Merge tag 'v3.5-rc4' into drm-intel-next-queued

I want to merge the "no more fake agp on gen6+" patches into
drm-intel-next (well, the last pieces). But a patch in 3.5-rc4 also
adds a new use of dev->agp. Hence the backmarge to sort this out, for
otherwise drm-intel-next merged into Linus' tree would conflict in the
relevant code, things would compile but nicely OOPS at driver load :(

Conflicts in this merge are just simple cases of "both branches
changed/added lines at the same place". The only tricky part is to
keep the order correct wrt the unwind code in case of errors in
intel_ringbuffer.c (and the MI_DISPLAY_FLIP #defines in i915_reg.h
together, obviously).

Conflicts:
	drivers/gpu/drm/i915/i915_reg.h
	drivers/gpu/drm/i915/intel_ringbuffer.c

Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

5 files changed, 67 insertions, 33 deletions

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 1e62b7557b00..db1521fcda5b 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -413,19 +413,15 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
         u32 align = max_t(u32, blksize, esp->padlen);
-        u32 rem;
+        unsigned int net_adj;
 
-        mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
-        rem = mtu & (align - 1);
-        mtu &= ~(align - 1);
-
-        if (x->props.mode != XFRM_MODE_TUNNEL) {
-                u32 padsize = ((blksize - 1) & 7) + 1;
-                mtu -= blksize - padsize;
-                mtu += min_t(u32, blksize - padsize, rem);
-        }
+        if (x->props.mode != XFRM_MODE_TUNNEL)
+                net_adj = sizeof(struct ipv6hdr);
+        else
+                net_adj = 0;
 
-        return mtu - 2;
+        return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
+                 net_adj) & ~(align - 1)) + (net_adj - 2);
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 0c220a416626..74c21b924a79 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1561,7 +1561,7 @@ static int fib6_age(struct rt6_info *rt, void *arg)
                                 neigh_flags = neigh->flags;
                                 neigh_release(neigh);
                         }
-                        if (neigh_flags & NTF_ROUTER) {
+                        if (!(neigh_flags & NTF_ROUTER)) {
                                 RT6_TRACE("purging route %p via non-router but gateway\n",
                                           rt);
                                 return -1;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d99fdc699625..decc21d19c53 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -526,6 +526,7 @@ int ip6_forward(struct sk_buff *skb)
         hdr->hop_limit--;
 
         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
         return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
                        ip6_forward_finish);
 
@@ -1187,6 +1188,29 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
 }
 
+static void ip6_append_data_mtu(int *mtu,
+                                int *maxfraglen,
+                                unsigned int fragheaderlen,
+                                struct sk_buff *skb,
+                                struct rt6_info *rt)
+{
+        if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
+                if (skb == NULL) {
+                        /* first fragment, reserve header_len */
+                        *mtu = *mtu - rt->dst.header_len;
+
+                } else {
+                        /*
+                         * this fragment is not first, the headers
+                         * space is regarded as data space.
+                         */
+                        *mtu = dst_mtu(rt->dst.path);
+                }
+                *maxfraglen = ((*mtu - fragheaderlen) & ~7)
+                              + fragheaderlen - sizeof(struct frag_hdr);
+        }
+}
+
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
@@ -1196,7 +1220,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_cork *cork;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *skb_prev = NULL;
         unsigned int maxfraglen, fragheaderlen;
         int exthdrlen;
         int dst_exthdrlen;
@@ -1253,8 +1277,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 inet->cork.fl.u.ip6 = *fl6;
                 np->cork.hop_limit = hlimit;
                 np->cork.tclass = tclass;
-                mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
-                      rt->dst.dev->mtu : dst_mtu(&rt->dst);
+                if (rt->dst.flags & DST_XFRM_TUNNEL)
+                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                              rt->dst.dev->mtu : dst_mtu(&rt->dst);
+                else
+                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                              rt->dst.dev->mtu : dst_mtu(rt->dst.path);
                 if (np->frag_size < mtu) {
                         if (np->frag_size)
                                 mtu = np->frag_size;
@@ -1350,25 +1378,27 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                         unsigned int fraglen;
                         unsigned int fraggap;
                         unsigned int alloclen;
-                        struct sk_buff *skb_prev;
 alloc_new_skb:
-                        skb_prev = skb;
-
                         /* There's no room in the current skb */
-                        if (skb_prev)
-                                fraggap = skb_prev->len - maxfraglen;
+                        if (skb)
+                                fraggap = skb->len - maxfraglen;
                         else
                                 fraggap = 0;
+                        /* update mtu and maxfraglen if necessary */
+                        if (skb == NULL || skb_prev == NULL)
+                                ip6_append_data_mtu(&mtu, &maxfraglen,
+                                                    fragheaderlen, skb, rt);
+
+                        skb_prev = skb;
 
                         /*
                          * If remaining data exceeds the mtu,
                          * we know we need more fragment(s).
                          */
                         datalen = length + fraggap;
-                        if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
-                                datalen = maxfraglen - fragheaderlen;
 
-                        fraglen = datalen + fragheaderlen;
+                        if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
+                                datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
                         if ((flags & MSG_MORE) &&
                             !(rt->dst.dev->features&NETIF_F_SG))
                                 alloclen = mtu;
@@ -1377,13 +1407,16 @@ alloc_new_skb:
 
                         alloclen += dst_exthdrlen;
 
-                        /*
-                         * The last fragment gets additional space at tail.
-                         * Note: we overallocate on fragments with MSG_MODE
-                         * because we have no idea if we're the last one.
-                         */
-                        if (datalen == length + fraggap)
-                                alloclen += rt->dst.trailer_len;
+                        if (datalen != length + fraggap) {
+                                /*
+                                 * this is not the last fragment, the trailer
+                                 * space is regarded as data space.
+                                 */
+                                datalen += rt->dst.trailer_len;
+                        }
+
+                        alloclen += rt->dst.trailer_len;
+                        fraglen = datalen + fragheaderlen;
 
                         /*
                          * We just reserve space for fragment header.
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index b15dc08643a4..461e47c8e956 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1886,6 +1886,8 @@ static inline int ip6mr_forward2_finish(struct sk_buff *skb)
 {
         IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
                          IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP6_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
+                         IPSTATS_MIB_OUTOCTETS, skb->len);
         return dst_output(skb);
 }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 554d5999abc4..3a9aec29581a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -476,7 +476,8 @@ out:
 
 
 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
-                              struct request_values *rvp)
+                              struct request_values *rvp,
+                              u16 queue_mapping)
 {
         struct inet6_request_sock *treq = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -513,6 +514,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 
                 fl6.daddr = treq->rmt_addr;
+                skb_set_queue_mapping(skb, queue_mapping);
                 err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
                 err = net_xmit_eval(err);
         }
@@ -528,7 +530,7 @@ static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
                              struct request_values *rvp)
 {
         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
-        return tcp_v6_send_synack(sk, req, rvp);
+        return tcp_v6_send_synack(sk, req, rvp, 0);
 }
 
 static void tcp_v6_reqsk_destructor(struct request_sock *req)
@@ -1213,7 +1215,8 @@ have_isn:
         security_inet_conn_request(sk, skb, req);
 
         if (tcp_v6_send_synack(sk, req,
-                               (struct request_values *)&tmp_ext) ||
+                               (struct request_values *)&tmp_ext,
+                               skb_get_queue_mapping(skb)) ||
             want_cookie)
                 goto drop_and_free;