4 files changed, 423 insertions, 107 deletions

diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 5715318d6bab..c47794b9d42f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -87,9 +87,13 @@ struct pending_tx_info {
 struct xenvif_rx_meta {
         int id;
         int size;
+        int gso_type;
         int gso_size;
 };
 
+#define GSO_BIT(type) \
+        (1 << XEN_NETIF_GSO_TYPE_ ## type)
+
 /* Discriminate from any valid pending_idx value. */
 #define INVALID_PENDING_IDX 0xFFFF
 
@@ -97,6 +101,13 @@ struct xenvif_rx_meta {
 
 #define MAX_PENDING_REQS 256
 
+/* It's possible for an skb to have a maximal number of frags
+ * but still be less than MAX_BUFFER_OFFSET in size. Thus the
+ * worst-case number of copy operations is MAX_SKB_FRAGS per
+ * ring slot.
+ */
+#define MAX_GRANT_COPY_OPS (MAX_SKB_FRAGS * XEN_NETIF_RX_RING_SIZE)
+
 struct xenvif {
         /* Unique identifier for this interface. */
         domid_t          domid;
@@ -139,21 +150,23 @@ struct xenvif {
          */
         RING_IDX rx_req_cons_peek;
 
-        /* Given MAX_BUFFER_OFFSET of 4096 the worst case is that each
-         * head/fragment page uses 2 copy operations because it
-         * straddles two buffers in the frontend.
-         */
-        struct gnttab_copy grant_copy_op[2*XEN_NETIF_RX_RING_SIZE];
-        struct xenvif_rx_meta meta[2*XEN_NETIF_RX_RING_SIZE];
+        /* This array is allocated seperately as it is large */
+        struct gnttab_copy *grant_copy_op;
 
+        /* We create one meta structure per ring request we consume, so
+         * the maximum number is the same as the ring size.
+         */
+        struct xenvif_rx_meta meta[XEN_NETIF_RX_RING_SIZE];
 
         u8               fe_dev_addr[6];
 
         /* Frontend feature information. */
+        int gso_mask;
+        int gso_prefix_mask;
+
         u8 can_sg:1;
-        u8 gso:1;
-        u8 gso_prefix:1;
-        u8 csum:1;
+        u8 ip_csum:1;
+        u8 ipv6_csum:1;
 
         /* Internal feature information. */
         u8 can_queue:1;     /* can queue packets for receiver? */
@@ -163,6 +176,7 @@ struct xenvif {
         unsigned long   credit_usec;
         unsigned long   remaining_credit;
         struct timer_list credit_timeout;
+        u64 credit_window_start;
 
         /* Statistics */
         unsigned long rx_gso_checksum_fixup;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 01bb854c7f62..fff8cddfed81 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -34,6 +34,7 @@
 #include <linux/ethtool.h>
 #include <linux/rtnetlink.h>
 #include <linux/if_vlan.h>
+#include <linux/vmalloc.h>
 
 #include <xen/events.h>
 #include <asm/xen/hypercall.h>
@@ -214,10 +215,14 @@ static netdev_features_t xenvif_fix_features(struct net_device *dev,
 
         if (!vif->can_sg)
                 features &= ~NETIF_F_SG;
-        if (!vif->gso && !vif->gso_prefix)
+        if (~(vif->gso_mask | vif->gso_prefix_mask) & GSO_BIT(TCPV4))
                 features &= ~NETIF_F_TSO;
-        if (!vif->csum)
+        if (~(vif->gso_mask | vif->gso_prefix_mask) & GSO_BIT(TCPV6))
+                features &= ~NETIF_F_TSO6;
+        if (!vif->ip_csum)
                 features &= ~NETIF_F_IP_CSUM;
+        if (!vif->ipv6_csum)
+                features &= ~NETIF_F_IPV6_CSUM;
 
         return features;
 }
@@ -303,21 +308,31 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         SET_NETDEV_DEV(dev, parent);
 
         vif = netdev_priv(dev);
+
+        vif->grant_copy_op = vmalloc(sizeof(struct gnttab_copy) *
+                                     MAX_GRANT_COPY_OPS);
+        if (vif->grant_copy_op == NULL) {
+                pr_warn("Could not allocate grant copy space for %s\n", name);
+                free_netdev(dev);
+                return ERR_PTR(-ENOMEM);
+        }
+
         vif->domid  = domid;
         vif->handle = handle;
         vif->can_sg = 1;
-        vif->csum = 1;
+        vif->ip_csum = 1;
         vif->dev = dev;
 
         vif->credit_bytes = vif->remaining_credit = ~0UL;
         vif->credit_usec  = 0UL;
         init_timer(&vif->credit_timeout);
-        /* Initialize 'expires' now: it's used to track the credit window. */
-        vif->credit_timeout.expires = jiffies;
+        vif->credit_window_start = get_jiffies_64();
 
         dev->netdev_ops = &xenvif_netdev_ops;
-        dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
-        dev->features = dev->hw_features;
+        dev->hw_features = NETIF_F_SG |
+                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                NETIF_F_TSO | NETIF_F_TSO6;
+        dev->features = dev->hw_features | NETIF_F_RXCSUM;
         SET_ETHTOOL_OPS(dev, &xenvif_ethtool_ops);
 
         dev->tx_queue_len = XENVIF_QUEUE_LENGTH;
@@ -363,11 +378,11 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
                    unsigned long rx_ring_ref, unsigned int tx_evtchn,
                    unsigned int rx_evtchn)
 {
+        struct task_struct *task;
         int err = -ENOMEM;
 
-        /* Already connected through? */
-        if (vif->tx_irq)
-                return 0;
+        BUG_ON(vif->tx_irq);
+        BUG_ON(vif->task);
 
         err = xenvif_map_frontend_rings(vif, tx_ring_ref, rx_ring_ref);
         if (err < 0)
@@ -406,14 +421,16 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
         }
 
         init_waitqueue_head(&vif->wq);
-        vif->task = kthread_create(xenvif_kthread,
-                                   (void *)vif, "%s", vif->dev->name);
-        if (IS_ERR(vif->task)) {
+        task = kthread_create(xenvif_kthread,
+                              (void *)vif, "%s", vif->dev->name);
+        if (IS_ERR(task)) {
                 pr_warn("Could not allocate kthread for %s\n", vif->dev->name);
-                err = PTR_ERR(vif->task);
+                err = PTR_ERR(task);
                 goto err_rx_unbind;
         }
 
+        vif->task = task;
+
         rtnl_lock();
         if (!vif->can_sg && vif->dev->mtu > ETH_DATA_LEN)
                 dev_set_mtu(vif->dev, ETH_DATA_LEN);
@@ -456,6 +473,11 @@ void xenvif_disconnect(struct xenvif *vif)
         if (netif_carrier_ok(vif->dev))
                 xenvif_carrier_off(vif);
 
+        if (vif->task) {
+                kthread_stop(vif->task);
+                vif->task = NULL;
+        }
+
         if (vif->tx_irq) {
                 if (vif->tx_irq == vif->rx_irq)
                         unbind_from_irqhandler(vif->tx_irq, vif);
@@ -466,9 +488,6 @@ void xenvif_disconnect(struct xenvif *vif)
                 vif->tx_irq = 0;
         }
 
-        if (vif->task)
-                kthread_stop(vif->task);
-
         xenvif_unmap_frontend_rings(vif);
 }
 
@@ -478,6 +497,7 @@ void xenvif_free(struct xenvif *vif)
 
         unregister_netdev(vif->dev);
 
+        vfree(vif->grant_copy_op);
         free_netdev(vif->dev);
 
         module_put(THIS_MODULE);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f3e591c611de..78425554a537 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -39,6 +39,7 @@
 #include <linux/udp.h>
 
 #include <net/tcp.h>
+#include <net/ip6_checksum.h>
 
 #include <xen/xen.h>
 #include <xen/events.h>
@@ -109,15 +110,12 @@ static inline unsigned long idx_to_kaddr(struct xenvif *vif,
         return (unsigned long)pfn_to_kaddr(idx_to_pfn(vif, idx));
 }
 
-/*
- * This is the amount of packet we copy rather than map, so that the
- * guest can't fiddle with the contents of the headers while we do
- * packet processing on them (netfilter, routing, etc).
+/* This is a miniumum size for the linear area to avoid lots of
+ * calls to __pskb_pull_tail() as we set up checksum offsets. The
+ * value 128 was chosen as it covers all IPv4 and most likely
+ * IPv6 headers.
  */
-#define PKT_PROT_LEN    (ETH_HLEN + \
-                         VLAN_HLEN + \
-                         sizeof(struct iphdr) + MAX_IPOPTLEN + \
-                         sizeof(struct tcphdr) + MAX_TCP_OPTION_SPACE)
+#define PKT_PROT_LEN 128
 
 static u16 frag_get_pending_idx(skb_frag_t *frag)
 {
@@ -145,7 +143,7 @@ static int max_required_rx_slots(struct xenvif *vif)
         int max = DIV_ROUND_UP(vif->dev->mtu, PAGE_SIZE);
 
         /* XXX FIXME: RX path dependent on MAX_SKB_FRAGS */
-        if (vif->can_sg || vif->gso || vif->gso_prefix)
+        if (vif->can_sg || vif->gso_mask || vif->gso_prefix_mask)
                 max += MAX_SKB_FRAGS + 1; /* extra_info + frags */
 
         return max;
@@ -317,6 +315,7 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif *vif,
         req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
 
         meta = npo->meta + npo->meta_prod++;
+        meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
         meta->gso_size = 0;
         meta->size = 0;
         meta->id = req->id;
@@ -339,6 +338,7 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
         struct gnttab_copy *copy_gop;
         struct xenvif_rx_meta *meta;
         unsigned long bytes;
+        int gso_type;
 
         /* Data must not cross a page boundary. */
         BUG_ON(size + offset > PAGE_SIZE<<compound_order(page));
@@ -397,7 +397,14 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
                 }
 
                 /* Leave a gap for the GSO descriptor. */
-                if (*head && skb_shinfo(skb)->gso_size && !vif->gso_prefix)
+                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                else
+                        gso_type = XEN_NETIF_GSO_TYPE_NONE;
+
+                if (*head && ((1 << gso_type) & vif->gso_mask))
                         vif->rx.req_cons++;
 
                 *head = 0; /* There must be something in this buffer now. */
@@ -428,14 +435,28 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         unsigned char *data;
         int head = 1;
         int old_meta_prod;
+        int gso_type;
+        int gso_size;
 
         old_meta_prod = npo->meta_prod;
 
+        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
+                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                gso_size = skb_shinfo(skb)->gso_size;
+        } else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
+                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                gso_size = skb_shinfo(skb)->gso_size;
+        } else {
+                gso_type = XEN_NETIF_GSO_TYPE_NONE;
+                gso_size = 0;
+        }
+
         /* Set up a GSO prefix descriptor, if necessary */
-        if (skb_shinfo(skb)->gso_size && vif->gso_prefix) {
+        if ((1 << gso_type) & vif->gso_prefix_mask) {
                 req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
                 meta = npo->meta + npo->meta_prod++;
-                meta->gso_size = skb_shinfo(skb)->gso_size;
+                meta->gso_type = gso_type;
+                meta->gso_size = gso_size;
                 meta->size = 0;
                 meta->id = req->id;
         }
@@ -443,10 +464,13 @@ static int xenvif_gop_skb(struct sk_buff *skb,
         req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
         meta = npo->meta + npo->meta_prod++;
 
-        if (!vif->gso_prefix)
-                meta->gso_size = skb_shinfo(skb)->gso_size;
-        else
+        if ((1 << gso_type) & vif->gso_mask) {
+                meta->gso_type = gso_type;
+                meta->gso_size = gso_size;
+        } else {
+                meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
                 meta->gso_size = 0;
+        }
 
         meta->size = 0;
         meta->id = req->id;
@@ -584,7 +608,7 @@ void xenvif_rx_action(struct xenvif *vif)
         if (!npo.copy_prod)
                 return;
 
-        BUG_ON(npo.copy_prod > ARRAY_SIZE(vif->grant_copy_op));
+        BUG_ON(npo.copy_prod > MAX_GRANT_COPY_OPS);
         gnttab_batch_copy(vif->grant_copy_op, npo.copy_prod);
 
         while ((skb = __skb_dequeue(&rxq)) != NULL) {
@@ -592,7 +616,8 @@ void xenvif_rx_action(struct xenvif *vif)
 
                 vif = netdev_priv(skb->dev);
 
-                if (vif->meta[npo.meta_cons].gso_size && vif->gso_prefix) {
+                if ((1 << vif->meta[npo.meta_cons].gso_type) &
+                    vif->gso_prefix_mask) {
                         resp = RING_GET_RESPONSE(&vif->rx,
                                                  vif->rx.rsp_prod_pvt++);
 
@@ -629,7 +654,8 @@ void xenvif_rx_action(struct xenvif *vif)
                                         vif->meta[npo.meta_cons].size,
                                         flags);
 
-                if (vif->meta[npo.meta_cons].gso_size && !vif->gso_prefix) {
+                if ((1 << vif->meta[npo.meta_cons].gso_type) &
+                    vif->gso_mask) {
                         struct xen_netif_extra_info *gso =
                                 (struct xen_netif_extra_info *)
                                 RING_GET_RESPONSE(&vif->rx,
@@ -637,8 +663,8 @@ void xenvif_rx_action(struct xenvif *vif)
 
                         resp->flags |= XEN_NETRXF_extra_info;
 
+                        gso->u.gso.type = vif->meta[npo.meta_cons].gso_type;
                         gso->u.gso.size = vif->meta[npo.meta_cons].gso_size;
-                        gso->u.gso.type = XEN_NETIF_GSO_TYPE_TCPV4;
                         gso->u.gso.pad = 0;
                         gso->u.gso.features = 0;
 
@@ -1101,15 +1127,20 @@ static int xenvif_set_skb_gso(struct xenvif *vif,
                 return -EINVAL;
         }
 
-        /* Currently only TCPv4 S.O. is supported. */
-        if (gso->u.gso.type != XEN_NETIF_GSO_TYPE_TCPV4) {
+        switch (gso->u.gso.type) {
+        case XEN_NETIF_GSO_TYPE_TCPV4:
+                skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
+                break;
+        case XEN_NETIF_GSO_TYPE_TCPV6:
+                skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
+                break;
+        default:
                 netdev_err(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
                 xenvif_fatal_tx_err(vif);
                 return -EINVAL;
         }
 
         skb_shinfo(skb)->gso_size = gso->u.gso.size;
-        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
 
         /* Header must be checked, and gso_segs computed. */
         skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
@@ -1118,62 +1149,244 @@ static int xenvif_set_skb_gso(struct xenvif *vif,
         return 0;
 }
 
-static int checksum_setup(struct xenvif *vif, struct sk_buff *skb)
+static inline int maybe_pull_tail(struct sk_buff *skb, unsigned int len,
+                                  unsigned int max)
 {
-        struct iphdr *iph;
-        int err = -EPROTO;
-        int recalculate_partial_csum = 0;
+        if (skb_headlen(skb) >= len)
+                return 0;
 
-        /*
-         * A GSO SKB must be CHECKSUM_PARTIAL. However some buggy
-         * peers can fail to set NETRXF_csum_blank when sending a GSO
-         * frame. In this case force the SKB to CHECKSUM_PARTIAL and
-         * recalculate the partial checksum.
+        /* If we need to pullup then pullup to the max, so we
+         * won't need to do it again.
          */
-        if (skb->ip_summed != CHECKSUM_PARTIAL && skb_is_gso(skb)) {
-                vif->rx_gso_checksum_fixup++;
-                skb->ip_summed = CHECKSUM_PARTIAL;
-                recalculate_partial_csum = 1;
+        if (max > skb->len)
+                max = skb->len;
+
+        if (__pskb_pull_tail(skb, max - skb_headlen(skb)) == NULL)
+                return -ENOMEM;
+
+        if (skb_headlen(skb) < len)
+                return -EPROTO;
+
+        return 0;
+}
+
+/* This value should be large enough to cover a tagged ethernet header plus
+ * maximally sized IP and TCP or UDP headers.
+ */
+#define MAX_IP_HDR_LEN 128
+
+static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
+                             int recalculate_partial_csum)
+{
+        unsigned int off;
+        bool fragment;
+        int err;
+
+        fragment = false;
+
+        err = maybe_pull_tail(skb,
+                              sizeof(struct iphdr),
+                              MAX_IP_HDR_LEN);
+        if (err < 0)
+                goto out;
+
+        if (ip_hdr(skb)->frag_off & htons(IP_OFFSET | IP_MF))
+                fragment = true;
+
+        off = ip_hdrlen(skb);
+
+        err = -EPROTO;
+
+        if (fragment)
+                goto out;
+
+        switch (ip_hdr(skb)->protocol) {
+        case IPPROTO_TCP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct tcphdr),
+                                      MAX_IP_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
+                if (!skb_partial_csum_set(skb, off,
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
+                        goto out;
+                }
+
+                if (recalculate_partial_csum)
+                        tcp_hdr(skb)->check =
+                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                   ip_hdr(skb)->daddr,
+                                                   skb->len - off,
+                                                   IPPROTO_TCP, 0);
+                break;
+        case IPPROTO_UDP:
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct udphdr),
+                                      MAX_IP_HDR_LEN);
+                if (err < 0)
+                        goto out;
+
+                if (!skb_partial_csum_set(skb, off,
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
+                        goto out;
+                }
+
+                if (recalculate_partial_csum)
+                        udp_hdr(skb)->check =
+                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                   ip_hdr(skb)->daddr,
+                                                   skb->len - off,
+                                                   IPPROTO_UDP, 0);
+                break;
+        default:
+                goto out;
         }
 
-        /* A non-CHECKSUM_PARTIAL SKB does not require setup. */
-        if (skb->ip_summed != CHECKSUM_PARTIAL)
-                return 0;
+        err = 0;
+
+out:
+        return err;
+}
+
+/* This value should be large enough to cover a tagged ethernet header plus
+ * an IPv6 header, all options, and a maximal TCP or UDP header.
+ */
+#define MAX_IPV6_HDR_LEN 256
+
+#define OPT_HDR(type, skb, off) \
+        (type *)(skb_network_header(skb) + (off))
+
+static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
+                               int recalculate_partial_csum)
+{
+        int err;
+        u8 nexthdr;
+        unsigned int off;
+        unsigned int len;
+        bool fragment;
+        bool done;
+
+        fragment = false;
+        done = false;
+
+        off = sizeof(struct ipv6hdr);
+
+        err = maybe_pull_tail(skb, off, MAX_IPV6_HDR_LEN);
+        if (err < 0)
+                goto out;
+
+        nexthdr = ipv6_hdr(skb)->nexthdr;
+
+        len = sizeof(struct ipv6hdr) + ntohs(ipv6_hdr(skb)->payload_len);
+        while (off <= len && !done) {
+                switch (nexthdr) {
+                case IPPROTO_DSTOPTS:
+                case IPPROTO_HOPOPTS:
+                case IPPROTO_ROUTING: {
+                        struct ipv6_opt_hdr *hp;
+
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct ipv6_opt_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
+
+                        hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);
+                        nexthdr = hp->nexthdr;
+                        off += ipv6_optlen(hp);
+                        break;
+                }
+                case IPPROTO_AH: {
+                        struct ip_auth_hdr *hp;
+
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct ip_auth_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
+
+                        hp = OPT_HDR(struct ip_auth_hdr, skb, off);
+                        nexthdr = hp->nexthdr;
+                        off += ipv6_authlen(hp);
+                        break;
+                }
+                case IPPROTO_FRAGMENT: {
+                        struct frag_hdr *hp;
+
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct frag_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
+
+                        hp = OPT_HDR(struct frag_hdr, skb, off);
+
+                        if (hp->frag_off & htons(IP6_OFFSET | IP6_MF))
+                                fragment = true;
+
+                        nexthdr = hp->nexthdr;
+                        off += sizeof(struct frag_hdr);
+                        break;
+                }
+                default:
+                        done = true;
+                        break;
+                }
+        }
+
+        err = -EPROTO;
 
-        if (skb->protocol != htons(ETH_P_IP))
+        if (!done || fragment)
                 goto out;
 
-        iph = (void *)skb->data;
-        switch (iph->protocol) {
+        switch (nexthdr) {
         case IPPROTO_TCP:
-                if (!skb_partial_csum_set(skb, 4 * iph->ihl,
-                                          offsetof(struct tcphdr, check)))
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct tcphdr),
+                                      MAX_IPV6_HDR_LEN);
+                if (err < 0)
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct tcphdr *tcph = tcp_hdr(skb);
-                        tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         skb->len - iph->ihl*4,
-                                                         IPPROTO_TCP, 0);
+                if (!skb_partial_csum_set(skb, off,
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
+                        goto out;
                 }
+
+                if (recalculate_partial_csum)
+                        tcp_hdr(skb)->check =
+                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                 &ipv6_hdr(skb)->daddr,
+                                                 skb->len - off,
+                                                 IPPROTO_TCP, 0);
                 break;
         case IPPROTO_UDP:
-                if (!skb_partial_csum_set(skb, 4 * iph->ihl,
-                                          offsetof(struct udphdr, check)))
+                err = maybe_pull_tail(skb,
+                                      off + sizeof(struct udphdr),
+                                      MAX_IPV6_HDR_LEN);
+                if (err < 0)
                         goto out;
 
-                if (recalculate_partial_csum) {
-                        struct udphdr *udph = udp_hdr(skb);
-                        udph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         skb->len - iph->ihl*4,
-                                                         IPPROTO_UDP, 0);
+                if (!skb_partial_csum_set(skb, off,
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
+                        goto out;
                 }
+
+                if (recalculate_partial_csum)
+                        udp_hdr(skb)->check =
+                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                 &ipv6_hdr(skb)->daddr,
+                                                 skb->len - off,
+                                                 IPPROTO_UDP, 0);
                 break;
         default:
-                if (net_ratelimit())
-                        netdev_err(vif->dev,
-                                   "Attempting to checksum a non-TCP/UDP packet, dropping a protocol %d packet\n",
-                                   iph->protocol);
                 goto out;
         }
 
@@ -1183,11 +1396,38 @@ out:
         return err;
 }
 
+static int checksum_setup(struct xenvif *vif, struct sk_buff *skb)
+{
+        int err = -EPROTO;
+        int recalculate_partial_csum = 0;
+
+        /* A GSO SKB must be CHECKSUM_PARTIAL. However some buggy
+         * peers can fail to set NETRXF_csum_blank when sending a GSO
+         * frame. In this case force the SKB to CHECKSUM_PARTIAL and
+         * recalculate the partial checksum.
+         */
+        if (skb->ip_summed != CHECKSUM_PARTIAL && skb_is_gso(skb)) {
+                vif->rx_gso_checksum_fixup++;
+                skb->ip_summed = CHECKSUM_PARTIAL;
+                recalculate_partial_csum = 1;
+        }
+
+        /* A non-CHECKSUM_PARTIAL SKB does not require setup. */
+        if (skb->ip_summed != CHECKSUM_PARTIAL)
+                return 0;
+
+        if (skb->protocol == htons(ETH_P_IP))
+                err = checksum_setup_ip(vif, skb, recalculate_partial_csum);
+        else if (skb->protocol == htons(ETH_P_IPV6))
+                err = checksum_setup_ipv6(vif, skb, recalculate_partial_csum);
+
+        return err;
+}
+
 static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
 {
-        unsigned long now = jiffies;
-        unsigned long next_credit =
-                vif->credit_timeout.expires +
+        u64 now = get_jiffies_64();
+        u64 next_credit = vif->credit_window_start +
                 msecs_to_jiffies(vif->credit_usec / 1000);
 
         /* Timer could already be pending in rare cases. */
@@ -1195,8 +1435,8 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
                 return true;
 
         /* Passed the point where we can replenish credit? */
-        if (time_after_eq(now, next_credit)) {
-                vif->credit_timeout.expires = now;
+        if (time_after_eq64(now, next_credit)) {
+                vif->credit_window_start = now;
                 tx_add_credit(vif);
         }
 
@@ -1208,6 +1448,7 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
                         tx_credit_callback;
                 mod_timer(&vif->credit_timeout,
                           next_credit);
+                vif->credit_window_start = next_credit;
 
                 return true;
         }
@@ -1215,14 +1456,15 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
         return false;
 }
 
-static unsigned xenvif_tx_build_gops(struct xenvif *vif)
+static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget)
 {
         struct gnttab_copy *gop = vif->tx_copy_ops, *request_gop;
         struct sk_buff *skb;
         int ret;
 
         while ((nr_pending_reqs(vif) + XEN_NETBK_LEGACY_SLOTS_MAX
-                < MAX_PENDING_REQS)) {
+                < MAX_PENDING_REQS) &&
+               (skb_queue_len(&vif->tx_queue) < budget)) {
                 struct xen_netif_tx_request txreq;
                 struct xen_netif_tx_request txfrags[XEN_NETBK_LEGACY_SLOTS_MAX];
                 struct page *page;
@@ -1244,7 +1486,7 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif)
                         continue;
                 }
 
-                RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do);
+                work_to_do = RING_HAS_UNCONSUMED_REQUESTS(&vif->tx);
                 if (!work_to_do)
                         break;
 
@@ -1384,14 +1626,13 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif)
 }
 
 
-static int xenvif_tx_submit(struct xenvif *vif, int budget)
+static int xenvif_tx_submit(struct xenvif *vif)
 {
         struct gnttab_copy *gop = vif->tx_copy_ops;
         struct sk_buff *skb;
         int work_done = 0;
 
-        while (work_done < budget &&
-               (skb = __skb_dequeue(&vif->tx_queue)) != NULL) {
+        while ((skb = __skb_dequeue(&vif->tx_queue)) != NULL) {
                 struct xen_netif_tx_request *txp;
                 u16 pending_idx;
                 unsigned data_len;
@@ -1428,12 +1669,7 @@ static int xenvif_tx_submit(struct xenvif *vif, int budget)
 
                 xenvif_fill_frags(vif, skb);
 
-                /*
-                 * If the initial fragment was < PKT_PROT_LEN then
-                 * pull through some bytes from the other fragments to
-                 * increase the linear region to PKT_PROT_LEN bytes.
-                 */
-                if (skb_headlen(skb) < PKT_PROT_LEN && skb_is_nonlinear(skb)) {
+                if (skb_is_nonlinear(skb) && skb_headlen(skb) < PKT_PROT_LEN) {
                         int target = min_t(int, skb->len, PKT_PROT_LEN);
                         __pskb_pull_tail(skb, target - skb_headlen(skb));
                 }
@@ -1471,14 +1707,14 @@ int xenvif_tx_action(struct xenvif *vif, int budget)
         if (unlikely(!tx_work_todo(vif)))
                 return 0;
 
-        nr_gops = xenvif_tx_build_gops(vif);
+        nr_gops = xenvif_tx_build_gops(vif, budget);
 
         if (nr_gops == 0)
                 return 0;
 
         gnttab_batch_copy(vif->tx_copy_ops, nr_gops);
 
-        work_done = xenvif_tx_submit(vif, nr_gops);
+        work_done = xenvif_tx_submit(vif);
 
         return work_done;
 }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 1b08d8798372..f0358992b04f 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -105,6 +105,22 @@ static int netback_probe(struct xenbus_device *dev,
                         goto abort_transaction;
                 }
 
+                err = xenbus_printf(xbt, dev->nodename, "feature-gso-tcpv6",
+                                    "%d", sg);
+                if (err) {
+                        message = "writing feature-gso-tcpv6";
+                        goto abort_transaction;
+                }
+
+                /* We support partial checksum setup for IPv6 packets */
+                err = xenbus_printf(xbt, dev->nodename,
+                                    "feature-ipv6-csum-offload",
+                                    "%d", 1);
+                if (err) {
+                        message = "writing feature-ipv6-csum-offload";
+                        goto abort_transaction;
+                }
+
                 /* We support rx-copy path. */
                 err = xenbus_printf(xbt, dev->nodename,
                                     "feature-rx-copy", "%d", 1);
@@ -561,20 +577,50 @@ static int connect_rings(struct backend_info *be)
                 val = 0;
         vif->can_sg = !!val;
 
+        vif->gso_mask = 0;
+        vif->gso_prefix_mask = 0;
+
         if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-gso-tcpv4",
                          "%d", &val) < 0)
                 val = 0;
-        vif->gso = !!val;
+        if (val)
+                vif->gso_mask |= GSO_BIT(TCPV4);
 
         if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-gso-tcpv4-prefix",
                          "%d", &val) < 0)
                 val = 0;
-        vif->gso_prefix = !!val;
+        if (val)
+                vif->gso_prefix_mask |= GSO_BIT(TCPV4);
+
+        if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-gso-tcpv6",
+                         "%d", &val) < 0)
+                val = 0;
+        if (val)
+                vif->gso_mask |= GSO_BIT(TCPV6);
+
+        if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-gso-tcpv6-prefix",
+                         "%d", &val) < 0)
+                val = 0;
+        if (val)
+                vif->gso_prefix_mask |= GSO_BIT(TCPV6);
+
+        if (vif->gso_mask & vif->gso_prefix_mask) {
+                xenbus_dev_fatal(dev, err,
+                                 "%s: gso and gso prefix flags are not "
+                                 "mutually exclusive",
+                                 dev->otherend);
+                return -EOPNOTSUPP;
+        }
 
         if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-no-csum-offload",
                          "%d", &val) < 0)
                 val = 0;
-        vif->csum = !val;
+        vif->ip_csum = !val;
+
+        if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-ipv6-csum-offload",
+                         "%d", &val) < 0)
+                val = 0;
+        vif->ipv6_csum = !!val;
 
         /* Map the shared frame, irq etc. */
         err = xenvif_connect(vif, tx_ring_ref, rx_ring_ref,