Merge branches 'clockevents/4.4-fixes' and 'clockevents/4.5-fixes' of http://git.linaro.org/people/daniel.lezcano/linux into timers/urgent

Pull in fixes from Daniel Lezcano:

 - Fix the vt8500 timer leading to a system lock up when dealing with too
   small delta (Roman Volkov)

 - Select the CLKSRC_MMIO when the fsl_ftm_timer is enabled with COMPILE_TEST
   (Daniel Lezcano)

 - Prevent to compile timers using the 'iomem' API when the architecture has
   not HAS_IOMEM set (Richard Weinberger)

13 files changed, 147 insertions, 49 deletions

diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index b36d837c701e..2a91a0561a47 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -62,6 +62,7 @@ struct unix_sock {
 #define UNIX_GC_CANDIDATE       0
 #define UNIX_GC_MAYBE_CYCLE     1
         struct socket_wq        peer_wq;
+        wait_queue_t            peer_wake;
 };
 
 static inline struct unix_sock *unix_sk(const struct sock *sk)
diff --git a/include/net/dst.h b/include/net/dst.h
index 1279f9b09791..c7329dcd90cc 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -322,6 +322,39 @@ static inline void skb_dst_force(struct sk_buff *skb)
         }
 }
 
+/**
+ * dst_hold_safe - Take a reference on a dst if possible
+ * @dst: pointer to dst entry
+ *
+ * This helper returns false if it could not safely
+ * take a reference on a dst.
+ */
+static inline bool dst_hold_safe(struct dst_entry *dst)
+{
+        if (dst->flags & DST_NOCACHE)
+                return atomic_inc_not_zero(&dst->__refcnt);
+        dst_hold(dst);
+        return true;
+}
+
+/**
+ * skb_dst_force_safe - makes sure skb dst is refcounted
+ * @skb: buffer
+ *
+ * If dst is not yet refcounted and not destroyed, grab a ref on it.
+ */
+static inline void skb_dst_force_safe(struct sk_buff *skb)
+{
+        if (skb_dst_is_noref(skb)) {
+                struct dst_entry *dst = skb_dst(skb);
+
+                if (!dst_hold_safe(dst))
+                        dst = NULL;
+
+                skb->_skb_refdst = (unsigned long)dst;
+        }
+}
+
 
 /**
  *      __skb_tunnel_rx - prepare skb for rx reinsert
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 2134e6d815bc..625bdf95d673 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -210,18 +210,37 @@ struct inet_sock {
 #define IP_CMSG_ORIGDSTADDR     BIT(6)
 #define IP_CMSG_CHECKSUM        BIT(7)
 
-/* SYNACK messages might be attached to request sockets.
+/**
+ * sk_to_full_sk - Access to a full socket
+ * @sk: pointer to a socket
+ *
+ * SYNACK messages might be attached to request sockets.
  * Some places want to reach the listener in this case.
  */
-static inline struct sock *skb_to_full_sk(const struct sk_buff *skb)
+static inline struct sock *sk_to_full_sk(struct sock *sk)
 {
-        struct sock *sk = skb->sk;
-
+#ifdef CONFIG_INET
         if (sk && sk->sk_state == TCP_NEW_SYN_RECV)
                 sk = inet_reqsk(sk)->rsk_listener;
+#endif
+        return sk;
+}
+
+/* sk_to_full_sk() variant with a const argument */
+static inline const struct sock *sk_const_to_full_sk(const struct sock *sk)
+{
+#ifdef CONFIG_INET
+        if (sk && sk->sk_state == TCP_NEW_SYN_RECV)
+                sk = ((const struct request_sock *)sk)->rsk_listener;
+#endif
         return sk;
 }
 
+static inline struct sock *skb_to_full_sk(const struct sk_buff *skb)
+{
+        return sk_to_full_sk(skb->sk);
+}
+
 static inline struct inet_sock *inet_sk(const struct sock *sk)
 {
         return (struct inet_sock *)sk;
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 4a6009d4486b..235c7811a86a 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -78,6 +78,7 @@ void inet_initpeers(void) __init;
 static inline void inetpeer_set_addr_v4(struct inetpeer_addr *iaddr, __be32 ip)
 {
         iaddr->a4.addr = ip;
+        iaddr->a4.vif = 0;
         iaddr->family = AF_INET;
 }
 
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 2bfb2ad2fab1..877f682989b8 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -133,27 +133,18 @@ void rt6_clean_tohost(struct net *net, struct in6_addr *gateway);
 /*
  *      Store a destination cache entry in a socket
  */
-static inline void __ip6_dst_store(struct sock *sk, struct dst_entry *dst,
-                                   const struct in6_addr *daddr,
-                                   const struct in6_addr *saddr)
+static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
+                                 const struct in6_addr *daddr,
+                                 const struct in6_addr *saddr)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
-        struct rt6_info *rt = (struct rt6_info *) dst;
 
+        np->dst_cookie = rt6_get_cookie((struct rt6_info *)dst);
         sk_setup_caps(sk, dst);
         np->daddr_cache = daddr;
 #ifdef CONFIG_IPV6_SUBTREES
         np->saddr_cache = saddr;
 #endif
-        np->dst_cookie = rt6_get_cookie(rt);
-}
-
-static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
-                                 struct in6_addr *daddr, struct in6_addr *saddr)
-{
-        spin_lock(&sk->sk_dst_lock);
-        __ip6_dst_store(sk, dst, daddr, saddr);
-        spin_unlock(&sk->sk_dst_lock);
 }
 
 static inline bool ipv6_unicast_destination(const struct sk_buff *skb)
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index e1a10b0ac0b0..9a5c9f013784 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -205,6 +205,7 @@ extern rwlock_t ip6_ra_lock;
  */
 
 struct ipv6_txoptions {
+        atomic_t                refcnt;
         /* Length of this structure */
         int                     tot_len;
 
@@ -217,7 +218,7 @@ struct ipv6_txoptions {
         struct ipv6_opt_hdr     *dst0opt;
         struct ipv6_rt_hdr      *srcrt; /* Routing Header */
         struct ipv6_opt_hdr     *dst1opt;
-
+        struct rcu_head         rcu;
         /* Option buffer, as read by IPV6_PKTOPTIONS, starts here. */
 };
 
@@ -252,6 +253,24 @@ struct ipv6_fl_socklist {
         struct rcu_head                 rcu;
 };
 
+static inline struct ipv6_txoptions *txopt_get(const struct ipv6_pinfo *np)
+{
+        struct ipv6_txoptions *opt;
+
+        rcu_read_lock();
+        opt = rcu_dereference(np->opt);
+        if (opt && !atomic_inc_not_zero(&opt->refcnt))
+                opt = NULL;
+        rcu_read_unlock();
+        return opt;
+}
+
+static inline void txopt_put(struct ipv6_txoptions *opt)
+{
+        if (opt && atomic_dec_and_test(&opt->refcnt))
+                kfree_rcu(opt, rcu);
+}
+
 struct ip6_flowlabel *fl6_sock_lookup(struct sock *sk, __be32 label);
 struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions *opt_space,
                                          struct ip6_flowlabel *fl,
@@ -490,6 +509,7 @@ struct ip6_create_arg {
         u32 user;
         const struct in6_addr *src;
         const struct in6_addr *dst;
+        int iif;
         u8 ecn;
 };
 
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 82045fca388b..760bc4d5a2cf 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -2003,8 +2003,10 @@ enum ieee80211_hw_flags {
  *      it shouldn't be set.
  *
  * @max_tx_aggregation_subframes: maximum number of subframes in an
- *      aggregate an HT driver will transmit, used by the peer as a
- *      hint to size its reorder buffer.
+ *      aggregate an HT driver will transmit. Though ADDBA will advertise
+ *      a constant value of 64 as some older APs can crash if the window
+ *      size is smaller (an example is LinkSys WRT120N with FW v1.0.07
+ *      build 002 Jun 18 2012).
  *
  * @offchannel_tx_hw_queue: HW queue ID to use for offchannel TX
  *      (if %IEEE80211_HW_QUEUE_CONTROL is set)
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index bf3937431030..2d8edaad29cb 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -181,8 +181,7 @@ void ndisc_cleanup(void);
 int ndisc_rcv(struct sk_buff *skb);
 
 void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
-                   const struct in6_addr *daddr, const struct in6_addr *saddr,
-                   struct sk_buff *oskb);
+                   const struct in6_addr *daddr, const struct in6_addr *saddr);
 
 void ndisc_send_rs(struct net_device *dev,
                    const struct in6_addr *saddr, const struct in6_addr *daddr);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 4c79ce8c1f92..b2a8e6338576 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -61,6 +61,9 @@ struct Qdisc {
                                       */
 #define TCQ_F_WARN_NONWC        (1 << 16)
 #define TCQ_F_CPUSTATS          0x20 /* run using percpu statistics */
+#define TCQ_F_NOPARENT          0x40 /* root of its hierarchy :
+                                      * qdisc_tree_decrease_qlen() should stop.
+                                      */
         u32                     limit;
         const struct Qdisc_ops  *ops;
         struct qdisc_size_table __rcu *stab;
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 495c87e367b3..eea9bdeecba2 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -775,10 +775,10 @@ struct sctp_transport {
                 hb_sent:1,
 
                 /* Is the Path MTU update pending on this tranport */
-                pmtu_pending:1;
+                pmtu_pending:1,
 
-        /* Has this transport moved the ctsn since we last sacked */
-        __u32 sack_generation;
+                /* Has this transport moved the ctsn since we last sacked */
+                sack_generation:1;
         u32 dst_cookie;
 
         struct flowi fl;
@@ -1482,19 +1482,20 @@ struct sctp_association {
                         prsctp_capable:1,   /* Can peer do PR-SCTP? */
                         auth_capable:1;     /* Is peer doing SCTP-AUTH? */
 
-                /* Ack State   : This flag indicates if the next received
+                /* sack_needed : This flag indicates if the next received
                  *             : packet is to be responded to with a
-                 *             : SACK. This is initializedto 0.  When a packet
-                 *             : is received it is incremented. If this value
+                 *             : SACK. This is initialized to 0.  When a packet
+                 *             : is received sack_cnt is incremented. If this value
                  *             : reaches 2 or more, a SACK is sent and the
                  *             : value is reset to 0. Note: This is used only
                  *             : when no DATA chunks are received out of
                  *             : order.  When DATA chunks are out of order,
                  *             : SACK's are not delayed (see Section 6).
                  */
-                __u8    sack_needed;     /* Do we need to sack the peer? */
+                __u8    sack_needed:1,     /* Do we need to sack the peer? */
+                        sack_generation:1,
+                        zero_window_announced:1;
                 __u32   sack_cnt;
-                __u32   sack_generation;
 
                 __u32   adaptation_ind;  /* Adaptation Code point. */
 
diff --git a/include/net/sock.h b/include/net/sock.h
index 7f89e4ba18d1..14d3c0734007 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -254,7 +254,6 @@ struct cg_proto;
   *     @sk_wq: sock wait queue and async head
   *     @sk_rx_dst: receive input route used by early demux
   *     @sk_dst_cache: destination cache
-  *     @sk_dst_lock: destination cache lock
   *     @sk_policy: flow policy
   *     @sk_receive_queue: incoming packets
   *     @sk_wmem_alloc: transmit queue bytes committed
@@ -384,14 +383,16 @@ struct sock {
         int                     sk_rcvbuf;
 
         struct sk_filter __rcu  *sk_filter;
-        struct socket_wq __rcu  *sk_wq;
-
+        union {
+                struct socket_wq __rcu  *sk_wq;
+                struct socket_wq        *sk_wq_raw;
+        };
 #ifdef CONFIG_XFRM
-        struct xfrm_policy      *sk_policy[2];
+        struct xfrm_policy __rcu *sk_policy[2];
 #endif
         struct dst_entry        *sk_rx_dst;
         struct dst_entry __rcu  *sk_dst_cache;
-        spinlock_t              sk_dst_lock;
+        /* Note: 32bit hole on 64bit arches */
         atomic_t                sk_wmem_alloc;
         atomic_t                sk_omem_alloc;
         int                     sk_sndbuf;
@@ -403,6 +404,7 @@ struct sock {
                                 sk_userlocks : 4,
                                 sk_protocol  : 8,
                                 sk_type      : 16;
+#define SK_PROTOCOL_MAX U8_MAX
         kmemcheck_bitfield_end(flags);
         int                     sk_wmem_queued;
         gfp_t                   sk_allocation;
@@ -739,6 +741,8 @@ enum sock_flags {
         SOCK_SELECT_ERR_QUEUE, /* Wake select on error queue */
 };
 
+#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
+
 static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
 {
         nsk->sk_flags = osk->sk_flags;
@@ -813,7 +817,7 @@ void sk_stream_write_space(struct sock *sk);
 static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
         /* dont let skb dst not refcounted, we are going to leave rcu lock */
-        skb_dst_force(skb);
+        skb_dst_force_safe(skb);
 
         if (!sk->sk_backlog.tail)
                 sk->sk_backlog.head = skb;
@@ -2005,10 +2009,27 @@ static inline unsigned long sock_wspace(struct sock *sk)
         return amt;
 }
 
-static inline void sk_wake_async(struct sock *sk, int how, int band)
+/* Note:
+ *  We use sk->sk_wq_raw, from contexts knowing this
+ *  pointer is not NULL and cannot disappear/change.
+ */
+static inline void sk_set_bit(int nr, struct sock *sk)
+{
+        set_bit(nr, &sk->sk_wq_raw->flags);
+}
+
+static inline void sk_clear_bit(int nr, struct sock *sk)
+{
+        clear_bit(nr, &sk->sk_wq_raw->flags);
+}
+
+static inline void sk_wake_async(const struct sock *sk, int how, int band)
 {
-        if (sock_flag(sk, SOCK_FASYNC))
-                sock_wake_async(sk->sk_socket, how, band);
+        if (sock_flag(sk, SOCK_FASYNC)) {
+                rcu_read_lock();
+                sock_wake_async(rcu_dereference(sk->sk_wq), how, band);
+                rcu_read_unlock();
+        }
 }
 
 /* Since sk_{r,w}mem_alloc sums skb->truesize, even a small frame might
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index c1c899c3a51b..e289ada6adf6 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -79,7 +79,7 @@ struct vxlanhdr {
 };
 
 /* VXLAN header flags. */
-#define VXLAN_HF_RCO BIT(24)
+#define VXLAN_HF_RCO BIT(21)
 #define VXLAN_HF_VNI BIT(27)
 #define VXLAN_HF_GBP BIT(31)
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 4a9c21f9b4ea..d6f6e5006ee9 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -548,6 +548,7 @@ struct xfrm_policy {
         u16                     family;
         struct xfrm_sec_ctx     *security;
         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
+        struct rcu_head         rcu;
 };
 
 static inline struct net *xp_net(const struct xfrm_policy *xp)
@@ -1141,12 +1142,14 @@ static inline int xfrm6_route_forward(struct sk_buff *skb)
         return xfrm_route_forward(skb, AF_INET6);
 }
 
-int __xfrm_sk_clone_policy(struct sock *sk);
+int __xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk);
 
-static inline int xfrm_sk_clone_policy(struct sock *sk)
+static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk)
 {
-        if (unlikely(sk->sk_policy[0] || sk->sk_policy[1]))
-                return __xfrm_sk_clone_policy(sk);
+        sk->sk_policy[0] = NULL;
+        sk->sk_policy[1] = NULL;
+        if (unlikely(osk->sk_policy[0] || osk->sk_policy[1]))
+                return __xfrm_sk_clone_policy(sk, osk);
         return 0;
 }
 
@@ -1154,12 +1157,16 @@ int xfrm_policy_delete(struct xfrm_policy *pol, int dir);
 
 static inline void xfrm_sk_free_policy(struct sock *sk)
 {
-        if (unlikely(sk->sk_policy[0] != NULL)) {
-                xfrm_policy_delete(sk->sk_policy[0], XFRM_POLICY_MAX);
+        struct xfrm_policy *pol;
+
+        pol = rcu_dereference_protected(sk->sk_policy[0], 1);
+        if (unlikely(pol != NULL)) {
+                xfrm_policy_delete(pol, XFRM_POLICY_MAX);
                 sk->sk_policy[0] = NULL;
         }
-        if (unlikely(sk->sk_policy[1] != NULL)) {
-                xfrm_policy_delete(sk->sk_policy[1], XFRM_POLICY_MAX+1);
+        pol = rcu_dereference_protected(sk->sk_policy[1], 1);
+        if (unlikely(pol != NULL)) {
+                xfrm_policy_delete(pol, XFRM_POLICY_MAX+1);
                 sk->sk_policy[1] = NULL;
         }
 }
@@ -1169,7 +1176,7 @@ void xfrm_garbage_collect(struct net *net);
 #else
 
 static inline void xfrm_sk_free_policy(struct sock *sk) {}
-static inline int xfrm_sk_clone_policy(struct sock *sk) { return 0; }
+static inline int xfrm_sk_clone_policy(struct sock *sk, const struct sock *osk) { return 0; }
 static inline int xfrm6_route_forward(struct sk_buff *skb) { return 1; }  
 static inline int xfrm4_route_forward(struct sk_buff *skb) { return 1; } 
 static inline int xfrm6_policy_check(struct sock *sk, int dir, struct sk_buff *skb)