From: Greg Kroah-Hartman Date: Thu, 10 May 2012 16:14:39 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.3.6~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=840af188f30fc2e4e075fdcf3c9089305825a396;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: asix-fix-tx-transfer-padding-for-full-speed-usb.patch netem-fix-possible-skb-leak.patch net-in-unregister_netdevice_notifier-unregister-the-netdevices.patch net-l2tp-unlock-socket-lock-before-returning-from-l2tp_ip_sendmsg.patch sky2-fix-receive-length-error-in-mixed-non-vlan-vlan-traffic.patch sky2-propogate-rx-hash-when-packet-is-copied.patch sungem-fix-wakeonlan.patch tcp-change-tcp_adv_win_scale-and-tcp_rmem.patch tg3-avoid-panic-from-reserved-statblk-field-access.patch --- diff --git a/queue-3.0/asix-fix-tx-transfer-padding-for-full-speed-usb.patch b/queue-3.0/asix-fix-tx-transfer-padding-for-full-speed-usb.patch new file mode 100644 index 00000000000..bbcd2becb1c --- /dev/null +++ b/queue-3.0/asix-fix-tx-transfer-padding-for-full-speed-usb.patch @@ -0,0 +1,43 @@ +From 51bbf6408e8cd626ea2fc939a76522ce1e853c51 Mon Sep 17 00:00:00 2001 +From: Ingo van Lil +Date: Mon, 23 Apr 2012 22:05:38 +0000 +Subject: asix: Fix tx transfer padding for full-speed USB + + +From: Ingo van Lil + +[ Upstream commit 2a5809499e35b53a6044fd34e72b242688b7a862 ] + +The asix.c USB Ethernet driver avoids ending a tx transfer with a zero- +length packet by appending a four-byte padding to transfers whose length +is a multiple of maxpacket. However, the hard-coded 512 byte maxpacket +length is valid for high-speed USB only; full-speed USB uses 64 byte +packets. + +Signed-off-by: Ingo van Lil +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/asix.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/asix.c ++++ b/drivers/net/usb/asix.c +@@ -398,7 +398,7 @@ static struct sk_buff *asix_tx_fixup(str + u32 packet_len; + u32 padbytes = 0xffff0000; + +- padlen = ((skb->len + 4) % 512) ? 0 : 4; ++ padlen = ((skb->len + 4) & (dev->maxpacket - 1)) ? 0 : 4; + + if ((!skb_cloned(skb)) && + ((headroom + tailroom) >= (4 + padlen))) { +@@ -420,7 +420,7 @@ static struct sk_buff *asix_tx_fixup(str + cpu_to_le32s(&packet_len); + skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len)); + +- if ((skb->len % 512) == 0) { ++ if (padlen) { + cpu_to_le32s(&padbytes); + memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes)); + skb_put(skb, sizeof(padbytes)); diff --git a/queue-3.0/net-in-unregister_netdevice_notifier-unregister-the-netdevices.patch b/queue-3.0/net-in-unregister_netdevice_notifier-unregister-the-netdevices.patch new file mode 100644 index 00000000000..b705a726ede --- /dev/null +++ b/queue-3.0/net-in-unregister_netdevice_notifier-unregister-the-netdevices.patch @@ -0,0 +1,61 @@ +From 90eb597e0908fae2765707cb7a8e2bb91495f1ae Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Fri, 6 Apr 2012 15:33:35 +0000 +Subject: net: In unregister_netdevice_notifier unregister the netdevices. + + +From: "Eric W. Biederman" + +[ Upstream commit 7d3d43dab4e978d8d9ad1acf8af15c9b1c4b0f0f ] + +We already synthesize events in register_netdevice_notifier and synthesizing +events in unregister_netdevice_notifier allows to us remove the need for +special case cleanup code. + +This change should be safe as it adds no new cases for existing callers +of unregiser_netdevice_notifier to handle. + +Signed-off-by: Eric W. Biederman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dev.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1406,14 +1406,34 @@ EXPORT_SYMBOL(register_netdevice_notifie + * register_netdevice_notifier(). The notifier is unlinked into the + * kernel structures and may then be reused. A negative errno code + * is returned on a failure. ++ * ++ * After unregistering unregister and down device events are synthesized ++ * for all devices on the device list to the removed notifier to remove ++ * the need for special case cleanup code. + */ + + int unregister_netdevice_notifier(struct notifier_block *nb) + { ++ struct net_device *dev; ++ struct net *net; + int err; + + rtnl_lock(); + err = raw_notifier_chain_unregister(&netdev_chain, nb); ++ if (err) ++ goto unlock; ++ ++ for_each_net(net) { ++ for_each_netdev(net, dev) { ++ if (dev->flags & IFF_UP) { ++ nb->notifier_call(nb, NETDEV_GOING_DOWN, dev); ++ nb->notifier_call(nb, NETDEV_DOWN, dev); ++ } ++ nb->notifier_call(nb, NETDEV_UNREGISTER, dev); ++ nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev); ++ } ++ } ++unlock: + rtnl_unlock(); + return err; + } diff --git a/queue-3.0/net-l2tp-unlock-socket-lock-before-returning-from-l2tp_ip_sendmsg.patch b/queue-3.0/net-l2tp-unlock-socket-lock-before-returning-from-l2tp_ip_sendmsg.patch new file mode 100644 index 00000000000..c21b4f692c5 --- /dev/null +++ b/queue-3.0/net-l2tp-unlock-socket-lock-before-returning-from-l2tp_ip_sendmsg.patch @@ -0,0 +1,44 @@ +From c36be477d760b67dee15964b35b5acaa59fd9dd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 May 2012 03:58:43 +0000 +Subject: net: l2tp: unlock socket lock before returning from l2tp_ip_sendmsg + + +From: Sasha Levin + +[ Upstream commit 84768edbb2721637620b2d84501bb0d5aed603f1 ] + +l2tp_ip_sendmsg could return without releasing socket lock, making it all the +way to userspace, and generating the following warning: + +[ 130.891594] ================================================ +[ 130.894569] [ BUG: lock held when returning to user space! ] +[ 130.897257] 3.4.0-rc5-next-20120501-sasha #104 Tainted: G W +[ 130.900336] ------------------------------------------------ +[ 130.902996] trinity/8384 is leaving the kernel with locks still held! +[ 130.906106] 1 lock held by trinity/8384: +[ 130.907924] #0: (sk_lock-AF_INET){+.+.+.}, at: [] l2tp_ip_sendmsg+0x2f/0x550 + +Introduced by commit 2f16270 ("l2tp: Fix locking in l2tp_ip.c"). + +Signed-off-by: Sasha Levin +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/l2tp/l2tp_ip.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -441,8 +441,9 @@ static int l2tp_ip_sendmsg(struct kiocb + + daddr = lip->l2tp_addr.s_addr; + } else { ++ rc = -EDESTADDRREQ; + if (sk->sk_state != TCP_ESTABLISHED) +- return -EDESTADDRREQ; ++ goto out; + + daddr = inet->inet_daddr; + connected = 1; diff --git a/queue-3.0/netem-fix-possible-skb-leak.patch b/queue-3.0/netem-fix-possible-skb-leak.patch new file mode 100644 index 00000000000..7c2ac986252 --- /dev/null +++ b/queue-3.0/netem-fix-possible-skb-leak.patch @@ -0,0 +1,37 @@ +From b995d8a008b1a73885675cbc467d0f62c5d2fbda Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sun, 29 Apr 2012 09:08:22 +0000 +Subject: netem: fix possible skb leak + + +From: Eric Dumazet + +[ Upstream commit 116a0fc31c6c9b8fc821be5a96e5bf0b43260131 ] + +skb_checksum_help(skb) can return an error, we must free skb in this +case. qdisc_drop(skb, sch) can also be feeded with a NULL skb (if +skb_unshare() failed), so lets use this generic helper. + +Signed-off-by: Eric Dumazet +Cc: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_netem.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -350,10 +350,8 @@ static int netem_enqueue(struct sk_buff + if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) { + if (!(skb = skb_unshare(skb, GFP_ATOMIC)) || + (skb->ip_summed == CHECKSUM_PARTIAL && +- skb_checksum_help(skb))) { +- sch->qstats.drops++; +- return NET_XMIT_DROP; +- } ++ skb_checksum_help(skb))) ++ return qdisc_drop(skb, sch); + + skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8); + } diff --git a/queue-3.0/series b/queue-3.0/series index 0006a3465f3..992ea8dd23f 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -8,3 +8,12 @@ arm-7410-1-add-extra-clobber-registers-for-assembly-in-kernel_execve.patch arm-7414-1-smp-prevent-use-of-the-console-when-using-idmap_pgd.patch regulator-fix-the-logic-to-ensure-new-voltage-setting-in-valid-range.patch arm-orion5x-fix-gpio-enable-bits-for-mpp9.patch +asix-fix-tx-transfer-padding-for-full-speed-usb.patch +netem-fix-possible-skb-leak.patch +net-in-unregister_netdevice_notifier-unregister-the-netdevices.patch +net-l2tp-unlock-socket-lock-before-returning-from-l2tp_ip_sendmsg.patch +sky2-propogate-rx-hash-when-packet-is-copied.patch +sky2-fix-receive-length-error-in-mixed-non-vlan-vlan-traffic.patch +tg3-avoid-panic-from-reserved-statblk-field-access.patch +sungem-fix-wakeonlan.patch +tcp-change-tcp_adv_win_scale-and-tcp_rmem.patch diff --git a/queue-3.0/sky2-fix-receive-length-error-in-mixed-non-vlan-vlan-traffic.patch b/queue-3.0/sky2-fix-receive-length-error-in-mixed-non-vlan-vlan-traffic.patch new file mode 100644 index 00000000000..9c408f86ab8 --- /dev/null +++ b/queue-3.0/sky2-fix-receive-length-error-in-mixed-non-vlan-vlan-traffic.patch @@ -0,0 +1,131 @@ +From b8e3a1e7482af7269812b64a203153752e0426f5 Mon Sep 17 00:00:00 2001 +From: stephen hemminger +Date: Mon, 30 Apr 2012 06:47:37 +0000 +Subject: sky2: fix receive length error in mixed non-VLAN/VLAN traffic + + +From: stephen hemminger + +[ Upstream commit e072b3fad5f3915102c94628b4971f52ff99dd05 ] + +Bug: The VLAN bit of the MAC RX Status Word is unreliable in several older +supported chips. Sometimes the VLAN bit is not set for valid VLAN packets +and also sometimes the VLAN bit is set for non-VLAN packets that came after +a VLAN packet. This results in a receive length error when VLAN hardware +tagging is enabled. + +Fix: Variation on original fix proposed by Mirko. +The VLAN information is decoded in the status loop, and can be +applied to the received SKB there. This eliminates the need for the +separate tag field in the interface data structure. The tag has to +be copied and cleared if packet is copied. This version checked out +with vlan and normal traffic. + +Note: vlan_tx_tag_present should be renamed vlan_tag_present, but that +is outside scope of this. + +Reported-by: Mirko Lindner +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/sky2.c | 28 +++++++++++++++++----------- + drivers/net/sky2.h | 1 - + 2 files changed, 17 insertions(+), 12 deletions(-) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -2345,9 +2345,11 @@ static struct sk_buff *receive_copy(stru + skb->ip_summed = re->skb->ip_summed; + skb->csum = re->skb->csum; + skb->rxhash = re->skb->rxhash; ++ skb->vlan_tci = re->skb->vlan_tci; + + pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr, + length, PCI_DMA_FROMDEVICE); ++ re->skb->vlan_tci = 0; + re->skb->rxhash = 0; + re->skb->ip_summed = CHECKSUM_NONE; + skb_put(skb, length); +@@ -2433,9 +2435,6 @@ static struct sk_buff *sky2_receive(stru + struct sk_buff *skb = NULL; + u16 count = (status & GMR_FS_LEN) >> 16; + +- if (status & GMR_FS_VLAN) +- count -= VLAN_HLEN; /* Account for vlan tag */ +- + netif_printk(sky2, rx_status, KERN_DEBUG, dev, + "rx slot %u status 0x%x len %d\n", + sky2->rx_next, status, length); +@@ -2443,6 +2442,9 @@ static struct sk_buff *sky2_receive(stru + sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending; + prefetch(sky2->rx_ring + sky2->rx_next); + ++ if (vlan_tx_tag_present(re->skb)) ++ count -= VLAN_HLEN; /* Account for vlan tag */ ++ + /* This chip has hardware problems that generates bogus status. + * So do only marginal checking and expect higher level protocols + * to handle crap frames. +@@ -2500,11 +2502,8 @@ static inline void sky2_tx_done(struct n + } + + static inline void sky2_skb_rx(const struct sky2_port *sky2, +- u32 status, struct sk_buff *skb) ++ struct sk_buff *skb) + { +- if (status & GMR_FS_VLAN) +- __vlan_hwaccel_put_tag(skb, be16_to_cpu(sky2->rx_tag)); +- + if (skb->ip_summed == CHECKSUM_NONE) + netif_receive_skb(skb); + else +@@ -2558,6 +2557,14 @@ static void sky2_rx_checksum(struct sky2 + } + } + ++static void sky2_rx_tag(struct sky2_port *sky2, u16 length) ++{ ++ struct sk_buff *skb; ++ ++ skb = sky2->rx_ring[sky2->rx_next].skb; ++ __vlan_hwaccel_put_tag(skb, be16_to_cpu(length)); ++} ++ + static void sky2_rx_hash(struct sky2_port *sky2, u32 status) + { + struct sk_buff *skb; +@@ -2616,8 +2623,7 @@ static int sky2_status_intr(struct sky2_ + } + + skb->protocol = eth_type_trans(skb, dev); +- +- sky2_skb_rx(sky2, status, skb); ++ sky2_skb_rx(sky2, skb); + + /* Stop after net poll weight */ + if (++work_done >= to_do) +@@ -2625,11 +2631,11 @@ static int sky2_status_intr(struct sky2_ + break; + + case OP_RXVLAN: +- sky2->rx_tag = length; ++ sky2_rx_tag(sky2, length); + break; + + case OP_RXCHKSVLAN: +- sky2->rx_tag = length; ++ sky2_rx_tag(sky2, length); + /* fall through */ + case OP_RXCHKS: + if (likely(dev->features & NETIF_F_RXCSUM)) +--- a/drivers/net/sky2.h ++++ b/drivers/net/sky2.h +@@ -2236,7 +2236,6 @@ struct sky2_port { + u16 rx_pending; + u16 rx_data_size; + u16 rx_nfrags; +- u16 rx_tag; + + struct { + unsigned long last; diff --git a/queue-3.0/sky2-propogate-rx-hash-when-packet-is-copied.patch b/queue-3.0/sky2-propogate-rx-hash-when-packet-is-copied.patch new file mode 100644 index 00000000000..ec97f874944 --- /dev/null +++ b/queue-3.0/sky2-propogate-rx-hash-when-packet-is-copied.patch @@ -0,0 +1,36 @@ +From 4a853459a467a29261b28d8c5b00c144677a248c Mon Sep 17 00:00:00 2001 +From: stephen hemminger +Date: Mon, 30 Apr 2012 05:49:45 +0000 +Subject: sky2: propogate rx hash when packet is copied + + +From: stephen hemminger + +[ Upstream commit 3f42941b5d1d13542b1a755a9e4f633aa72e4d3e ] + +When a small packet is received, the driver copies it to a new skb to allow +reusing the full size Rx buffer. The copy was propogating the checksum offload +but not the receive hash information. The bug is impact was mostly harmless +and therefore not observed until reviewing this area of code. + +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/sky2.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -2344,8 +2344,11 @@ static struct sk_buff *receive_copy(stru + skb_copy_from_linear_data(re->skb, skb->data, length); + skb->ip_summed = re->skb->ip_summed; + skb->csum = re->skb->csum; ++ skb->rxhash = re->skb->rxhash; ++ + pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr, + length, PCI_DMA_FROMDEVICE); ++ re->skb->rxhash = 0; + re->skb->ip_summed = CHECKSUM_NONE; + skb_put(skb, length); + } diff --git a/queue-3.0/sungem-fix-wakeonlan.patch b/queue-3.0/sungem-fix-wakeonlan.patch new file mode 100644 index 00000000000..729de38e6e3 --- /dev/null +++ b/queue-3.0/sungem-fix-wakeonlan.patch @@ -0,0 +1,33 @@ +From bdd5111960eec2e0c0aca9058ef0281ec95b19db Mon Sep 17 00:00:00 2001 +From: Gerard Lledo +Date: Sat, 28 Apr 2012 08:52:37 +0000 +Subject: sungem: Fix WakeOnLan + + +From: Gerard Lledo + +[ Upstream commit 5a8887d39e1ba5ee2d4ccb94b14d6f2dce5ddfca ] + +WakeOnLan was broken in this driver because gp->asleep_wol is a 1-bit +bitfield and it was being assigned WAKE_MAGIC, which is (1 << 5). +gp->asleep_wol remains 0 and the machine never wakes up. Fixed by casting +gp->wake_on_lan to bool. Tested on an iBook G4. + +Signed-off-by: Gerard Lledo +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/sungem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/sungem.c ++++ b/drivers/net/sungem.c +@@ -2363,7 +2363,7 @@ static int gem_suspend(struct pci_dev *p + netif_device_detach(dev); + + /* Switch off MAC, remember WOL setting */ +- gp->asleep_wol = gp->wake_on_lan; ++ gp->asleep_wol = !!gp->wake_on_lan; + gem_do_stop(dev, gp->asleep_wol); + } else + gp->asleep_wol = 0; diff --git a/queue-3.0/tcp-change-tcp_adv_win_scale-and-tcp_rmem.patch b/queue-3.0/tcp-change-tcp_adv_win_scale-and-tcp_rmem.patch new file mode 100644 index 00000000000..a7df0bff316 --- /dev/null +++ b/queue-3.0/tcp-change-tcp_adv_win_scale-and-tcp_rmem.patch @@ -0,0 +1,118 @@ +From 6b3d2aea9c90d53ceba4466d58d4241743ded244 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 2 May 2012 02:28:41 +0000 +Subject: tcp: change tcp_adv_win_scale and tcp_rmem[2] + + +From: Eric Dumazet + +[ Upstream commit b49960a05e32121d29316cfdf653894b88ac9190 ] + +tcp_adv_win_scale default value is 2, meaning we expect a good citizen +skb to have skb->len / skb->truesize ratio of 75% (3/4) + +In 2.6 kernels we (mis)accounted for typical MSS=1460 frame : +1536 + 64 + 256 = 1856 'estimated truesize', and 1856 * 3/4 = 1392. +So these skbs were considered as not bloated. + +With recent truesize fixes, a typical MSS=1460 frame truesize is now the +more precise : +2048 + 256 = 2304. But 2304 * 3/4 = 1728. +So these skb are not good citizen anymore, because 1460 < 1728 + +(GRO can escape this problem because it build skbs with a too low +truesize.) + +This also means tcp advertises a too optimistic window for a given +allocated rcvspace : When receiving frames, sk_rmem_alloc can hit +sk_rcvbuf limit and we call tcp_prune_queue()/tcp_collapse() too often, +especially when application is slow to drain its receive queue or in +case of losses (netperf is fast, scp is slow). This is a major latency +source. + +We should adjust the len/truesize ratio to 50% instead of 75% + +This patch : + +1) changes tcp_adv_win_scale default to 1 instead of 2 + +2) increase tcp_rmem[2] limit from 4MB to 6MB to take into account +better truesize tracking and to allow autotuning tcp receive window to +reach same value than before. Note that same amount of kernel memory is +consumed compared to 2.6 kernels. + +Signed-off-by: Eric Dumazet +Cc: Neal Cardwell +Cc: Tom Herbert +Cc: Yuchung Cheng +Acked-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/networking/ip-sysctl.txt | 4 ++-- + net/ipv4/tcp.c | 9 +++++---- + net/ipv4/tcp_input.c | 2 +- + 3 files changed, 8 insertions(+), 7 deletions(-) + +--- a/Documentation/networking/ip-sysctl.txt ++++ b/Documentation/networking/ip-sysctl.txt +@@ -147,7 +147,7 @@ tcp_adv_win_scale - INTEGER + (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale), + if it is <= 0. + Possible values are [-31, 31], inclusive. +- Default: 2 ++ Default: 1 + + tcp_allowed_congestion_control - STRING + Show/set the congestion control choices available to non-privileged +@@ -407,7 +407,7 @@ tcp_rmem - vector of 3 INTEGERs: min, de + net.core.rmem_max. Calling setsockopt() with SO_RCVBUF disables + automatic tuning of that socket's receive buffer size, in which + case this value is ignored. +- Default: between 87380B and 4MB, depending on RAM size. ++ Default: between 87380B and 6MB, depending on RAM size. + + tcp_sack - BOOLEAN + Enable select acknowledgments (SACKS). +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3221,7 +3221,7 @@ void __init tcp_init(void) + { + struct sk_buff *skb = NULL; + unsigned long limit; +- int i, max_share, cnt; ++ int i, max_rshare, max_wshare, cnt; + unsigned long jiffy = jiffies; + + BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb)); +@@ -3285,15 +3285,16 @@ void __init tcp_init(void) + + /* Set per-socket limits to no more than 1/128 the pressure threshold */ + limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7); +- max_share = min(4UL*1024*1024, limit); ++ max_wshare = min(4UL*1024*1024, limit); ++ max_rshare = min(6UL*1024*1024, limit); + + sysctl_tcp_wmem[0] = SK_MEM_QUANTUM; + sysctl_tcp_wmem[1] = 16*1024; +- sysctl_tcp_wmem[2] = max(64*1024, max_share); ++ sysctl_tcp_wmem[2] = max(64*1024, max_wshare); + + sysctl_tcp_rmem[0] = SK_MEM_QUANTUM; + sysctl_tcp_rmem[1] = 87380; +- sysctl_tcp_rmem[2] = max(87380, max_share); ++ sysctl_tcp_rmem[2] = max(87380, max_rshare); + + printk(KERN_INFO "TCP: Hash tables configured " + "(established %u bind %u)\n", +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -83,7 +83,7 @@ int sysctl_tcp_ecn __read_mostly = 2; + EXPORT_SYMBOL(sysctl_tcp_ecn); + int sysctl_tcp_dsack __read_mostly = 1; + int sysctl_tcp_app_win __read_mostly = 31; +-int sysctl_tcp_adv_win_scale __read_mostly = 2; ++int sysctl_tcp_adv_win_scale __read_mostly = 1; + EXPORT_SYMBOL(sysctl_tcp_adv_win_scale); + + int sysctl_tcp_stdurg __read_mostly; diff --git a/queue-3.0/tg3-avoid-panic-from-reserved-statblk-field-access.patch b/queue-3.0/tg3-avoid-panic-from-reserved-statblk-field-access.patch new file mode 100644 index 00000000000..92d9e4d2f6a --- /dev/null +++ b/queue-3.0/tg3-avoid-panic-from-reserved-statblk-field-access.patch @@ -0,0 +1,65 @@ +From 622fc09f446efa3a4f3e69302507069973e8ac8a Mon Sep 17 00:00:00 2001 +From: Matt Carlson +Date: Tue, 24 Apr 2012 13:37:01 +0000 +Subject: tg3: Avoid panic from reserved statblk field access + + +From: Matt Carlson + +[ Upstream commit f891ea1634ce41f5f47ae40d8594809f4cd2ca66 ] + +When RSS is enabled, interrupt vector 0 does not receive any rx traffic. +The rx producer index fields for vector 0's status block should be +considered reserved in this case. This patch changes the code to +respect these reserved fields, which avoids a kernel panic when these +fields take on non-zero values. + +Signed-off-by: Matt Carlson +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tg3.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/net/tg3.c ++++ b/drivers/net/tg3.c +@@ -740,8 +740,13 @@ static inline unsigned int tg3_has_work( + if (sblk->status & SD_STATUS_LINK_CHG) + work_exists = 1; + } +- /* check for RX/TX work to do */ +- if (sblk->idx[0].tx_consumer != tnapi->tx_cons || ++ ++ /* check for TX work to do */ ++ if (sblk->idx[0].tx_consumer != tnapi->tx_cons) ++ work_exists = 1; ++ ++ /* check for RX work to do */ ++ if (tnapi->rx_rcb_prod_idx && + *(tnapi->rx_rcb_prod_idx) != tnapi->rx_rcb_ptr) + work_exists = 1; + +@@ -5216,6 +5221,9 @@ static int tg3_poll_work(struct tg3_napi + return work_done; + } + ++ if (!tnapi->rx_rcb_prod_idx) ++ return work_done; ++ + /* run RX thread, within the bounds set by NAPI. + * All RX "locking" is done by ensuring outside + * code synchronizes with tg3->napi.poll() +@@ -6626,6 +6634,12 @@ static int tg3_alloc_consistent(struct t + */ + switch (i) { + default: ++ if (tg3_flag(tp, ENABLE_RSS)) { ++ tnapi->rx_rcb_prod_idx = NULL; ++ break; ++ } ++ /* Fall through */ ++ case 1: + tnapi->rx_rcb_prod_idx = &sblk->idx[0].rx_producer; + break; + case 2: