergs. Handle them here. B stepping K8s sometimes report a
|
||||
+ * truncated RIP for IRET exceptions returning to compat mode. Check
|
||||
+ * for these here too.
|
||||
*/
|
||||
error_kernelspace:
|
||||
incl %ebx
|
||||
leaq native_irq_return_iret(%rip),%rcx
|
||||
cmpq %rcx,RIP+8(%rsp)
|
||||
- je error_swapgs
|
||||
+ je error_bad_iret
|
||||
movl %ecx,%eax /* zero extend */
|
||||
cmpq %rax,RIP+8(%rsp)
|
||||
je bstep_iret
|
||||
@@ -1421,7 +1406,15 @@ error_kernelspace:
|
||||
bstep_iret:
|
||||
/* Fix truncated RIP */
|
||||
movq %rcx,RIP+8(%rsp)
|
||||
- jmp error_swapgs
|
||||
+ /* fall through */
|
||||
+
|
||||
+error_bad_iret:
|
||||
+ SWAPGS
|
||||
+ mov %rsp,%rdi
|
||||
+ call fixup_bad_iret
|
||||
+ mov %rax,%rsp
|
||||
+ decl %ebx /* Return to usergs */
|
||||
+ jmp error_sti
|
||||
CFI_ENDPROC
|
||||
END(error_entry)
|
||||
|
||||
--- a/arch/x86/kernel/traps.c
|
||||
+++ b/arch/x86/kernel/traps.c
|
||||
@@ -407,6 +407,35 @@ asmlinkage __visible struct pt_regs *syn
|
||||
return regs;
|
||||
}
|
||||
NOKPROBE_SYMBOL(sync_regs);
|
||||
+
|
||||
+struct bad_iret_stack {
|
||||
+ void *error_entry_ret;
|
||||
+ struct pt_regs regs;
|
||||
+};
|
||||
+
|
||||
+asmlinkage __visible
|
||||
+struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
|
||||
+{
|
||||
+ /*
|
||||
+ * This is called from entry_64.S early in handling a fault
|
||||
+ * caused by a bad iret to user mode. To handle the fault
|
||||
+ * correctly, we want move our stack frame to task_pt_regs
|
||||
+ * and we want to pretend that the exception came from the
|
||||
+ * iret target.
|
||||
+ */
|
||||
+ struct bad_iret_stack *new_stack =
|
||||
+ container_of(task_pt_regs(current),
|
||||
+ struct bad_iret_stack, regs);
|
||||
+
|
||||
+ /* Copy the IRET target to the new stack. */
|
||||
+ memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
|
||||
+
|
||||
+ /* Copy the remainder of the stack from the current stack. */
|
||||
+ memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
|
||||
+
|
||||
+ BUG_ON(!user_mode_vm(&new_stack->regs));
|
||||
+ return new_stack;
|
||||
+}
|
||||
#endif
|
||||
|
||||
/*
|
|
@ -1,131 +0,0 @@
|
|||
From: Andy Lutomirski <luto@amacapital.net>
|
||||
Date: Sat, 22 Nov 2014 18:00:32 -0800
|
||||
Subject: x86_64, traps: Stop using IST for #SS
|
||||
Origin: https://git.kernel.org/linus/6f442be2fb22be02cafa606f1769fa1e6f894441
|
||||
|
||||
On a 32-bit kernel, this has no effect, since there are no IST stacks.
|
||||
|
||||
On a 64-bit kernel, #SS can only happen in user code, on a failed iret
|
||||
to user space, a canonical violation on access via RSP or RBP, or a
|
||||
genuine stack segment violation in 32-bit kernel code. The first two
|
||||
cases don't need IST, and the latter two cases are unlikely fatal bugs,
|
||||
and promoting them to double faults would be fine.
|
||||
|
||||
This fixes a bug in which the espfix64 code mishandles a stack segment
|
||||
violation.
|
||||
|
||||
This saves 4k of memory per CPU and a tiny bit of code.
|
||||
|
||||
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
|
||||
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
arch/x86/include/asm/page_32_types.h | 1 -
|
||||
arch/x86/include/asm/page_64_types.h | 11 +++++------
|
||||
arch/x86/include/asm/traps.h | 1 +
|
||||
arch/x86/kernel/dumpstack_64.c | 1 -
|
||||
arch/x86/kernel/entry_64.S | 2 +-
|
||||
arch/x86/kernel/traps.c | 18 +-----------------
|
||||
6 files changed, 8 insertions(+), 26 deletions(-)
|
||||
|
||||
--- a/arch/x86/include/asm/page_32_types.h
|
||||
+++ b/arch/x86/include/asm/page_32_types.h
|
||||
@@ -20,7 +20,6 @@
|
||||
#define THREAD_SIZE_ORDER 1
|
||||
#define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER)
|
||||
|
||||
-#define STACKFAULT_STACK 0
|
||||
#define DOUBLEFAULT_STACK 1
|
||||
#define NMI_STACK 0
|
||||
#define DEBUG_STACK 0
|
||||
--- a/arch/x86/include/asm/page_64_types.h
|
||||
+++ b/arch/x86/include/asm/page_64_types.h
|
||||
@@ -14,12 +14,11 @@
|
||||
#define IRQ_STACK_ORDER 2
|
||||
#define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER)
|
||||
|
||||
-#define STACKFAULT_STACK 1
|
||||
-#define DOUBLEFAULT_STACK 2
|
||||
-#define NMI_STACK 3
|
||||
-#define DEBUG_STACK 4
|
||||
-#define MCE_STACK 5
|
||||
-#define N_EXCEPTION_STACKS 5 /* hw limit: 7 */
|
||||
+#define DOUBLEFAULT_STACK 1
|
||||
+#define NMI_STACK 2
|
||||
+#define DEBUG_STACK 3
|
||||
+#define MCE_STACK 4
|
||||
+#define N_EXCEPTION_STACKS 4 /* hw limit: 7 */
|
||||
|
||||
#define PUD_PAGE_SIZE (_AC(1, UL) << PUD_SHIFT)
|
||||
#define PUD_PAGE_MASK (~(PUD_PAGE_SIZE-1))
|
||||
--- a/arch/x86/include/asm/traps.h
|
||||
+++ b/arch/x86/include/asm/traps.h
|
||||
@@ -39,6 +39,7 @@ asmlinkage void simd_coprocessor_error(v
|
||||
|
||||
#ifdef CONFIG_TRACING
|
||||
asmlinkage void trace_page_fault(void);
|
||||
+#define trace_stack_segment stack_segment
|
||||
#define trace_divide_error divide_error
|
||||
#define trace_bounds bounds
|
||||
#define trace_invalid_op invalid_op
|
||||
--- a/arch/x86/kernel/dumpstack_64.c
|
||||
+++ b/arch/x86/kernel/dumpstack_64.c
|
||||
@@ -24,7 +24,6 @@ static char x86_stack_ids[][8] = {
|
||||
[ DEBUG_STACK-1 ] = "#DB",
|
||||
[ NMI_STACK-1 ] = "NMI",
|
||||
[ DOUBLEFAULT_STACK-1 ] = "#DF",
|
||||
- [ STACKFAULT_STACK-1 ] = "#SS",
|
||||
[ MCE_STACK-1 ] = "#MC",
|
||||
#if DEBUG_STKSZ > EXCEPTION_STKSZ
|
||||
[ N_EXCEPTION_STACKS ...
|
||||
--- a/arch/x86/kernel/entry_64.S
|
||||
+++ b/arch/x86/kernel/entry_64.S
|
||||
@@ -1321,7 +1321,7 @@ apicinterrupt3 HYPERVISOR_CALLBACK_VECTO
|
||||
|
||||
idtentry debug do_debug has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK
|
||||
idtentry int3 do_int3 has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK
|
||||
-idtentry stack_segment do_stack_segment has_error_code=1 paranoid=1
|
||||
+idtentry stack_segment do_stack_segment has_error_code=1
|
||||
#ifdef CONFIG_XEN
|
||||
idtentry xen_debug do_debug has_error_code=0
|
||||
idtentry xen_int3 do_int3 has_error_code=0
|
||||
--- a/arch/x86/kernel/traps.c
|
||||
+++ b/arch/x86/kernel/traps.c
|
||||
@@ -233,27 +233,11 @@ DO_ERROR(X86_TRAP_UD, SIGILL, "inva
|
||||
DO_ERROR(X86_TRAP_OLD_MF, SIGFPE, "coprocessor segment overrun",coprocessor_segment_overrun)
|
||||
DO_ERROR(X86_TRAP_TS, SIGSEGV, "invalid TSS", invalid_TSS)
|
||||
DO_ERROR(X86_TRAP_NP, SIGBUS, "segment not present", segment_not_present)
|
||||
-#ifdef CONFIG_X86_32
|
||||
DO_ERROR(X86_TRAP_SS, SIGBUS, "stack segment", stack_segment)
|
||||
-#endif
|
||||
DO_ERROR(X86_TRAP_AC, SIGBUS, "alignment check", alignment_check)
|
||||
|
||||
#ifdef CONFIG_X86_64
|
||||
/* Runs on IST stack */
|
||||
-dotraplinkage void do_stack_segment(struct pt_regs *regs, long error_code)
|
||||
-{
|
||||
- enum ctx_state prev_state;
|
||||
-
|
||||
- prev_state = exception_enter();
|
||||
- if (notify_die(DIE_TRAP, "stack segment", regs, error_code,
|
||||
- X86_TRAP_SS, SIGBUS) != NOTIFY_STOP) {
|
||||
- preempt_conditional_sti(regs);
|
||||
- do_trap(X86_TRAP_SS, SIGBUS, "stack segment", regs, error_code, NULL);
|
||||
- preempt_conditional_cli(regs);
|
||||
- }
|
||||
- exception_exit(prev_state);
|
||||
-}
|
||||
-
|
||||
dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
|
||||
{
|
||||
static const char str[] = "double fault";
|
||||
@@ -778,7 +762,7 @@ void __init trap_init(void)
|
||||
set_intr_gate(X86_TRAP_OLD_MF, coprocessor_segment_overrun);
|
||||
set_intr_gate(X86_TRAP_TS, invalid_TSS);
|
||||
set_intr_gate(X86_TRAP_NP, segment_not_present);
|
||||
- set_intr_gate_ist(X86_TRAP_SS, &stack_segment, STACKFAULT_STACK);
|
||||
+ set_intr_gate(X86_TRAP_SS, stack_segment);
|
||||
set_intr_gate(X86_TRAP_GP, general_protection);
|
||||
set_intr_gate(X86_TRAP_SPURIOUS, spurious_interrupt_bug);
|
||||
set_intr_gate(X86_TRAP_MF, coprocessor_error);
|
|
@ -0,0 +1,35 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Date: Mon, 29 Dec 2014 00:55:03 +0100
|
||||
Subject: ARM: thread_info: Avoid ABI change in 3.16.7-ckt3
|
||||
Forwarded: not-needed
|
||||
|
||||
Restore thread_info::arm_restart_block even though it's now unused.
|
||||
|
||||
--- a/arch/arm/include/asm/thread_info.h
|
||||
+++ b/arch/arm/include/asm/thread_info.h
|
||||
@@ -43,6 +43,17 @@ struct cpu_context_save {
|
||||
__u32 extra[2]; /* Xscale 'acc' register, etc */
|
||||
};
|
||||
|
||||
+/* bwh: Retained only for ABI compatibility */
|
||||
+struct arm_restart_block {
|
||||
+ union {
|
||||
+ /* For user cache flushing */
|
||||
+ struct {
|
||||
+ unsigned long start;
|
||||
+ unsigned long end;
|
||||
+ } cache;
|
||||
+ };
|
||||
+};
|
||||
+
|
||||
/*
|
||||
* low level task data that entry.S needs immediate access to.
|
||||
* __switch_to() assumes cpu_context follows immediately after cpu_domain.
|
||||
@@ -68,6 +79,7 @@ struct thread_info {
|
||||
unsigned long thumbee_state; /* ThumbEE Handler Base register */
|
||||
#endif
|
||||
struct restart_block restart_block;
|
||||
+ struct arm_restart_block arm_restart_block;
|
||||
};
|
||||
|
||||
#define INIT_THREAD_INFO(tsk) \
|
|
@ -0,0 +1,29 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Date: Mon, 29 Dec 2014 00:59:35 +0100
|
||||
Subject: PCI: Avoid ABI change in 3.16.7-ckt3
|
||||
Forwarded: not-needed
|
||||
|
||||
Move the added bitfield pci_dev::no_64bit_msi to the end of its
|
||||
bitfield group and hide it from genksyms.
|
||||
|
||||
--- a/include/linux/pci.h
|
||||
+++ b/include/linux/pci.h
|
||||
@@ -331,7 +331,6 @@ struct pci_dev {
|
||||
unsigned int is_added:1;
|
||||
unsigned int is_busmaster:1; /* device is busmaster */
|
||||
unsigned int no_msi:1; /* device may not use msi */
|
||||
- unsigned int no_64bit_msi:1; /* device may only use 32-bit MSIs */
|
||||
unsigned int block_cfg_access:1; /* config space access is blocked */
|
||||
unsigned int broken_parity_status:1; /* Device generates false positive parity */
|
||||
unsigned int irq_reroute_variant:2; /* device needs IRQ rerouting variant */
|
||||
@@ -349,6 +348,10 @@ struct pci_dev {
|
||||
unsigned int __aer_firmware_first:1;
|
||||
unsigned int broken_intx_masking:1;
|
||||
unsigned int io_window_1k:1; /* Intel P2P bridge 1K I/O windows */
|
||||
+#ifndef __GENKSYMS__
|
||||
+ unsigned int no_64bit_msi:1; /* device may only use 32-bit MSIs */
|
||||
+ /* 8 bits spare */
|
||||
+#endif
|
||||
pci_dev_flags_t dev_flags;
|
||||
atomic_t enable_cnt; /* pci_enable_device has been called */
|
||||
|
|
@ -52,17 +52,12 @@ bugfix/mips/disable-advansys.patch
|
|||
bugfix/arm/ixp4xx_iobe.patch
|
||||
bugfix/m68k/ethernat-kconfig.patch
|
||||
bugfix/s390/s390-3215-fix-hanging-console-issue.patch
|
||||
bugfix/arm64/arm64-crypto-fix-makefile-rule-for-aes-glue-.o.patch
|
||||
bugfix/s390/s390-3215-fix-tty-output-containing-tabs.patch
|
||||
bugfix/x86/drm-i915-initialise-userptr-mmu_notifier-serial-to-1.patch
|
||||
bugfix/x86/drm-i915-Add-some-L3-registers-to-the-parser-whiteli.patch
|
||||
bugfix/parisc/parisc-reduce-sigrtmin-from-37-to-32-to-behave-like-.patch
|
||||
bugfix/arm64/arm64-add-missing-dts-entry-for-X-Gene-platform.patch
|
||||
bugfix/arm64/arm64-removed-using-of-the-mask-attribute-in-the-dts.patch
|
||||
bugfix/x86/x86_64-traps-Stop-using-IST-for-SS.patch
|
||||
bugfix/x86/x86_64-traps-Fix-the-espfix64-DF-fixup-and-rewrite-i.patch
|
||||
bugfix/x86/x86_64-traps-Rework-bad_iret.patch
|
||||
bugfix/x86/x86-asm-traps-Disable-tracing-and-kprobes-in-fixup_b.patch
|
||||
|
||||
# Arch features
|
||||
features/mips/MIPS-Support-hard-limit-of-cpu-count-nr_cpu_ids.patch
|
||||
|
@ -136,13 +131,8 @@ bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch
|
|||
bugfix/all/disable-some-marvell-phys.patch
|
||||
debian/i2o-disable-i2o_ext_adaptec-on-64bit.patch
|
||||
bugfix/all/aic94xx-remove-broken-fallback-for-missing-ctrl-a.patch
|
||||
bugfix/all/fold-swapping-d_name.hash-into-switch_names.patch
|
||||
bugfix/all/vfs-Don-t-exchange-short-filenames-unconditionally.patch
|
||||
bugfix/all/rtsx_usb_ms-use-msleep_interruptible-in-polling-loop.patch
|
||||
bugfix/all/HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch
|
||||
bugfix/all/drivers-net-Disable-UFO-through-virtio.patch
|
||||
bugfix/all/drivers-net-ipv6-Select-IPv6-fragment-idents-for-vir.patch
|
||||
bugfix/all/revert-drivers-net-disable-ufo-through-virtio-in-macvtap-and-tun.patch
|
||||
bugfix/all/xen-netback-Adding-debugfs-io_ring_qX-files.patch
|
||||
bugfix/all/xen-netback-Using-a-new-state-bit-instead-of-carrier.patch
|
||||
bugfix/all/xen-netback-Turn-off-the-carrier-if-the-guest-is-not.patch
|
||||
|
@ -161,7 +151,6 @@ bugfix/all/xen-netback-Disable-NAPI-after-disabling-interrupts.patch
|
|||
bugfix/all/xen-netback-do-not-report-success-if-backend_create_.patch
|
||||
bugfix/all/netback-don-t-store-invalid-vif-pointer.patch
|
||||
bugfix/all/xen-netback-support-frontends-without-feature-rx-not.patch
|
||||
bugfix/all/of-fdt-memblock_reserve-memreserve-regions-in-the-ca.patch
|
||||
|
||||
# memfd_create() & kdbus backport
|
||||
features/all/kdbus/mm-allow-drivers-to-prevent-new-writable-mappings.patch
|
||||
|
@ -491,3 +480,5 @@ debian/of-fix-abi-changes.patch
|
|||
debian/iovec-fix-abi-change-in-3.16.7-ckt1.patch
|
||||
debian/truncate-fix-abi-change-in-3.16.7-ckt1.patch
|
||||
debian/perf-fix-abi-change-in-3.16.7-ckt2.patch
|
||||
debian/arm-thread_info-fix-abi-change-in-3.16.7-ckt3.patch
|
||||
debian/pci-fix-abi-change-in-3.16.7-ckt3.patch
|
||||
|
|
Loading…
Reference in New Issue