Re: Linux 4.12+ memory leak on router with i40e NICs

[Vitezslav Samel]

On Tue, Oct 17, 2017 at 01:34:29AM +0200, Paweł Staszewski wrote:
> W dniu 2017-10-16 o 18:26, Paweł Staszewski pisze:
> > W dniu 2017-10-16 o 13:20, Pavlos Parissis pisze:
> > > On 15/10/2017 02:58 πμ, Alexander Duyck wrote:
> > > > Hi Pawel,
> > > > 
> > > > To clarify is that Dave Miller's tree or Linus's that you are talking
> > > > about? If it is Dave's tree how long ago was it you pulled it since I
> > > > think the fix was just pushed by Jeff Kirsher a few days ago.
> > > > 
> > > > The issue should be fixed in the following commit:
> > > > https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/drivers/net/ethernet/intel/i40e/i40e_txrx.c?id=2b9478ffc550f17c6cd8c69057234e91150f5972
> > > 
> > > Do you know when it is going to be available on net-next and
> > > linux-stable repos?
> > > 
> > > Cheers,
> > > Pavlos
> > > 
> > > 
> > I will make some tests today night with "net" git tree where this patch
> > is included.
> > Starting from 0:00 CET
> > :)
> > 
> > 
> Upgraded and looks like problem is not solved with that patch
> Currently running system with
> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/
> kernel
> 
> Still about 0.5GB of memory is leaking somewhere
> 
> Also can confirm that the latest kernel where memory is not leaking (with
> use i40e driver intel 710 cards) is 4.11.12
> With kernel 4.11.12 - after hour no change in memory usage.
> 
> also checked that with ixgbe instead of i40e with same  net.git kernel there
> is no memleak - after hour same memory usage - so for 100% this is i40e
> driver problem.

  I have (probably) the same problem here but with X520 cards: booting
4.12.x gives me oops after circa 20 minutes of our workload. Booting
4.9.y is OK. This machine is in production so any testing is very
limited.

  Machine was stable for >2 months (on the desk before got to
production) with 4.12.8 but with no traffic on X520 cards.

Cheers,

Vita

Re: pull-request: mac80211 2017-10-16

[Johannes Berg]

On Tue, 2017-10-17 at 01:30 +0200, Jason A. Donenfeld wrote:
> Mobile phone right now, so not able to write patch, but you probably
> should be using crypto_memneq for comparing those two keys, not
> memcmp.

I know that's a gut instinct, but I really don't see the point.

If you actually get this to evaluate to "equal", you're already being
attacked, and the attacker already knows they're trying to get the same
key to be installed again. If it's not equal, you execute so much code
beneath, going to the driver etc., that I'd think this particular time
is in the noise.

Also, this isn't something that the attacker can directly observe
anyway, and if they can, then surely the fact that we *skip* a large
amount of code when returning 0 is also observable.

Besides, the only thing that can observe the timing is hostapd or
wpa_supplicant, which obviously know the key (and in the fixed versions
will already have done the comparison themselves).

And lastly, if you wanted to use this as an oracle to get the key back
from the kernel, then you already have admin permissions (in your
network namespace), and can just sniff netlink traffic anyway.

johannes

[PATCH net] sock_diag: request _diag module only when the family or proto has been registered

[Xin Long]

Now when using 'ss' in iproute, kernel would try to load all _diag
modules. It causes the corresponding family or proto modules to be
loaded as well.

Like after 'ss -a', sctp, dccp, af_packet(if it works as a moudle)
will be loaded.

As these family or proto modules are loaded unexpectly, this might
have some security implications.

This patch is to introduce sock_diag_request_module() in which we
only request the _diag module when it's corresponding family or
proto has been registered.

Note that we can't just load _diag module without the family or
proto loaded, as some symbols in _diag module are from the family
or proto moudle.

Reported-by: Sabrina Dubroca 
Signed-off-by: Xin Long 
---
 include/linux/net.h   |  1 +
 include/linux/sock_diag.h |  1 +
 net/core/sock_diag.c  | 32 
 net/ipv4/inet_diag.c  |  3 +--
 net/socket.c  |  5 +
 5 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/include/linux/net.h b/include/linux/net.h
index d97d80d..6c7cf09 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -225,6 +225,7 @@ enum {
 int sock_wake_async(struct socket_wq *sk_wq, int how, int band);
 int sock_register(const struct net_proto_family *fam);
 void sock_unregister(int family);
+bool sock_is_registered(int family);
 int __sock_create(struct net *net, int family, int type, int proto,
  struct socket **res, int kern);
 int sock_create(int family, int type, int proto, struct socket **res);
diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index a2f8109..e9a1b8d 100644
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -77,4 +77,5 @@ bool sock_diag_has_destroy_listeners(const struct sock *sk)
 void sock_diag_broadcast_destroy(struct sock *sk);
 
 int sock_diag_destroy(struct sock *sk, int err);
+int sock_diag_request_module(int family, int protocol);
 #endif
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index 217f4e3..caad6b6 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -7,6 +7,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -207,6 +208,25 @@ void sock_diag_unregister(const struct sock_diag_handler 
*hnld)
 }
 EXPORT_SYMBOL_GPL(sock_diag_unregister);
 
+int sock_diag_request_module(int family, int protocol)
+{
+   if (!protocol) {
+   if (!sock_is_registered(family))
+   return -ENOENT;
+
+   return request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+ NETLINK_SOCK_DIAG, family);
+   }
+
+   if (family == AF_INET &&
+   !rcu_access_pointer(inet_protos[protocol]))
+   return -ENOENT;
+
+   return request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
+ NETLINK_SOCK_DIAG, family, protocol);
+}
+EXPORT_SYMBOL_GPL(sock_diag_request_module);
+
 static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
int err;
@@ -220,8 +240,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct 
nlmsghdr *nlh)
return -EINVAL;
 
if (sock_diag_handlers[req->sdiag_family] == NULL)
-   request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-   NETLINK_SOCK_DIAG, req->sdiag_family);
+   sock_diag_request_module(req->sdiag_family, 0);
 
mutex_lock(_diag_table_mutex);
hndl = sock_diag_handlers[req->sdiag_family];
@@ -247,8 +266,7 @@ static int sock_diag_rcv_msg(struct sk_buff *skb, struct 
nlmsghdr *nlh,
case TCPDIAG_GETSOCK:
case DCCPDIAG_GETSOCK:
if (inet_rcv_compat == NULL)
-   request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-   NETLINK_SOCK_DIAG, AF_INET);
+   sock_diag_request_module(AF_INET, 0);
 
mutex_lock(_diag_table_mutex);
if (inet_rcv_compat != NULL)
@@ -281,14 +299,12 @@ static int sock_diag_bind(struct net *net, int group)
case SKNLGRP_INET_TCP_DESTROY:
case SKNLGRP_INET_UDP_DESTROY:
if (!sock_diag_handlers[AF_INET])
-   request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-  NETLINK_SOCK_DIAG, AF_INET);
+   sock_diag_request_module(AF_INET, 0);
break;
case SKNLGRP_INET6_TCP_DESTROY:
case SKNLGRP_INET6_UDP_DESTROY:
if (!sock_diag_handlers[AF_INET6])
-   request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-  NETLINK_SOCK_DIAG, AF_INET);
+   sock_diag_request_module(AF_INET, 0);
break;
}
return 0;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index c9c35b6..d10c8fa 100644
--- 

Re: [PATCH] bpf: devmap: Check attr->max_entries more carefully

[John Fastabend]

On 10/15/2017 03:13 PM, Richard Weinberger wrote:
> Am Montag, 16. Oktober 2017, 00:00:20 CEST schrieb Richard Weinberger:
>> max_entries is user controlled and used as input for __alloc_percpu().
>> This function expects that the allocation size is a power of two and
>> less than PCPU_MIN_UNIT_SIZE.
>> Otherwise a WARN() is triggered.
> 
> On a second though, I think we should also have a hard limit for 
> ->max_entries 
> or check for an overflow here:
> 

Or just,

static u64 dev_map_bitmap_size(const union bpf_attr *attr)
{
return BITS_TO_LONGS((u64) attr->max_entries) *
sizeof(unsigned long);
}

Let me know if you want me to send a patch or if you want to.

Thanks,
John

> static u64 dev_map_bitmap_size(const union bpf_attr *attr)
> {
> return BITS_TO_LONGS(attr->max_entries) * sizeof(unsigned long);
> }
> 
> Thanks,
> //richard
> 

Re: [PATCH net-next] tcp: Check daddr_cache before use in tracepoint

[Eric Dumazet]

On Mon, 2017-10-16 at 14:29 -0700, David Ahern wrote:
> Running perf in one window to capture tcp_retransmit_skb tracepoint:
> $ perf record -e tcp:tcp_retransmit_skb -a
> 
> And causing a retransmission on an active TCP session (e.g., dropping
> packets in the receiver, changing MTU on the interface to 500 and back
> to 1500) triggers a panic:
...

> Check that daddr_cache is non-NULL before de-referencing.
> 
> Fixes: e086101b150a ("tcp: add a tracepoint for tcp retransmission")
> Signed-off-by: David Ahern 
> ---
>  include/trace/events/tcp.h | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/include/trace/events/tcp.h b/include/trace/events/tcp.h
> index 3d1cbd072b7e..13e8ee8af2c8 100644
> --- a/include/trace/events/tcp.h
> +++ b/include/trace/events/tcp.h
> @@ -48,7 +48,8 @@ TRACE_EVENT(tcp_retransmit_skb,
>   pin6 = (struct in6_addr *)__entry->saddr_v6;
>   *pin6 = np->saddr;
>   pin6 = (struct in6_addr *)__entry->daddr_v6;
> - *pin6 = *(np->daddr_cache);
> + if (np->daddr_cache)
> + *pin6 = *(np->daddr_cache);
>   } else {
>   pin6 = (struct in6_addr *)__entry->saddr_v6;
>   ipv6_addr_set_v4mapped(inet->inet_saddr, pin6);

This is weird.

IPV6 TCP uses sk->sk_v6_daddr and sk->->sk_v6_rcv_saddr

So I would rather remove the need to fetch np = inet6_sk(sk) in the
first place, and look at sk->sk_family instead.

No need to get to np at all.

Re: [PATCH net-next] virtio_net: implement VIRTIO_CONFIG_S_NEEDS_RESET

[Michael S. Tsirkin]

On Tue, Oct 17, 2017 at 11:05:07AM +0800, Jason Wang wrote:
> 
> 
> On 2017年10月17日 06:34, Willem de Bruijn wrote:
> > On Mon, Oct 16, 2017 at 12:38 PM, Michael S. Tsirkin  
> > wrote:
> > > On Mon, Oct 16, 2017 at 12:04:57PM -0400, Willem de Bruijn wrote:
> > > > On Mon, Oct 16, 2017 at 11:31 AM, Michael S. Tsirkin  
> > > > wrote:
> > > > > On Mon, Oct 16, 2017 at 11:03:18AM -0400, Willem de Bruijn wrote:
> > > > > > > > +static int virtnet_reset(struct virtnet_info *vi)
> > > > > > > > +{
> > > > > > > > + struct virtio_device *dev = vi->vdev;
> > > > > > > > + int ret;
> > > > > > > > +
> > > > > > > > + virtio_config_disable(dev);
> > > > > > > > + dev->failed = dev->config->get_status(dev) & 
> > > > > > > > VIRTIO_CONFIG_S_FAILED;
> > > > > > > > + virtnet_freeze_down(dev, true);
> > > > > > > > + remove_vq_common(vi);
> > > > > > > > +
> > > > > > > > + virtio_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE);
> > > > > > > > + virtio_add_status(dev, VIRTIO_CONFIG_S_DRIVER);
> > > > > > > > +
> > > > > > > > + ret = virtio_finalize_features(dev);
> > > > > > > > + if (ret)
> > > > > > > > + goto err;
> > > > > > > > +
> > > > > > > > + ret = virtnet_restore_up(dev);
> > > > > > > > + if (ret)
> > > > > > > > + goto err;
> > > > > > > > +
> > > > > > > > + ret = virtnet_set_queues(vi, vi->curr_queue_pairs);
> > > > > > > > + if (ret)
> > > > > > > > + goto err;
> > > > > > > > +
> > > > > > > > + virtio_add_status(dev, VIRTIO_CONFIG_S_DRIVER_OK);
> > > > > > > > + virtio_config_enable(dev);
> > > > > > > > + return 0;
> > > > > > > > +
> > > > > > > > +err:
> > > > > > > > + virtio_add_status(dev, VIRTIO_CONFIG_S_FAILED);
> > > > > > > > + return ret;
> > > > > > > > +}
> > > > > > > > +
> > > > > > > >   static int virtnet_set_guest_offloads(struct virtnet_info 
> > > > > > > > *vi, u64 offloads)
> > > > > > > >   {
> > > > > > > >struct scatterlist sg;
> > > > > > > I have a question here though. How do things like MAC address
> > > > > > > get restored?
> > > > > > > 
> > > > > > > What about the rx mode?
> > > > > > > 
> > > > > > > vlans?
> > > > > > The function as is releases and reinitializes only ring state.
> > > > > > Device configuration such as mac and vlan persist across
> > > > > > the reset.
> > > > > What gave you this impression? Take a look at e.g. this
> > > > > code in qemu:
> > > > > 
> > > > > static void virtio_net_reset(VirtIODevice *vdev)
> > > > > {
> > > > >  VirtIONet *n = VIRTIO_NET(vdev);
> > > > > 
> > > > >  /* Reset back to compatibility mode */
> > > > >  n->promisc = 1;
> > > > >  n->allmulti = 0;
> > > > >  n->alluni = 0;
> > > > >  n->nomulti = 0;
> > > > >  n->nouni = 0;
> > > > >  n->nobcast = 0;
> > > > >  /* multiqueue is disabled by default */
> > > > >  n->curr_queues = 1;
> > > > >  timer_del(n->announce_timer);
> > > > >  n->announce_counter = 0;
> > > > >  n->status &= ~VIRTIO_NET_S_ANNOUNCE;
> > > > > 
> > > > >  /* Flush any MAC and VLAN filter table state */
> > > > >  n->mac_table.in_use = 0;
> > > > >  n->mac_table.first_multi = 0;
> > > > >  n->mac_table.multi_overflow = 0;
> > > > >  n->mac_table.uni_overflow = 0;
> > > > >  memset(n->mac_table.macs, 0, MAC_TABLE_ENTRIES * ETH_ALEN);
> > > > >  memcpy(>mac[0], >nic->conf->macaddr, sizeof(n->mac));
> > > > >  qemu_format_nic_info_str(qemu_get_queue(n->nic), n->mac);
> > > > >  memset(n->vlans, 0, MAX_VLAN >> 3);
> > > > > }
> > > > > 
> > > > > So device seems to lose all state, you have to re-program it.
> > > > Oh, indeed! The guest does not reset its state, so it might
> > > > be out of sync with the host after the operation. Was this not
> > > > an issue when previously resetting in the context of xdp?
> > > I suspect it was broken back then, too.
> > Okay. I guess that in principle this is all programmable through
> > virtnet_set_rx_mode, virtnet_vlan_rx_add_vid, etc. But it's a
> > lot more complex than just restoring virtnet_reset. Will need to
> > be careful about concurrency issues at the least. Similar to the
> > ones you point out below.
> > 
> 
> The problem has been pointed out during developing virtio-net XDP. But it
> may not be a big issue since vhost_net ignores all kinds of the filters now.
> 
> Thanks

It might not keep doing that in the future though.
And virtio-net in userspace doesn't ignore the filters.

-- 
MST

Re: [PATCH net-next] virtio_net: implement VIRTIO_CONFIG_S_NEEDS_RESET

[Jason Wang]

On 2017年10月17日 06:34, Willem de Bruijn wrote:

On Mon, Oct 16, 2017 at 12:38 PM, Michael S. Tsirkin  wrote:

On Mon, Oct 16, 2017 at 12:04:57PM -0400, Willem de Bruijn wrote:

On Mon, Oct 16, 2017 at 11:31 AM, Michael S. Tsirkin  wrote:

On Mon, Oct 16, 2017 at 11:03:18AM -0400, Willem de Bruijn wrote:

+static int virtnet_reset(struct virtnet_info *vi)
+{
+ struct virtio_device *dev = vi->vdev;
+ int ret;
+
+ virtio_config_disable(dev);
+ dev->failed = dev->config->get_status(dev) & VIRTIO_CONFIG_S_FAILED;
+ virtnet_freeze_down(dev, true);
+ remove_vq_common(vi);
+
+ virtio_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE);
+ virtio_add_status(dev, VIRTIO_CONFIG_S_DRIVER);
+
+ ret = virtio_finalize_features(dev);
+ if (ret)
+ goto err;
+
+ ret = virtnet_restore_up(dev);
+ if (ret)
+ goto err;
+
+ ret = virtnet_set_queues(vi, vi->curr_queue_pairs);
+ if (ret)
+ goto err;
+
+ virtio_add_status(dev, VIRTIO_CONFIG_S_DRIVER_OK);
+ virtio_config_enable(dev);
+ return 0;
+
+err:
+ virtio_add_status(dev, VIRTIO_CONFIG_S_FAILED);
+ return ret;
+}
+
  static int virtnet_set_guest_offloads(struct virtnet_info *vi, u64 offloads)
  {
   struct scatterlist sg;

I have a question here though. How do things like MAC address
get restored?

What about the rx mode?

vlans?

The function as is releases and reinitializes only ring state.
Device configuration such as mac and vlan persist across
the reset.

What gave you this impression? Take a look at e.g. this
code in qemu:

static void virtio_net_reset(VirtIODevice *vdev)
{
 VirtIONet *n = VIRTIO_NET(vdev);

 /* Reset back to compatibility mode */
 n->promisc = 1;
 n->allmulti = 0;
 n->alluni = 0;
 n->nomulti = 0;
 n->nouni = 0;
 n->nobcast = 0;
 /* multiqueue is disabled by default */
 n->curr_queues = 1;
 timer_del(n->announce_timer);
 n->announce_counter = 0;
 n->status &= ~VIRTIO_NET_S_ANNOUNCE;

 /* Flush any MAC and VLAN filter table state */
 n->mac_table.in_use = 0;
 n->mac_table.first_multi = 0;
 n->mac_table.multi_overflow = 0;
 n->mac_table.uni_overflow = 0;
 memset(n->mac_table.macs, 0, MAC_TABLE_ENTRIES * ETH_ALEN);
 memcpy(>mac[0], >nic->conf->macaddr, sizeof(n->mac));
 qemu_format_nic_info_str(qemu_get_queue(n->nic), n->mac);
 memset(n->vlans, 0, MAX_VLAN >> 3);
}

So device seems to lose all state, you have to re-program it.

Oh, indeed! The guest does not reset its state, so it might
be out of sync with the host after the operation. Was this not
an issue when previously resetting in the context of xdp?

I suspect it was broken back then, too.

Okay. I guess that in principle this is all programmable through
virtnet_set_rx_mode, virtnet_vlan_rx_add_vid, etc. But it's a
lot more complex than just restoring virtnet_reset. Will need to
be careful about concurrency issues at the least. Similar to the
ones you point out below.



The problem has been pointed out during developing virtio-net XDP. But 
it may not be a big issue since vhost_net ignores all kinds of the 
filters now.


Thanks

[net-next PATCH] macvlan/macvtap: Add support for L2 forwarding offloads with macvtap

[Alexander Duyck]

This patch reverts earlier commit b13ba1b83f52 ("macvlan: forbid L2
fowarding offload for macvtap"). The reason for reverting this is because
the original patch no longer fixes what it previously did as the
underlying structure has changed for macvtap. Specifically macvtap
originally pulled packets directly off of the lowerdev. However in commit
6acf54f1cf0a ("macvtap: Add support of packet capture on macvtap device.")
that code was changed and instead macvtap would listen directly on the
macvtap device itself instead of the lower device. As such, the L2
forwarding offload should now be able to provide a performance advantage of
skipping the checks on the lower dev while not introducing any sort of
regression.

Signed-off-by: Alexander Duyck 
---
 drivers/net/macvlan.c |5 +
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 858bd66..cfeb0ee 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -596,8 +596,6 @@ static int macvlan_hard_header(struct sk_buff *skb, struct 
net_device *dev,
.cache_update   = eth_header_cache_update,
 };
 
-static struct rtnl_link_ops macvlan_link_ops;
-
 static int macvlan_open(struct net_device *dev)
 {
struct macvlan_dev *vlan = netdev_priv(dev);
@@ -613,8 +611,7 @@ static int macvlan_open(struct net_device *dev)
goto hash_add;
}
 
-   if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD &&
-   dev->rtnl_link_ops == _link_ops) {
+   if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD) {
vlan->fwd_priv =
  lowerdev->netdev_ops->ndo_dfwd_add_station(lowerdev, dev);
 

[PATCH net-next] tcp: fix tcp_xmit_retransmit_queue() after rbtree introduction

[Eric Dumazet]

From: Eric Dumazet 

I tried to hard avoiding a call to rb_first() (via tcp_rtx_queue_head)
in tcp_xmit_retransmit_queue(). But this was probably too bold.

Quoting Yuchung :

We might miss re-arming the RTO if tp->retransmit_skb_hint is not NULL.
This can happen when RACK marks the first packet lost again and resets
tp->retransmit_skb_hint for example (tcp_rack_mark_skb_lost())

Fixes: 75c119afe14f ("tcp: implement rb-tree based retransmit queue")
Signed-off-by: Eric Dumazet 
Reported-by: Yuchung Cheng 
---
 net/ipv4/tcp_output.c |9 +++--
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 
6c74f2a3977876e691e7355045d4a84a98af1e30..53dc1267c85e668d9a6d5d60d24e6101f7a9c56b
 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2921,7 +2921,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff 
*skb, int segs)
 void tcp_xmit_retransmit_queue(struct sock *sk)
 {
const struct inet_connection_sock *icsk = inet_csk(sk);
-   struct sk_buff *skb, *rtx_head = NULL, *hole = NULL;
+   struct sk_buff *skb, *rtx_head, *hole = NULL;
struct tcp_sock *tp = tcp_sk(sk);
u32 max_segs;
int mib_idx;
@@ -2929,11 +2929,8 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
if (!tp->packets_out)
return;
 
-   skb = tp->retransmit_skb_hint;
-   if (!skb) {
-   rtx_head = tcp_rtx_queue_head(sk);
-   skb = rtx_head;
-   }
+   rtx_head = tcp_rtx_queue_head(sk);
+   skb = tp->retransmit_skb_hint ?: rtx_head;
max_segs = tcp_tso_segs(sk, tcp_current_mss(sk));
skb_rbtree_walk_from(skb) {
__u8 sacked;

Re: [PATCH v3] net: ftgmac100: Request clock and set speed

[Andrew Jeffery]

On Fri, 2017-10-13 at 12:16 +0800, Joel Stanley wrote:
> According to the ASPEED datasheet, gigabit speeds require a clock of
> 100MHz or higher. Other speeds require 25MHz or higher. This patch
> configures a 100MHz clock if the system has a direct-attached
> PHY, or 25MHz if the system is running NC-SI which is limited to 100MHz.
> 
> There appear to be no other upstream users of the FTGMAC100 driver it is
> hard to know the clocking requirements of other platforms. Therefore a
> conservative approach was taken with enabling clocks. If the platform is
> not ASPEED, both requesting the clock and configuring the speed is
> skipped.
> 
> Signed-off-by: Joel Stanley 

Tested on an AST2500 EVB and an OpenPOWER Palmetto (AST2400) machine.
Confirmed clock rates were nominally what was requested, and successfully
downloaded a 100MB test file.

Tested-by: Andrew Jeffery 

> ---
> Andrew, can you please give this one a spin on hardware?
> 
> v3:
>  - Fix errors from v2
> v2:
>  - only touch the clocks on Aspeed platforms
>  - unconditionally call clk_unprepare_disable
> 
>  drivers/net/ethernet/faraday/ftgmac100.c | 26 ++
>  1 file changed, 26 insertions(+)
> 
> diff --git a/drivers/net/ethernet/faraday/ftgmac100.c 
> b/drivers/net/ethernet/faraday/ftgmac100.c
> index 9ed8e4b81530..78db8e62a83f 100644
> --- a/drivers/net/ethernet/faraday/ftgmac100.c
> +++ b/drivers/net/ethernet/faraday/ftgmac100.c
> @@ -21,6 +21,7 @@
>  
>  #define pr_fmt(fmt)  KBUILD_MODNAME ": " fmt
>  
> +#include 
>  #include 
>  #include 
>  #include 
> @@ -59,6 +60,9 @@
>  /* Min number of tx ring entries before stopping queue */
>  #define TX_THRESHOLD (MAX_SKB_FRAGS + 1)
>  
> +#define FTGMAC_100MHZ1
> +#define FTGMAC_25MHZ 2500
> +
>  struct ftgmac100 {
>   /* Registers */
>   struct resource *res;
> @@ -96,6 +100,7 @@ struct ftgmac100 {
>   struct napi_struct napi;
>   struct work_struct reset_task;
>   struct mii_bus *mii_bus;
> + struct clk *clk;
>  
>   /* Link management */
>   int cur_speed;
> @@ -1734,6 +1739,22 @@ static void ftgmac100_ncsi_handler(struct ncsi_dev *nd)
>   nd->link_up ? "up" : "down");
>  }
>  
> +static void ftgmac100_setup_clk(struct ftgmac100 *priv)
> +{
> + priv->clk = devm_clk_get(priv->dev, NULL);
> + if (IS_ERR(priv->clk))
> + return;
> +
> + clk_prepare_enable(priv->clk);
> +
> + /* Aspeed specifies a 100MHz clock is required for up to
> +  * 1000Mbit link speeds. As NCSI is limited to 100Mbit, 25MHz
> +  * is sufficient
> +  */
> + clk_set_rate(priv->clk, priv->use_ncsi ? FTGMAC_25MHZ :
> + FTGMAC_100MHZ);
> +}
> +
>  static int ftgmac100_probe(struct platform_device *pdev)
>  {
>   struct resource *res;
> @@ -1830,6 +1851,9 @@ static int ftgmac100_probe(struct platform_device *pdev)
>   goto err_setup_mdio;
>   }
>  
> + if (priv->is_aspeed)
> + ftgmac100_setup_clk(priv);
> +
>   /* Default ring sizes */
>   priv->rx_q_entries = priv->new_rx_q_entries = DEF_RX_QUEUE_ENTRIES;
>   priv->tx_q_entries = priv->new_tx_q_entries = DEF_TX_QUEUE_ENTRIES;
> @@ -1883,6 +1907,8 @@ static int ftgmac100_remove(struct platform_device 
> *pdev)
>  
>   unregister_netdev(netdev);
>  
> + clk_disable_unprepare(priv->clk);
> +
>   /* There's a small chance the reset task will have been re-queued,
>    * during stop, make sure it's gone before we free the structure.
>    */

signature.asc
Description: This is a digitally signed message part

Re: [iproute2] regression in ss output

[Eric Dumazet]

On Mon, 2017-10-16 at 14:28 -0700, Stephen Hemminger wrote:
> On Mon, 16 Oct 2017 20:44:07 +
> Humberto Alves  wrote:
> 
> > Yes, just get rid of this 'if statement'.
> > in6addr_any should be represented as '::', not '*'. Otherwise it's 
> > impossible to distinguish IPv4 listening addresses from IPv6. Thank you :)
> 
> But IPv6 accepts IPv4 as well.

Not always (IPV6_V6ONLY socket option)

I agree that this recent change in ss is problematic.

Please give us back a way to distinguish IPV6 and IPv4

Hello

[Mrs. AmiraaWilliams]

Hello Dear,

Please forgive me for stressing you with my predicaments as I know
that this letter may come to you as big surprise. Actually, I came
across your E-mail from my personal search afterward I decided to
email you directly believing that you will be honest to fulfill my
final wish before i die. Meanwhile, I am Mrs. Amiraa Williams, 62
years old, from America, and I am suffering from a long time cancer
and from all indication my condition is really deteriorating as my
doctors have confirmed and courageously Advised me that I may not live
beyond two months from now for the reason that my tumor has reached a
critical stage which has defiled all forms of medical treatment, As a
matter of fact, registered nurse by profession while my husband was
dealing on Gold Dust and Gold Dory Bars in Burkina Faso till his
sudden death the year 2008 then I took over his business till date. In
fact, at this moment I have a deposit sum of four million five hundred
thousand US dollars [$4,500,000.00] with one of the leading bank in
Burkina Faso but unfortunately I cannot visit the bank since I’m
critically sick and powerless to do anything myself but my bank
account officer advised me to assign any of my trustworthy relative,
friends or partner with authorization letter to stand as the recipient
of my money but sorrowfully I don’t have any reliable relative and no
child.

Therefore, I want you to receive the money and take 50% to take care
of yourself and family while 50% should be use basically on
humanitarian purposes mostly to orphanages home, Motherless babies
home, less privileged and disable citizens and widows around the
world.  as soon as I receive your respond I shall send you the full
details with my pictures, banking records and with full contacts of my
banking institution to communicate them on the matter.

Hope to hear from you soon.
Yours Faithfully,
Mrs. Amiraa Williams

Re: RFC(v2): Audit Kernel Container IDs

[Steve Grubb]

On Monday, October 16, 2017 8:33:40 PM EDT Richard Guy Briggs wrote:
> On 2017-10-12 16:33, Casey Schaufler wrote:
> > On 10/12/2017 7:14 AM, Richard Guy Briggs wrote:
> > > Containers are a userspace concept.  The kernel knows nothing of them.
> > > 
> > > The Linux audit system needs a way to be able to track the container
> > > provenance of events and actions.  Audit needs the kernel's help to do
> > > this.
> > > 
> > > Since the concept of a container is entirely a userspace concept, a
> > > registration from the userspace container orchestration system initiates
> > > this.  This will define a point in time and a set of resources
> > > associated with a particular container with an audit container ID.
> > > 
> > > The registration is a pseudo filesystem (proc, since PID tree already
> > > exists) write of a u8[16] UUID representing the container ID to a file
> > > representing a process that will become the first process in a new
> > > container.  This write might place restrictions on mount namespaces
> > > required to define a container, or at least careful checking of
> > > namespaces in the kernel to verify permissions of the orchestrator so it
> > > can't change its own container ID.  A bind mount of nsfs may be
> > > necessary in the container orchestrator's mntNS.
> > > Note: Use a 128-bit scalar rather than a string to make compares faster
> > > and simpler.
> > > 
> > > Require a new CAP_CONTAINER_ADMIN to be able to carry out the
> > > registration.
> > 
> > Hang on. If containers are a user space concept, how can
> > you want CAP_CONTAINER_ANYTHING? If there's not such thing as
> > a container, how can you be asking for a capability to manage
> > them?
> 
> There is such a thing, but the kernel doesn't know about it yet.  This
> same situation exists for loginuid and sessionid which are userspace
> concepts that the kernel tracks for the convenience of userspace.  As
> for its name, I'm not particularly picky, so if you don't like
> CAP_CONTAINER_* then I'm fine with CAP_AUDIT_CONTAINERID.  It really
> needs to be distinct from CAP_AUDIT_WRITE and CAP_AUDIT_CONTROL since we
> don't want to give the ability to set a containerID to any process that
> is able to do audit logging (such as vsftpd) and similarly we don't want
> to give the orchestrator the ability to control the setup of the audit
> daemon.

A long time ago, we were debating what should guard against rouge processes 
from setting the loginuid. Casey argued that the ability to set the loginuid 
means they have the ability to control the audit trail. That means that it 
should be guarded by CAP_AUDIT_CONTROL. I think the same logic applies today. 

The ability to arbitrarily set a container ID means the process has the 
ability to indirectly control the audit trail.

-Steve

Re: net-next: WARNING: CPU: 0 PID: 1544 at net/ipv4/tcp_input.c:889

[Eric Dumazet]

On Mon, Oct 16, 2017 at 4:11 PM, Andrei Vagin  wrote:
> Hi Eric,
>
> Could you take a look at this warning? It may be related with your
> recent patches. First time we saw this warning 7 days ago
> (net-next/master) and now we see it regularly.
>
> I printed tp->fackets_out and state->reord  before the warnings and
> here are values for them:
> tp->fackets_out = -1 state->reord = 4
>
> In my case, this warning is triggered for connections which have been
> restored by CRIU.
>
> Let me know if you need any other information. I can reproduce this
> bugs for an hour.
>
> Thanks,
> Andrei

Hi Andrei

We are aware of these recurring issues and Yuchung and other Googlers
decided it was time to remove FACK.

Stay tuned.

[patch net v3 4/4] selftests: Introduce a new test case to tc testsuite

[Chris Mi]

In this patchset, we fixed a tc bug. This patch adds the test case
that reproduces the bug. To run this test case, user should specify
an existing NIC device:
  # sudo ./tdc.py -d enp4s0f0

This test case belongs to category "flower". If user doesn't specify
a NIC device, the test cases belong to "flower" will not be run.

In this test case, we create 1M filters and all filters share the same
action. When destroying all filters, kernel should not panic. It takes
about 18s to run it.

Signed-off-by: Chris Mi 
Acked-by: Jamal Hadi Salim 
Acked-by: Lucas Bates 
---
 .../tc-testing/tc-tests/filters/tests.json | 23 +-
 tools/testing/selftests/tc-testing/tdc.py  | 20 +++
 tools/testing/selftests/tc-testing/tdc_config.py   |  2 ++
 3 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json 
b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
index c727b96..5fa02d8 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
@@ -17,5 +17,26 @@
 "teardown": [
 "$TC qdisc del dev $DEV1 ingress"
 ]
+},
+{
+"id": "d052",
+"name": "Add 1M filters with the same action",
+"category": [
+"filter",
+"flower"
+],
+"setup": [
+"$TC qdisc add dev $DEV2 ingress",
+"./tdc_batch.py $DEV2 $BATCH_FILE --share_action -n 100"
+],
+"cmdUnderTest": "$TC -b $BATCH_FILE",
+"expExitCode": "0",
+"verifyCmd": "$TC actions list action gact",
+"matchPattern": "action order 0: gact action drop.*index 1 ref 100 
bind 100",
+"matchCount": "1",
+"teardown": [
+"$TC qdisc del dev $DEV2 ingress",
+"/bin/rm $BATCH_FILE"
+]
 }
-]
\ No newline at end of file
+]
diff --git a/tools/testing/selftests/tc-testing/tdc.py 
b/tools/testing/selftests/tc-testing/tdc.py
index cd61b78..5f11f5d 100755
--- a/tools/testing/selftests/tc-testing/tdc.py
+++ b/tools/testing/selftests/tc-testing/tdc.py
@@ -88,7 +88,7 @@ def prepare_env(cmdlist):
 exit(1)
 
 
-def test_runner(filtered_tests):
+def test_runner(filtered_tests, args):
 """
 Driver function for the unit tests.
 
@@ -105,6 +105,8 @@ def test_runner(filtered_tests):
 for tidx in testlist:
 result = True
 tresult = ""
+if "flower" in tidx["category"] and args.device == None:
+continue
 print("Test " + tidx["id"] + ": " + tidx["name"])
 prepare_env(tidx["setup"])
 (p, procout) = exec_cmd(tidx["cmdUnderTest"])
@@ -152,6 +154,10 @@ def ns_create():
 exec_cmd(cmd, False)
 cmd = 'ip -s $NS link set $DEV1 up'
 exec_cmd(cmd, False)
+cmd = 'ip link set $DEV2 netns $NS'
+exec_cmd(cmd, False)
+cmd = 'ip -s $NS link set $DEV2 up'
+exec_cmd(cmd, False)
 
 
 def ns_destroy():
@@ -211,7 +217,8 @@ def set_args(parser):
 help='Execute the single test case with specified ID')
 parser.add_argument('-i', '--id', action='store_true', dest='gen_id',
 help='Generate ID numbers for new test cases')
-return parser
+parser.add_argument('-d', '--device',
+help='Execute the test case in flower category')
 return parser
 
 
@@ -225,6 +232,8 @@ def check_default_settings(args):
 
 if args.path != None:
  NAMES['TC'] = args.path
+if args.device != None:
+ NAMES['DEV2'] = args.device
 if not os.path.isfile(NAMES['TC']):
 print("The specified tc path " + NAMES['TC'] + " does not exist.")
 exit(1)
@@ -381,14 +390,17 @@ def set_operation_mode(args):
 if (len(alltests) == 0):
 print("Cannot find a test case with ID matching " + target_id)
 exit(1)
-catresults = test_runner(alltests)
+catresults = test_runner(alltests, args)
 print("All test results: " + "\n\n" + catresults)
 elif (len(target_category) > 0):
+if (target_category == "flower") and args.device == None:
+print("Please specify a NIC device (-d) to run category flower")
+exit(1)
 if (target_category not in ucat):
 print("Specified category is not present in this file.")
 exit(1)
 else:
-catresults = test_runner(testcases[target_category])
+catresults = test_runner(testcases[target_category], args)
 print("Category " + target_category + "\n\n" + catresults)
 
 ns_destroy()
diff --git a/tools/testing/selftests/tc-testing/tdc_config.py 
b/tools/testing/selftests/tc-testing/tdc_config.py
index 0108737..b635251 100644
--- 

[patch net v3 3/4] selftests: Introduce a new script to generate tc batch file

[Chris Mi]

  # ./tdc_batch.py -h
  usage: tdc_batch.py [-h] [-n NUMBER] [-o] [-s] [-p] device file

  TC batch file generator

  positional arguments:
devicedevice name
file  batch file name

  optional arguments:
-h, --helpshow this help message and exit
-n NUMBER, --number NUMBER
  how many lines in batch file
-o, --skip_sw skip_sw (offload), by default skip_hw
-s, --share_actionall filters share the same action
-p, --prioall filters have different prio

Signed-off-by: Chris Mi 
Acked-by: Jamal Hadi Salim 
Acked-by: Lucas Bates 
---
 tools/testing/selftests/tc-testing/tdc_batch.py | 62 +
 1 file changed, 62 insertions(+)
 create mode 100755 tools/testing/selftests/tc-testing/tdc_batch.py

diff --git a/tools/testing/selftests/tc-testing/tdc_batch.py 
b/tools/testing/selftests/tc-testing/tdc_batch.py
new file mode 100755
index 000..707c6bf
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/tdc_batch.py
@@ -0,0 +1,62 @@
+#!/usr/bin/python3
+
+"""
+tdc_batch.py - a script to generate TC batch file
+
+Copyright (C) 2017 Chris Mi 
+"""
+
+import argparse
+
+parser = argparse.ArgumentParser(description='TC batch file generator')
+parser.add_argument("device", help="device name")
+parser.add_argument("file", help="batch file name")
+parser.add_argument("-n", "--number", type=int,
+help="how many lines in batch file")
+parser.add_argument("-o", "--skip_sw",
+help="skip_sw (offload), by default skip_hw",
+action="store_true")
+parser.add_argument("-s", "--share_action",
+help="all filters share the same action",
+action="store_true")
+parser.add_argument("-p", "--prio",
+help="all filters have different prio",
+action="store_true")
+args = parser.parse_args()
+
+device = args.device
+file = open(args.file, 'w')
+
+number = 1
+if args.number:
+number = args.number
+
+skip = "skip_hw"
+if args.skip_sw:
+skip = "skip_sw"
+
+share_action = ""
+if args.share_action:
+share_action = "index 1"
+
+prio = "prio 1"
+if args.prio:
+prio = ""
+if number > 0x4000:
+number = 0x4000
+
+index = 0
+for i in range(0x100):
+for j in range(0x100):
+for k in range(0x100):
+mac = ("%02x:%02x:%02x" % (i, j, k))
+src_mac = "e4:11:00:" + mac
+dst_mac = "e4:12:00:" + mac
+cmd = ("filter add dev %s %s protocol ip parent : flower %s "
+   "src_mac %s dst_mac %s action drop %s" %
+   (device, prio, skip, src_mac, dst_mac, share_action))
+file.write("%s\n" % cmd)
+index += 1
+if index >= number:
+file.close()
+exit(0)
-- 
1.8.3.1

[patch net v3 2/4] net/sched: Use action array instead of action list as parameter

[Chris Mi]

When destroying filters, actions should be destroyed first.
The pointers of each action are saved in an array. TC doesn't
use the array directly, but put all actions in a doubly linked
list and use that list as parameter.

There is no problem if each filter has its own actions. But if
some filters share the same action, when these filters are
destroyed, RCU callback fl_destroy_filter() may be called at the
same time. That means the same action's 'struct list_head list'
could be manipulated at the same time. It may point to an invalid
address so that system will panic.

This patch uses the action array directly to fix this issue.

Fixes commit in pre-git era.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Chris Mi 
Acked-by: Jamal Hadi Salim 
---
 include/net/act_api.h |   7 ++--
 net/sched/act_api.c   | 103 +++---
 net/sched/cls_api.c   |  18 +++--
 3 files changed, 75 insertions(+), 53 deletions(-)

diff --git a/include/net/act_api.h b/include/net/act_api.h
index a469ab6..081a313 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -148,16 +148,17 @@ static inline int tcf_idr_release(struct tc_action *a, 
bool bind)
 int tcf_register_action(struct tc_action_ops *a, struct pernet_operations 
*ops);
 int tcf_unregister_action(struct tc_action_ops *a,
  struct pernet_operations *ops);
-int tcf_action_destroy(struct list_head *actions, int bind);
+int tcf_action_destroy(struct tc_action **actions, int nr, int bind);
 int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,
int nr_actions, struct tcf_result *res);
 int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla,
struct nlattr *est, char *name, int ovr, int bind,
-   struct list_head *actions);
+   struct tc_action **actions, int *nr);
 struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
struct nlattr *nla, struct nlattr *est,
char *name, int ovr, int bind);
-int tcf_action_dump(struct sk_buff *skb, struct list_head *, int, int);
+int tcf_action_dump(struct sk_buff *skb, struct tc_action **actions, int nr,
+   int bind, int ref);
 int tcf_action_dump_old(struct sk_buff *skb, struct tc_action *a, int, int);
 int tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int, int);
 int tcf_action_copy_stats(struct sk_buff *, struct tc_action *, int);
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 9c0224d..391d560 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -513,13 +513,15 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action 
**actions,
 }
 EXPORT_SYMBOL(tcf_action_exec);
 
-int tcf_action_destroy(struct list_head *actions, int bind)
+int tcf_action_destroy(struct tc_action **actions, int nr, int bind)
 {
const struct tc_action_ops *ops;
-   struct tc_action *a, *tmp;
+   struct tc_action *a;
int ret = 0;
+   int i;
 
-   list_for_each_entry_safe(a, tmp, actions, list) {
+   for (i = 0; i < nr; i++) {
+   a = actions[i];
ops = a->ops;
ret = __tcf_idr_release(a, bind, true);
if (ret == ACT_P_DELETED)
@@ -568,14 +570,16 @@ int tcf_action_destroy(struct list_head *actions, int 
bind)
 }
 EXPORT_SYMBOL(tcf_action_dump_1);
 
-int tcf_action_dump(struct sk_buff *skb, struct list_head *actions,
+int tcf_action_dump(struct sk_buff *skb, struct tc_action **actions, int nr,
int bind, int ref)
 {
struct tc_action *a;
-   int err = -EINVAL;
struct nlattr *nest;
+   int err = -EINVAL;
+   int i;
 
-   list_for_each_entry(a, actions, list) {
+   for (i = 0; i < nr; i++) {
+   a = actions[i];
nest = nla_nest_start(skb, a->order);
if (nest == NULL)
goto nla_put_failure;
@@ -700,10 +704,7 @@ struct tc_action *tcf_action_init_1(struct net *net, 
struct tcf_proto *tp,
if (TC_ACT_EXT_CMP(a->tcfa_action, TC_ACT_GOTO_CHAIN)) {
err = tcf_action_goto_chain_init(a, tp);
if (err) {
-   LIST_HEAD(actions);
-
-   list_add_tail(>list, );
-   tcf_action_destroy(, bind);
+   tcf_action_destroy(, 1, bind);
return ERR_PTR(err);
}
}
@@ -720,23 +721,27 @@ struct tc_action *tcf_action_init_1(struct net *net, 
struct tcf_proto *tp,
return ERR_PTR(err);
 }
 
-static void cleanup_a(struct list_head *actions, int ovr)
+static void cleanup_a(struct tc_action **actions, int nr, int ovr)
 {
struct tc_action *a;
+   int i;
 
if (!ovr)
return;
 
-   list_for_each_entry(a, actions, 

[patch net v3 1/4] net/sched: Change tc_action refcnt and bindcnt to atomic

[Chris Mi]

If many filters share the same action. That action's refcnt and bindcnt
could be manipulated by many RCU callbacks at the same time. This patch
makes these operations atomic.

Fixes commit in pre-git era.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Chris Mi 
Acked-by: Jamal Hadi Salim 
---
 include/net/act_api.h  |  4 ++--
 net/sched/act_api.c| 21 +++--
 net/sched/act_bpf.c|  4 ++--
 net/sched/act_connmark.c   |  4 ++--
 net/sched/act_csum.c   |  4 ++--
 net/sched/act_gact.c   |  4 ++--
 net/sched/act_ife.c|  4 ++--
 net/sched/act_ipt.c|  4 ++--
 net/sched/act_mirred.c |  4 ++--
 net/sched/act_nat.c|  4 ++--
 net/sched/act_pedit.c  |  4 ++--
 net/sched/act_police.c |  4 ++--
 net/sched/act_sample.c |  4 ++--
 net/sched/act_simple.c |  4 ++--
 net/sched/act_skbedit.c|  4 ++--
 net/sched/act_skbmod.c |  4 ++--
 net/sched/act_tunnel_key.c |  4 ++--
 net/sched/act_vlan.c   |  4 ++--
 18 files changed, 45 insertions(+), 44 deletions(-)

diff --git a/include/net/act_api.h b/include/net/act_api.h
index b944e0eb..a469ab6 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -25,8 +25,8 @@ struct tc_action {
struct tcf_idrinfo  *idrinfo;
 
u32 tcfa_index;
-   int tcfa_refcnt;
-   int tcfa_bindcnt;
+   atomic_ttcfa_refcnt;
+   atomic_ttcfa_bindcnt;
u32 tcfa_capab;
int tcfa_action;
struct tcf_ttcfa_tm;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index da6fa82..9c0224d 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -88,12 +88,13 @@ int __tcf_idr_release(struct tc_action *p, bool bind, bool 
strict)
 
if (p) {
if (bind)
-   p->tcfa_bindcnt--;
-   else if (strict && p->tcfa_bindcnt > 0)
+   atomic_dec(>tcfa_bindcnt);
+   else if (strict && atomic_read(>tcfa_bindcnt) > 0)
return -EPERM;
 
-   p->tcfa_refcnt--;
-   if (p->tcfa_bindcnt <= 0 && p->tcfa_refcnt <= 0) {
+   atomic_dec(>tcfa_refcnt);
+   if (atomic_read(>tcfa_bindcnt) == 0 &&
+   atomic_read(>tcfa_refcnt) == 0) {
if (p->ops->cleanup)
p->ops->cleanup(p, bind);
tcf_idr_remove(p->idrinfo, p);
@@ -245,8 +246,8 @@ bool tcf_idr_check(struct tc_action_net *tn, u32 index, 
struct tc_action **a,
 
if (index && p) {
if (bind)
-   p->tcfa_bindcnt++;
-   p->tcfa_refcnt++;
+   atomic_inc(>tcfa_bindcnt);
+   atomic_inc(>tcfa_refcnt);
*a = p;
return true;
}
@@ -274,9 +275,9 @@ int tcf_idr_create(struct tc_action_net *tn, u32 index, 
struct nlattr *est,
 
if (unlikely(!p))
return -ENOMEM;
-   p->tcfa_refcnt = 1;
+   atomic_set(>tcfa_refcnt, 1);
if (bind)
-   p->tcfa_bindcnt = 1;
+   atomic_set(>tcfa_bindcnt, 1);
 
if (cpustats) {
p->cpu_bstats = netdev_alloc_pcpu_stats(struct 
gnet_stats_basic_cpu);
@@ -727,7 +728,7 @@ static void cleanup_a(struct list_head *actions, int ovr)
return;
 
list_for_each_entry(a, actions, list)
-   a->tcfa_refcnt--;
+   atomic_dec(>tcfa_refcnt);
 }
 
 int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla,
@@ -751,7 +752,7 @@ int tcf_action_init(struct net *net, struct tcf_proto *tp, 
struct nlattr *nla,
}
act->order = i;
if (ovr)
-   act->tcfa_refcnt++;
+   atomic_inc(>tcfa_refcnt);
list_add_tail(>list, actions);
}
 
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index c0c707e..4ddf281 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -141,8 +141,8 @@ static int tcf_bpf_dump(struct sk_buff *skb, struct 
tc_action *act,
struct tcf_bpf *prog = to_bpf(act);
struct tc_act_bpf opt = {
.index   = prog->tcf_index,
-   .refcnt  = prog->tcf_refcnt - ref,
-   .bindcnt = prog->tcf_bindcnt - bind,
+   .refcnt  = atomic_read(>tcf_refcnt) - ref,
+   .bindcnt = atomic_read(>tcf_bindcnt) - bind,
.action  = prog->tcf_action,
};
struct tcf_t tm;
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 10b7a88..d2cf658 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -153,8 +153,8 @@ static inline 

[patch net v3 0/4] net/sched: Fix a system panic when deleting filters

[Chris Mi]

If some filters share the same action, when deleting these filters,
it is possible to create a system panic. This is because deletions
could be manipulated by many RCU callbacks at the same time.

This patch set fixes these issues. To reproduce the issue run selftests
in patch 3 and 4. To test if the issue was fixed, apply patches 1 and 2
and then repeat the tests.

v2 changelog


Revise the comment and add Acked-by: Jamal Hadi Salim 

v3 changelog

Add Acked-by: Lucas Bates  for patch 3 and 4

Chris Mi (4):
  net/sched: Change tc_action refcnt and bindcnt to atomic
  net/sched: Use action array instead of action list as parameter
  selftests: Introduce a new script to generate tc batch file
  selftests: Introduce a new test case to tc testsuite

 include/net/act_api.h  |  11 +-
 net/sched/act_api.c| 124 +
 net/sched/act_bpf.c|   4 +-
 net/sched/act_connmark.c   |   4 +-
 net/sched/act_csum.c   |   4 +-
 net/sched/act_gact.c   |   4 +-
 net/sched/act_ife.c|   4 +-
 net/sched/act_ipt.c|   4 +-
 net/sched/act_mirred.c |   4 +-
 net/sched/act_nat.c|   4 +-
 net/sched/act_pedit.c  |   4 +-
 net/sched/act_police.c |   4 +-
 net/sched/act_sample.c |   4 +-
 net/sched/act_simple.c |   4 +-
 net/sched/act_skbedit.c|   4 +-
 net/sched/act_skbmod.c |   4 +-
 net/sched/act_tunnel_key.c |   4 +-
 net/sched/act_vlan.c   |   4 +-
 net/sched/cls_api.c|  18 +--
 .../tc-testing/tc-tests/filters/tests.json |  23 +++-
 tools/testing/selftests/tc-testing/tdc.py  |  20 +++-
 tools/testing/selftests/tc-testing/tdc_batch.py|  62 +++
 tools/testing/selftests/tc-testing/tdc_config.py   |   2 +
 23 files changed, 222 insertions(+), 102 deletions(-)
 create mode 100755 tools/testing/selftests/tc-testing/tdc_batch.py

-- 
1.8.3.1

RE: [patch net v2 1/4] net/sched: Change tc_action refcnt and bindcnt to atomic

[Chris Mi]

> -Original Message-
> From: Cong Wang [mailto:xiyou.wangc...@gmail.com]
> Sent: Tuesday, October 17, 2017 1:06 AM
> To: Chris Mi 
> Cc: Linux Kernel Network Developers ; Jamal Hadi
> Salim ; Lucas Bates ; Jiri Pirko
> ; David Miller 
> Subject: Re: [patch net v2 1/4] net/sched: Change tc_action refcnt and
> bindcnt to atomic
> 
> On Mon, Oct 16, 2017 at 4:18 AM, Chris Mi  wrote:
> > If many filters share the same action. That action's refcnt and
> > bindcnt could be manipulated by many RCU callbacks at the same time.
> > This patch makes these operations atomic.
> 
> Actually I have been thinking about removing these RCU callbacks, they are
> not necessary AFAIK, callers hold RTNL lock so they are allowed to block. The
> only drawback is that adding a synchronize_rcu(), but these are slow paths
> anyway...
> 
> I am not sure, it is arguable anyway, essentially it is:
> 
> synchronize_rcu() in slow path vs.  multiple RCU callback races
> 
> 
> >
> > Fixes commit in pre-git era.
> >
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> 
> This is not true, the action RCU callbacks were introduced
> by:
> 
> commit c7de2cf053420d63bac85133469c965d4b1083e1
> Author: Eric Dumazet 
> Date:   Wed Jun 9 02:09:23 2010 +
> 
> pkt_sched: gen_kill_estimator() rcu fixes
> 
> 
> and the filter RCU callbacks were introduced by the patchset like this one:
> 
> 
> commit 1ce87720d456e471de0fbd814dc5d1fe10fc1c44
> Author: John Fastabend 
> Date:   Fri Sep 12 20:09:16 2014 -0700
> 
> net: sched: make cls_u32 lockless
I don't think this bug were introduced by above two commits only.
Actually, this bug were introduced by several commits, at least the following:
1. refcnt and bindcnt are not atomic
2. passing actions using list instead of arrays (I think initially we are using 
arrays)
3. using RCU callbacks
So instead of blaming the latest commit, it is better to say it is a pre-git 
error.

Re: RFC(v2): Audit Kernel Container IDs

[Casey Schaufler]

On 10/16/2017 5:33 PM, Richard Guy Briggs wrote:
> On 2017-10-12 16:33, Casey Schaufler wrote:
>> On 10/12/2017 7:14 AM, Richard Guy Briggs wrote:
>>> Containers are a userspace concept.  The kernel knows nothing of them.
>>>
>>> The Linux audit system needs a way to be able to track the container
>>> provenance of events and actions.  Audit needs the kernel's help to do
>>> this.
>>>
>>> Since the concept of a container is entirely a userspace concept, a
>>> registration from the userspace container orchestration system initiates
>>> this.  This will define a point in time and a set of resources
>>> associated with a particular container with an audit container ID.
>>>
>>> The registration is a pseudo filesystem (proc, since PID tree already
>>> exists) write of a u8[16] UUID representing the container ID to a file
>>> representing a process that will become the first process in a new
>>> container.  This write might place restrictions on mount namespaces
>>> required to define a container, or at least careful checking of
>>> namespaces in the kernel to verify permissions of the orchestrator so it
>>> can't change its own container ID.  A bind mount of nsfs may be
>>> necessary in the container orchestrator's mntNS.
>>> Note: Use a 128-bit scalar rather than a string to make compares faster
>>> and simpler.
>>>
>>> Require a new CAP_CONTAINER_ADMIN to be able to carry out the
>>> registration.
>> Hang on. If containers are a user space concept, how can
>> you want CAP_CONTAINER_ANYTHING? If there's not such thing as
>> a container, how can you be asking for a capability to manage
>> them?
> There is such a thing, but the kernel doesn't know about it yet.

Then how can it be the kernel's place to control access to a
container resource, that is, the containerID.

>   This
> same situation exists for loginuid and sessionid which are userspace
> concepts that the kernel tracks for the convenience of userspace.

Ah, no. Loginuid identifies a user, which is a kernel concept in
that a user is defined by the uid. The session ID has well defined
kernel semantics. You're trying to say that the containerID is an
opaque value that is meaningless to the kernel, but you still want
the kernel to protect it. How can the kernel know if it is protecting
it correctly?

>   As
> for its name, I'm not particularly picky, so if you don't like
> CAP_CONTAINER_* then I'm fine with CAP_AUDIT_CONTAINERID.  It really
> needs to be distinct from CAP_AUDIT_WRITE and CAP_AUDIT_CONTROL since we
> don't want to give the ability to set a containerID to any process that
> is able to do audit logging (such as vsftpd) and similarly we don't want
> to give the orchestrator the ability to control the setup of the audit
> daemon.

Sorry, but what aspect of the kernel security policy is this
capability supposed to protect? That's what capabilities are
for, not the undefined support of undefined user-space behavior.

If it's audit behavior, you want CAP_AUDIT_CONTROL. If it's
more than audit behavior you have to define what system security
policy you're dealing with in order to pick the right capability.

We get this request pretty regularly. "I need my own capability
because I have a niche thing that isn't part of the system security
policy but that is important!" Fit the containerID into the
system security policy, and if that results in using CAP_SYS_ADMIN,
oh well.

>>>   At that time, record the target container's user-supplied
>>> container identifier along with the target container's first process
>>> (which may become the target container's "init" process) process ID
>>> (referenced from the initial PID namespace), all namespace IDs (in the
>>> form of a nsfs device number and inode number tuple) in a new auxilliary
>>> record AUDIT_CONTAINER with a qualifying op=$action field.
>>>
>>> Issue a new auxilliary record AUDIT_CONTAINER_INFO for each valid
>>> container ID present on an auditable action or event.
>>>
>>> Forked and cloned processes inherit their parent's container ID,
>>> referenced in the process' task_struct.
>>>
>>> Mimic setns(2) and return an error if the process has already initiated
>>> threading or forked since this registration should happen before the
>>> process execution is started by the orchestrator and hence should not
>>> yet have any threads or children.  If this is deemed overly restrictive,
>>> switch all threads and children to the new containerID.
>>>
>>> Trust the orchestrator to judiciously use and restrict CAP_CONTAINER_ADMIN.
>>>
>>> Log the creation of every namespace, inheriting/adding its spawning
>>> process' containerID(s), if applicable.  Include the spawning and
>>> spawned namespace IDs (device and inode number tuples).
>>> [AUDIT_NS_CREATE, AUDIT_NS_DESTROY] [clone(2), unshare(2), setns(2)]
>>> Note: At this point it appears only network namespaces may need to track
>>> container IDs apart from processes since incoming packets may cause an
>>> auditable event before being associated with a 

homepage of iptuils-tracepth ?

[shirish शिरीष]

Dear all,

Please CC me as I'm not subscribed to the list. I recently came across
iptuils-tracepath . I tried to find the upstream homepage for it and
saw http://www.skbuff.net/iputils/ but it shows an older version while
Debian seems to have the later/latest

[$] apt-cache policy iputils-tracepath
iputils-tracepath:
  Installed: 3:20161105-1
  Candidate: 3:20161105-1
  Version table:
 *** 3:20161105-1 600
600 http://httpredir.debian.org/debian buster/main amd64 Packages
  1 http://httpredir.debian.org/debian unstable/main amd64 Packages
100 /var/lib/dpkg/status

while the one shown on the skbuff.net shows one from 2015 only. It
would be nice to see a better home. Also there doesn't seem to be a
mirror on github.com

Look forward to know more.

-- 
  Regards,
  Shirish Agarwal  शिरीष अग्रवाल
  My quotes in this email licensed under CC 3.0
http://creativecommons.org/licenses/by-nc/3.0/
http://flossexperiences.wordpress.com
EB80 462B 08E1 A0DE A73A  2C2F 9F3D C7A4 E1C4 D2D8

RE: [patch net v2 4/4] selftests: Introduce a new test case to tc testsuite

[Chris Mi]

> -Original Message-
> From: Lucas Bates [mailto:luc...@mojatatu.com]
> Sent: Tuesday, October 17, 2017 12:25 AM
> To: Chris Mi 
> Cc: netdev@vger.kernel.org; Jamal Hadi Salim ; Cong
> Wang ; Jiri Pirko ;
> da...@davemloft.net
> Subject: Re: [patch net v2 4/4] selftests: Introduce a new test case to tc
> testsuite
> 
> On Mon, Oct 16, 2017 at 7:18 AM, Chris Mi  wrote:
> > In this patchset, we fixed a tc bug. This patch adds the test case
> > that reproduces the bug. To run this test case, user should specify an
> > existing NIC device:
> >   # sudo ./tdc.py -d enp4s0f0
> >
> > This test case belongs to category "flower". If user doesn't specify a
> > NIC device, the test cases belong to "flower" will not be run.
> >
> > In this test case, we create 1M filters and all filters share the same
> > action. When destroying all filters, kernel should not panic. It takes
> > about 18s to run it.
> >
> > Signed-off-by: Chris Mi 
> > Acked-by: Jamal Hadi Salim 
> 
> I'm a little wary about adding changes like these into tdc.py directly; I 
> don't
> think it's going to be sustainable in the long run.
> Even the namespace creation I put in to the original version is too specific 
> and
> limiting.
> 
> There are some upcoming changes to tdc to help address these particular
> issues.  I'll ack this for now, thanks.
OK. Thanks for your review, Lucas.
> 
> Acked-by: Lucas Bates 
> 
> 
> > ---
> >  .../tc-testing/tc-tests/filters/tests.json | 23
> +-
> >  tools/testing/selftests/tc-testing/tdc.py  | 20 +++
> >  tools/testing/selftests/tc-testing/tdc_config.py   |  2 ++
> >  3 files changed, 40 insertions(+), 5 deletions(-)
> >
> > diff --git
> > a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
> > b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
> > index c727b96..5fa02d8 100644
> > --- a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
> > +++ b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json
> > @@ -17,5 +17,26 @@
> >  "teardown": [
> >  "$TC qdisc del dev $DEV1 ingress"
> >  ]
> > +},
> > +{
> > +"id": "d052",
> > +"name": "Add 1M filters with the same action",
> > +"category": [
> > +"filter",
> > +"flower"
> > +],
> > +"setup": [
> > +"$TC qdisc add dev $DEV2 ingress",
> > +"./tdc_batch.py $DEV2 $BATCH_FILE --share_action -n 100"
> > +],
> > +"cmdUnderTest": "$TC -b $BATCH_FILE",
> > +"expExitCode": "0",
> > +"verifyCmd": "$TC actions list action gact",
> > +"matchPattern": "action order 0: gact action drop.*index 1 ref 
> > 100
> bind 100",
> > +"matchCount": "1",
> > +"teardown": [
> > +"$TC qdisc del dev $DEV2 ingress",
> > +"/bin/rm $BATCH_FILE"
> > +]
> >  }
> > -]
> > \ No newline at end of file
> > +]
> > diff --git a/tools/testing/selftests/tc-testing/tdc.py
> > b/tools/testing/selftests/tc-testing/tdc.py
> > index cd61b78..5f11f5d 100755
> > --- a/tools/testing/selftests/tc-testing/tdc.py
> > +++ b/tools/testing/selftests/tc-testing/tdc.py
> > @@ -88,7 +88,7 @@ def prepare_env(cmdlist):
> >  exit(1)
> >
> >
> > -def test_runner(filtered_tests):
> > +def test_runner(filtered_tests, args):
> >  """
> >  Driver function for the unit tests.
> >
> > @@ -105,6 +105,8 @@ def test_runner(filtered_tests):
> >  for tidx in testlist:
> >  result = True
> >  tresult = ""
> > +if "flower" in tidx["category"] and args.device == None:
> > +continue
> >  print("Test " + tidx["id"] + ": " + tidx["name"])
> >  prepare_env(tidx["setup"])
> >  (p, procout) = exec_cmd(tidx["cmdUnderTest"]) @@ -152,6
> > +154,10 @@ def ns_create():
> >  exec_cmd(cmd, False)
> >  cmd = 'ip -s $NS link set $DEV1 up'
> >  exec_cmd(cmd, False)
> > +cmd = 'ip link set $DEV2 netns $NS'
> > +exec_cmd(cmd, False)
> > +cmd = 'ip -s $NS link set $DEV2 up'
> > +exec_cmd(cmd, False)
> >
> >
> >  def ns_destroy():
> > @@ -211,7 +217,8 @@ def set_args(parser):
> >  help='Execute the single test case with specified 
> > ID')
> >  parser.add_argument('-i', '--id', action='store_true', dest='gen_id',
> >  help='Generate ID numbers for new test cases')
> > -return parser
> > +parser.add_argument('-d', '--device',
> > +help='Execute the test case in flower
> > + category')
> >  return parser
> >
> >
> > @@ -225,6 +232,8 @@ def check_default_settings(args):
> >
> >  if args.path != None:
> >   NAMES['TC'] = args.path
> > 

[next-queue PATCH v9 6/6] igb: Add support for CBS offload

[Vinicius Costa Gomes]

From: Andre Guedes 

This patch adds support for Credit-Based Shaper (CBS) qdisc offload
from Traffic Control system. This support enable us to leverage the
Forwarding and Queuing for Time-Sensitive Streams (FQTSS) features
from Intel i210 Ethernet Controller. FQTSS is the former 802.1Qav
standard which was merged into 802.1Q in 2014. It enables traffic
prioritization and bandwidth reservation via the Credit-Based Shaper
which is implemented in hardware by i210 controller.

The patch introduces the igb_setup_tc() function which implements the
support for CBS qdisc hardware offload in the IGB driver. CBS offload
is the only traffic control offload supported by the driver at the
moment.

FQTSS transmission mode from i210 controller is automatically enabled
by the IGB driver when the CBS is enabled for the first hardware
queue. Likewise, FQTSS mode is automatically disabled when CBS is
disabled for the last hardware queue. Changing FQTSS mode requires NIC
reset.

FQTSS feature is supported by i210 controller only.

Signed-off-by: Andre Guedes 
---
 drivers/net/ethernet/intel/igb/e1000_defines.h |  23 ++
 drivers/net/ethernet/intel/igb/e1000_regs.h|   8 +
 drivers/net/ethernet/intel/igb/igb.h   |   6 +
 drivers/net/ethernet/intel/igb/igb_main.c  | 347 +
 4 files changed, 384 insertions(+)

diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h 
b/drivers/net/ethernet/intel/igb/e1000_defines.h
index 1de82f247312..83cabff1e0ab 100644
--- a/drivers/net/ethernet/intel/igb/e1000_defines.h
+++ b/drivers/net/ethernet/intel/igb/e1000_defines.h
@@ -353,7 +353,18 @@
 #define E1000_RXPBS_CFG_TS_EN   0x8000
 
 #define I210_RXPBSIZE_DEFAULT  0x00A2 /* RXPBSIZE default */
+#define I210_RXPBSIZE_MASK 0x003F
+#define I210_RXPBSIZE_PB_32KB  0x0020
 #define I210_TXPBSIZE_DEFAULT  0x0414 /* TXPBSIZE default */
+#define I210_TXPBSIZE_MASK 0xC0FF
+#define I210_TXPBSIZE_PB0_8KB  (8 << 0)
+#define I210_TXPBSIZE_PB1_8KB  (8 << 6)
+#define I210_TXPBSIZE_PB2_4KB  (4 << 12)
+#define I210_TXPBSIZE_PB3_4KB  (4 << 18)
+
+#define I210_DTXMXPKTSZ_DEFAULT0x0098
+
+#define I210_SR_QUEUES_NUM 2
 
 /* SerDes Control */
 #define E1000_SCTL_DISABLE_SERDES_LOOPBACK 0x0400
@@ -1051,4 +1062,16 @@
 #define E1000_VLAPQF_P_VALID(_n)   (0x1 << (3 + (_n) * 4))
 #define E1000_VLAPQF_QUEUE_MASK0x03
 
+/* TX Qav Control fields */
+#define E1000_TQAVCTRL_XMIT_MODE   BIT(0)
+#define E1000_TQAVCTRL_DATAFETCHARBBIT(4)
+#define E1000_TQAVCTRL_DATATRANARB BIT(8)
+
+/* TX Qav Credit Control fields */
+#define E1000_TQAVCC_IDLESLOPE_MASK0x
+#define E1000_TQAVCC_QUEUEMODE BIT(31)
+
+/* Transmit Descriptor Control fields */
+#define E1000_TXDCTL_PRIORITY  BIT(27)
+
 #endif
diff --git a/drivers/net/ethernet/intel/igb/e1000_regs.h 
b/drivers/net/ethernet/intel/igb/e1000_regs.h
index 58adbf234e07..8eee081d395f 100644
--- a/drivers/net/ethernet/intel/igb/e1000_regs.h
+++ b/drivers/net/ethernet/intel/igb/e1000_regs.h
@@ -421,6 +421,14 @@ do { \
 
 #define E1000_I210_FLA 0x1201C
 
+#define E1000_I210_DTXMXPKTSZ  0x355C
+
+#define E1000_I210_TXDCTL(_n)  (0x0E028 + ((_n) * 0x40))
+
+#define E1000_I210_TQAVCTRL0x3570
+#define E1000_I210_TQAVCC(_n)  (0x3004 + ((_n) * 0x40))
+#define E1000_I210_TQAVHC(_n)  (0x300C + ((_n) * 0x40))
+
 #define E1000_INVM_DATA_REG(_n)(0x12120 + 4*(_n))
 #define E1000_INVM_SIZE64 /* Number of INVM Data Registers */
 
diff --git a/drivers/net/ethernet/intel/igb/igb.h 
b/drivers/net/ethernet/intel/igb/igb.h
index 06ffb2bc713e..92845692087a 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -281,6 +281,11 @@ struct igb_ring {
u16 count;  /* number of desc. in the ring */
u8 queue_index; /* logical index of the ring*/
u8 reg_idx; /* physical index of the ring */
+   bool cbs_enable;/* indicates if CBS is enabled */
+   s32 idleslope;  /* idleSlope in kbps */
+   s32 sendslope;  /* sendSlope in kbps */
+   s32 hicredit;   /* hiCredit in bytes */
+   s32 locredit;   /* loCredit in bytes */
 
/* everything past this point are written often */
u16 next_to_clean;
@@ -621,6 +626,7 @@ struct igb_adapter {
 #define IGB_FLAG_EEE   BIT(14)
 #define IGB_FLAG_VLAN_PROMISC  BIT(15)
 #define IGB_FLAG_RX_LEGACY BIT(16)
+#define IGB_FLAG_FQTSS BIT(17)
 
 /* Media Auto Sense */
 #define IGB_MAS_ENABLE_0   0X0001
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c 
b/drivers/net/ethernet/intel/igb/igb_main.c
index 837d9b46a390..be2cf263efa9 100644
--- 

[next-queue PATCH v9 2/6] net/sched: Change behavior of mq select_queue()

[Vinicius Costa Gomes]

From: Jesus Sanchez-Palencia 

Currently, the class_ops select_queue() implementation on sch_mq
returns a pointer to netdev_queue #0 when it receives and invalid
qdisc id. That can be misleading since all of mq's inner qdiscs are
attached to a valid netdev_queue.

Here we fix that by returning NULL when a qdisc id is invalid. This is
aligned with how select_queue() is implemented for sch_mqprio in the
next patch on this series, keeping a consistent behavior between these
two qdiscs.

Signed-off-by: Jesus Sanchez-Palencia 
---
 net/sched/sch_mq.c | 10 +-
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index f3a3e507422b..213b586a06a0 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -130,15 +130,7 @@ static struct netdev_queue *mq_queue_get(struct Qdisc 
*sch, unsigned long cl)
 static struct netdev_queue *mq_select_queue(struct Qdisc *sch,
struct tcmsg *tcm)
 {
-   unsigned int ntx = TC_H_MIN(tcm->tcm_parent);
-   struct netdev_queue *dev_queue = mq_queue_get(sch, ntx);
-
-   if (!dev_queue) {
-   struct net_device *dev = qdisc_dev(sch);
-
-   return netdev_get_tx_queue(dev, 0);
-   }
-   return dev_queue;
+   return mq_queue_get(sch, TC_H_MIN(tcm->tcm_parent));
 }
 
 static int mq_graft(struct Qdisc *sch, unsigned long cl, struct Qdisc *new,
-- 
2.14.2

[next-queue PATCH v9 5/6] net/sched: Add support for HW offloading for CBS

[Vinicius Costa Gomes]

This adds support for offloading the CBS algorithm to the controller,
if supported. Drivers wanting to support CBS offload must implement
the .ndo_setup_tc callback and handle the TC_SETUP_CBS (introduced
here) type.

Signed-off-by: Vinicius Costa Gomes 
---
 include/linux/netdevice.h |   1 +
 include/net/pkt_sched.h   |   9 
 net/sched/sch_cbs.c   | 104 --
 3 files changed, 102 insertions(+), 12 deletions(-)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 31bb3010c69b..1f6c44ef5b21 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -775,6 +775,7 @@ enum tc_setup_type {
TC_SETUP_CLSFLOWER,
TC_SETUP_CLSMATCHALL,
TC_SETUP_CLSBPF,
+   TC_SETUP_CBS,
 };
 
 /* These structures hold the attributes of xdp state that are being passed
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 259bc191ba59..7c597b050b36 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -146,4 +146,13 @@ static inline bool is_classid_clsact_egress(u32 classid)
   TC_H_MIN(classid) == TC_H_MIN(TC_H_MIN_EGRESS);
 }
 
+struct tc_cbs_qopt_offload {
+   u8 enable;
+   s32 queue;
+   s32 hicredit;
+   s32 locredit;
+   s32 idleslope;
+   s32 sendslope;
+};
+
 #endif
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index c0102b589494..cae021c642e5 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -68,6 +68,8 @@
 #define BYTES_PER_KBIT (1000LL / 8)
 
 struct cbs_sched_data {
+   bool offload;
+   int queue;
s64 port_rate; /* in bytes/s */
s64 last; /* timestamp in ns */
s64 credits; /* in bytes */
@@ -80,6 +82,11 @@ struct cbs_sched_data {
struct sk_buff *(*dequeue)(struct Qdisc *sch);
 };
 
+static int cbs_enqueue_offload(struct sk_buff *skb, struct Qdisc *sch)
+{
+   return qdisc_enqueue_tail(skb, sch);
+}
+
 static int cbs_enqueue_soft(struct sk_buff *skb, struct Qdisc *sch)
 {
struct cbs_sched_data *q = qdisc_priv(sch);
@@ -169,6 +176,11 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
return skb;
 }
 
+static struct sk_buff *cbs_dequeue_offload(struct Qdisc *sch)
+{
+   return qdisc_dequeue_head(sch);
+}
+
 static struct sk_buff *cbs_dequeue(struct Qdisc *sch)
 {
struct cbs_sched_data *q = qdisc_priv(sch);
@@ -180,14 +192,66 @@ static const struct nla_policy cbs_policy[TCA_CBS_MAX + 
1] = {
[TCA_CBS_PARMS] = { .len = sizeof(struct tc_cbs_qopt) },
 };
 
+static void cbs_disable_offload(struct net_device *dev,
+   struct cbs_sched_data *q)
+{
+   struct tc_cbs_qopt_offload cbs = { };
+   const struct net_device_ops *ops;
+   int err;
+
+   if (!q->offload)
+   return;
+
+   q->enqueue = cbs_enqueue_soft;
+   q->dequeue = cbs_dequeue_soft;
+
+   ops = dev->netdev_ops;
+   if (!ops->ndo_setup_tc)
+   return;
+
+   cbs.queue = q->queue;
+   cbs.enable = 0;
+
+   err = ops->ndo_setup_tc(dev, TC_SETUP_CBS, );
+   if (err < 0)
+   pr_warn("Couldn't disable CBS offload for queue %d\n",
+   cbs.queue);
+}
+
+static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
+ const struct tc_cbs_qopt *opt)
+{
+   const struct net_device_ops *ops = dev->netdev_ops;
+   struct tc_cbs_qopt_offload cbs = { };
+   int err;
+
+   if (!ops->ndo_setup_tc)
+   return -EOPNOTSUPP;
+
+   cbs.queue = q->queue;
+
+   cbs.enable = 1;
+   cbs.hicredit = opt->hicredit;
+   cbs.locredit = opt->locredit;
+   cbs.idleslope = opt->idleslope;
+   cbs.sendslope = opt->sendslope;
+
+   err = ops->ndo_setup_tc(dev, TC_SETUP_CBS, );
+   if (err < 0)
+   return err;
+
+   q->enqueue = cbs_enqueue_offload;
+   q->dequeue = cbs_dequeue_offload;
+
+   return 0;
+}
+
 static int cbs_change(struct Qdisc *sch, struct nlattr *opt)
 {
struct cbs_sched_data *q = qdisc_priv(sch);
struct net_device *dev = qdisc_dev(sch);
struct nlattr *tb[TCA_CBS_MAX + 1];
-   struct ethtool_link_ksettings ecmd;
struct tc_cbs_qopt *qopt;
-   s64 link_speed;
int err;
 
err = nla_parse_nested(tb, TCA_CBS_MAX, opt, cbs_policy, NULL);
@@ -199,23 +263,30 @@ static int cbs_change(struct Qdisc *sch, struct nlattr 
*opt)
 
qopt = nla_data(tb[TCA_CBS_PARMS]);
 
-   if (qopt->offload)
-   return -EOPNOTSUPP;
+   if (!qopt->offload) {
+   struct ethtool_link_ksettings ecmd;
+   s64 link_speed;
 
-   if (!__ethtool_get_link_ksettings(dev, ))
-   link_speed = ecmd.base.speed;
-   else
-   link_speed = SPEED_1000;
+   if (!__ethtool_get_link_ksettings(dev, ))
+   

[next-queue PATCH v9 3/6] net/sched: Add select_queue() class_ops for mqprio

[Vinicius Costa Gomes]

From: Jesus Sanchez-Palencia 

When replacing a child qdisc from mqprio, tc_modify_qdisc() must fetch
the netdev_queue pointer that the current child qdisc is associated
with before creating the new qdisc.

Currently, when using mqprio as root qdisc, the kernel will end up
getting the queue #0 pointer from the mqprio (root qdisc), which leaves
any new child qdisc with a possibly wrong netdev_queue pointer.

Implementing the Qdisc_class_ops select_queue() on mqprio fixes this
issue and avoid an inconsistent state when child qdiscs are replaced.

Signed-off-by: Jesus Sanchez-Palencia 
---
 net/sched/sch_mqprio.c | 7 +++
 1 file changed, 7 insertions(+)

diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index 6bcdfe6e7b63..8c042ae323e3 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -396,6 +396,12 @@ static void mqprio_walk(struct Qdisc *sch, struct 
qdisc_walker *arg)
}
 }
 
+static struct netdev_queue *mqprio_select_queue(struct Qdisc *sch,
+   struct tcmsg *tcm)
+{
+   return mqprio_queue_get(sch, TC_H_MIN(tcm->tcm_parent));
+}
+
 static const struct Qdisc_class_ops mqprio_class_ops = {
.graft  = mqprio_graft,
.leaf   = mqprio_leaf,
@@ -403,6 +409,7 @@ static const struct Qdisc_class_ops mqprio_class_ops = {
.walk   = mqprio_walk,
.dump   = mqprio_dump_class,
.dump_stats = mqprio_dump_class_stats,
+   .select_queue   = mqprio_select_queue,
 };
 
 static struct Qdisc_ops mqprio_qdisc_ops __read_mostly = {
-- 
2.14.2

[next-queue PATCH v9 4/6] net/sched: Introduce Credit Based Shaper (CBS) qdisc

[Vinicius Costa Gomes]

This queueing discipline implements the shaper algorithm defined by
the 802.1Q-2014 Section 8.6.8.2 and detailed in Annex L.

It's primary usage is to apply some bandwidth reservation to user
defined traffic classes, which are mapped to different queues via the
mqprio qdisc.

Only a simple software implementation is added for now.

Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Jesus Sanchez-Palencia 
---
 include/uapi/linux/pkt_sched.h |  19 +++
 net/sched/Kconfig  |  11 ++
 net/sched/Makefile |   1 +
 net/sched/sch_cbs.c| 293 +
 4 files changed, 324 insertions(+)
 create mode 100644 net/sched/sch_cbs.c

diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
index 099bf5528fed..25b6ab82a586 100644
--- a/include/uapi/linux/pkt_sched.h
+++ b/include/uapi/linux/pkt_sched.h
@@ -871,4 +871,23 @@ struct tc_pie_xstats {
__u32 maxq; /* maximum queue size */
__u32 ecn_mark; /* packets marked with ecn*/
 };
+
+/* CBS */
+struct tc_cbs_qopt {
+   __u8 offload;
+   __u8 _pad[3];
+   __s32 hicredit;
+   __s32 locredit;
+   __s32 idleslope;
+   __s32 sendslope;
+};
+
+enum {
+   TCA_CBS_UNSPEC,
+   TCA_CBS_PARMS,
+   __TCA_CBS_MAX,
+};
+
+#define TCA_CBS_MAX (__TCA_CBS_MAX - 1)
+
 #endif
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index e70ed26485a2..c03d86a7775e 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -172,6 +172,17 @@ config NET_SCH_TBF
  To compile this code as a module, choose M here: the
  module will be called sch_tbf.
 
+config NET_SCH_CBS
+   tristate "Credit Based Shaper (CBS)"
+   ---help---
+ Say Y here if you want to use the Credit Based Shaper (CBS) packet
+ scheduling algorithm.
+
+ See the top of  for more details.
+
+ To compile this code as a module, choose M here: the
+ module will be called sch_cbs.
+
 config NET_SCH_GRED
tristate "Generic Random Early Detection (GRED)"
---help---
diff --git a/net/sched/Makefile b/net/sched/Makefile
index 7b915d226de7..80c8f92d162d 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -52,6 +52,7 @@ obj-$(CONFIG_NET_SCH_FQ_CODEL)+= sch_fq_codel.o
 obj-$(CONFIG_NET_SCH_FQ)   += sch_fq.o
 obj-$(CONFIG_NET_SCH_HHF)  += sch_hhf.o
 obj-$(CONFIG_NET_SCH_PIE)  += sch_pie.o
+obj-$(CONFIG_NET_SCH_CBS)  += sch_cbs.o
 
 obj-$(CONFIG_NET_CLS_U32)  += cls_u32.o
 obj-$(CONFIG_NET_CLS_ROUTE4)   += cls_route.o
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
new file mode 100644
index ..c0102b589494
--- /dev/null
+++ b/net/sched/sch_cbs.c
@@ -0,0 +1,293 @@
+/*
+ * net/sched/sch_cbs.c Credit Based Shaper
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ *
+ * Authors:Vinicius Costa Gomes 
+ *
+ */
+
+/* Credit Based Shaper (CBS)
+ * =
+ *
+ * This is a simple rate-limiting shaper aimed at TSN applications on
+ * systems with known traffic workloads.
+ *
+ * Its algorithm is defined by the IEEE 802.1Q-2014 Specification,
+ * Section 8.6.8.2, and explained in more detail in the Annex L of the
+ * same specification.
+ *
+ * There are four tunables to be considered:
+ *
+ * 'idleslope': Idleslope is the rate of credits that is
+ * accumulated (in kilobits per second) when there is at least
+ * one packet waiting for transmission. Packets are transmitted
+ * when the current value of credits is equal or greater than
+ * zero. When there is no packet to be transmitted the amount of
+ * credits is set to zero. This is the main tunable of the CBS
+ * algorithm.
+ *
+ * 'sendslope':
+ * Sendslope is the rate of credits that is depleted (it should be a
+ * negative number of kilobits per second) when a transmission is
+ * ocurring. It can be calculated as follows, (IEEE 802.1Q-2014 Section
+ * 8.6.8.2 item g):
+ *
+ * sendslope = idleslope - port_transmit_rate
+ *
+ * 'hicredit': Hicredit defines the maximum amount of credits (in
+ * bytes) that can be accumulated. Hicredit depends on the
+ * characteristics of interfering traffic,
+ * 'max_interference_size' is the maximum size of any burst of
+ * traffic that can delay the transmission of a frame that is
+ * available for transmission for this traffic class, (IEEE
+ * 802.1Q-2014 Annex L, Equation L-3):
+ *
+ * hicredit = max_interference_size * (idleslope / port_transmit_rate)
+ *
+ * 'locredit': Locredit is the minimum amount of credits that can
+ * be 

[next-queue PATCH v9 0/6] TSN: Add qdisc based config interface for CBS

[Vinicius Costa Gomes]

Hi,

Changes from v8:
 - Add an explicit padding field to the tc_cbs_qopt struct, as pointed
   out by David Laight;

Changes from v7:
 - Fixed comments from Eric Dumazet and Ivan Khoronzhuk;

Changes since v6:
 - Fixed compilation for 32bit arches;
 - Aligned the behaviour of .select_queue() of the mq qdisc to be the
   same as mqprio;

Changes since v5:
 - Fixed comments from Jiri Pirko;

Changes since v4:
 - Added a software implementation of the CBS algorithm;

Changes since v3:
 - None, only a clean patchset without old patches;

Changes since v2:
 - squashed the patch introducing the userspace API into the patch
   implementing CBS;

Changes since v1:
 - Solved the mqprio dependency;
 - Fixed a mqprio bug, that caused the inner qdisc to have a wrong
   dev_queue associated with it;

Changes from the RFC:
 - Fixed comments from Henrik Austad;
 - Simplified the Qdisc, using the generic implementation of callbacks
   where possible;
 - Small refactor on the driver (igb) code;

This patchset is a proposal of how the Traffic Control subsystem can
be used to offload the configuration of the Credit Based Shaper
(defined in the IEEE 802.1Q-2014 Section 8.6.8.2) into supported
network devices.

As part of this work, we've assessed previous public discussions
related to TSN enabling: patches from Henrik Austad (Cisco), the
presentation from Eric Mann at Linux Plumbers 2012, patches from
Gangfeng Huang (National Instruments) and the current state of the
OpenAVNU project (https://github.com/AVnu/OpenAvnu/).

Overview


Time-sensitive Networking (TSN) is a set of standards that aim to
address resources availability for providing bandwidth reservation and
bounded latency on Ethernet based LANs. The proposal described here
aims to cover mainly what is needed to enable the following standards:
802.1Qat and 802.1Qav.

The initial target of this work is the Intel i210 NIC, but other
controllers' datasheet were also taken into account, like the Renesas
RZ/A1H RZ/A1M group and the Synopsis DesignWare Ethernet QoS
controller.


Proposal


Feature-wise, what is covered here is the configuration interfaces for
HW implementations of the Credit-Based shaper (CBS, 802.1Qav). CBS is
a per-queue shaper. Given that this feature is related to traffic
shaping, and that the traffic control subsystem already provides a
queueing discipline that offloads config into the device driver (i.e.
mqprio), designing a new qdisc for the specific purpose of offloading
the config for the CBS shaper seemed like a good fit.

For steering traffic into the correct queues, we use the socket option
SO_PRIORITY and then a mechanism to map priority to traffic classes /
Tx queues. The qdisc mqprio is currently used in our tests.

As for the CBS config interface, this patchset is proposing a new
qdisc called 'cbs'. Its 'tc' cmd line is:

$ tc qdisc add dev IFACE parent ID cbs locredit N hicredit M sendslope S \
 idleslope I

   Note that the parameters for this qdisc are the ones defined by the
   802.1Q-2014 spec, so no hardware specific functionality is exposed here.

Per-stream shaping, as defined by IEEE 802.1Q-2014 Section 34.6.1, is
not yet covered by this proposal.


Testing this RFC


Attached to this cover letter are:
 - calculate_cbs_params.py: A Python script to calculate the
   parameters to the CBS queueing discipline;
 - tsn-talker.c: A sample C implementation of the talker side of a stream;
 - tsn-listener.c: A sample C implementation of the listener side of a
   stream;

For testing the patches of this series, you may want to use the
attached samples to this cover letter and use the 'mqprio' qdisc to
setup the priorities to Tx queues mapping, together with the 'cbs'
qdisc to configure the HW shaper of the i210 controller:

1) Setup priorities to traffic classes to hardware queues mapping
$ tc qdisc replace dev ens4 handle 100: parent root mqprio num_tc 3 \
 map 2 2 1 0 2 2 2 2 2 2 2 2 2 2 2 2 queues 1@0 1@1 2@2 hw 0

For a more detailed explanation, see mqprio(8), in short, this command
will map traffic with priority 3 to the hardware queue 0, traffic with
priority 2 to hardware queue 1, and the rest will be mapped to
hardware queues 2 and 3.

2) Check scheme. You want to get the inner qdiscs ID from the bottom up
$ tc -g class show dev ens4

Ex.:
+---(100:3) mqprio
|+---(100:6) mqprio
|+---(100:7) mqprio
|
+---(100:2) mqprio
|+---(100:5) mqprio
|
+---(100:1) mqprio
 +---(100:4) mqprio

* Here '100:4' is Tx Queue #0 and '100:5' is Tx Queue #1.

3) Calculate CBS parameters for classes A and B. i.e. BW for A is 20Mbps and
   for B is 10Mbps:
$ calc_cbs_params.py -A 2 -a 1500 -B 1 -b 1500

4) Configure CBS for traffic class A (priority 3) as provided by the script:
$ tc qdisc replace dev ens4 parent 100:4 cbs locredit -1470 \
 hicredit 30 sendslope -98 idleslope 2

5) Configure CBS for traffic class B (priority 2):
$ tc qdisc replace dev ens4 parent 100:5 cbs \
 

[next-queue PATCH v9 1/6] net/sched: Check for null dev_queue on create flow

[Vinicius Costa Gomes]

From: Jesus Sanchez-Palencia 

In qdisc_alloc() the dev_queue pointer was used without any checks
being performed. If qdisc_create() gets a null dev_queue pointer, it
just passes it along to qdisc_alloc(), leading to a crash. That
happens if a root qdisc implements select_queue() and returns a null
dev_queue pointer for an "invalid handle", for example, or if the
dev_queue associated with the parent qdisc is null.

This patch is in preparation for the next in this series, where
select_queue() is being added to mqprio and as it may return a null
dev_queue.

Signed-off-by: Jesus Sanchez-Palencia 
---
 net/sched/sch_generic.c | 8 +++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index a0a198768aad..de2408f1ccd3 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -603,8 +603,14 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
struct Qdisc *sch;
unsigned int size = QDISC_ALIGN(sizeof(*sch)) + ops->priv_size;
int err = -ENOBUFS;
-   struct net_device *dev = dev_queue->dev;
+   struct net_device *dev;
+
+   if (!dev_queue) {
+   err = -EINVAL;
+   goto errout;
+   }
 
+   dev = dev_queue->dev;
p = kzalloc_node(size, GFP_KERNEL,
 netdev_queue_numa_node_read(dev_queue));
 
-- 
2.14.2

Re: WARNING in tcp_update_reordering

[David Ahern]

[ cc Andrei who reported a similar trace ]

On 10/16/17 6:50 PM, Yuchung Cheng wrote:
> On Mon, Oct 16, 2017 at 3:38 PM, David Ahern  wrote:
>> I need to throw this one over the fence. I triggered the trace below
>> testing changes to the tcp tracepoint. It is not readily reproducible
>> and does not appear to be correlated to the perf session.
> We're seeing this internally at Google a lot as well. The culprit is
> because TCP tries to measure/track reordering in precise packet
> distance (tp->reordering). That's difficult but also fairly useless to
> get right because that highly depends on the instantaneous
> traffic load and L2/pathing behavior. In other words the previous
> reordering degree has little bearing for my next reordering based on
> our analysis. The
> warning itself has minor to no impact on TCP performance or
> reliability.
> 
> I am testing a patch to replace that approach (and remove the
> warning). Should be ready soon.
> 

Thanks for the update.

[PATCH 50/58] net: hns: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. Switches test of .data field to
.function, since .data will be going away.

Cc: Yisen Zhuang 
Cc: Salil Mehta 
Cc: "David S. Miller" 
Cc: lipeng 
Cc: Lin Yun Sheng 
Cc: Kejian Yan 
Cc: Arnd Bergmann 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/hisilicon/hns/hns_enet.c   |  7 +++
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 13 ++---
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c 
b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 36520634c96a..91565c8fee08 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2159,9 +2159,9 @@ static void hns_nic_task_schedule(struct hns_nic_priv 
*priv)
(void)schedule_work(>service_task);
 }
 
-static void hns_nic_service_timer(unsigned long data)
+static void hns_nic_service_timer(struct timer_list *t)
 {
-   struct hns_nic_priv *priv = (struct hns_nic_priv *)data;
+   struct hns_nic_priv *priv = from_timer(priv, t, service_timer);
 
(void)mod_timer(>service_timer, jiffies + SERVICE_TIMER_HZ);
 
@@ -2451,8 +2451,7 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
/* carrier off reporting is important to ethtool even BEFORE open */
netif_carrier_off(ndev);
 
-   setup_timer(>service_timer, hns_nic_service_timer,
-   (unsigned long)priv);
+   timer_setup(>service_timer, hns_nic_service_timer, 0);
INIT_WORK(>service_task, hns_nic_service_task);
 
set_bit(NIC_STATE_SERVICE_INITED, >state);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c 
b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index c322b4534148..6e93943c489a 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -2350,11 +2350,11 @@ static int hclge_get_status(struct hnae3_handle *handle)
return hdev->hw.mac.link;
 }
 
-static void hclge_service_timer(unsigned long data)
+static void hclge_service_timer(struct timer_list *t)
 {
-   struct hclge_dev *hdev = (struct hclge_dev *)data;
-   (void)mod_timer(>service_timer, jiffies + HZ);
+   struct hclge_dev *hdev = from_timer(hdev, t, service_timer);
 
+   mod_timer(>service_timer, jiffies + HZ);
hclge_task_schedule(hdev);
 }
 
@@ -3204,7 +3204,7 @@ static int hclge_ae_start(struct hnae3_handle *handle)
/* mac enable */
hclge_cfg_mac_mode(hdev, true);
clear_bit(HCLGE_STATE_DOWN, >state);
-   (void)mod_timer(>service_timer, jiffies + HZ);
+   mod_timer(>service_timer, jiffies + HZ);
 
ret = hclge_mac_start_phy(hdev);
if (ret)
@@ -4436,8 +4436,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
 
hclge_dcb_ops_set(hdev);
 
-   setup_timer(>service_timer, hclge_service_timer,
-   (unsigned long)hdev);
+   timer_setup(>service_timer, hclge_service_timer, 0);
INIT_WORK(>service_task, hclge_service_task);
 
set_bit(HCLGE_STATE_SERVICE_INITED, >state);
@@ -4464,7 +4463,7 @@ static void hclge_uninit_ae_dev(struct hnae3_ae_dev 
*ae_dev)
if (IS_ENABLED(CONFIG_PCI_IOV))
hclge_disable_sriov(hdev);
 
-   if (hdev->service_timer.data)
+   if (hdev->service_timer.function)
del_timer_sync(>service_timer);
if (hdev->service_task.func)
cancel_work_sync(>service_task);
-- 
2.7.4

[PATCH 31/58] isdn/gigaset: Use kzalloc instead of open-coded field zeroing

[Kees Cook]

This replaces a kmalloc followed by a bunch of per-field zeroing with a
single kzalloc call, reducing the lines of code.

Cc: Paul Bolle 
Cc: Karsten Keil 
Cc: "David S. Miller" 
Cc: Johan Hovold 
Cc: gigaset307x-com...@lists.sourceforge.net
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/isdn/gigaset/bas-gigaset.c | 10 +-
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/isdn/gigaset/bas-gigaset.c 
b/drivers/isdn/gigaset/bas-gigaset.c
index 2da3ff650e1d..33151f05e744 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -2200,7 +2200,7 @@ static int gigaset_initcshw(struct cardstate *cs)
 {
struct bas_cardstate *ucs;
 
-   cs->hw.bas = ucs = kmalloc(sizeof *ucs, GFP_KERNEL);
+   cs->hw.bas = ucs = kzalloc(sizeof(*ucs), GFP_KERNEL);
if (!ucs) {
pr_err("out of memory\n");
return -ENOMEM;
@@ -2212,15 +2212,7 @@ static int gigaset_initcshw(struct cardstate *cs)
return -ENOMEM;
}
 
-   ucs->urb_cmd_in = NULL;
-   ucs->urb_cmd_out = NULL;
-   ucs->rcvbuf = NULL;
-   ucs->rcvbuf_size = 0;
-
spin_lock_init(>lock);
-   ucs->pending = 0;
-
-   ucs->basstate = 0;
setup_timer(>timer_ctrl, req_timeout, (unsigned long) cs);
setup_timer(>timer_atrdy, atrdy_timeout, (unsigned long) cs);
setup_timer(>timer_cmd_in, cmd_in_timeout, (unsigned long) cs);
-- 
2.7.4

[PATCH 57/58] ipv4: timewait: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Alexey Kuznetsov 
Cc: Hideaki YOSHIFUJI 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/ipv4/inet_timewait_sock.c | 7 +++
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 5b039159e67a..a4bab81f1462 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -142,9 +142,9 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, 
struct sock *sk,
 }
 EXPORT_SYMBOL_GPL(__inet_twsk_hashdance);
 
-static void tw_timer_handler(unsigned long data)
+static void tw_timer_handler(struct timer_list *t)
 {
-   struct inet_timewait_sock *tw = (struct inet_timewait_sock *)data;
+   struct inet_timewait_sock *tw = from_timer(tw, t, tw_timer);
 
if (tw->tw_kill)
__NET_INC_STATS(twsk_net(tw), LINUX_MIB_TIMEWAITKILLED);
@@ -188,8 +188,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct 
sock *sk,
tw->tw_prot = sk->sk_prot_creator;
atomic64_set(>tw_cookie, atomic64_read(>sk_cookie));
twsk_net_set(tw, sock_net(sk));
-   setup_pinned_timer(>tw_timer, tw_timer_handler,
-  (unsigned long)tw);
+   timer_setup(>tw_timer, tw_timer_handler, TIMER_PINNED);
/*
 * Because we use RCU lookups, we should not set tw_refcnt
 * to a non null value before everything is setup for this
-- 
2.7.4

Re: WARNING in tcp_update_reordering

[Yuchung Cheng]

On Mon, Oct 16, 2017 at 3:38 PM, David Ahern  wrote:
>
> I need to throw this one over the fence. I triggered the trace below
> testing changes to the tcp tracepoint. It is not readily reproducible
> and does not appear to be correlated to the perf session.
We're seeing this internally at Google a lot as well. The culprit is
because TCP tries to measure/track reordering in precise packet
distance (tp->reordering). That's difficult but also fairly useless to
get right because that highly depends on the instantaneous
traffic load and L2/pathing behavior. In other words the previous
reordering degree has little bearing for my next reordering based on
our analysis. The
warning itself has minor to no impact on TCP performance or
reliability.

I am testing a patch to replace that approach (and remove the
warning). Should be ready soon.

>
> Triggered by the following:
>   ssh into VM and run 'top -d1'
>   in host, drop tcp packets:
> $ sudo iptables -I INPUT -i br1 -p tcp -j DROP
>   and then 5 - 7 seconds later remove the rule:
> $ sudo iptables -D INPUT -i br1 -p tcp -j DROP
>
> [   73.695849] [ cut here ]
> [   73.697258] WARNING: CPU: 1 PID: 0 at
> /home/dsa/kernel-2.git/net/ipv4/tcp_input.c:889
> tcp_update_reordering+0x4/0x72
> [   73.700306] Modules linked in: vrf
> [   73.701316] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.14.0-rc4+ #43
> [   73.703170] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
> [   73.706040] task: 88003e132180 task.stack: c9078000
> [   73.707769] RIP: 0010:tcp_update_reordering+0x4/0x72
> [   73.709209] RSP: 0018:88003fd039c0 EFLAGS: 00010282
> [   73.710702] RAX: 0004 RBX: 88003c7be800 RCX:
> 0004
> [   73.711797] RDX:  RSI: fffb RDI:
> 88003c7be800
> [   73.712809] RBP: 88003fd03a38 R08:  R09:
> 
> [   73.713831] R10: 88003fd03a90 R11:  R12:
> 88003fd03a90
> [   73.714846] R13:  R14: 88003c7bef40 R15:
> 88003c7bef48
> [   73.715871] FS:  () GS:88003fd0()
> knlGS:
> [   73.717016] CS:  0010 DS:  ES:  CR0: 80050033
> [   73.717823] CR2: 56441f284000 CR3: 3d7ba002 CR4:
> 000606e0
> [   73.718834] Call Trace:
> [   73.719193]  
> [   73.719497]  ? tcp_sacktag_write_queue+0x533/0x5ab
> [   73.720180]  ? tcp_mtu_to_mss+0xd/0x1c
> [   73.720718]  tcp_ack+0x320/0xd21
> [   73.721189]  tcp_rcv_established+0x251/0x2c2
> [   73.721799]  tcp_v4_do_rcv+0x9a/0x169
> [   73.722328]  tcp_v4_rcv+0x55c/0x7bb
> [   73.722841]  ip_local_deliver_finish+0xc0/0x141
> [   73.723486]  ip_local_deliver+0xa5/0xae
> [   73.724038]  ? xfrm4_policy_check.constprop.10+0x52/0x52
> [   73.724787]  ip_rcv_finish+0x2de/0x35c
> [   73.725326]  ip_rcv+0x271/0x2ea
> [   73.725787]  ? deliver_ptype_list_skb+0x48/0x69
> [   73.726430]  __netif_receive_skb_core+0x326/0x54a
> [   73.727112]  ? kvm_clock_read+0x1e/0x20
> [   73.727664]  ? kvm_clock_get_cycles+0x9/0xb
> [   73.728257]  __netif_receive_skb+0x16/0x6d
> [   73.728837]  ? __netif_receive_skb+0x16/0x6d
> [   73.729446]  netif_receive_skb_internal+0x4d/0xa3
> [   73.730116]  napi_gro_receive+0x75/0xcc
> [   73.730667]  receive_buf+0xa05/0xa16
> [   73.731192]  ? vring_unmap_one+0x1a/0x68
> [   73.731754]  virtnet_poll+0x103/0x1b1
> [   73.732284]  net_rx_action+0xdb/0x249
> [   73.732814]  __do_softirq+0xfc/0x26b
> [   73.72]  irq_exit+0x51/0x92
> [   73.733788]  do_IRQ+0x98/0xb0
> [   73.734225]  common_interrupt+0x93/0x93
> [   73.734779]  
> [   73.735095] RIP: 0010:native_safe_halt+0x6/0x8
> [   73.735726] RSP: 0018:c907bea8 EFLAGS: 0246 ORIG_RAX:
> ff6e
> [   73.736784] RAX:  RBX:  RCX:
> 88003fd10ca0
> [   73.737776] RDX: 000101ba RSI: 0001 RDI:
> 0001
> [   73.738780] RBP: c907bea8 R08: 88003d48a900 R09:
> 0200
> [   73.739777] R10: 0003 R11: 0001 R12:
> 
> [   73.740779] R13: 88003e132180 R14: 88003e132180 R15:
> 88003e132180
> [   73.741781]  default_idle+0x1a/0x2d
> [   73.742285]  arch_cpu_idle+0xa/0xc
> [   73.742784]  default_idle_call+0x19/0x1b
> [   73.743352]  do_idle+0xd7/0x1a9
> [   73.743807]  cpu_startup_entry+0x1a/0x1c
> [   73.744371]  start_secondary+0x11e/0x120
> [   73.744930]  secondary_startup_64+0xa5/0xa5
> [   73.745526] Code: 02 74 0b 48 c7 87 e0 06 00 00 00 00 00 00 8a 97 2c
> 06 00 00 83 e0 0d c1 e0 04 5d 83 e2 0f 09 d0 88 87 2c 06 00 00 c3 85 f6
> 79 03 <0f> ff c3 3b b7 10 06 00 00 55 48 89 e5 41 54 41 89 d4 53 48 89
> [   73.748142] ---[ end trace 730e0fcd13f383bc ]---

[PATCH 58/58] sunrpc: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Trond Myklebust 
Cc: Anna Schumaker 
Cc: "J. Bruce Fields" 
Cc: Jeff Layton 
Cc: "David S. Miller" 
Cc: linux-...@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/sunrpc/sched.c| 8 
 net/sunrpc/svc.c  | 2 +-
 net/sunrpc/svc_xprt.c | 9 -
 net/sunrpc/xprt.c | 9 -
 4 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 0cc83839c13c..5dea47eb31bb 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -44,7 +44,7 @@ static mempool_t  *rpc_buffer_mempool __read_mostly;
 
 static voidrpc_async_schedule(struct work_struct *);
 static void rpc_release_task(struct rpc_task *task);
-static void __rpc_queue_timer_fn(unsigned long ptr);
+static void __rpc_queue_timer_fn(struct timer_list *t);
 
 /*
  * RPC tasks sit here while waiting for conditions to improve.
@@ -228,7 +228,7 @@ static void __rpc_init_priority_wait_queue(struct 
rpc_wait_queue *queue, const c
queue->maxpriority = nr_queues - 1;
rpc_reset_waitqueue_priority(queue);
queue->qlen = 0;
-   setup_timer(>timer_list.timer, __rpc_queue_timer_fn, (unsigned 
long)queue);
+   timer_setup(>timer_list.timer, __rpc_queue_timer_fn, 0);
INIT_LIST_HEAD(>timer_list.list);
rpc_assign_waitqueue_name(queue, qname);
 }
@@ -635,9 +635,9 @@ void rpc_wake_up_status(struct rpc_wait_queue *queue, int 
status)
 }
 EXPORT_SYMBOL_GPL(rpc_wake_up_status);
 
-static void __rpc_queue_timer_fn(unsigned long ptr)
+static void __rpc_queue_timer_fn(struct timer_list *t)
 {
-   struct rpc_wait_queue *queue = (struct rpc_wait_queue *)ptr;
+   struct rpc_wait_queue *queue = from_timer(queue, t, timer_list.timer);
struct rpc_task *task, *n;
unsigned long expires, now, timeo;
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index aa04666f929d..33f4ae68426d 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -455,7 +455,7 @@ __svc_create(struct svc_program *prog, unsigned int 
bufsize, int npools,
serv->sv_xdrsize   = xdrsize;
INIT_LIST_HEAD(>sv_tempsocks);
INIT_LIST_HEAD(>sv_permsocks);
-   init_timer(>sv_temptimer);
+   timer_setup(>sv_temptimer, NULL, 0);
spin_lock_init(>sv_lock);
 
__svc_init_bc(serv);
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index d16a8b423c20..71de77bd4423 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -28,7 +28,7 @@ module_param(svc_rpc_per_connection_limit, uint, 0644);
 static struct svc_deferred_req *svc_deferred_dequeue(struct svc_xprt *xprt);
 static int svc_deferred_recv(struct svc_rqst *rqstp);
 static struct cache_deferred_req *svc_defer(struct cache_req *req);
-static void svc_age_temp_xprts(unsigned long closure);
+static void svc_age_temp_xprts(struct timer_list *t);
 static void svc_delete_xprt(struct svc_xprt *xprt);
 
 /* apparently the "standard" is that clients close
@@ -785,8 +785,7 @@ static void svc_add_new_temp_xprt(struct svc_serv *serv, 
struct svc_xprt *newxpt
serv->sv_tmpcnt++;
if (serv->sv_temptimer.function == NULL) {
/* setup timer to age temp transports */
-   setup_timer(>sv_temptimer, svc_age_temp_xprts,
-   (unsigned long)serv);
+   serv->sv_temptimer.function = 
(TIMER_FUNC_TYPE)svc_age_temp_xprts;
mod_timer(>sv_temptimer,
  jiffies + svc_conn_age_period * HZ);
}
@@ -960,9 +959,9 @@ int svc_send(struct svc_rqst *rqstp)
  * Timer function to close old temporary transports, using
  * a mark-and-sweep algorithm.
  */
-static void svc_age_temp_xprts(unsigned long closure)
+static void svc_age_temp_xprts(struct timer_list *t)
 {
-   struct svc_serv *serv = (struct svc_serv *)closure;
+   struct svc_serv *serv = from_timer(serv, t, sv_temptimer);
struct svc_xprt *xprt;
struct list_head *le, *next;
 
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index e741ec2b4d8e..4b00302e1867 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -696,9 +696,9 @@ xprt_schedule_autodisconnect(struct rpc_xprt *xprt)
 }
 
 static void
-xprt_init_autodisconnect(unsigned long data)
+xprt_init_autodisconnect(struct timer_list *t)
 {
-   struct rpc_xprt *xprt = (struct rpc_xprt *)data;
+   struct rpc_xprt *xprt = from_timer(xprt, t, timer);
 
spin_lock(>transport_lock);
if (!list_empty(>recv))
@@ -1422,10 +1422,9 @@ struct rpc_xprt *xprt_create_transport(struct 
xprt_create *args)
xprt->idle_timeout = 0;

[PATCH 55/58] net: fs_enet: Remove unused timer

[Kees Cook]

Removes unused timer and its old initialization call.

Cc: Pantelis Antoniou 
Cc: Vitaly Bordug 
Cc: linuxppc-...@lists.ozlabs.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c | 2 --
 drivers/net/ethernet/freescale/fs_enet/fs_enet.h  | 1 -
 2 files changed, 3 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c 
b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
index 753259091b22..7892f2f0c6b5 100644
--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
@@ -1023,8 +1023,6 @@ static int fs_enet_probe(struct platform_device *ofdev)
 
ndev->ethtool_ops = _ethtool_ops;
 
-   init_timer(>phy_timer_list);
-
netif_carrier_off(ndev);
 
ndev->features |= NETIF_F_SG;
diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet.h 
b/drivers/net/ethernet/freescale/fs_enet/fs_enet.h
index 5ce516c8a62a..dd306deb7cf1 100644
--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet.h
+++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet.h
@@ -137,7 +137,6 @@ struct fs_enet_private {
cbd_t __iomem *cur_rx;
cbd_t __iomem *cur_tx;
int tx_free;
-   struct timer_list phy_timer_list;
const struct phy_info *phy;
u32 msg_enable;
struct mii_if_info mii_if;
-- 
2.7.4

[PATCH 29/58] forcedeth: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Zhu Yanjun 
Cc: Philippe Reynes 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/nvidia/forcedeth.c | 28 ++--
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/net/ethernet/nvidia/forcedeth.c 
b/drivers/net/ethernet/nvidia/forcedeth.c
index a235e8881af9..88128ce61471 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -1884,10 +1884,9 @@ static int nv_alloc_rx_optimized(struct net_device *dev)
 }
 
 /* If rx bufs are exhausted called after 50ms to attempt to refresh */
-static void nv_do_rx_refill(unsigned long data)
+static void nv_do_rx_refill(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *) data;
-   struct fe_priv *np = netdev_priv(dev);
+   struct fe_priv *np = from_timer(np, t, oom_kick);
 
/* Just reschedule NAPI rx processing */
napi_schedule(>napi);
@@ -4065,10 +4064,10 @@ static void nv_free_irq(struct net_device *dev)
}
 }
 
-static void nv_do_nic_poll(unsigned long data)
+static void nv_do_nic_poll(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *) data;
-   struct fe_priv *np = netdev_priv(dev);
+   struct fe_priv *np = from_timer(np, t, nic_poll);
+   struct net_device *dev = np->dev;
u8 __iomem *base = get_hwbase(dev);
u32 mask = 0;
unsigned long flags;
@@ -4176,16 +4175,18 @@ static void nv_do_nic_poll(unsigned long data)
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void nv_poll_controller(struct net_device *dev)
 {
-   nv_do_nic_poll((unsigned long) dev);
+   struct fe_priv *np = netdev_priv(dev);
+
+   nv_do_nic_poll(>nic_poll);
 }
 #endif
 
-static void nv_do_stats_poll(unsigned long data)
+static void nv_do_stats_poll(struct timer_list *t)
__acquires(_priv(dev)->hwstats_lock)
__releases(_priv(dev)->hwstats_lock)
 {
-   struct net_device *dev = (struct net_device *) data;
-   struct fe_priv *np = netdev_priv(dev);
+   struct fe_priv *np = from_timer(np, t, stats_poll);
+   struct net_device *dev = np->dev;
 
/* If lock is currently taken, the stats are being refreshed
 * and hence fresh enough */
@@ -5631,10 +5632,9 @@ static int nv_probe(struct pci_dev *pci_dev, const 
struct pci_device_id *id)
u64_stats_init(>swstats_rx_syncp);
u64_stats_init(>swstats_tx_syncp);
 
-   setup_timer(>oom_kick, nv_do_rx_refill, (unsigned long)dev);
-   setup_timer(>nic_poll, nv_do_nic_poll, (unsigned long)dev);
-   setup_deferrable_timer(>stats_poll, nv_do_stats_poll,
-  (unsigned long)dev);
+   timer_setup(>oom_kick, nv_do_rx_refill, 0);
+   timer_setup(>nic_poll, nv_do_nic_poll, 0);
+   timer_setup(>stats_poll, nv_do_stats_poll, TIMER_DEFERRABLE);
 
err = pci_enable_device(pci_dev);
if (err)
-- 
2.7.4

[PATCH 24/58] chelsio: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Johannes Berg 
Cc: Eric Dumazet 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/chelsio/cxgb/sge.c | 29 +
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb/sge.c 
b/drivers/net/ethernet/chelsio/cxgb/sge.c
index 75e439918700..30de26ef3da4 100644
--- a/drivers/net/ethernet/chelsio/cxgb/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb/sge.c
@@ -1882,10 +1882,10 @@ netdev_tx_t t1_start_xmit(struct sk_buff *skb, struct 
net_device *dev)
 /*
  * Callback for the Tx buffer reclaim timer.  Runs with softirqs disabled.
  */
-static void sge_tx_reclaim_cb(unsigned long data)
+static void sge_tx_reclaim_cb(struct timer_list *t)
 {
int i;
-   struct sge *sge = (struct sge *)data;
+   struct sge *sge = from_timer(sge, t, tx_reclaim_timer);
 
for (i = 0; i < SGE_CMDQ_N; ++i) {
struct cmdQ *q = >cmdQ[i];
@@ -1978,10 +1978,10 @@ void t1_sge_start(struct sge *sge)
 /*
  * Callback for the T2 ESPI 'stuck packet feature' workaorund
  */
-static void espibug_workaround_t204(unsigned long data)
+static void espibug_workaround_t204(struct timer_list *t)
 {
-   struct adapter *adapter = (struct adapter *)data;
-   struct sge *sge = adapter->sge;
+   struct sge *sge = from_timer(sge, t, espibug_timer);
+   struct adapter *adapter = sge->adapter;
unsigned int nports = adapter->params.nports;
u32 seop[MAX_NPORTS];
 
@@ -2021,10 +2021,10 @@ static void espibug_workaround_t204(unsigned long data)
mod_timer(>espibug_timer, jiffies + sge->espibug_timeout);
 }
 
-static void espibug_workaround(unsigned long data)
+static void espibug_workaround(struct timer_list *t)
 {
-   struct adapter *adapter = (struct adapter *)data;
-   struct sge *sge = adapter->sge;
+   struct sge *sge = from_timer(sge, t, espibug_timer);
+   struct adapter *adapter = sge->adapter;
 
if (netif_running(adapter->port[0].dev)) {
struct sk_buff *skb = sge->espibug_skb[0];
@@ -2075,18 +2075,15 @@ struct sge *t1_sge_create(struct adapter *adapter, 
struct sge_params *p)
goto nomem_port;
}
 
-   setup_timer(>tx_reclaim_timer, sge_tx_reclaim_cb,
-   (unsigned long)sge);
+   timer_setup(>tx_reclaim_timer, sge_tx_reclaim_cb, 0);
 
if (is_T2(sge->adapter)) {
-   init_timer(>espibug_timer);
+   timer_setup(>espibug_timer,
+   adapter->params.nports > 1 ? 
espibug_workaround_t204 : espibug_workaround,
+   0);
 
-   if (adapter->params.nports > 1) {
+   if (adapter->params.nports > 1)
tx_sched_init(sge);
-   sge->espibug_timer.function = espibug_workaround_t204;
-   } else
-   sge->espibug_timer.function = espibug_workaround;
-   sge->espibug_timer.data = (unsigned long)sge->adapter;
 
sge->espibug_timeout = 1;
/* for T204, every 10ms */
-- 
2.7.4

[PATCH 54/58] net/xen-netback: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Wei Liu 
Cc: Paul Durrant 
Cc: xen-de...@lists.xenproject.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/xen-netback/common.h| 2 +-
 drivers/net/xen-netback/interface.c | 2 +-
 drivers/net/xen-netback/netback.c   | 6 ++
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 5b1d2e8402d9..a46a1e94505d 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -307,7 +307,7 @@ static inline struct xenbus_device 
*xenvif_to_xenbus_device(struct xenvif *vif)
return to_xenbus_device(vif->dev->dev.parent);
 }
 
-void xenvif_tx_credit_callback(unsigned long data);
+void xenvif_tx_credit_callback(struct timer_list *t);
 
 struct xenvif *xenvif_alloc(struct device *parent,
domid_t domid,
diff --git a/drivers/net/xen-netback/interface.c 
b/drivers/net/xen-netback/interface.c
index dcfcb153918c..5cbe0ae55a07 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -520,7 +520,7 @@ int xenvif_init_queue(struct xenvif_queue *queue)
 
queue->credit_bytes = queue->remaining_credit = ~0UL;
queue->credit_usec  = 0UL;
-   setup_timer(>credit_timeout, xenvif_tx_credit_callback, 0UL);
+   timer_setup(>credit_timeout, xenvif_tx_credit_callback, 0);
queue->credit_window_start = get_jiffies_64();
 
queue->rx_queue_max = XENVIF_RX_QUEUE_BYTES;
diff --git a/drivers/net/xen-netback/netback.c 
b/drivers/net/xen-netback/netback.c
index 5042ff8d449a..a27daa23c9dc 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -183,9 +183,9 @@ static void tx_add_credit(struct xenvif_queue *queue)
queue->rate_limited = false;
 }
 
-void xenvif_tx_credit_callback(unsigned long data)
+void xenvif_tx_credit_callback(struct timer_list *t)
 {
-   struct xenvif_queue *queue = (struct xenvif_queue *)data;
+   struct xenvif_queue *queue = from_timer(queue, t, credit_timeout);
tx_add_credit(queue);
xenvif_napi_schedule_or_enable_events(queue);
 }
@@ -700,8 +700,6 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, 
unsigned size)
 
/* Still too big to send right now? Set a callback. */
if (size > queue->remaining_credit) {
-   queue->credit_timeout.data =
-   (unsigned long)queue;
mod_timer(>credit_timeout,
  next_credit);
queue->credit_window_start = next_credit;
-- 
2.7.4

[PATCH 17/58] net/cw1200: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Solomon Peachy 
Cc: Kalle Valo 
Cc: linux-wirel...@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/wireless/st/cw1200/pm.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/st/cw1200/pm.c 
b/drivers/net/wireless/st/cw1200/pm.c
index d2202ae92bdd..ded23df1ac1d 100644
--- a/drivers/net/wireless/st/cw1200/pm.c
+++ b/drivers/net/wireless/st/cw1200/pm.c
@@ -91,7 +91,7 @@ struct cw1200_suspend_state {
u8 prev_ps_mode;
 };
 
-static void cw1200_pm_stay_awake_tmo(unsigned long arg)
+static void cw1200_pm_stay_awake_tmo(struct timer_list *unused)
 {
/* XXX what's the point of this ? */
 }
@@ -101,8 +101,7 @@ int cw1200_pm_init(struct cw1200_pm_state *pm,
 {
spin_lock_init(>lock);
 
-   setup_timer(>stay_awake, cw1200_pm_stay_awake_tmo,
-   (unsigned long)pm);
+   timer_setup(>stay_awake, cw1200_pm_stay_awake_tmo, 0);
 
return 0;
 }
-- 
2.7.4

[PATCH 56/58] um: net: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. (Note that this timer is actually
disabled.)

Cc: Jeff Dike 
Cc: Richard Weinberger 
Cc: "David S. Miller" 
Cc: Jarod Wilson 
Cc: user-mode-linux-de...@lists.sourceforge.net
Cc: user-mode-linux-u...@lists.sourceforge.net
Signed-off-by: Kees Cook 
---
 arch/um/drivers/net_kern.c | 9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
index 1669240c7a25..b305f8247909 100644
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@@ -168,7 +168,6 @@ static int uml_net_open(struct net_device *dev)
goto out_close;
}
 
-   lp->tl.data = (unsigned long) >user;
netif_start_queue(dev);
 
/* clear buffer - it can happen that the host side of the interface
@@ -278,10 +277,11 @@ static const struct ethtool_ops uml_net_ethtool_ops = {
.get_ts_info= ethtool_op_get_ts_info,
 };
 
-static void uml_net_user_timer_expire(unsigned long _conn)
+static void uml_net_user_timer_expire(struct timer_list *t)
 {
 #ifdef undef
-   struct connection *conn = (struct connection *)_conn;
+   struct uml_net_private *lp = from_timer(lp, t, tl);
+   struct connection *conn = >user;
 
dprintk(KERN_INFO "uml_net_user_timer_expire [%p]\n", conn);
do_connect(conn);
@@ -458,9 +458,8 @@ static void eth_configure(int n, void *init, char *mac,
  .add_address  = transport->user->add_address,
  .delete_address   = transport->user->delete_address });
 
-   init_timer(>tl);
+   timer_setup(>tl, uml_net_user_timer_expire, 0);
spin_lock_init(>lock);
-   lp->tl.function = uml_net_user_timer_expire;
memcpy(lp->mac, dev->dev_addr, sizeof(lp->mac));
 
if ((transport->user->init != NULL) &&
-- 
2.7.4

[PATCH 26/58] bna: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Rasesh Mody 
Cc: Sudarsana Kalluru 
Cc: dept-gelinuxnic...@cavium.com
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/brocade/bna/bnad.c | 43 +++--
 1 file changed, 19 insertions(+), 24 deletions(-)

diff --git a/drivers/net/ethernet/brocade/bna/bnad.c 
b/drivers/net/ethernet/brocade/bna/bnad.c
index 6e13c937d715..a843076597ec 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -1693,9 +1693,9 @@ bnad_rx_res_alloc(struct bnad *bnad, struct bna_res_info 
*res_info,
 /* Timer callbacks */
 /* a) IOC timer */
 static void
-bnad_ioc_timeout(unsigned long data)
+bnad_ioc_timeout(struct timer_list *t)
 {
-   struct bnad *bnad = (struct bnad *)data;
+   struct bnad *bnad = from_timer(bnad, t, bna.ioceth.ioc.ioc_timer);
unsigned long flags;
 
spin_lock_irqsave(>bna_lock, flags);
@@ -1704,9 +1704,9 @@ bnad_ioc_timeout(unsigned long data)
 }
 
 static void
-bnad_ioc_hb_check(unsigned long data)
+bnad_ioc_hb_check(struct timer_list *t)
 {
-   struct bnad *bnad = (struct bnad *)data;
+   struct bnad *bnad = from_timer(bnad, t, bna.ioceth.ioc.hb_timer);
unsigned long flags;
 
spin_lock_irqsave(>bna_lock, flags);
@@ -1715,9 +1715,9 @@ bnad_ioc_hb_check(unsigned long data)
 }
 
 static void
-bnad_iocpf_timeout(unsigned long data)
+bnad_iocpf_timeout(struct timer_list *t)
 {
-   struct bnad *bnad = (struct bnad *)data;
+   struct bnad *bnad = from_timer(bnad, t, bna.ioceth.ioc.iocpf_timer);
unsigned long flags;
 
spin_lock_irqsave(>bna_lock, flags);
@@ -1726,9 +1726,9 @@ bnad_iocpf_timeout(unsigned long data)
 }
 
 static void
-bnad_iocpf_sem_timeout(unsigned long data)
+bnad_iocpf_sem_timeout(struct timer_list *t)
 {
-   struct bnad *bnad = (struct bnad *)data;
+   struct bnad *bnad = from_timer(bnad, t, bna.ioceth.ioc.sem_timer);
unsigned long flags;
 
spin_lock_irqsave(>bna_lock, flags);
@@ -1748,9 +1748,9 @@ bnad_iocpf_sem_timeout(unsigned long data)
 
 /* b) Dynamic Interrupt Moderation Timer */
 static void
-bnad_dim_timeout(unsigned long data)
+bnad_dim_timeout(struct timer_list *t)
 {
-   struct bnad *bnad = (struct bnad *)data;
+   struct bnad *bnad = from_timer(bnad, t, dim_timer);
struct bnad_rx_info *rx_info;
struct bnad_rx_ctrl *rx_ctrl;
int i, j;
@@ -1781,9 +1781,9 @@ bnad_dim_timeout(unsigned long data)
 
 /* c)  Statistics Timer */
 static void
-bnad_stats_timeout(unsigned long data)
+bnad_stats_timeout(struct timer_list *t)
 {
-   struct bnad *bnad = (struct bnad *)data;
+   struct bnad *bnad = from_timer(bnad, t, stats_timer);
unsigned long flags;
 
if (!netif_running(bnad->netdev) ||
@@ -1804,8 +1804,7 @@ bnad_dim_timer_start(struct bnad *bnad)
 {
if (bnad->cfg_flags & BNAD_CF_DIM_ENABLED &&
!test_bit(BNAD_RF_DIM_TIMER_RUNNING, >run_flags)) {
-   setup_timer(>dim_timer, bnad_dim_timeout,
-   (unsigned long)bnad);
+   timer_setup(>dim_timer, bnad_dim_timeout, 0);
set_bit(BNAD_RF_DIM_TIMER_RUNNING, >run_flags);
mod_timer(>dim_timer,
  jiffies + msecs_to_jiffies(BNAD_DIM_TIMER_FREQ));
@@ -1823,8 +1822,7 @@ bnad_stats_timer_start(struct bnad *bnad)
 
spin_lock_irqsave(>bna_lock, flags);
if (!test_and_set_bit(BNAD_RF_STATS_TIMER_RUNNING, >run_flags)) {
-   setup_timer(>stats_timer, bnad_stats_timeout,
-   (unsigned long)bnad);
+   timer_setup(>stats_timer, bnad_stats_timeout, 0);
mod_timer(>stats_timer,
  jiffies + msecs_to_jiffies(BNAD_STATS_TIMER_FREQ));
}
@@ -3692,14 +3690,11 @@ bnad_pci_probe(struct pci_dev *pdev,
goto res_free;
 
/* Set up timers */
-   setup_timer(>bna.ioceth.ioc.ioc_timer, bnad_ioc_timeout,
-   (unsigned long)bnad);
-   setup_timer(>bna.ioceth.ioc.hb_timer, bnad_ioc_hb_check,
-   (unsigned long)bnad);
-   setup_timer(>bna.ioceth.ioc.iocpf_timer, bnad_iocpf_timeout,
-   (unsigned long)bnad);
-   setup_timer(>bna.ioceth.ioc.sem_timer, bnad_iocpf_sem_timeout,
-   (unsigned long)bnad);
+   timer_setup(>bna.ioceth.ioc.ioc_timer, bnad_ioc_timeout, 0);
+   timer_setup(>bna.ioceth.ioc.hb_timer, bnad_ioc_hb_check, 0);
+   timer_setup(>bna.ioceth.ioc.iocpf_timer, bnad_iocpf_timeout, 0);
+   timer_setup(>bna.ioceth.ioc.sem_timer, bnad_iocpf_sem_timeout,
+   0);
 
/*
 * Start the chip
-- 

[PATCH 27/58] net: dl2k: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Jarod Wilson 
Cc: Tobias Klauser 
Cc: Philippe Reynes 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
Reviewed-by: Tobias Klauser 
---
 drivers/net/ethernet/dlink/dl2k.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/dlink/dl2k.c 
b/drivers/net/ethernet/dlink/dl2k.c
index 778f974e2928..a2f6758d38dd 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -68,7 +68,7 @@ static const int max_intrloop = 50;
 static const int multicast_filter_limit = 0x40;
 
 static int rio_open (struct net_device *dev);
-static void rio_timer (unsigned long data);
+static void rio_timer (struct timer_list *t);
 static void rio_tx_timeout (struct net_device *dev);
 static netdev_tx_t start_xmit (struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t rio_interrupt (int irq, void *dev_instance);
@@ -644,7 +644,7 @@ static int rio_open(struct net_device *dev)
return i;
}
 
-   setup_timer(>timer, rio_timer, (unsigned long)dev);
+   timer_setup(>timer, rio_timer, 0);
np->timer.expires = jiffies + 1 * HZ;
add_timer(>timer);
 
@@ -655,10 +655,10 @@ static int rio_open(struct net_device *dev)
 }
 
 static void
-rio_timer (unsigned long data)
+rio_timer (struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *)data;
-   struct netdev_private *np = netdev_priv(dev);
+   struct netdev_private *np = from_timer(np, t, timer);
+   struct net_device *dev = pci_get_drvdata(np->pdev);
unsigned int entry;
int next_tick = 1*HZ;
unsigned long flags;
-- 
2.7.4

[PATCH 18/58] net: vxge: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Jon Mason 
Cc: "David S. Miller" 
Cc: Miroslav Lichvar 
Cc: Jarod Wilson 
Cc: Eric Dumazet 
Cc: stephen hemminger 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/neterion/vxge/vxge-main.c | 12 ++--
 drivers/net/ethernet/neterion/vxge/vxge-main.h |  8 +++-
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c 
b/drivers/net/ethernet/neterion/vxge/vxge-main.c
index 50ea69d88480..5d5b9855e24e 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
@@ -2597,9 +2597,9 @@ static int vxge_add_isr(struct vxgedev *vdev)
return VXGE_HW_OK;
 }
 
-static void vxge_poll_vp_reset(unsigned long data)
+static void vxge_poll_vp_reset(struct timer_list *t)
 {
-   struct vxgedev *vdev = (struct vxgedev *)data;
+   struct vxgedev *vdev = from_timer(vdev, t, vp_reset_timer);
int i, j = 0;
 
for (i = 0; i < vdev->no_of_vpath; i++) {
@@ -2616,9 +2616,9 @@ static void vxge_poll_vp_reset(unsigned long data)
mod_timer(>vp_reset_timer, jiffies + HZ / 2);
 }
 
-static void vxge_poll_vp_lockup(unsigned long data)
+static void vxge_poll_vp_lockup(struct timer_list *t)
 {
-   struct vxgedev *vdev = (struct vxgedev *)data;
+   struct vxgedev *vdev = from_timer(vdev, t, vp_lockup_timer);
enum vxge_hw_status status = VXGE_HW_OK;
struct vxge_vpath *vpath;
struct vxge_ring *ring;
@@ -2858,12 +2858,12 @@ static int vxge_open(struct net_device *dev)
vdev->config.rx_pause_enable);
 
if (vdev->vp_reset_timer.function == NULL)
-   vxge_os_timer(>vp_reset_timer, vxge_poll_vp_reset, vdev,
+   vxge_os_timer(>vp_reset_timer, vxge_poll_vp_reset,
  HZ / 2);
 
/* There is no need to check for RxD leak and RxD lookup on Titan1A */
if (vdev->titan1 && vdev->vp_lockup_timer.function == NULL)
-   vxge_os_timer(>vp_lockup_timer, vxge_poll_vp_lockup, vdev,
+   vxge_os_timer(>vp_lockup_timer, vxge_poll_vp_lockup,
  HZ / 2);
 
set_bit(__VXGE_STATE_CARD_UP, >state);
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.h 
b/drivers/net/ethernet/neterion/vxge/vxge-main.h
index 3a79d93b8445..59a57ff5e96a 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.h
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.h
@@ -417,12 +417,10 @@ struct vxge_tx_priv {
module_param(p, int, 0)
 
 static inline
-void vxge_os_timer(struct timer_list *timer, void (*func)(unsigned long data),
-  struct vxgedev *vdev, unsigned long timeout)
+void vxge_os_timer(struct timer_list *timer, void (*func)(struct timer_list *),
+  unsigned long timeout)
 {
-   init_timer(timer);
-   timer->function = func;
-   timer->data = (unsigned long)vdev;
+   timer_setup(timer, func, 0);
mod_timer(timer, jiffies + timeout);
 }
 
-- 
2.7.4

[PATCH 25/58] net: amd8111e: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Eric Dumazet 
Cc: Jarod Wilson 
Cc: Philippe Reynes 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/amd/amd8111e.c | 7 +++
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/amd/amd8111e.c 
b/drivers/net/ethernet/amd/amd8111e.c
index 7f22af6e37e0..358f7ab77c70 100644
--- a/drivers/net/ethernet/amd/amd8111e.c
+++ b/drivers/net/ethernet/amd/amd8111e.c
@@ -1669,9 +1669,9 @@ static int amd8111e_resume(struct pci_dev *pci_dev)
return 0;
 }
 
-static void amd8111e_config_ipg(struct net_device *dev)
+static void amd8111e_config_ipg(struct timer_list *t)
 {
-   struct amd8111e_priv *lp = netdev_priv(dev);
+   struct amd8111e_priv *lp = from_timer(lp, t, ipg_data.ipg_timer);
struct ipg_info *ipg_data = >ipg_data;
void __iomem *mmio = lp->mmio;
unsigned int prev_col_cnt = ipg_data->col_cnt;
@@ -1883,8 +1883,7 @@ static int amd8111e_probe_one(struct pci_dev *pdev,
 
/* Initialize software ipg timer */
if(lp->options & OPTION_DYN_IPG_ENABLE){
-   setup_timer(>ipg_data.ipg_timer,
-   (void *)_config_ipg, (unsigned long)dev);
+   timer_setup(>ipg_data.ipg_timer, amd8111e_config_ipg, 0);
lp->ipg_data.ipg_timer.expires = jiffies +
 IPG_CONVERGE_JIFFIES;
lp->ipg_data.ipg = DEFAULT_IPG;
-- 
2.7.4

[PATCH 19/58] drivers/atm/suni: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. Passes NULL timer when doing non-
timer call.

Cc: Chas Williams <3ch...@gmail.com>
Cc: linux-atm-gene...@lists.sourceforge.net
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/atm/suni.c | 10 --
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
index b0363149b2fd..b8825f2d79e0 100644
--- a/drivers/atm/suni.c
+++ b/drivers/atm/suni.c
@@ -53,7 +53,7 @@ static DEFINE_SPINLOCK(sunis_lock);
 if (atomic_read(>s) < 0) atomic_set(>s,INT_MAX);
 
 
-static void suni_hz(unsigned long from_timer)
+static void suni_hz(struct timer_list *timer)
 {
struct suni_priv *walk;
struct atm_dev *dev;
@@ -85,7 +85,7 @@ static void suni_hz(unsigned long from_timer)
((GET(TACP_TCC) & 0xff) << 8) |
((GET(TACP_TCCM) & 7) << 16));
}
-   if (from_timer) mod_timer(_timer,jiffies+HZ);
+   if (timer) mod_timer(_timer,jiffies+HZ);
 }
 
 
@@ -322,13 +322,11 @@ static int suni_start(struct atm_dev *dev)
printk(KERN_WARNING "%s(itf %d): no signal\n",dev->type,
dev->number);
PRIV(dev)->loop_mode = ATM_LM_NONE;
-   suni_hz(0); /* clear SUNI counters */
+   suni_hz(NULL); /* clear SUNI counters */
(void) fetch_stats(dev,NULL,1); /* clear kernel counters */
if (first) {
-   init_timer(_timer);
+   timer_setup(_timer, suni_hz, 0);
poll_timer.expires = jiffies+HZ;
-   poll_timer.function = suni_hz;
-   poll_timer.data = 1;
 #if 0
 printk(KERN_DEBUG "[u] p=0x%lx,n=0x%lx\n",(unsigned long) poll_timer.list.prev,
 (unsigned long) poll_timer.list.next);
-- 
2.7.4

Re: Linux 4.12+ memory leak on router with i40e NICs

[Paweł Staszewski]

W dniu 2017-10-17 o 01:56, Alexander Duyck pisze:

On Mon, Oct 16, 2017 at 4:34 PM, Paweł Staszewski  wrote:


W dniu 2017-10-16 o 18:26, Paweł Staszewski pisze:



W dniu 2017-10-16 o 13:20, Pavlos Parissis pisze:

On 15/10/2017 02:58 πμ, Alexander Duyck wrote:

Hi Pawel,

To clarify is that Dave Miller's tree or Linus's that you are talking
about? If it is Dave's tree how long ago was it you pulled it since I
think the fix was just pushed by Jeff Kirsher a few days ago.

The issue should be fixed in the following commit:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/drivers/net/ethernet/intel/i40e/i40e_txrx.c?id=2b9478ffc550f17c6cd8c69057234e91150f5972


Do you know when it is going to be available on net-next and linux-stable
repos?

Cheers,
Pavlos



I will make some tests today night with "net" git tree where this patch is
included.
Starting from 0:00 CET
:)



Upgraded and looks like problem is not solved with that patch
Currently running system with
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/
kernel

Still about 0.5GB of memory is leaking somewhere

Also can confirm that the latest kernel where memory is not leaking (with
use i40e driver intel 710 cards) is 4.11.12
With kernel 4.11.12 - after hour no change in memory usage.

also checked that with ixgbe instead of i40e with same  net.git kernel there
is no memleak - after hour same memory usage - so for 100% this is i40e
driver problem.

So how long was the run to get the .5GB of memory leaking?

1 hour



Also is there any chance of you being able to bisect to determine
where the memory leak was introduced since as you pointed out it
didn't exist in 4.11.12 so odds are it was introduced somewhere
between 4.11 and the latest kernel release.
Can be hard cause currently need to back to 4.11.12 - this is production 
host/router
Will try to find some free/test router for tests/bicects with i40e 
driver (intel 710 cards)




Thanks.

- Alex

[PATCH 04/58] net/irda-usb: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. This requires adding a pointer to
hold the timer's target URB, as there won't be a way to pass this in the
future.

Cc: Samuel Ortiz 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/staging/irda/drivers/irda-usb.c | 20 ++--
 drivers/staging/irda/drivers/irda-usb.h |  1 +
 2 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/drivers/staging/irda/drivers/irda-usb.c 
b/drivers/staging/irda/drivers/irda-usb.c
index 82bfc051e1de..bda6bdc6c70b 100644
--- a/drivers/staging/irda/drivers/irda-usb.c
+++ b/drivers/staging/irda/drivers/irda-usb.c
@@ -117,7 +117,7 @@ static void irda_usb_close(struct irda_usb_cb *self);
 static void speed_bulk_callback(struct urb *urb);
 static void write_bulk_callback(struct urb *urb);
 static void irda_usb_receive(struct urb *urb);
-static void irda_usb_rx_defer_expired(unsigned long data);
+static void irda_usb_rx_defer_expired(struct timer_list *t);
 static int irda_usb_net_open(struct net_device *dev);
 static int irda_usb_net_close(struct net_device *dev);
 static int irda_usb_net_ioctl(struct net_device *dev, struct ifreq *rq, int 
cmd);
@@ -846,8 +846,7 @@ static void irda_usb_receive(struct urb *urb)
 * hot unplug of the dongle...
 * Lowest effective timer is 10ms...
 * Jean II */
-   self->rx_defer_timer.function = irda_usb_rx_defer_expired;
-   self->rx_defer_timer.data = (unsigned long) urb;
+   self->rx_defer_timer_urb = urb;
mod_timer(>rx_defer_timer,
  jiffies + msecs_to_jiffies(10));
 
@@ -953,20 +952,13 @@ static void irda_usb_receive(struct urb *urb)
  * In case of errors, we want the USB layer to have time to recover.
  * Now, it is time to resubmit ouur Rx URB...
  */
-static void irda_usb_rx_defer_expired(unsigned long data)
+static void irda_usb_rx_defer_expired(struct timer_list *t)
 {
-   struct urb *urb = (struct urb *) data;
+   struct irda_usb_cb *self = from_timer(self, t, rx_defer_timer);
+   struct urb *urb = self->rx_defer_timer_urb;
struct sk_buff *skb = (struct sk_buff *) urb->context;
-   struct irda_usb_cb *self; 
-   struct irda_skb_cb *cb;
struct urb *next_urb;
 
-   /* Find ourselves */
-   cb = (struct irda_skb_cb *) skb->cb;
-   IRDA_ASSERT(cb != NULL, return;);
-   self = (struct irda_usb_cb *) cb->context;
-   IRDA_ASSERT(self != NULL, return;);
-
/* Same stuff as when Rx is done, see above... */
next_urb = self->idle_rx_urb;
urb->context = NULL;
@@ -1622,7 +1614,7 @@ static int irda_usb_probe(struct usb_interface *intf,
self = netdev_priv(net);
self->netdev = net;
spin_lock_init(>lock);
-   init_timer(>rx_defer_timer);
+   timer_setup(>rx_defer_timer, irda_usb_rx_defer_expired, 0);
 
self->capability = id->driver_info;
self->needspatch = ((self->capability & IUC_STIR421X) != 0);
diff --git a/drivers/staging/irda/drivers/irda-usb.h 
b/drivers/staging/irda/drivers/irda-usb.h
index 8ac389fa9348..56ee8c16c5e2 100644
--- a/drivers/staging/irda/drivers/irda-usb.h
+++ b/drivers/staging/irda/drivers/irda-usb.h
@@ -170,5 +170,6 @@ struct irda_usb_cb {
int needspatch; /* device needs firmware patch */
 
struct timer_list rx_defer_timer;   /* Wait for Rx error to clear */
+   struct urb *rx_defer_timer_urb; /* URB attached to rx_defer_timer */
 };
 
-- 
2.7.4

[PATCH 02/58] net/lapb: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Hans Liljestrand 
Cc: "Reshetova, Elena" 
Cc: linux-...@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/lapb/lapb_iface.c |  4 ++--
 net/lapb/lapb_timer.c | 18 --
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index e15314e3b464..db6e0afe3a20 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -127,8 +127,8 @@ static struct lapb_cb *lapb_create_cb(void)
skb_queue_head_init(>write_queue);
skb_queue_head_init(>ack_queue);
 
-   init_timer(>t1timer);
-   init_timer(>t2timer);
+   timer_setup(>t1timer, NULL, 0);
+   timer_setup(>t2timer, NULL, 0);
 
lapb->t1  = LAPB_DEFAULT_T1;
lapb->t2  = LAPB_DEFAULT_T2;
diff --git a/net/lapb/lapb_timer.c b/net/lapb/lapb_timer.c
index 1a5535bc3b8d..8bb469cb3abe 100644
--- a/net/lapb/lapb_timer.c
+++ b/net/lapb/lapb_timer.c
@@ -35,15 +35,14 @@
 #include 
 #include 
 
-static void lapb_t1timer_expiry(unsigned long);
-static void lapb_t2timer_expiry(unsigned long);
+static void lapb_t1timer_expiry(struct timer_list *);
+static void lapb_t2timer_expiry(struct timer_list *);
 
 void lapb_start_t1timer(struct lapb_cb *lapb)
 {
del_timer(>t1timer);
 
-   lapb->t1timer.data = (unsigned long)lapb;
-   lapb->t1timer.function = _t1timer_expiry;
+   lapb->t1timer.function = (TIMER_FUNC_TYPE)lapb_t1timer_expiry;
lapb->t1timer.expires  = jiffies + lapb->t1;
 
add_timer(>t1timer);
@@ -53,8 +52,7 @@ void lapb_start_t2timer(struct lapb_cb *lapb)
 {
del_timer(>t2timer);
 
-   lapb->t2timer.data = (unsigned long)lapb;
-   lapb->t2timer.function = _t2timer_expiry;
+   lapb->t2timer.function = (TIMER_FUNC_TYPE)lapb_t2timer_expiry;
lapb->t2timer.expires  = jiffies + lapb->t2;
 
add_timer(>t2timer);
@@ -75,9 +73,9 @@ int lapb_t1timer_running(struct lapb_cb *lapb)
return timer_pending(>t1timer);
 }
 
-static void lapb_t2timer_expiry(unsigned long param)
+static void lapb_t2timer_expiry(struct timer_list *t)
 {
-   struct lapb_cb *lapb = (struct lapb_cb *)param;
+   struct lapb_cb *lapb = from_timer(lapb, t, t2timer);
 
if (lapb->condition & LAPB_ACK_PENDING_CONDITION) {
lapb->condition &= ~LAPB_ACK_PENDING_CONDITION;
@@ -85,9 +83,9 @@ static void lapb_t2timer_expiry(unsigned long param)
}
 }
 
-static void lapb_t1timer_expiry(unsigned long param)
+static void lapb_t1timer_expiry(struct timer_list *t)
 {
-   struct lapb_cb *lapb = (struct lapb_cb *)param;
+   struct lapb_cb *lapb = from_timer(lapb, t, t1timer);
 
switch (lapb->state) {
 
-- 
2.7.4

[PATCH 00/58] networking: Convert timers to use timer_setup()

[Kees Cook]

This is the current set of outstanding networking patches to perform
conversions to the new timer interface (rebased to -next). This is not
all expected conversions, but it contains everything needed in networking
to eliminate init_timer(), and all the non-standard setup_*_timer() uses.

Thanks,

-Kees

[PATCH 03/58] net/rose: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Ralf Baechle 
Cc: "David S. Miller" 
Cc: linux-h...@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/rose/af_rose.c   | 17 +
 net/rose/rose_link.c | 16 +++-
 net/rose/rose_loopback.c |  9 +++--
 net/rose/rose_route.c|  8 
 net/rose/rose_timer.c| 30 +-
 5 files changed, 36 insertions(+), 44 deletions(-)

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 4a9729257023..6a5c4992cf61 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -318,9 +318,11 @@ void rose_destroy_socket(struct sock *);
 /*
  * Handler for deferred kills.
  */
-static void rose_destroy_timer(unsigned long data)
+static void rose_destroy_timer(struct timer_list *t)
 {
-   rose_destroy_socket((struct sock *)data);
+   struct sock *sk = from_timer(sk, t, sk_timer);
+
+   rose_destroy_socket(sk);
 }
 
 /*
@@ -353,8 +355,7 @@ void rose_destroy_socket(struct sock *sk)
 
if (sk_has_allocations(sk)) {
/* Defer: outstanding buffers */
-   setup_timer(>sk_timer, rose_destroy_timer,
-   (unsigned long)sk);
+   timer_setup(>sk_timer, rose_destroy_timer, 0);
sk->sk_timer.expires  = jiffies + 10 * HZ;
add_timer(>sk_timer);
} else
@@ -538,8 +539,8 @@ static int rose_create(struct net *net, struct socket 
*sock, int protocol,
sock->ops= _proto_ops;
sk->sk_protocol = protocol;
 
-   init_timer(>timer);
-   init_timer(>idletimer);
+   timer_setup(>timer, NULL, 0);
+   timer_setup(>idletimer, NULL, 0);
 
rose->t1   = msecs_to_jiffies(sysctl_rose_call_request_timeout);
rose->t2   = msecs_to_jiffies(sysctl_rose_reset_request_timeout);
@@ -582,8 +583,8 @@ static struct sock *rose_make_new(struct sock *osk)
sk->sk_state= TCP_ESTABLISHED;
sock_copy_flags(sk, osk);
 
-   init_timer(>timer);
-   init_timer(>idletimer);
+   timer_setup(>timer, NULL, 0);
+   timer_setup(>idletimer, NULL, 0);
 
orose   = rose_sk(osk);
rose->t1= orose->t1;
diff --git a/net/rose/rose_link.c b/net/rose/rose_link.c
index c76638cc2cd5..cda4c6678ef1 100644
--- a/net/rose/rose_link.c
+++ b/net/rose/rose_link.c
@@ -27,8 +27,8 @@
 #include 
 #include 
 
-static void rose_ftimer_expiry(unsigned long);
-static void rose_t0timer_expiry(unsigned long);
+static void rose_ftimer_expiry(struct timer_list *);
+static void rose_t0timer_expiry(struct timer_list *);
 
 static void rose_transmit_restart_confirmation(struct rose_neigh *neigh);
 static void rose_transmit_restart_request(struct rose_neigh *neigh);
@@ -37,8 +37,7 @@ void rose_start_ftimer(struct rose_neigh *neigh)
 {
del_timer(>ftimer);
 
-   neigh->ftimer.data = (unsigned long)neigh;
-   neigh->ftimer.function = _ftimer_expiry;
+   neigh->ftimer.function = (TIMER_FUNC_TYPE)rose_ftimer_expiry;
neigh->ftimer.expires  =
jiffies + msecs_to_jiffies(sysctl_rose_link_fail_timeout);
 
@@ -49,8 +48,7 @@ static void rose_start_t0timer(struct rose_neigh *neigh)
 {
del_timer(>t0timer);
 
-   neigh->t0timer.data = (unsigned long)neigh;
-   neigh->t0timer.function = _t0timer_expiry;
+   neigh->t0timer.function = (TIMER_FUNC_TYPE)rose_t0timer_expiry;
neigh->t0timer.expires  =
jiffies + msecs_to_jiffies(sysctl_rose_restart_request_timeout);
 
@@ -77,13 +75,13 @@ static int rose_t0timer_running(struct rose_neigh *neigh)
return timer_pending(>t0timer);
 }
 
-static void rose_ftimer_expiry(unsigned long param)
+static void rose_ftimer_expiry(struct timer_list *t)
 {
 }
 
-static void rose_t0timer_expiry(unsigned long param)
+static void rose_t0timer_expiry(struct timer_list *t)
 {
-   struct rose_neigh *neigh = (struct rose_neigh *)param;
+   struct rose_neigh *neigh = from_timer(neigh, t, t0timer);
 
rose_transmit_restart_request(neigh);
 
diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
index 344456206b70..7af4f99c4a93 100644
--- a/net/rose/rose_loopback.c
+++ b/net/rose/rose_loopback.c
@@ -19,12 +19,13 @@ static struct sk_buff_head loopback_queue;
 static struct timer_list loopback_timer;
 
 static void rose_set_loopback_timer(void);
+static void rose_loopback_timer(struct timer_list *unused);
 
 void rose_loopback_init(void)
 {
skb_queue_head_init(_queue);
 
-   init_timer(_timer);
+   timer_setup(_timer, rose_loopback_timer, 0);
 }
 
 static int rose_loopback_running(void)
@@ -50,20 +51,16 @@ int rose_loopback_queue(struct sk_buff *skb, struct 
rose_neigh *neigh)

[PATCH 16/58] net: ethernet: stmmac: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Giuseppe Cavallaro 
Cc: Alexandre Torgue 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
Acked-by:  Giuseppe Cavallaro 
---
 drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c | 22 ++
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c 
b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
index 6a9c954492f2..8b50afcdb52d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
@@ -118,10 +118,9 @@ int tse_pcs_init(void __iomem *base, struct tse_pcs *pcs)
return ret;
 }
 
-static void pcs_link_timer_callback(unsigned long data)
+static void pcs_link_timer_callback(struct tse_pcs *pcs)
 {
u16 val = 0;
-   struct tse_pcs *pcs = (struct tse_pcs *)data;
void __iomem *tse_pcs_base = pcs->tse_pcs_base;
void __iomem *sgmii_adapter_base = pcs->sgmii_adapter_base;
 
@@ -138,12 +137,11 @@ static void pcs_link_timer_callback(unsigned long data)
}
 }
 
-static void auto_nego_timer_callback(unsigned long data)
+static void auto_nego_timer_callback(struct tse_pcs *pcs)
 {
u16 val = 0;
u16 speed = 0;
u16 duplex = 0;
-   struct tse_pcs *pcs = (struct tse_pcs *)data;
void __iomem *tse_pcs_base = pcs->tse_pcs_base;
void __iomem *sgmii_adapter_base = pcs->sgmii_adapter_base;
 
@@ -201,14 +199,14 @@ static void auto_nego_timer_callback(unsigned long data)
}
 }
 
-static void aneg_link_timer_callback(unsigned long data)
+static void aneg_link_timer_callback(struct timer_list *t)
 {
-   struct tse_pcs *pcs = (struct tse_pcs *)data;
+   struct tse_pcs *pcs = from_timer(pcs, t, aneg_link_timer);
 
if (pcs->autoneg == AUTONEG_ENABLE)
-   auto_nego_timer_callback(data);
+   auto_nego_timer_callback(pcs);
else if (pcs->autoneg == AUTONEG_DISABLE)
-   pcs_link_timer_callback(data);
+   pcs_link_timer_callback(pcs);
 }
 
 void tse_pcs_fix_mac_speed(struct tse_pcs *pcs, struct phy_device *phy_dev,
@@ -237,8 +235,8 @@ void tse_pcs_fix_mac_speed(struct tse_pcs *pcs, struct 
phy_device *phy_dev,
 
tse_pcs_reset(tse_pcs_base, pcs);
 
-   setup_timer(>aneg_link_timer,
-   aneg_link_timer_callback, (unsigned long)pcs);
+   timer_setup(>aneg_link_timer, aneg_link_timer_callback,
+   0);
mod_timer(>aneg_link_timer, jiffies +
  msecs_to_jiffies(AUTONEGO_LINK_TIMER));
} else if (phy_dev->autoneg == AUTONEG_DISABLE) {
@@ -270,8 +268,8 @@ void tse_pcs_fix_mac_speed(struct tse_pcs *pcs, struct 
phy_device *phy_dev,
 
tse_pcs_reset(tse_pcs_base, pcs);
 
-   setup_timer(>aneg_link_timer,
-   aneg_link_timer_callback, (unsigned long)pcs);
+   timer_setup(>aneg_link_timer, aneg_link_timer_callback,
+   0);
mod_timer(>aneg_link_timer, jiffies +
  msecs_to_jiffies(AUTONEGO_LINK_TIMER));
}
-- 
2.7.4

[PATCH 38/58] hdlc: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. This adds a pointer back to the
net_device, and drops needless open-coded resetting of the .function and
.data fields.

Cc: David S. Miller 
Cc: Krzysztof Halasa 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/wan/hdlc_cisco.c | 13 ++---
 drivers/net/wan/hdlc_fr.c| 12 ++--
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index c696d42f4502..320039d329c7 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -54,6 +54,7 @@ struct cisco_state {
cisco_proto settings;
 
struct timer_list timer;
+   struct net_device *dev;
spinlock_t lock;
unsigned long last_poll;
int up;
@@ -257,11 +258,10 @@ static int cisco_rx(struct sk_buff *skb)
 
 
 
-static void cisco_timer(unsigned long arg)
+static void cisco_timer(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *)arg;
-   hdlc_device *hdlc = dev_to_hdlc(dev);
-   struct cisco_state *st = state(hdlc);
+   struct cisco_state *st = from_timer(st, t, timer);
+   struct net_device *dev = st->dev;
 
spin_lock(>lock);
if (st->up &&
@@ -276,8 +276,6 @@ static void cisco_timer(unsigned long arg)
spin_unlock(>lock);
 
st->timer.expires = jiffies + st->settings.interval * HZ;
-   st->timer.function = cisco_timer;
-   st->timer.data = arg;
add_timer(>timer);
 }
 
@@ -293,7 +291,8 @@ static void cisco_start(struct net_device *dev)
st->up = st->txseq = st->rxseq = 0;
spin_unlock_irqrestore(>lock, flags);
 
-   setup_timer(>timer, cisco_timer, (unsigned long)dev);
+   st->dev = dev;
+   timer_setup(>timer, cisco_timer, 0);
st->timer.expires = jiffies + HZ; /* First poll after 1 s */
add_timer(>timer);
 }
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index 425a47ffed25..038236a9c60e 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -140,6 +140,7 @@ struct frad_state {
int dce_pvc_count;
 
struct timer_list timer;
+   struct net_device *dev;
unsigned long last_poll;
int reliable;
int dce_changed;
@@ -597,9 +598,10 @@ static void fr_set_link_state(int reliable, struct 
net_device *dev)
 }
 
 
-static void fr_timer(unsigned long arg)
+static void fr_timer(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *)arg;
+   struct frad_state *st = from_timer(st, t, timer);
+   struct net_device *dev = st->dev;
hdlc_device *hdlc = dev_to_hdlc(dev);
int i, cnt = 0, reliable;
u32 list;
@@ -644,8 +646,6 @@ static void fr_timer(unsigned long arg)
state(hdlc)->settings.t391 * HZ;
}
 
-   state(hdlc)->timer.function = fr_timer;
-   state(hdlc)->timer.data = arg;
add_timer((hdlc)->timer);
 }
 
@@ -1003,8 +1003,8 @@ static void fr_start(struct net_device *dev)
state(hdlc)->n391cnt = 0;
state(hdlc)->txseq = state(hdlc)->rxseq = 0;
 
-   setup_timer((hdlc)->timer, fr_timer,
-   (unsigned long)dev);
+   state(hdlc)->dev = dev;
+   timer_setup((hdlc)->timer, fr_timer, 0);
/* First poll after 1 s */
state(hdlc)->timer.expires = jiffies + HZ;
add_timer((hdlc)->timer);
-- 
2.7.4

[PATCH 39/58] appletalk: Remove unneeded synchronization

[Kees Cook]

The use of del_timer_sync() will make sure a timer is not rescheduled.
As such, there is no need to add external signals to kill timers. In
preparation for switching the timer callback argument to the timer
pointer, this drops the .data argument since it doesn't serve a meaningful
purpose here.

Cc: David Howells 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/appletalk/ltpc.c | 6 --
 1 file changed, 6 deletions(-)

diff --git a/drivers/net/appletalk/ltpc.c b/drivers/net/appletalk/ltpc.c
index e4aa374caa4d..cc3dc9337eae 100644
--- a/drivers/net/appletalk/ltpc.c
+++ b/drivers/net/appletalk/ltpc.c
@@ -880,14 +880,10 @@ static void ltpc_poll(unsigned long l)
}
ltpc_poll_counter--;
}
-  
-   if (!dev)
-   return;  /* we've been downed */
 
/* poll 20 times per second */
idle(dev);
ltpc_timer.expires = jiffies + HZ/20;
-   
add_timer(_timer);
 }
 
@@ -1252,8 +1248,6 @@ static void __exit ltpc_cleanup(void)
if(debug & DEBUG_VERBOSE) printk("unregister_netdev\n");
unregister_netdev(dev_ltpc);
 
-   ltpc_timer.data = 0;  /* signal the poll routine that we're done */
-
del_timer_sync(_timer);
 
if(debug & DEBUG_VERBOSE) printk("freeing irq\n");
-- 
2.7.4

[PATCH 37/58] net/core: Collapse redundant sk_timer callback data assignments

[Kees Cook]

The core sk_timer initializer can provide the common .data assignment
instead of it being set separately in users.

Cc: "David S. Miller" 
Cc: Ralf Baechle 
Cc: Andrew Hendry 
Cc: Eric Dumazet 
Cc: Paolo Abeni 
Cc: David Howells 
Cc: Colin Ian King 
Cc: Ingo Molnar 
Cc: linzhang 
Cc: netdev@vger.kernel.org
Cc: linux-h...@vger.kernel.org
Cc: linux-...@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/core/sock.c   | 2 +-
 net/netrom/nr_timer.c | 1 -
 net/rose/rose_timer.c | 1 -
 net/x25/af_x25.c  | 1 -
 net/x25/x25_timer.c   | 1 -
 5 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index aeb1cd59763c..57113b42b2c8 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2685,7 +2685,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
sk_init_common(sk);
sk->sk_send_head=   NULL;
 
-   init_timer(>sk_timer);
+   setup_timer(>sk_timer, NULL, (unsigned long)sk);
 
sk->sk_allocation   =   GFP_KERNEL;
sk->sk_rcvbuf   =   sysctl_rmem_default;
diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index 94d05806a9a2..f84ce71f1f5f 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -45,7 +45,6 @@ void nr_init_timers(struct sock *sk)
setup_timer(>idletimer, nr_idletimer_expiry, (unsigned long)sk);
 
/* initialized by sock_init_data */
-   sk->sk_timer.data = (unsigned long)sk;
sk->sk_timer.function = _heartbeat_expiry;
 }
 
diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c
index 3b89d66f15bb..e08201185214 100644
--- a/net/rose/rose_timer.c
+++ b/net/rose/rose_timer.c
@@ -36,7 +36,6 @@ void rose_start_heartbeat(struct sock *sk)
 {
del_timer(>sk_timer);
 
-   sk->sk_timer.data = (unsigned long)sk;
sk->sk_timer.function = _heartbeat_expiry;
sk->sk_timer.expires  = jiffies + 5 * HZ;
 
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index ac095936552d..c590c0bd1393 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -414,7 +414,6 @@ static void __x25_destroy_socket(struct sock *sk)
/* Defer: outstanding buffers */
sk->sk_timer.expires  = jiffies + 10 * HZ;
sk->sk_timer.function = x25_destroy_timer;
-   sk->sk_timer.data = (unsigned long)sk;
add_timer(>sk_timer);
} else {
/* drop last reference so sock_put will free */
diff --git a/net/x25/x25_timer.c b/net/x25/x25_timer.c
index 5c5db1a36399..de5cec41d100 100644
--- a/net/x25/x25_timer.c
+++ b/net/x25/x25_timer.c
@@ -36,7 +36,6 @@ void x25_init_timers(struct sock *sk)
setup_timer(>timer, x25_timer_expiry, (unsigned long)sk);
 
/* initialized by sock_init_data */
-   sk->sk_timer.data = (unsigned long)sk;
sk->sk_timer.function = _heartbeat_expiry;
 }
 
-- 
2.7.4

[PATCH 36/58] inet: frags: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Alexander Aring 
Cc: Stefan Schmidt 
Cc: "David S. Miller" 
Cc: Alexey Kuznetsov 
Cc: Hideaki YOSHIFUJI 
Cc: Pablo Neira Ayuso 
Cc: Jozsef Kadlecsik 
Cc: Florian Westphal 
Cc: linux-w...@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: netfilter-de...@vger.kernel.org
Cc: coret...@netfilter.org
Signed-off-by: Kees Cook 
Acked-by: Stefan Schmidt  # for ieee802154
---
 include/net/inet_frag.h | 2 +-
 net/ieee802154/6lowpan/reassembly.c | 5 +++--
 net/ipv4/inet_fragment.c| 4 ++--
 net/ipv4/ip_fragment.c  | 5 +++--
 net/ipv6/netfilter/nf_conntrack_reasm.c | 5 +++--
 net/ipv6/reassembly.c   | 5 +++--
 6 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
index fc59e0775e00..c695807ca707 100644
--- a/include/net/inet_frag.h
+++ b/include/net/inet_frag.h
@@ -95,7 +95,7 @@ struct inet_frags {
void(*constructor)(struct inet_frag_queue *q,
   const void *arg);
void(*destructor)(struct inet_frag_queue *);
-   void(*frag_expire)(unsigned long data);
+   void(*frag_expire)(struct timer_list *t);
struct kmem_cache   *frags_cachep;
const char  *frags_cache_name;
 };
diff --git a/net/ieee802154/6lowpan/reassembly.c 
b/net/ieee802154/6lowpan/reassembly.c
index f85b08baff16..85bf86ad6b18 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -80,12 +80,13 @@ static void lowpan_frag_init(struct inet_frag_queue *q, 
const void *a)
fq->daddr = *arg->dst;
 }
 
-static void lowpan_frag_expire(unsigned long data)
+static void lowpan_frag_expire(struct timer_list *t)
 {
+   struct inet_frag_queue *frag = from_timer(frag, t, timer);
struct frag_queue *fq;
struct net *net;
 
-   fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);
+   fq = container_of(frag, struct frag_queue, q);
net = container_of(fq->q.net, struct net, ieee802154_lowpan.frags);
 
spin_lock(>q.lock);
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index af74d0433453..7f3ef5c287a1 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -147,7 +147,7 @@ inet_evict_bucket(struct inet_frags *f, struct 
inet_frag_bucket *hb)
spin_unlock(>chain_lock);
 
hlist_for_each_entry_safe(fq, n, , list_evictor)
-   f->frag_expire((unsigned long) fq);
+   f->frag_expire(>timer);
 
return evicted;
 }
@@ -366,7 +366,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct 
netns_frags *nf,
f->constructor(q, arg);
add_frag_mem_limit(nf, f->qsize);
 
-   setup_timer(>timer, f->frag_expire, (unsigned long)q);
+   timer_setup(>timer, f->frag_expire, 0);
spin_lock_init(>lock);
refcount_set(>refcnt, 1);
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 46408c220d9d..9215654a401f 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -190,12 +190,13 @@ static bool frag_expire_skip_icmp(u32 user)
 /*
  * Oops, a fragment queue timed out.  Kill it and send an ICMP reply.
  */
-static void ip_expire(unsigned long arg)
+static void ip_expire(struct timer_list *t)
 {
+   struct inet_frag_queue *frag = from_timer(frag, t, timer);
struct ipq *qp;
struct net *net;
 
-   qp = container_of((struct inet_frag_queue *) arg, struct ipq, q);
+   qp = container_of(frag, struct ipq, q);
net = container_of(qp->q.net, struct net, ipv4.frags);
 
rcu_read_lock();
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c 
b/net/ipv6/netfilter/nf_conntrack_reasm.c
index b263bf3a19f7..977d8900cfd1 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -169,12 +169,13 @@ static unsigned int nf_hashfn(const struct 
inet_frag_queue *q)
return nf_hash_frag(nq->id, >saddr, >daddr);
 }
 
-static void nf_ct_frag6_expire(unsigned long data)
+static void nf_ct_frag6_expire(struct timer_list *t)
 {
+   struct inet_frag_queue *frag = from_timer(frag, t, timer);
struct frag_queue *fq;
struct net *net;
 
-   fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);
+   fq = container_of(frag, struct frag_queue, q);
net = container_of(fq->q.net, struct net, nf_frag.frags);
 
ip6_expire_frag_queue(net, 

[PATCH 35/58] inet/connection_sock: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Gerrit Renker 
Cc: Alexey Kuznetsov 
Cc: Hideaki YOSHIFUJI 
Cc: netdev@vger.kernel.org
Cc: d...@vger.kernel.org
Signed-off-by: Kees Cook 
---
 include/net/inet_connection_sock.h |  6 +++---
 net/dccp/timer.c   | 18 ++
 net/ipv4/inet_connection_sock.c| 21 +
 net/ipv4/tcp_timer.c   | 18 +++---
 4 files changed, 33 insertions(+), 30 deletions(-)

diff --git a/include/net/inet_connection_sock.h 
b/include/net/inet_connection_sock.h
index 13e4c89a8231..0358745ea059 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -169,9 +169,9 @@ enum inet_csk_ack_state_t {
 };
 
 void inet_csk_init_xmit_timers(struct sock *sk,
-  void (*retransmit_handler)(unsigned long),
-  void (*delack_handler)(unsigned long),
-  void (*keepalive_handler)(unsigned long));
+  void (*retransmit_handler)(struct timer_list *),
+  void (*delack_handler)(struct timer_list *),
+  void (*keepalive_handler)(struct timer_list *));
 void inet_csk_clear_xmit_timers(struct sock *sk);
 
 static inline void inet_csk_schedule_ack(struct sock *sk)
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index 3a2c34027758..1e35526bf436 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -125,10 +125,11 @@ static void dccp_retransmit_timer(struct sock *sk)
__sk_dst_reset(sk);
 }
 
-static void dccp_write_timer(unsigned long data)
+static void dccp_write_timer(struct timer_list *t)
 {
-   struct sock *sk = (struct sock *)data;
-   struct inet_connection_sock *icsk = inet_csk(sk);
+   struct inet_connection_sock *icsk =
+   from_timer(icsk, t, icsk_retransmit_timer);
+   struct sock *sk = >icsk_inet.sk;
int event = 0;
 
bh_lock_sock(sk);
@@ -161,19 +162,20 @@ static void dccp_write_timer(unsigned long data)
sock_put(sk);
 }
 
-static void dccp_keepalive_timer(unsigned long data)
+static void dccp_keepalive_timer(struct timer_list *t)
 {
-   struct sock *sk = (struct sock *)data;
+   struct sock *sk = from_timer(sk, t, sk_timer);
 
pr_err("dccp should not use a keepalive timer !\n");
sock_put(sk);
 }
 
 /* This is the same as tcp_delack_timer, sans prequeue & mem_reclaim stuff */
-static void dccp_delack_timer(unsigned long data)
+static void dccp_delack_timer(struct timer_list *t)
 {
-   struct sock *sk = (struct sock *)data;
-   struct inet_connection_sock *icsk = inet_csk(sk);
+   struct inet_connection_sock *icsk =
+   from_timer(icsk, t, icsk_delack_timer);
+   struct sock *sk = >icsk_inet.sk;
 
bh_lock_sock(sk);
if (sock_owned_by_user(sk)) {
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 4158c38916b2..1d54b20906cc 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -495,17 +495,15 @@ EXPORT_SYMBOL(inet_csk_accept);
  * to optimize.
  */
 void inet_csk_init_xmit_timers(struct sock *sk,
-  void (*retransmit_handler)(unsigned long),
-  void (*delack_handler)(unsigned long),
-  void (*keepalive_handler)(unsigned long))
+  void (*retransmit_handler)(struct timer_list *t),
+  void (*delack_handler)(struct timer_list *t),
+  void (*keepalive_handler)(struct timer_list *t))
 {
struct inet_connection_sock *icsk = inet_csk(sk);
 
-   setup_timer(>icsk_retransmit_timer, retransmit_handler,
-   (unsigned long)sk);
-   setup_timer(>icsk_delack_timer, delack_handler,
-   (unsigned long)sk);
-   setup_timer(>sk_timer, keepalive_handler, (unsigned long)sk);
+   timer_setup(>icsk_retransmit_timer, retransmit_handler, 0);
+   timer_setup(>icsk_delack_timer, delack_handler, 0);
+   timer_setup(>sk_timer, keepalive_handler, 0);
icsk->icsk_pending = icsk->icsk_ack.pending = 0;
 }
 EXPORT_SYMBOL(inet_csk_init_xmit_timers);
@@ -677,9 +675,9 @@ void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, 
struct request_sock *req
 }
 EXPORT_SYMBOL(inet_csk_reqsk_queue_drop_and_put);
 
-static void reqsk_timer_handler(unsigned long data)
+static void reqsk_timer_handler(struct timer_list *t)
 {
-   struct request_sock *req = (struct request_sock *)data;
+   struct request_sock *req = from_timer(req, t, 

[PATCH 41/58] net/atm/mpc: Stop using open-coded timer .data field

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using an explicit static variable to hold
additional expiration details.

Cc: "David S. Miller" 
Cc: Andrew Morton 
Cc: Alexey Dobriyan 
Cc: "Reshetova, Elena" 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/atm/mpc.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 63138c8c2269..3b59a053b7cb 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -95,7 +95,7 @@ static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
 static int mpoa_event_listener(struct notifier_block *mpoa_notifier,
   unsigned long event, void *dev);
 static void mpc_timer_refresh(void);
-static void mpc_cache_check(unsigned long checking_time);
+static void mpc_cache_check(unsigned long unused);
 
 static struct llc_snap_hdr llc_snap_mpoa_ctrl = {
0xaa, 0xaa, 0x03,
@@ -121,7 +121,8 @@ static struct notifier_block mpoa_notifier = {
 
 struct mpoa_client *mpcs = NULL; /* FIXME */
 static struct atm_mpoa_qos *qos_head = NULL;
-static DEFINE_TIMER(mpc_timer, NULL);
+static DEFINE_TIMER(mpc_timer, mpc_cache_check);
+static unsigned long checking_time;
 
 
 static struct mpoa_client *find_mpc_by_itfnum(int itf)
@@ -1411,12 +1412,11 @@ static void clean_up(struct k_message *msg, struct 
mpoa_client *mpc, int action)
 static void mpc_timer_refresh(void)
 {
mpc_timer.expires = jiffies + (MPC_P2 * HZ);
-   mpc_timer.data = mpc_timer.expires;
-   mpc_timer.function = mpc_cache_check;
+   checking_time = mpc_timer.expires;
add_timer(_timer);
 }
 
-static void mpc_cache_check(unsigned long checking_time)
+static void mpc_cache_check(unsigned long unused)
 {
struct mpoa_client *mpc = mpcs;
static unsigned long previous_resolving_check_time;
-- 
2.7.4

[PATCH 32/58] isdn/gigaset: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Paul Bolle 
Cc: Karsten Keil 
Cc: "David S. Miller" 
Cc: Johan Hovold 
Cc: gigaset307x-com...@lists.sourceforge.net
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/isdn/gigaset/bas-gigaset.c | 36 
 drivers/isdn/gigaset/common.c  |  7 +++
 2 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/drivers/isdn/gigaset/bas-gigaset.c 
b/drivers/isdn/gigaset/bas-gigaset.c
index 33151f05e744..c990c6bbffc2 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -433,10 +433,11 @@ static void check_pending(struct bas_cardstate *ucs)
  * argument:
  * controller state structure
  */
-static void cmd_in_timeout(unsigned long data)
+static void cmd_in_timeout(struct timer_list *t)
 {
-   struct cardstate *cs = (struct cardstate *) data;
-   struct bas_cardstate *ucs = cs->hw.bas;
+   struct bas_cardstate *ucs = from_timer(ucs, t, timer_cmd_in);
+   struct urb *urb = ucs->urb_int_in;
+   struct cardstate *cs = urb->context;
int rc;
 
if (!ucs->rcvbuf_size) {
@@ -639,10 +640,11 @@ static void int_in_work(struct work_struct *work)
  * argument:
  * controller state structure
  */
-static void int_in_resubmit(unsigned long data)
+static void int_in_resubmit(struct timer_list *t)
 {
-   struct cardstate *cs = (struct cardstate *) data;
-   struct bas_cardstate *ucs = cs->hw.bas;
+   struct bas_cardstate *ucs = from_timer(ucs, t, timer_int_in);
+   struct urb *urb = ucs->urb_int_in;
+   struct cardstate *cs = urb->context;
int rc;
 
if (ucs->retry_int_in++ >= BAS_RETRY) {
@@ -1441,10 +1443,11 @@ static void read_iso_tasklet(unsigned long data)
  * argument:
  * controller state structure
  */
-static void req_timeout(unsigned long data)
+static void req_timeout(struct timer_list *t)
 {
-   struct cardstate *cs = (struct cardstate *) data;
-   struct bas_cardstate *ucs = cs->hw.bas;
+   struct bas_cardstate *ucs = from_timer(ucs, t, timer_ctrl);
+   struct urb *urb = ucs->urb_int_in;
+   struct cardstate *cs = urb->context;
int pending;
unsigned long flags;
 
@@ -1837,10 +1840,11 @@ static void write_command_callback(struct urb *urb)
  * argument:
  * controller state structure
  */
-static void atrdy_timeout(unsigned long data)
+static void atrdy_timeout(struct timer_list *t)
 {
-   struct cardstate *cs = (struct cardstate *) data;
-   struct bas_cardstate *ucs = cs->hw.bas;
+   struct bas_cardstate *ucs = from_timer(ucs, t, timer_atrdy);
+   struct urb *urb = ucs->urb_int_in;
+   struct cardstate *cs = urb->context;
 
dev_warn(cs->dev, "timeout waiting for HD_READY_SEND_ATDATA\n");
 
@@ -2213,10 +2217,10 @@ static int gigaset_initcshw(struct cardstate *cs)
}
 
spin_lock_init(>lock);
-   setup_timer(>timer_ctrl, req_timeout, (unsigned long) cs);
-   setup_timer(>timer_atrdy, atrdy_timeout, (unsigned long) cs);
-   setup_timer(>timer_cmd_in, cmd_in_timeout, (unsigned long) cs);
-   setup_timer(>timer_int_in, int_in_resubmit, (unsigned long) cs);
+   timer_setup(>timer_ctrl, req_timeout, 0);
+   timer_setup(>timer_atrdy, atrdy_timeout, 0);
+   timer_setup(>timer_cmd_in, cmd_in_timeout, 0);
+   timer_setup(>timer_int_in, int_in_resubmit, 0);
init_waitqueue_head(>waitqueue);
INIT_WORK(>int_in_wq, int_in_work);
 
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 7c7814497e3e..15482c5de33c 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -153,9 +153,9 @@ static int test_timeout(struct at_state_t *at_state)
return 1;
 }
 
-static void timer_tick(unsigned long data)
+static void timer_tick(struct timer_list *t)
 {
-   struct cardstate *cs = (struct cardstate *) data;
+   struct cardstate *cs = from_timer(cs, t, timer);
unsigned long flags;
unsigned channel;
struct at_state_t *at_state;
@@ -687,7 +687,7 @@ struct cardstate *gigaset_initcs(struct gigaset_driver 
*drv, int channels,
cs->ignoreframes = ignoreframes;
INIT_LIST_HEAD(>temp_at_states);
cs->running = 0;
-   init_timer(>timer); /* clear next & prev */
+   timer_setup(>timer, timer_tick, 0);
spin_lock_init(>ev_lock);
cs->ev_tail = 0;
cs->ev_head = 0;
@@ -768,7 +768,6 @@ struct cardstate *gigaset_initcs(struct gigaset_driver 
*drv, int channels,
spin_lock_irqsave(>lock, flags);
cs->running = 1;
spin_unlock_irqrestore(>lock, flags);
-   setup_timer(>timer, timer_tick, (unsigned long) 

[PATCH 33/58] net: sched: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. Add pointer back to Qdisc.

Cc: Jamal Hadi Salim 
Cc: Cong Wang 
Cc: Jiri Pirko 
Cc: "David S. Miller" 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/sched/cls_flow.c|  7 +++
 net/sched/sch_generic.c |  6 +++---
 net/sched/sch_pie.c | 10 ++
 net/sched/sch_red.c | 10 ++
 net/sched/sch_sfq.c | 10 +-
 5 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 2a3a60ec5b86..ca9acce2d402 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -345,9 +345,9 @@ static int flow_classify(struct sk_buff *skb, const struct 
tcf_proto *tp,
return -1;
 }
 
-static void flow_perturbation(unsigned long arg)
+static void flow_perturbation(struct timer_list *t)
 {
-   struct flow_filter *f = (struct flow_filter *)arg;
+   struct flow_filter *f = from_timer(f, t, perturb_timer);
 
get_random_bytes(>hashrnd, 4);
if (f->perturb_period)
@@ -502,8 +502,7 @@ static int flow_change(struct net *net, struct sk_buff 
*in_skb,
get_random_bytes(>hashrnd, 4);
}
 
-   setup_deferrable_timer(>perturb_timer, flow_perturbation,
-  (unsigned long)fnew);
+   timer_setup(>perturb_timer, flow_perturbation, TIMER_DEFERRABLE);
 
netif_keep_dst(qdisc_dev(tp->q));
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index a0a198768aad..6ced7c89c141 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -288,9 +288,9 @@ unsigned long dev_trans_start(struct net_device *dev)
 }
 EXPORT_SYMBOL(dev_trans_start);
 
-static void dev_watchdog(unsigned long arg)
+static void dev_watchdog(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *)arg;
+   struct net_device *dev = from_timer(dev, t, watchdog_timer);
 
netif_tx_lock(dev);
if (!qdisc_tx_is_noop(dev)) {
@@ -954,7 +954,7 @@ void dev_init_scheduler(struct net_device *dev)
if (dev_ingress_queue(dev))
dev_init_scheduler_queue(dev, dev_ingress_queue(dev), 
_qdisc);
 
-   setup_timer(>watchdog_timer, dev_watchdog, (unsigned long)dev);
+   timer_setup(>watchdog_timer, dev_watchdog, 0);
 }
 
 static void shutdown_scheduler_queue(struct net_device *dev,
diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c
index 6c2791d6102d..776c694c77c7 100644
--- a/net/sched/sch_pie.c
+++ b/net/sched/sch_pie.c
@@ -74,6 +74,7 @@ struct pie_sched_data {
struct pie_vars vars;
struct pie_stats stats;
struct timer_list adapt_timer;
+   struct Qdisc *sch;
 };
 
 static void pie_params_init(struct pie_params *params)
@@ -422,10 +423,10 @@ static void calculate_probability(struct Qdisc *sch)
pie_vars_init(>vars);
 }
 
-static void pie_timer(unsigned long arg)
+static void pie_timer(struct timer_list *t)
 {
-   struct Qdisc *sch = (struct Qdisc *)arg;
-   struct pie_sched_data *q = qdisc_priv(sch);
+   struct pie_sched_data *q = from_timer(q, t, adapt_timer);
+   struct Qdisc *sch = q->sch;
spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
 
spin_lock(root_lock);
@@ -446,7 +447,8 @@ static int pie_init(struct Qdisc *sch, struct nlattr *opt)
pie_vars_init(>vars);
sch->limit = q->params.limit;
 
-   setup_timer(>adapt_timer, pie_timer, (unsigned long)sch);
+   q->sch = sch;
+   timer_setup(>adapt_timer, pie_timer, 0);
 
if (opt) {
int err = pie_change(sch, opt);
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 93b9d70a9b28..fdfdb56aaae2 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -40,6 +40,7 @@ struct red_sched_data {
u32 limit;  /* HARD maximal queue length */
unsigned char   flags;
struct timer_list   adapt_timer;
+   struct Qdisc*sch;
struct red_parmsparms;
struct red_vars vars;
struct red_statsstats;
@@ -221,10 +222,10 @@ static int red_change(struct Qdisc *sch, struct nlattr 
*opt)
return 0;
 }
 
-static inline void red_adaptative_timer(unsigned long arg)
+static inline void red_adaptative_timer(struct timer_list *t)
 {
-   struct Qdisc *sch = (struct Qdisc *)arg;
-   struct red_sched_data *q = qdisc_priv(sch);
+   struct red_sched_data *q = from_timer(q, t, adapt_timer);
+   struct Qdisc *sch = q->sch;
spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
 
spin_lock(root_lock);
@@ -238,7 +239,8 @@ static int red_init(struct Qdisc *sch, struct nlattr *opt)
struct 

[PATCH 44/58] net: ethernet: sun: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Philippe Reynes 
Cc: Jarod Wilson 
Cc: Shannon Nelson 
Cc: Rob Herring 
Cc: chris hyser 
Cc: Tushar Dave 
Cc: Tobias Klauser 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/sun/cassini.c|  7 ---
 drivers/net/ethernet/sun/ldmvsw.c |  3 +--
 drivers/net/ethernet/sun/niu.c| 10 --
 drivers/net/ethernet/sun/sunbmac.c| 10 --
 drivers/net/ethernet/sun/sungem.c |  6 +++---
 drivers/net/ethernet/sun/sunhme.c | 10 --
 drivers/net/ethernet/sun/sunvnet.c|  3 +--
 drivers/net/ethernet/sun/sunvnet_common.c |  4 ++--
 drivers/net/ethernet/sun/sunvnet_common.h |  2 +-
 9 files changed, 24 insertions(+), 31 deletions(-)

diff --git a/drivers/net/ethernet/sun/cassini.c 
b/drivers/net/ethernet/sun/cassini.c
index a74d78f64af9..113bd57e2ea0 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -4079,9 +4079,9 @@ static void cas_reset_task(struct work_struct *work)
 #endif
 }
 
-static void cas_link_timer(unsigned long data)
+static void cas_link_timer(struct timer_list *t)
 {
-   struct cas *cp = (struct cas *) data;
+   struct cas *cp = from_timer(cp, t, link_timer);
int mask, pending = 0, reset = 0;
unsigned long flags;
 
@@ -5039,7 +5039,8 @@ static int cas_init_one(struct pci_dev *pdev, const 
struct pci_device_id *ent)
spin_lock_init(>stat_lock[N_TX_RINGS]);
mutex_init(>pm_mutex);
 
-   setup_timer(>link_timer, cas_link_timer, (unsigned long)cp);
+   timer_setup(>link_timer, cas_link_timer, 0);
+
 #if 1
/* Just in case the implementation of atomic operations
 * change so that an explicit initialization is necessary.
diff --git a/drivers/net/ethernet/sun/ldmvsw.c 
b/drivers/net/ethernet/sun/ldmvsw.c
index 5feeaa9f0a9e..5ea037672e6f 100644
--- a/drivers/net/ethernet/sun/ldmvsw.c
+++ b/drivers/net/ethernet/sun/ldmvsw.c
@@ -363,8 +363,7 @@ static int vsw_port_probe(struct vio_dev *vdev, const 
struct vio_device_id *id)
list_add_rcu(>list, >port_list);
spin_unlock_irqrestore(>lock, flags);
 
-   setup_timer(>clean_timer, sunvnet_clean_timer_expire_common,
-   (unsigned long)port);
+   timer_setup(>clean_timer, sunvnet_clean_timer_expire_common, 0);
 
err = register_netdev(dev);
if (err) {
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index bde19b307d0d..ab502ee35fb2 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -2221,9 +2221,9 @@ static int niu_link_status(struct niu *np, int *link_up_p)
return err;
 }
 
-static void niu_timer(unsigned long __opaque)
+static void niu_timer(struct timer_list *t)
 {
-   struct niu *np = (struct niu *) __opaque;
+   struct niu *np = from_timer(np, t, timer);
unsigned long off;
int err, link_up;
 
@@ -6123,7 +6123,7 @@ static int niu_open(struct net_device *dev)
 
err = niu_init_hw(np);
if (!err) {
-   setup_timer(>timer, niu_timer, (unsigned long)np);
+   timer_setup(>timer, niu_timer, 0);
np->timer.expires = jiffies + HZ;
 
err = niu_enable_interrupts(np, 1);
@@ -6773,10 +6773,8 @@ static int niu_change_mtu(struct net_device *dev, int 
new_mtu)
 
err = niu_init_hw(np);
if (!err) {
-   init_timer(>timer);
+   timer_setup(>timer, niu_timer, 0);
np->timer.expires = jiffies + HZ;
-   np->timer.data = (unsigned long) np;
-   np->timer.function = niu_timer;
 
err = niu_enable_interrupts(np, 1);
if (err)
diff --git a/drivers/net/ethernet/sun/sunbmac.c 
b/drivers/net/ethernet/sun/sunbmac.c
index 3189722110c2..0b1f41f6bceb 100644
--- a/drivers/net/ethernet/sun/sunbmac.c
+++ b/drivers/net/ethernet/sun/sunbmac.c
@@ -523,9 +523,9 @@ static int try_next_permutation(struct bigmac *bp, void 
__iomem *tregs)
return -1;
 }
 
-static void bigmac_timer(unsigned long data)
+static void bigmac_timer(struct timer_list *t)
 {
-   struct bigmac *bp = (struct bigmac *) data;
+   struct bigmac *bp = from_timer(bp, t, bigmac_timer);
void __iomem *tregs = bp->tregs;
int restart_timer = 0;
 
@@ -613,8 +613,6 @@ static void bigmac_begin_auto_negotiation(struct bigmac *bp)
bp->timer_state = ltrywait;
bp->timer_ticks = 0;
bp->bigmac_timer.expires = jiffies + (12 * HZ) / 10;
-   bp->bigmac_timer.data = 

[PATCH 28/58] net: ksz884x: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Johannes Berg 
Cc: Jarod Wilson 
Cc: Masahiro Yamada 
Cc: Philippe Reynes 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/micrel/ksz884x.c | 18 +-
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/micrel/ksz884x.c 
b/drivers/net/ethernet/micrel/ksz884x.c
index e798fbe08600..52207508744c 100644
--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
@@ -4338,11 +4338,11 @@ static void ksz_stop_timer(struct ksz_timer_info *info)
 }
 
 static void ksz_init_timer(struct ksz_timer_info *info, int period,
-   void (*function)(unsigned long), void *data)
+   void (*function)(struct timer_list *))
 {
info->max = 0;
info->period = period;
-   setup_timer(>timer, function, (unsigned long)data);
+   timer_setup(>timer, function, 0);
 }
 
 static void ksz_update_timer(struct ksz_timer_info *info)
@@ -6689,9 +6689,9 @@ static void mib_read_work(struct work_struct *work)
}
 }
 
-static void mib_monitor(unsigned long ptr)
+static void mib_monitor(struct timer_list *t)
 {
-   struct dev_info *hw_priv = (struct dev_info *) ptr;
+   struct dev_info *hw_priv = from_timer(hw_priv, t, mib_timer_info.timer);
 
mib_read_work(_priv->mib_read);
 
@@ -6716,10 +6716,10 @@ static void mib_monitor(unsigned long ptr)
  *
  * This routine is run in a kernel timer to monitor the network device.
  */
-static void dev_monitor(unsigned long ptr)
+static void dev_monitor(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *) ptr;
-   struct dev_priv *priv = netdev_priv(dev);
+   struct dev_priv *priv = from_timer(priv, t, monitor_timer_info.timer);
+   struct net_device *dev = priv->mii_if.dev;
struct dev_info *hw_priv = priv->adapter;
struct ksz_hw *hw = _priv->hw;
struct ksz_port *port = >port;
@@ -6789,7 +6789,7 @@ static int __init netdev_init(struct net_device *dev)
 
/* 500 ms timeout */
ksz_init_timer(>monitor_timer_info, 500 * HZ / 1000,
-   dev_monitor, dev);
+   dev_monitor);
 
/* 500 ms timeout */
dev->watchdog_timeo = HZ / 2;
@@ -7065,7 +7065,7 @@ static int pcidev_init(struct pci_dev *pdev, const struct 
pci_device_id *id)
 
/* 500 ms timeout */
ksz_init_timer(_priv->mib_timer_info, 500 * HZ / 1000,
-   mib_monitor, hw_priv);
+   mib_monitor);
 
for (i = 0; i < hw->dev_count; i++) {
dev = alloc_etherdev(sizeof(struct dev_priv));
-- 
2.7.4

[PATCH 52/58] net/core: Convert sk_timer users to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly for all users of sk_timer.

Cc: "David S. Miller" 
Cc: Ralf Baechle 
Cc: Andrew Hendry 
Cc: Eric Dumazet 
Cc: Paolo Abeni 
Cc: David Howells 
Cc: Julia Lawall 
Cc: linzhang 
Cc: Ingo Molnar 
Cc: netdev@vger.kernel.org
Cc: linux-h...@vger.kernel.org
Cc: linux-...@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/core/sock.c|  2 +-
 net/netrom/af_netrom.c |  6 +++---
 net/netrom/nr_timer.c  | 47 ---
 net/rose/rose_timer.c  |  8 
 net/x25/af_x25.c   |  8 +---
 net/x25/x25_timer.c| 17 +
 6 files changed, 46 insertions(+), 42 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index 57113b42b2c8..34b3ac2de44a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2685,7 +2685,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
sk_init_common(sk);
sk->sk_send_head=   NULL;
 
-   setup_timer(>sk_timer, NULL, (unsigned long)sk);
+   timer_setup(>sk_timer, NULL, 0);
 
sk->sk_allocation   =   GFP_KERNEL;
sk->sk_rcvbuf   =   sysctl_rmem_default;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ebf16f7f9089..2dec3583c97d 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -241,9 +241,9 @@ void nr_destroy_socket(struct sock *);
 /*
  * Handler for deferred kills.
  */
-static void nr_destroy_timer(unsigned long data)
+static void nr_destroy_timer(struct timer_list *t)
 {
-   struct sock *sk=(struct sock *)data;
+   struct sock *sk = from_timer(sk, t, sk_timer);
bh_lock_sock(sk);
sock_hold(sk);
nr_destroy_socket(sk);
@@ -284,7 +284,7 @@ void nr_destroy_socket(struct sock *sk)
 
if (sk_has_allocations(sk)) {
/* Defer: outstanding buffers */
-   sk->sk_timer.function = nr_destroy_timer;
+   sk->sk_timer.function = (TIMER_FUNC_TYPE)nr_destroy_timer;
sk->sk_timer.expires  = jiffies + 2 * HZ;
add_timer(>sk_timer);
} else
diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index f84ce71f1f5f..43569aea0f5e 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -29,23 +29,23 @@
 #include 
 #include 
 
-static void nr_heartbeat_expiry(unsigned long);
-static void nr_t1timer_expiry(unsigned long);
-static void nr_t2timer_expiry(unsigned long);
-static void nr_t4timer_expiry(unsigned long);
-static void nr_idletimer_expiry(unsigned long);
+static void nr_heartbeat_expiry(struct timer_list *);
+static void nr_t1timer_expiry(struct timer_list *);
+static void nr_t2timer_expiry(struct timer_list *);
+static void nr_t4timer_expiry(struct timer_list *);
+static void nr_idletimer_expiry(struct timer_list *);
 
 void nr_init_timers(struct sock *sk)
 {
struct nr_sock *nr = nr_sk(sk);
 
-   setup_timer(>t1timer, nr_t1timer_expiry, (unsigned long)sk);
-   setup_timer(>t2timer, nr_t2timer_expiry, (unsigned long)sk);
-   setup_timer(>t4timer, nr_t4timer_expiry, (unsigned long)sk);
-   setup_timer(>idletimer, nr_idletimer_expiry, (unsigned long)sk);
+   timer_setup(>t1timer, nr_t1timer_expiry, 0);
+   timer_setup(>t2timer, nr_t2timer_expiry, 0);
+   timer_setup(>t4timer, nr_t4timer_expiry, 0);
+   timer_setup(>idletimer, nr_idletimer_expiry, 0);
 
/* initialized by sock_init_data */
-   sk->sk_timer.function = _heartbeat_expiry;
+   sk->sk_timer.function = (TIMER_FUNC_TYPE)nr_heartbeat_expiry;
 }
 
 void nr_start_t1timer(struct sock *sk)
@@ -112,9 +112,9 @@ int nr_t1timer_running(struct sock *sk)
return timer_pending(_sk(sk)->t1timer);
 }
 
-static void nr_heartbeat_expiry(unsigned long param)
+static void nr_heartbeat_expiry(struct timer_list *t)
 {
-   struct sock *sk = (struct sock *)param;
+   struct sock *sk = from_timer(sk, t, sk_timer);
struct nr_sock *nr = nr_sk(sk);
 
bh_lock_sock(sk);
@@ -151,10 +151,10 @@ static void nr_heartbeat_expiry(unsigned long param)
bh_unlock_sock(sk);
 }
 
-static void nr_t2timer_expiry(unsigned long param)
+static void nr_t2timer_expiry(struct timer_list *t)
 {
-   struct sock *sk = (struct sock *)param;
-   struct nr_sock *nr = nr_sk(sk);
+   struct nr_sock *nr = from_timer(nr, t, t2timer);
+   struct sock *sk = >sock;
 
bh_lock_sock(sk);
if (nr->condition & NR_COND_ACK_PENDING) {
@@ -164,19 +164,20 @@ static void nr_t2timer_expiry(unsigned long param)
bh_unlock_sock(sk);
 }
 
-static void nr_t4timer_expiry(unsigned long 

[PATCH 40/58] drivers/net/appletalk: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. Adds a static variable to hold the
polled net_device.

Cc: David Howells 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/appletalk/ltpc.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/appletalk/ltpc.c b/drivers/net/appletalk/ltpc.c
index cc3dc9337eae..75a5a9b87c5a 100644
--- a/drivers/net/appletalk/ltpc.c
+++ b/drivers/net/appletalk/ltpc.c
@@ -694,6 +694,7 @@ static int do_read(struct net_device *dev, void *cbuf, int 
cbuflen,
 /* end of idle handlers -- what should be seen is do_read, do_write */
 
 static struct timer_list ltpc_timer;
+static struct net_device *ltpc_timer_dev;
 
 static netdev_tx_t ltpc_xmit(struct sk_buff *skb, struct net_device *dev);
 
@@ -867,10 +868,8 @@ static void set_multicast_list(struct net_device *dev)
 
 static int ltpc_poll_counter;
 
-static void ltpc_poll(unsigned long l)
+static void ltpc_poll(struct timer_list *unused)
 {
-   struct net_device *dev = (struct net_device *) l;
-
del_timer(_timer);
 
if(debug & DEBUG_VERBOSE) {
@@ -882,7 +881,7 @@ static void ltpc_poll(unsigned long l)
}
 
/* poll 20 times per second */
-   idle(dev);
+   idle(ltpc_timer_dev);
ltpc_timer.expires = jiffies + HZ/20;
add_timer(_timer);
 }
@@ -1161,7 +1160,8 @@ struct net_device * __init ltpc_probe(void)
dev->irq = 0;
/* polled mode -- 20 times per second */
/* this is really, really slow... should it poll more often? */
-   setup_timer(_timer, ltpc_poll, (unsigned long)dev);
+   ltpc_timer_dev = dev;
+   timer_setup(_timer, ltpc_poll, 0);
 
ltpc_timer.expires = jiffies + HZ/20;
add_timer(_timer);
-- 
2.7.4

[PATCH 34/58] netfilter: ipset: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. This introduces a pointer back to the
struct ip_set, which is used instead of the struct timer_list .data field.

Cc: Pablo Neira Ayuso 
Cc: Jozsef Kadlecsik 
Cc: Florian Westphal 
Cc: "David S. Miller" 
Cc: Stephen Hemminger 
Cc: simran singhal 
Cc: Muhammad Falak R Wani 
Cc: netfilter-de...@vger.kernel.org
Cc: coret...@netfilter.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/netfilter/ipset/ip_set_bitmap_gen.h   | 10 +-
 net/netfilter/ipset/ip_set_bitmap_ip.c|  2 ++
 net/netfilter/ipset/ip_set_bitmap_ipmac.c |  2 ++
 net/netfilter/ipset/ip_set_bitmap_port.c  |  2 ++
 net/netfilter/ipset/ip_set_hash_gen.h | 12 +++-
 net/netfilter/ipset/ip_set_list_set.c | 12 +++-
 6 files changed, 25 insertions(+), 15 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h 
b/net/netfilter/ipset/ip_set_bitmap_gen.h
index 8ad2b52a0b32..5ca18f07683b 100644
--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
+++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
@@ -37,11 +37,11 @@
 #define get_ext(set, map, id)  ((map)->extensions + ((set)->dsize * (id)))
 
 static void
-mtype_gc_init(struct ip_set *set, void (*gc)(unsigned long ul_set))
+mtype_gc_init(struct ip_set *set, void (*gc)(struct timer_list *t))
 {
struct mtype *map = set->data;
 
-   setup_timer(>gc, gc, (unsigned long)set);
+   timer_setup(>gc, gc, 0);
mod_timer(>gc, jiffies + IPSET_GC_PERIOD(set->timeout) * HZ);
 }
 
@@ -272,10 +272,10 @@ mtype_list(const struct ip_set *set,
 }
 
 static void
-mtype_gc(unsigned long ul_set)
+mtype_gc(struct timer_list *t)
 {
-   struct ip_set *set = (struct ip_set *)ul_set;
-   struct mtype *map = set->data;
+   struct mtype *map = from_timer(map, t, gc);
+   struct ip_set *set = map->set;
void *x;
u32 id;
 
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c 
b/net/netfilter/ipset/ip_set_bitmap_ip.c
index 4783efff0bde..d8975a0b4282 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -48,6 +48,7 @@ struct bitmap_ip {
size_t memsize; /* members size */
u8 netmask; /* subnet netmask */
struct timer_list gc;   /* garbage collection */
+   struct ip_set *set; /* attached to this ip_set */
unsigned char extensions[0] /* data extensions */
__aligned(__alignof__(u64));
 };
@@ -232,6 +233,7 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map,
map->netmask = netmask;
set->timeout = IPSET_NO_TIMEOUT;
 
+   map->set = set;
set->data = map;
set->family = NFPROTO_IPV4;
 
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c 
b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 9a065f672d3a..4c279fbd2d5d 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -52,6 +52,7 @@ struct bitmap_ipmac {
u32 elements;   /* number of max elements in the set */
size_t memsize; /* members size */
struct timer_list gc;   /* garbage collector */
+   struct ip_set *set; /* attached to this ip_set */
unsigned char extensions[0] /* MAC + data extensions */
__aligned(__alignof__(u64));
 };
@@ -307,6 +308,7 @@ init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map,
map->elements = elements;
set->timeout = IPSET_NO_TIMEOUT;
 
+   map->set = set;
set->data = map;
set->family = NFPROTO_IPV4;
 
diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c 
b/net/netfilter/ipset/ip_set_bitmap_port.c
index 7f0c733358a4..7f9bbd7c98b5 100644
--- a/net/netfilter/ipset/ip_set_bitmap_port.c
+++ b/net/netfilter/ipset/ip_set_bitmap_port.c
@@ -40,6 +40,7 @@ struct bitmap_port {
u32 elements;   /* number of max elements in the set */
size_t memsize; /* members size */
struct timer_list gc;   /* garbage collection */
+   struct ip_set *set; /* attached to this ip_set */
unsigned char extensions[0] /* data extensions */
__aligned(__alignof__(u64));
 };
@@ -214,6 +215,7 @@ init_map_port(struct ip_set *set, struct bitmap_port *map,
map->last_port = last_port;
set->timeout = IPSET_NO_TIMEOUT;
 
+   map->set = set;
set->data = map;
set->family = NFPROTO_UNSPEC;
 
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h 
b/net/netfilter/ipset/ip_set_hash_gen.h
index 51063d9ed0f7..efffc8eabafe 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h

[PATCH 21/58] net: tulip: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: David Howells 
Cc: Jarod Wilson 
Cc: Stephen Hemminger 
Cc: Johannes Berg 
Cc: Eric Dumazet 
Cc: Philippe Reynes 
Cc: "yuval.sh...@oracle.com" 
Cc: netdev@vger.kernel.org
Cc: linux-par...@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/dec/tulip/de4x5.c   | 12 ++--
 drivers/net/ethernet/dec/tulip/dmfe.c| 10 +-
 drivers/net/ethernet/dec/tulip/interrupt.c   |  6 +++---
 drivers/net/ethernet/dec/tulip/pnic.c|  6 +++---
 drivers/net/ethernet/dec/tulip/pnic2.c   |  6 +++---
 drivers/net/ethernet/dec/tulip/timer.c   | 12 ++--
 drivers/net/ethernet/dec/tulip/tulip.h   | 12 ++--
 drivers/net/ethernet/dec/tulip/tulip_core.c  | 14 ++
 drivers/net/ethernet/dec/tulip/uli526x.c | 10 +-
 drivers/net/ethernet/dec/tulip/winbond-840.c | 10 +-
 10 files changed, 48 insertions(+), 50 deletions(-)

diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c 
b/drivers/net/ethernet/dec/tulip/de4x5.c
index 299812e92db7..a31b4df3e7ff 100644
--- a/drivers/net/ethernet/dec/tulip/de4x5.c
+++ b/drivers/net/ethernet/dec/tulip/de4x5.c
@@ -912,7 +912,7 @@ static int de4x5_init(struct net_device *dev);
 static int de4x5_sw_reset(struct net_device *dev);
 static int de4x5_rx(struct net_device *dev);
 static int de4x5_tx(struct net_device *dev);
-static voidde4x5_ast(struct net_device *dev);
+static voidde4x5_ast(struct timer_list *t);
 static int de4x5_txur(struct net_device *dev);
 static int de4x5_rx_ovfc(struct net_device *dev);
 
@@ -1147,8 +1147,7 @@ de4x5_hw_init(struct net_device *dev, u_long iobase, 
struct device *gendev)
lp->timeout = -1;
lp->gendev = gendev;
spin_lock_init(>lock);
-   setup_timer(>timer, (void (*)(unsigned long))de4x5_ast,
-   (unsigned long)dev);
+   timer_setup(>timer, de4x5_ast, 0);
de4x5_parse_params(dev);
 
/*
@@ -1741,9 +1740,10 @@ de4x5_tx(struct net_device *dev)
 }
 
 static void
-de4x5_ast(struct net_device *dev)
+de4x5_ast(struct timer_list *t)
 {
-   struct de4x5_private *lp = netdev_priv(dev);
+   struct de4x5_private *lp = from_timer(lp, t, timer);
+   struct net_device *dev = dev_get_drvdata(lp->gendev);
int next_tick = DE4X5_AUTOSENSE_MS;
int dt;
 
@@ -2369,7 +2369,7 @@ autoconf_media(struct net_device *dev)
lp->media = INIT;
lp->tcount = 0;
 
-   de4x5_ast(dev);
+   de4x5_ast(>timer);
 
return lp->media;
 }
diff --git a/drivers/net/ethernet/dec/tulip/dmfe.c 
b/drivers/net/ethernet/dec/tulip/dmfe.c
index 6585f737d08b..17ef7a28873d 100644
--- a/drivers/net/ethernet/dec/tulip/dmfe.c
+++ b/drivers/net/ethernet/dec/tulip/dmfe.c
@@ -331,7 +331,7 @@ static void dmfe_phy_write_1bit(void __iomem *, u32);
 static u16 dmfe_phy_read_1bit(void __iomem *);
 static u8 dmfe_sense_speed(struct dmfe_board_info *);
 static void dmfe_process_mode(struct dmfe_board_info *);
-static void dmfe_timer(unsigned long);
+static void dmfe_timer(struct timer_list *);
 static inline u32 cal_CRC(unsigned char *, unsigned int, u8);
 static void dmfe_rx_packet(struct net_device *, struct dmfe_board_info *);
 static void dmfe_free_tx_pkt(struct net_device *, struct dmfe_board_info *);
@@ -596,7 +596,7 @@ static int dmfe_open(struct net_device *dev)
netif_wake_queue(dev);
 
/* set and active a timer process */
-   setup_timer(>timer, dmfe_timer, (unsigned long)dev);
+   timer_setup(>timer, dmfe_timer, 0);
db->timer.expires = DMFE_TIMER_WUT + HZ * 2;
add_timer(>timer);
 
@@ -1128,10 +1128,10 @@ static const struct ethtool_ops netdev_ethtool_ops = {
  * Dynamic media sense, allocate Rx buffer...
  */
 
-static void dmfe_timer(unsigned long data)
+static void dmfe_timer(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *)data;
-   struct dmfe_board_info *db = netdev_priv(dev);
+   struct dmfe_board_info *db = from_timer(db, t, timer);
+   struct net_device *dev = pci_get_drvdata(db->pdev);
void __iomem *ioaddr = db->ioaddr;
u32 tmp_cr8;
unsigned char tmp_cr12;
diff --git a/drivers/net/ethernet/dec/tulip/interrupt.c 
b/drivers/net/ethernet/dec/tulip/interrupt.c
index 8df80880ecaa..c1ca0765d56d 100644
--- a/drivers/net/ethernet/dec/tulip/interrupt.c
+++ b/drivers/net/ethernet/dec/tulip/interrupt.c
@@ -102,10 +102,10 @@ int tulip_refill_rx(struct net_device *dev)
 
 #ifdef CONFIG_TULIP_NAPI
 
-void oom_timer(unsigned long data)
+void oom_timer(struct timer_list 

[PATCH 46/58] hamradio/scc: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Joerg Reuter 
Cc: linux-h...@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/hamradio/scc.c | 69 +++---
 1 file changed, 35 insertions(+), 34 deletions(-)

diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c
index 295f267b73ea..c9f7215c5dc2 100644
--- a/drivers/net/hamradio/scc.c
+++ b/drivers/net/hamradio/scc.c
@@ -185,14 +185,15 @@
 static const char banner[] __initconst = KERN_INFO \
"AX.25: Z8530 SCC driver version "VERSION".dl1bke\n";
 
-static void t_dwait(unsigned long);
-static void t_txdelay(unsigned long);
-static void t_tail(unsigned long);
-static void t_busy(unsigned long);
-static void t_maxkeyup(unsigned long);
-static void t_idle(unsigned long);
+static void t_dwait(struct timer_list *t);
+static void t_txdelay(struct timer_list *t);
+static void t_tail(struct timer_list *t);
+static void t_busy(struct timer_list *);
+static void t_maxkeyup(struct timer_list *);
+static void t_idle(struct timer_list *t);
 static void scc_tx_done(struct scc_channel *);
-static void scc_start_tx_timer(struct scc_channel *, void (*)(unsigned long), 
unsigned long);
+static void scc_start_tx_timer(struct scc_channel *,
+  void (*)(struct timer_list *), unsigned long);
 static void scc_start_maxkeyup(struct scc_channel *);
 static void scc_start_defer(struct scc_channel *);
 
@@ -992,24 +993,27 @@ static void scc_key_trx(struct scc_channel *scc, char tx)
 
 /* > SCC timer interrupt handler and friends. < */
 
-static void __scc_start_tx_timer(struct scc_channel *scc, void 
(*handler)(unsigned long), unsigned long when)
+static void __scc_start_tx_timer(struct scc_channel *scc,
+void (*handler)(struct timer_list *t),
+unsigned long when)
 {
del_timer(>tx_t);
 
if (when == 0)
{
-   handler((unsigned long) scc);
+   handler(>tx_t);
} else 
if (when != TIMER_OFF)
{
-   scc->tx_t.data = (unsigned long) scc;
-   scc->tx_t.function = handler;
+   scc->tx_t.function = (TIMER_FUNC_TYPE)handler;
scc->tx_t.expires = jiffies + (when*HZ)/100;
add_timer(>tx_t);
}
 }
 
-static void scc_start_tx_timer(struct scc_channel *scc, void 
(*handler)(unsigned long), unsigned long when)
+static void scc_start_tx_timer(struct scc_channel *scc,
+  void (*handler)(struct timer_list *t),
+  unsigned long when)
 {
unsigned long flags;

@@ -1027,8 +1031,7 @@ static void scc_start_defer(struct scc_channel *scc)

if (scc->kiss.maxdefer != 0 && scc->kiss.maxdefer != TIMER_OFF)
{
-   scc->tx_wdog.data = (unsigned long) scc;
-   scc->tx_wdog.function = t_busy;
+   scc->tx_wdog.function = (TIMER_FUNC_TYPE)t_busy;
scc->tx_wdog.expires = jiffies + HZ*scc->kiss.maxdefer;
add_timer(>tx_wdog);
}
@@ -1044,8 +1047,7 @@ static void scc_start_maxkeyup(struct scc_channel *scc)

if (scc->kiss.maxkeyup != 0 && scc->kiss.maxkeyup != TIMER_OFF)
{
-   scc->tx_wdog.data = (unsigned long) scc;
-   scc->tx_wdog.function = t_maxkeyup;
+   scc->tx_wdog.function = (TIMER_FUNC_TYPE)t_maxkeyup;
scc->tx_wdog.expires = jiffies + HZ*scc->kiss.maxkeyup;
add_timer(>tx_wdog);
}
@@ -1121,9 +1123,9 @@ static inline int is_grouped(struct scc_channel *scc)
  * fulldup == 2:  mintime expired, reset status or key trx and start txdelay
  */
 
-static void t_dwait(unsigned long channel)
+static void t_dwait(struct timer_list *t)
 {
-   struct scc_channel *scc = (struct scc_channel *) channel;
+   struct scc_channel *scc = from_timer(scc, t, tx_t);

if (scc->stat.tx_state == TXS_WAIT) /* maxkeyup or idle timeout */
{
@@ -1163,9 +1165,9 @@ static void t_dwait(unsigned long channel)
  * kick transmission by a fake scc_txint(scc), start 'maxkeyup' watchdog.
  */
 
-static void t_txdelay(unsigned long channel)
+static void t_txdelay(struct timer_list *t)
 {
-   struct scc_channel *scc = (struct scc_channel *) channel;
+   struct scc_channel *scc = from_timer(scc, t, tx_t);
 
scc_start_maxkeyup(scc);
 
@@ -1184,9 +1186,9 @@ static void t_txdelay(unsigned long channel)
  * transmission after 'mintime' seconds
  */
 
-static void t_tail(unsigned long channel)
+static void t_tail(struct timer_list *t)
 {
-   struct scc_channel *scc = (struct scc_channel *) channel;
+   struct scc_channel 

[PATCH 22/58] net: can: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Oliver Hartkopp 
Cc: Marc Kleine-Budde 
Cc: "David S. Miller" 
Cc: linux-...@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/can/af_can.c | 4 ++--
 net/can/af_can.h | 2 +-
 net/can/proc.c   | 8 
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/can/af_can.c b/net/can/af_can.c
index 88edac0f3e36..1f75e11ac35a 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -882,8 +882,8 @@ static int can_pernet_init(struct net *net)
if (IS_ENABLED(CONFIG_PROC_FS)) {
/* the statistics are updated every second (timer triggered) */
if (stats_timer) {
-   setup_timer(>can.can_stattimer, can_stat_update,
-   (unsigned long)net);
+   timer_setup(>can.can_stattimer, can_stat_update,
+   0);
mod_timer(>can.can_stattimer,
  round_jiffies(jiffies + HZ));
}
diff --git a/net/can/af_can.h b/net/can/af_can.h
index d0ef45bb2a72..eca6463c6213 100644
--- a/net/can/af_can.h
+++ b/net/can/af_can.h
@@ -113,6 +113,6 @@ struct s_pstats {
 /* function prototypes for the CAN networklayer procfs (proc.c) */
 void can_init_proc(struct net *net);
 void can_remove_proc(struct net *net);
-void can_stat_update(unsigned long data);
+void can_stat_update(struct timer_list *t);
 
 #endif /* AF_CAN_H */
diff --git a/net/can/proc.c b/net/can/proc.c
index 83045f00c63c..d979b3dc49a6 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -115,9 +115,9 @@ static unsigned long calc_rate(unsigned long oldjif, 
unsigned long newjif,
return rate;
 }
 
-void can_stat_update(unsigned long data)
+void can_stat_update(struct timer_list *t)
 {
-   struct net *net = (struct net *)data;
+   struct net *net = from_timer(net, t, can.can_stattimer);
struct s_stats *can_stats = net->can.can_stats;
unsigned long j = jiffies; /* snapshot */
 
@@ -221,7 +221,7 @@ static int can_stats_proc_show(struct seq_file *m, void *v)
 
seq_putc(m, '\n');
 
-   if (net->can.can_stattimer.function == can_stat_update) {
+   if (net->can.can_stattimer.function == 
(TIMER_FUNC_TYPE)can_stat_update) {
seq_printf(m, " %8ld %% total match ratio (RXMR)\n",
can_stats->total_rx_match_ratio);
 
@@ -291,7 +291,7 @@ static int can_reset_stats_proc_show(struct seq_file *m, 
void *v)
 
user_reset = 1;
 
-   if (net->can.can_stattimer.function == can_stat_update) {
+   if (net->can.can_stattimer.function == 
(TIMER_FUNC_TYPE)can_stat_update) {
seq_printf(m, "Scheduled statistic reset #%ld.\n",
can_pstats->stats_reset + 1);
} else {
-- 
2.7.4

[PATCH 47/58] net/ethernet/sgi: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Ralf Baechle 
Cc: linux-m...@linux-mips.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/sgi/ioc3-eth.c | 8 +++-
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/sgi/ioc3-eth.c 
b/drivers/net/ethernet/sgi/ioc3-eth.c
index 9c0488e0f08e..18d533fdf14c 100644
--- a/drivers/net/ethernet/sgi/ioc3-eth.c
+++ b/drivers/net/ethernet/sgi/ioc3-eth.c
@@ -764,9 +764,9 @@ static inline void ioc3_setup_duplex(struct ioc3_private 
*ip)
ioc3_w_emcr(ip->emcr);
 }
 
-static void ioc3_timer(unsigned long data)
+static void ioc3_timer(struct timer_list *t)
 {
-   struct ioc3_private *ip = (struct ioc3_private *) data;
+   struct ioc3_private *ip = from_timer(ip, t, ioc3_timer);
 
/* Print the link status if it has changed */
mii_check_media(>mii, 1, 0);
@@ -818,8 +818,6 @@ static int ioc3_mii_init(struct ioc3_private *ip)
 static void ioc3_mii_start(struct ioc3_private *ip)
 {
ip->ioc3_timer.expires = jiffies + (12 * HZ)/10;  /* 1.2 sec. */
-   ip->ioc3_timer.data = (unsigned long) ip;
-   ip->ioc3_timer.function = ioc3_timer;
add_timer(>ioc3_timer);
 }
 
@@ -1291,7 +1289,7 @@ static int ioc3_probe(struct pci_dev *pdev, const struct 
pci_device_id *ent)
 #endif
 
spin_lock_init(>ioc3_lock);
-   init_timer(>ioc3_timer);
+   timer_setup(>ioc3_timer, ioc3_timer, 0);
 
ioc3_stop(ip);
ioc3_init(dev);
-- 
2.7.4

[PATCH 45/58] net: seeq: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Russell King 
Cc: linux-arm-ker...@lists.infradead.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/seeq/ether3.c | 11 ++-
 drivers/net/ethernet/seeq/ether3.h |  1 +
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/seeq/ether3.c 
b/drivers/net/ethernet/seeq/ether3.c
index 244c1e171017..da4807723a06 100644
--- a/drivers/net/ethernet/seeq/ether3.c
+++ b/drivers/net/ethernet/seeq/ether3.c
@@ -170,9 +170,11 @@ ether3_setbuffer(struct net_device *dev, buffer_rw_t read, 
int start)
 /*
  * Switch LED off...
  */
-static void ether3_ledoff(unsigned long data)
+static void ether3_ledoff(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *)data;
+   struct dev_priv *private = from_timer(priv, t, timer);
+   struct net_device *dev = private->dev;
+
ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
 }
 
@@ -183,8 +185,6 @@ static inline void ether3_ledon(struct net_device *dev)
 {
del_timer((dev)->timer);
priv(dev)->timer.expires = jiffies + HZ / 50; /* leave on for 1/50th 
second */
-   priv(dev)->timer.data = (unsigned long)dev;
-   priv(dev)->timer.function = ether3_ledoff;
add_timer((dev)->timer);
if (priv(dev)->regs.config2 & CFG2_CTRLO)
ether3_outw(priv(dev)->regs.config2 &= ~CFG2_CTRLO, 
REG_CONFIG2);
@@ -783,7 +783,8 @@ ether3_probe(struct expansion_card *ec, const struct 
ecard_id *id)
 
ether3_addr(dev->dev_addr, ec);
 
-   init_timer((dev)->timer);
+   priv(dev)->dev = dev;
+   timer_setup((dev)->timer, ether3_ledoff, 0);
 
/* Reset card...
 */
diff --git a/drivers/net/ethernet/seeq/ether3.h 
b/drivers/net/ethernet/seeq/ether3.h
index 2db63b08bdf3..ea2ba286e665 100644
--- a/drivers/net/ethernet/seeq/ether3.h
+++ b/drivers/net/ethernet/seeq/ether3.h
@@ -165,6 +165,7 @@ struct dev_priv {
 unsigned char tx_tail; /* buffer nr of transmitting packet 
 */
 unsigned int rx_head;  /* address to fetch next packet from
 */
 struct timer_list timer;
+net_device *dev;
 int broken;/* 0 = ok, 1 = something went 
wrong  */
 };
 
-- 
2.7.4

[PATCH 10/58] isdn/hisax: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Karsten Keil 
Cc: Geliang Tang 
Cc: "David S. Miller" 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/isdn/hisax/amd7930_fn.c |  6 +++---
 drivers/isdn/hisax/arcofi.c |  6 +++---
 drivers/isdn/hisax/diva.c   |  9 -
 drivers/isdn/hisax/elsa.c   | 10 +-
 drivers/isdn/hisax/fsm.c|  7 +++
 drivers/isdn/hisax/hfc4s8s_l1.c |  6 +++---
 drivers/isdn/hisax/hfc_2bds0.c  |  4 ++--
 drivers/isdn/hisax/hfc_pci.c|  9 +
 drivers/isdn/hisax/hfc_sx.c |  9 +
 drivers/isdn/hisax/hfc_usb.c| 10 ++
 drivers/isdn/hisax/hfcscard.c   |  5 +++--
 drivers/isdn/hisax/icc.c|  6 +++---
 drivers/isdn/hisax/ipacx.c  |  8 
 drivers/isdn/hisax/isac.c   |  6 +++---
 drivers/isdn/hisax/isar.c   |  9 -
 drivers/isdn/hisax/isdnl3.c |  6 +++---
 drivers/isdn/hisax/saphir.c |  7 +++
 drivers/isdn/hisax/teleint.c|  5 +++--
 drivers/isdn/hisax/w6692.c  |  7 +++
 19 files changed, 68 insertions(+), 67 deletions(-)

diff --git a/drivers/isdn/hisax/amd7930_fn.c b/drivers/isdn/hisax/amd7930_fn.c
index dcf4c2a9fcea..77debda2221b 100644
--- a/drivers/isdn/hisax/amd7930_fn.c
+++ b/drivers/isdn/hisax/amd7930_fn.c
@@ -398,7 +398,6 @@ Amd7930_fill_Dfifo(struct IsdnCardState *cs)
debugl1(cs, "Amd7930: fill_Dfifo dbusytimer running");
del_timer(>dbusytimer);
}
-   init_timer(>dbusytimer);
cs->dbusytimer.expires = jiffies + ((DBUSY_TIMER_VALUE * HZ) / 1000);
add_timer(>dbusytimer);
 
@@ -686,8 +685,9 @@ DC_Close_Amd7930(struct IsdnCardState *cs) {
 
 
 static void
-dbusy_timer_handler(struct IsdnCardState *cs)
+dbusy_timer_handler(struct timer_list *t)
 {
+   struct IsdnCardState *cs = from_timer(cs, t, dbusytimer);
u_long flags;
struct PStack *stptr;
WORD dtcr, der;
@@ -790,5 +790,5 @@ void Amd7930_init(struct IsdnCardState *cs)
 void setup_Amd7930(struct IsdnCardState *cs)
 {
INIT_WORK(>tqueue, Amd7930_bh);
-   setup_timer(>dbusytimer, (void *)dbusy_timer_handler, (long)cs);
+   timer_setup(>dbusytimer, dbusy_timer_handler, 0);
 }
diff --git a/drivers/isdn/hisax/arcofi.c b/drivers/isdn/hisax/arcofi.c
index 9826bad49e2c..2f784f96d439 100644
--- a/drivers/isdn/hisax/arcofi.c
+++ b/drivers/isdn/hisax/arcofi.c
@@ -23,7 +23,6 @@ add_arcofi_timer(struct IsdnCardState *cs) {
if (test_and_set_bit(FLG_ARCOFI_TIMER, >HW_Flags)) {
del_timer(>dc.isac.arcofitimer);
}
-   init_timer(>dc.isac.arcofitimer);
cs->dc.isac.arcofitimer.expires = jiffies + ((ARCOFI_TIMER_VALUE * HZ) 
/ 1000);
add_timer(>dc.isac.arcofitimer);
 }
@@ -112,7 +111,8 @@ arcofi_fsm(struct IsdnCardState *cs, int event, void *data) 
{
 }
 
 static void
-arcofi_timer(struct IsdnCardState *cs) {
+arcofi_timer(struct timer_list *t) {
+   struct IsdnCardState *cs = from_timer(cs, t, dc.isac.arcofitimer);
arcofi_fsm(cs, ARCOFI_TIMEOUT, NULL);
 }
 
@@ -125,7 +125,7 @@ clear_arcofi(struct IsdnCardState *cs) {
 
 void
 init_arcofi(struct IsdnCardState *cs) {
-   setup_timer(>dc.isac.arcofitimer, (void *)arcofi_timer, (long)cs);
+   timer_setup(>dc.isac.arcofitimer, arcofi_timer, 0);
init_waitqueue_head(>dc.isac.arcofi_wait);
test_and_set_bit(HW_ARCOFI, >HW_Flags);
 }
diff --git a/drivers/isdn/hisax/diva.c b/drivers/isdn/hisax/diva.c
index 3fc94e7741ae..38bdd3f7b960 100644
--- a/drivers/isdn/hisax/diva.c
+++ b/drivers/isdn/hisax/diva.c
@@ -798,8 +798,9 @@ reset_diva(struct IsdnCardState *cs)
 #define DIVA_ASSIGN 1
 
 static void
-diva_led_handler(struct IsdnCardState *cs)
+diva_led_handler(struct timer_list *t)
 {
+   struct IsdnCardState *cs = from_timer(cs, t, hw.diva.tl);
int blink = 0;
 
if ((cs->subtyp == DIVA_IPAC_ISA) ||
@@ -828,7 +829,6 @@ diva_led_handler(struct IsdnCardState *cs)
 
byteout(cs->hw.diva.ctrl, cs->hw.diva.ctrl_reg);
if (blink) {
-   init_timer(>hw.diva.tl);
cs->hw.diva.tl.expires = jiffies + ((blink * HZ) / 1000);
add_timer(>hw.diva.tl);
}
@@ -900,7 +900,7 @@ Diva_card_msg(struct IsdnCardState *cs, int mt, void *arg)
(cs->subtyp != DIVA_IPAC_PCI) &&
(cs->subtyp != DIVA_IPACX_PCI)) {
spin_lock_irqsave(>lock, flags);
-   diva_led_handler(cs);
+   diva_led_handler(>hw.diva.tl);
spin_unlock_irqrestore(>lock, flags);
}
return (0);
@@ -978,8 +978,7 @@ static int setup_diva_common(struct IsdnCardState *cs)
printk(KERN_INFO "Diva: IPACX Design Id: %x\n",
   

[PATCH 11/58] net/hamradio/6pack: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Andreas Koensgen 
Cc: linux-h...@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/hamradio/6pack.c | 20 +++-
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 97fe8dfb602d..bbc7b7808a31 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -136,9 +136,9 @@ static int encode_sixpack(unsigned char *, unsigned char *, 
int, unsigned char);
  * Note that in case of DAMA operation, the data is not sent here.
  */
 
-static void sp_xmit_on_air(unsigned long channel)
+static void sp_xmit_on_air(struct timer_list *t)
 {
-   struct sixpack *sp = (struct sixpack *) channel;
+   struct sixpack *sp = from_timer(sp, t, tx_t);
int actual, when = sp->slottime;
static unsigned char random;
 
@@ -229,7 +229,7 @@ static void sp_encaps(struct sixpack *sp, unsigned char 
*icp, int len)
sp->xleft = count;
sp->xhead = sp->xbuff;
sp->status2 = count;
-   sp_xmit_on_air((unsigned long)sp);
+   sp_xmit_on_air(>tx_t);
}
 
return;
@@ -500,9 +500,9 @@ static inline void tnc_set_sync_state(struct sixpack *sp, 
int new_tnc_state)
__tnc_set_sync_state(sp, new_tnc_state);
 }
 
-static void resync_tnc(unsigned long channel)
+static void resync_tnc(struct timer_list *t)
 {
-   struct sixpack *sp = (struct sixpack *) channel;
+   struct sixpack *sp = from_timer(sp, t, resync_t);
static char resync_cmd = 0xe8;
 
/* clear any data that might have been received */
@@ -526,8 +526,6 @@ static void resync_tnc(unsigned long channel)
/* Start resync timer again -- the TNC might be still absent */
 
del_timer(>resync_t);
-   sp->resync_t.data   = (unsigned long) sp;
-   sp->resync_t.function   = resync_tnc;
sp->resync_t.expires= jiffies + SIXP_RESYNC_TIMEOUT;
add_timer(>resync_t);
 }
@@ -541,8 +539,6 @@ static inline int tnc_init(struct sixpack *sp)
sp->tty->ops->write(sp->tty, , 1);
 
del_timer(>resync_t);
-   sp->resync_t.data = (unsigned long) sp;
-   sp->resync_t.function = resync_tnc;
sp->resync_t.expires = jiffies + SIXP_RESYNC_TIMEOUT;
add_timer(>resync_t);
 
@@ -623,9 +619,9 @@ static int sixpack_open(struct tty_struct *tty)
 
netif_start_queue(dev);
 
-   setup_timer(>tx_t, sp_xmit_on_air, (unsigned long)sp);
+   timer_setup(>tx_t, sp_xmit_on_air, 0);
 
-   init_timer(>resync_t);
+   timer_setup(>resync_t, resync_tnc, 0);
 
spin_unlock_bh(>lock);
 
@@ -926,8 +922,6 @@ static void decode_prio_command(struct sixpack *sp, 
unsigned char cmd)
 
if (sp->tnc_state == TNC_IN_SYNC) {
del_timer(>resync_t);
-   sp->resync_t.data   = (unsigned long) sp;
-   sp->resync_t.function   = resync_tnc;
sp->resync_t.expires= jiffies + SIXP_INIT_RESYNC_TIMEOUT;
add_timer(>resync_t);
}
-- 
2.7.4

[PATCH 05/58] net/irda/bfin_sir: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Samuel Ortiz 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/staging/irda/drivers/bfin_sir.c | 12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/irda/drivers/bfin_sir.c 
b/drivers/staging/irda/drivers/bfin_sir.c
index 3151b580dbd6..59e409b68349 100644
--- a/drivers/staging/irda/drivers/bfin_sir.c
+++ b/drivers/staging/irda/drivers/bfin_sir.c
@@ -22,6 +22,8 @@ static int max_rate = 57600;
 static int max_rate = 115200;
 #endif
 
+static void bfin_sir_rx_dma_timeout(struct timer_list *t);
+
 static void turnaround_delay(int mtt)
 {
long ticks;
@@ -57,7 +59,7 @@ static void bfin_sir_init_ports(struct bfin_sir_port *sp, 
struct platform_device
sp->clk = get_sclk();
 #ifdef CONFIG_SIR_BFIN_DMA
sp->tx_done= 1;
-   init_timer(&(sp->rx_dma_timer));
+   timer_setup(>rx_dma_timer, bfin_sir_rx_dma_timeout, 0);
 #endif
 }
 
@@ -317,10 +319,12 @@ static void bfin_sir_dma_rx_chars(struct net_device *dev)
async_unwrap_char(dev, >stats, >rx_buff, 
port->rx_dma_buf.buf[i]);
 }
 
-void bfin_sir_rx_dma_timeout(struct net_device *dev)
+static void bfin_sir_rx_dma_timeout(struct timer_list *t)
 {
+   struct bfin_sir_port *port = from_timer(port, t, rx_dma_timer);
+   struct net_device *dev = port->dev;
struct bfin_sir_self *self = netdev_priv(dev);
-   struct bfin_sir_port *port = self->sir_port;
+
int x_pos, pos;
unsigned long flags;
 
@@ -405,8 +409,6 @@ static int bfin_sir_startup(struct bfin_sir_port *port, 
struct net_device *dev)
set_dma_start_addr(port->rx_dma_channel, (unsigned 
long)port->rx_dma_buf.buf);
enable_dma(port->rx_dma_channel);
 
-   port->rx_dma_timer.data = (unsigned long)(dev);
-   port->rx_dma_timer.function = (void *)bfin_sir_rx_dma_timeout;
 
 #else
 
-- 
2.7.4

[PATCH 12/58] xfrm: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
helper to pass the timer pointer explicitly.

Cc: Steffen Klassert 
Cc: Herbert Xu 
Cc: "David S. Miller" 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/xfrm/xfrm_policy.c | 17 -
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 2746b62a8944..b669c624a1ec 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -57,7 +57,7 @@ static __read_mostly seqcount_t xfrm_policy_hash_generation;
 static void xfrm_init_pmtu(struct dst_entry *dst);
 static int stale_bundle(struct dst_entry *dst);
 static int xfrm_bundle_ok(struct xfrm_dst *xdst);
-static void xfrm_policy_queue_process(unsigned long arg);
+static void xfrm_policy_queue_process(struct timer_list *t);
 
 static void __xfrm_policy_link(struct xfrm_policy *pol, int dir);
 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
@@ -179,9 +179,9 @@ static inline unsigned long make_jiffies(long secs)
return secs*HZ;
 }
 
-static void xfrm_policy_timer(unsigned long data)
+static void xfrm_policy_timer(struct timer_list *t)
 {
-   struct xfrm_policy *xp = (struct xfrm_policy *)data;
+   struct xfrm_policy *xp = from_timer(xp, t, timer);
unsigned long now = get_seconds();
long next = LONG_MAX;
int warn = 0;
@@ -267,10 +267,9 @@ struct xfrm_policy *xfrm_policy_alloc(struct net *net, 
gfp_t gfp)
rwlock_init(>lock);
refcount_set(>refcnt, 1);
skb_queue_head_init(>polq.hold_queue);
-   setup_timer(>timer, xfrm_policy_timer,
-   (unsigned long)policy);
-   setup_timer(>polq.hold_timer, xfrm_policy_queue_process,
-   (unsigned long)policy);
+   timer_setup(>timer, xfrm_policy_timer, 0);
+   timer_setup(>polq.hold_timer,
+   xfrm_policy_queue_process, 0);
}
return policy;
 }
@@ -1852,12 +1851,12 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy 
**pols, int num_pols,
return xdst;
 }
 
-static void xfrm_policy_queue_process(unsigned long arg)
+static void xfrm_policy_queue_process(struct timer_list *t)
 {
struct sk_buff *skb;
struct sock *sk;
struct dst_entry *dst;
-   struct xfrm_policy *pol = (struct xfrm_policy *)arg;
+   struct xfrm_policy *pol = from_timer(pol, t, polq.hold_timer);
struct net *net = xp_net(pol);
struct xfrm_policy_queue *pq = >polq;
struct flowi fl;
-- 
2.7.4

[PATCH 09/58] net/irda: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Samuel Ortiz 
Cc: "David S. Miller" 
Cc: Stephen Hemminger 
Cc: Johannes Berg 
Cc: Ingo Molnar 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 .../staging/irda/include/net/irda/irlmp_event.h|  6 +--
 drivers/staging/irda/include/net/irda/timer.h  | 11 ++---
 drivers/staging/irda/net/af_irda.c |  7 ++-
 drivers/staging/irda/net/ircomm/ircomm_tty.c   |  2 +-
 .../staging/irda/net/ircomm/ircomm_tty_attach.c|  8 ++--
 drivers/staging/irda/net/irda_device.c | 10 ++--
 drivers/staging/irda/net/iriap.c   | 10 ++--
 drivers/staging/irda/net/irlan/irlan_client.c  |  6 +--
 drivers/staging/irda/net/irlan/irlan_common.c  |  4 +-
 drivers/staging/irda/net/irlap.c   | 16 +++
 drivers/staging/irda/net/irlap_event.c |  6 +--
 drivers/staging/irda/net/irlmp.c   |  8 ++--
 drivers/staging/irda/net/irlmp_event.c | 10 ++--
 drivers/staging/irda/net/irttp.c   | 11 ++---
 drivers/staging/irda/net/timer.c   | 54 +++---
 15 files changed, 79 insertions(+), 90 deletions(-)

diff --git a/drivers/staging/irda/include/net/irda/irlmp_event.h 
b/drivers/staging/irda/include/net/irda/irlmp_event.h
index 9e4ec17a7449..a1a082fe384e 100644
--- a/drivers/staging/irda/include/net/irda/irlmp_event.h
+++ b/drivers/staging/irda/include/net/irda/irlmp_event.h
@@ -82,9 +82,9 @@ typedef enum {
 extern const char *const irlmp_state[];
 extern const char *const irlsap_state[];
 
-void irlmp_watchdog_timer_expired(void *data);
-void irlmp_discovery_timer_expired(void *data);
-void irlmp_idle_timer_expired(void *data);
+void irlmp_watchdog_timer_expired(struct timer_list *t);
+void irlmp_discovery_timer_expired(struct timer_list *t);
+void irlmp_idle_timer_expired(struct timer_list *t);
 
 void irlmp_do_lap_event(struct lap_cb *self, IRLMP_EVENT event, 
struct sk_buff *skb);
diff --git a/drivers/staging/irda/include/net/irda/timer.h 
b/drivers/staging/irda/include/net/irda/timer.h
index d784f242cf7b..a6635f0afae9 100644
--- a/drivers/staging/irda/include/net/irda/timer.h
+++ b/drivers/staging/irda/include/net/irda/timer.h
@@ -72,14 +72,11 @@ struct lap_cb;
 
 #define WATCHDOG_TIMEOUT(20*HZ)   /* 20 sec */
 
-typedef void (*TIMER_CALLBACK)(void *);
-
-static inline void irda_start_timer(struct timer_list *ptimer, int timeout, 
-   void* data, TIMER_CALLBACK callback)
+static inline void irda_start_timer(struct timer_list *ptimer, int timeout,
+   void (*callback)(struct timer_list *))
 {
-   ptimer->function = (void (*)(unsigned long)) callback;
-   ptimer->data = (unsigned long) data;
-   
+   ptimer->function = (TIMER_FUNC_TYPE) callback;
+
/* Set new value for timer (update or add timer).
 * We use mod_timer() because it's more efficient and also
 * safer with respect to race conditions - Jean II */
diff --git a/drivers/staging/irda/net/af_irda.c 
b/drivers/staging/irda/net/af_irda.c
index 23fa7c8b09a5..b82a47b9ef0b 100644
--- a/drivers/staging/irda/net/af_irda.c
+++ b/drivers/staging/irda/net/af_irda.c
@@ -429,11 +429,11 @@ static void 
irda_selective_discovery_indication(discinfo_t *discovery,
  * We were waiting for a node to be discovered, but nothing has come up
  * so far. Wake up the user and tell him that we failed...
  */
-static void irda_discovery_timeout(u_long priv)
+static void irda_discovery_timeout(struct timer_list *t)
 {
struct irda_sock *self;
 
-   self = (struct irda_sock *) priv;
+   self = from_timer(self, t, watchdog);
BUG_ON(self == NULL);
 
/* Nothing for the caller */
@@ -2505,8 +2505,7 @@ static int irda_getsockopt(struct socket *sock, int 
level, int optname,
 
/* Set watchdog timer to expire in  ms. */
self->errno = 0;
-   setup_timer(>watchdog, irda_discovery_timeout,
-   (unsigned long)self);
+   timer_setup(>watchdog, irda_discovery_timeout, 0);
mod_timer(>watchdog,
  jiffies + msecs_to_jiffies(val));
 
diff --git a/drivers/staging/irda/net/ircomm/ircomm_tty.c 
b/drivers/staging/irda/net/ircomm/ircomm_tty.c
index ec157c3419b5..473abfaffe7b 100644
--- a/drivers/staging/irda/net/ircomm/ircomm_tty.c
+++ b/drivers/staging/irda/net/ircomm/ircomm_tty.c
@@ -395,7 +395,7 @@ static int ircomm_tty_install(struct tty_driver *driver, 
struct tty_struct *tty)

[PATCH 13/58] ethernet/broadcom: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
helper to pass the timer pointer explicitly.

Cc: Florian Fainelli 
Cc: bcm-kernel-feedback-l...@broadcom.com
Cc: "David S. Miller" 
Cc: Arnd Bergmann 
Cc: Jarod Wilson 
Cc: netdev@vger.kernel.org
Cc: linux-arm-ker...@lists.infradead.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/broadcom/bcm63xx_enet.c | 24 +---
 1 file changed, 9 insertions(+), 15 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c 
b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index f6bc13fe8a99..d9346e2ac720 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -295,16 +295,13 @@ static int bcm_enet_refill_rx(struct net_device *dev)
 /*
  * timer callback to defer refill rx queue in case we're OOM
  */
-static void bcm_enet_refill_rx_timer(unsigned long data)
+static void bcm_enet_refill_rx_timer(struct timer_list *t)
 {
-   struct net_device *dev;
-   struct bcm_enet_priv *priv;
-
-   dev = (struct net_device *)data;
-   priv = netdev_priv(dev);
+   struct bcm_enet_priv *priv = from_timer(priv, t, rx_timeout);
+   struct net_device *dev = priv->net_dev;
 
spin_lock(>rx_lock);
-   bcm_enet_refill_rx((struct net_device *)data);
+   bcm_enet_refill_rx(dev);
spin_unlock(>rx_lock);
 }
 
@@ -1860,8 +1857,7 @@ static int bcm_enet_probe(struct platform_device *pdev)
spin_lock_init(>rx_lock);
 
/* init rx timeout (used for oom) */
-   setup_timer(>rx_timeout, bcm_enet_refill_rx_timer,
-   (unsigned long)dev);
+   timer_setup(>rx_timeout, bcm_enet_refill_rx_timer, 0);
 
/* init the mib update lock */
mutex_init(>mib_update_lock);
@@ -2015,9 +2011,9 @@ static inline int bcm_enet_port_is_rgmii(int portid)
 /*
  * enet sw PHY polling
  */
-static void swphy_poll_timer(unsigned long data)
+static void swphy_poll_timer(struct timer_list *t)
 {
-   struct bcm_enet_priv *priv = (struct bcm_enet_priv *)data;
+   struct bcm_enet_priv *priv = from_timer(priv, t, swphy_poll);
unsigned int i;
 
for (i = 0; i < priv->num_ports; i++) {
@@ -2326,7 +2322,7 @@ static int bcm_enetsw_open(struct net_device *dev)
}
 
/* start phy polling timer */
-   setup_timer(>swphy_poll, swphy_poll_timer, (unsigned long)priv);
+   timer_setup(>swphy_poll, swphy_poll_timer, 0);
mod_timer(>swphy_poll, jiffies);
return 0;
 
@@ -2743,9 +2739,7 @@ static int bcm_enetsw_probe(struct platform_device *pdev)
spin_lock_init(>rx_lock);
 
/* init rx timeout (used for oom) */
-   init_timer(>rx_timeout);
-   priv->rx_timeout.function = bcm_enet_refill_rx_timer;
-   priv->rx_timeout.data = (unsigned long)dev;
+   timer_setup(>rx_timeout, bcm_enet_refill_rx_timer, 0);
 
/* register netdevice */
dev->netdev_ops = _enetsw_ops;
-- 
2.7.4

[PATCH 08/58] net/wireless/ray_cs: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Kalle Valo 
Cc: linux-wirel...@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/wireless/ray_cs.c | 53 ---
 1 file changed, 24 insertions(+), 29 deletions(-)

diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 170cd504e8ff..d8afcdfca1ed 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -92,7 +92,7 @@ static const struct iw_handler_def ray_handler_def;
 /* Prototypes for raylink functions **/
 static void authenticate(ray_dev_t *local);
 static int build_auth_frame(ray_dev_t *local, UCHAR *dest, int auth_type);
-static void authenticate_timeout(u_long);
+static void authenticate_timeout(struct timer_list *t);
 static int get_free_ccs(ray_dev_t *local);
 static int get_free_tx_ccs(ray_dev_t *local);
 static void init_startup_params(ray_dev_t *local);
@@ -102,7 +102,7 @@ static int ray_init(struct net_device *dev);
 static int interrupt_ecf(ray_dev_t *local, int ccs);
 static void ray_reset(struct net_device *dev);
 static void ray_update_parm(struct net_device *dev, UCHAR objid, UCHAR *value, 
int len);
-static void verify_dl_startup(u_long);
+static void verify_dl_startup(struct timer_list *t);
 
 /* Prototypes for interrpt time functions **/
 static irqreturn_t ray_interrupt(int reg, void *dev_id);
@@ -120,9 +120,8 @@ static void associate(ray_dev_t *local);
 
 /* Card command functions */
 static int dl_startup_params(struct net_device *dev);
-static void join_net(u_long local);
-static void start_net(u_long local);
-/* void start_net(ray_dev_t *local); */
+static void join_net(struct timer_list *t);
+static void start_net(struct timer_list *t);
 
 /*===*/
 /* Parameters that can be set with 'insmod' */
@@ -323,7 +322,7 @@ static int ray_probe(struct pcmcia_device *p_dev)
dev_dbg(_dev->dev, "ray_cs ray_attach calling ether_setup.)\n");
netif_stop_queue(dev);
 
-   init_timer(>timer);
+   timer_setup(>timer, NULL, 0);
 
this_device = p_dev;
return ray_config(p_dev);
@@ -570,8 +569,7 @@ static int dl_startup_params(struct net_device *dev)
local->card_status = CARD_DL_PARAM;
/* Start kernel timer to wait for dl startup to complete. */
local->timer.expires = jiffies + HZ / 2;
-   local->timer.data = (long)local;
-   local->timer.function = verify_dl_startup;
+   local->timer.function = (TIMER_FUNC_TYPE)verify_dl_startup;
add_timer(>timer);
dev_dbg(>dev,
  "ray_cs dl_startup_params started timer for verify_dl_startup\n");
@@ -641,9 +639,9 @@ static void init_startup_params(ray_dev_t *local)
 } /* init_startup_params */
 
 /*===*/
-static void verify_dl_startup(u_long data)
+static void verify_dl_startup(struct timer_list *t)
 {
-   ray_dev_t *local = (ray_dev_t *) data;
+   ray_dev_t *local = from_timer(local, t, timer);
struct ccs __iomem *pccs = ccs_base(local) + local->dl_param_ccs;
UCHAR status;
struct pcmcia_device *link = local->finder;
@@ -676,16 +674,16 @@ static void verify_dl_startup(u_long data)
return;
}
if (local->sparm.b4.a_network_type == ADHOC)
-   start_net((u_long) local);
+   start_net(>timer);
else
-   join_net((u_long) local);
+   join_net(>timer);
 } /* end verify_dl_startup */
 
 /*===*/
 /* Command card to start a network */
-static void start_net(u_long data)
+static void start_net(struct timer_list *t)
 {
-   ray_dev_t *local = (ray_dev_t *) data;
+   ray_dev_t *local = from_timer(local, t, timer);
struct ccs __iomem *pccs;
int ccsindex;
struct pcmcia_device *link = local->finder;
@@ -710,9 +708,9 @@ static void start_net(u_long data)
 
 /*===*/
 /* Command card to join a network */
-static void join_net(u_long data)
+static void join_net(struct timer_list *t)
 {
-   ray_dev_t *local = (ray_dev_t *) data;
+   ray_dev_t *local = from_timer(local, t, timer);
 
struct ccs __iomem *pccs;
int ccsindex;
@@ -1639,13 +1637,13 @@ static int get_free_ccs(ray_dev_t *local)
 } /* get_free_ccs */
 
 /*===*/
-static void authenticate_timeout(u_long data)
+static void authenticate_timeout(struct timer_list *t)
 {
-   

[PATCH 14/58] net: tulip: de2104x: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: "yuval.sh...@oracle.com" 
Cc: Tobias Klauser 
Cc: Jarod Wilson 
Cc: Philippe Reynes 
Cc: netdev@vger.kernel.org
Cc: linux-par...@vger.kernel.org
Signed-off-by: Kees Cook 
Reviewed-by: Tobias Klauser 
---
 drivers/net/ethernet/dec/tulip/de2104x.c | 21 +
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c 
b/drivers/net/ethernet/dec/tulip/de2104x.c
index c87b8cc42963..13430f75496c 100644
--- a/drivers/net/ethernet/dec/tulip/de2104x.c
+++ b/drivers/net/ethernet/dec/tulip/de2104x.c
@@ -333,8 +333,8 @@ static void de_set_rx_mode (struct net_device *dev);
 static void de_tx (struct de_private *de);
 static void de_clean_rings (struct de_private *de);
 static void de_media_interrupt (struct de_private *de, u32 status);
-static void de21040_media_timer (unsigned long data);
-static void de21041_media_timer (unsigned long data);
+static void de21040_media_timer (struct timer_list *t);
+static void de21041_media_timer (struct timer_list *t);
 static unsigned int de_ok_to_advertise (struct de_private *de, u32 new_media);
 
 
@@ -959,9 +959,9 @@ static void de_next_media (struct de_private *de, const u32 
*media,
}
 }
 
-static void de21040_media_timer (unsigned long data)
+static void de21040_media_timer (struct timer_list *t)
 {
-   struct de_private *de = (struct de_private *) data;
+   struct de_private *de = from_timer(de, t, media_timer);
struct net_device *dev = de->dev;
u32 status = dr32(SIAStatus);
unsigned int carrier;
@@ -1040,9 +1040,9 @@ static unsigned int de_ok_to_advertise (struct de_private 
*de, u32 new_media)
return 1;
 }
 
-static void de21041_media_timer (unsigned long data)
+static void de21041_media_timer (struct timer_list *t)
 {
-   struct de_private *de = (struct de_private *) data;
+   struct de_private *de = from_timer(de, t, media_timer);
struct net_device *dev = de->dev;
u32 status = dr32(SIAStatus);
unsigned int carrier;
@@ -1999,12 +1999,9 @@ static int de_init_one(struct pci_dev *pdev, const 
struct pci_device_id *ent)
de->msg_enable = (debug < 0 ? DE_DEF_MSG_ENABLE : debug);
de->board_idx = board_idx;
spin_lock_init (>lock);
-   init_timer(>media_timer);
-   if (de->de21040)
-   de->media_timer.function = de21040_media_timer;
-   else
-   de->media_timer.function = de21041_media_timer;
-   de->media_timer.data = (unsigned long) de;
+   timer_setup(>media_timer,
+   de->de21040 ? de21040_media_timer : de21041_media_timer,
+   0);
 
netif_carrier_off(dev);
 
-- 
2.7.4

[PATCH 06/58] net/ti/tlan: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Samuel Chessman 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/ti/tlan.c | 32 +---
 1 file changed, 13 insertions(+), 19 deletions(-)

diff --git a/drivers/net/ethernet/ti/tlan.c b/drivers/net/ethernet/ti/tlan.c
index c8d53d8c83ee..8f53d762fbc4 100644
--- a/drivers/net/ethernet/ti/tlan.c
+++ b/drivers/net/ethernet/ti/tlan.c
@@ -172,7 +172,8 @@ static u32  tlan_handle_tx_eoc(struct net_device *, u16);
 static u32 tlan_handle_status_check(struct net_device *, u16);
 static u32 tlan_handle_rx_eoc(struct net_device *, u16);
 
-static voidtlan_timer(unsigned long);
+static voidtlan_timer(struct timer_list *t);
+static voidtlan_phy_monitor(struct timer_list *t);
 
 static voidtlan_reset_lists(struct net_device *);
 static voidtlan_free_lists(struct net_device *);
@@ -190,7 +191,6 @@ static void tlan_phy_power_up(struct net_device *);
 static voidtlan_phy_reset(struct net_device *);
 static voidtlan_phy_start_link(struct net_device *);
 static voidtlan_phy_finish_auto_neg(struct net_device *);
-static void tlan_phy_monitor(unsigned long);
 
 /*
   static int   tlan_phy_nop(struct net_device *);
@@ -254,11 +254,10 @@ tlan_set_timer(struct net_device *dev, u32 ticks, u32 
type)
spin_unlock_irqrestore(>lock, flags);
return;
}
-   priv->timer.function = tlan_timer;
+   priv->timer.function = (TIMER_FUNC_TYPE)tlan_timer;
if (!in_irq())
spin_unlock_irqrestore(>lock, flags);
 
-   priv->timer.data = (unsigned long) dev;
priv->timer_set_at = jiffies;
priv->timer_type = type;
mod_timer(>timer, jiffies + ticks);
@@ -926,8 +925,8 @@ static int tlan_open(struct net_device *dev)
return err;
}
 
-   init_timer(>timer);
-   init_timer(>media_timer);
+   timer_setup(>timer, NULL, 0);
+   timer_setup(>media_timer, tlan_phy_monitor, 0);
 
tlan_start(dev);
 
@@ -1426,8 +1425,7 @@ static u32 tlan_handle_tx_eof(struct net_device *dev, u16 
host_int)
tlan_dio_write8(dev->base_addr,
TLAN_LED_REG, TLAN_LED_LINK | TLAN_LED_ACT);
if (priv->timer.function == NULL) {
-   priv->timer.function = tlan_timer;
-   priv->timer.data = (unsigned long) dev;
+   priv->timer.function = (TIMER_FUNC_TYPE)tlan_timer;
priv->timer.expires = jiffies + TLAN_TIMER_ACT_DELAY;
priv->timer_set_at = jiffies;
priv->timer_type = TLAN_TIMER_ACTIVITY;
@@ -1578,8 +1576,7 @@ static u32 tlan_handle_rx_eof(struct net_device *dev, u16 
host_int)
tlan_dio_write8(dev->base_addr,
TLAN_LED_REG, TLAN_LED_LINK | TLAN_LED_ACT);
if (priv->timer.function == NULL)  {
-   priv->timer.function = tlan_timer;
-   priv->timer.data = (unsigned long) dev;
+   priv->timer.function = (TIMER_FUNC_TYPE)tlan_timer;
priv->timer.expires = jiffies + TLAN_TIMER_ACT_DELAY;
priv->timer_set_at = jiffies;
priv->timer_type = TLAN_TIMER_ACTIVITY;
@@ -1836,10 +1833,10 @@ ThunderLAN driver timer function
  *
  **/
 
-static void tlan_timer(unsigned long data)
+static void tlan_timer(struct timer_list *t)
 {
-   struct net_device   *dev = (struct net_device *) data;
-   struct tlan_priv*priv = netdev_priv(dev);
+   struct tlan_priv*priv = from_timer(priv, t, timer);
+   struct net_device   *dev = priv->dev;
u32 elapsed;
unsigned long   flags = 0;
 
@@ -1872,7 +1869,6 @@ static void tlan_timer(unsigned long data)
tlan_dio_write8(dev->base_addr,
TLAN_LED_REG, TLAN_LED_LINK);
} else  {
-   priv->timer.function = tlan_timer;
priv->timer.expires = priv->timer_set_at
+ TLAN_TIMER_ACT_DELAY;
spin_unlock_irqrestore(>lock, flags);
@@ -2317,8 +2313,6 @@ tlan_finish_reset(struct net_device *dev)
} else
netdev_info(dev, "Link active\n");
/* Enabling link beat monitoring */
-   priv->media_timer.function = tlan_phy_monitor;
-   priv->media_timer.data = (unsigned long) 

[PATCH 15/58] pcmcia/electra_cf: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Michael Ellerman 
Cc: linux-pcm...@lists.infradead.org
Signed-off-by: Kees Cook 
---
 drivers/pcmcia/electra_cf.c | 12 +++-
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/pcmcia/electra_cf.c b/drivers/pcmcia/electra_cf.c
index c6fe2a4a7a6a..9671ded549f0 100644
--- a/drivers/pcmcia/electra_cf.c
+++ b/drivers/pcmcia/electra_cf.c
@@ -79,9 +79,9 @@ static int electra_cf_ss_init(struct pcmcia_socket *s)
 }
 
 /* the timer is primarily to kick this socket's pccardd */
-static void electra_cf_timer(unsigned long _cf)
+static void electra_cf_timer(struct timer_list *t)
 {
-   struct electra_cf_socket *cf = (void *) _cf;
+   struct electra_cf_socket *cf = from_timer(cf, t, timer);
int present = electra_cf_present(cf);
 
if (present != cf->present) {
@@ -95,7 +95,9 @@ static void electra_cf_timer(unsigned long _cf)
 
 static irqreturn_t electra_cf_irq(int irq, void *_cf)
 {
-   electra_cf_timer((unsigned long)_cf);
+   struct electra_cf_socket *cf = _cf;
+
+   electra_cf_timer(>timer);
return IRQ_HANDLED;
 }
 
@@ -206,7 +208,7 @@ static int electra_cf_probe(struct platform_device *ofdev)
if (!cf)
return -ENOMEM;
 
-   setup_timer(>timer, electra_cf_timer, (unsigned long)cf);
+   timer_setup(>timer, electra_cf_timer, 0);
cf->irq = 0;
 
cf->ofdev = ofdev;
@@ -305,7 +307,7 @@ static int electra_cf_probe(struct platform_device *ofdev)
 cf->mem_phys, io.start, cf->irq);
 
cf->active = 1;
-   electra_cf_timer((unsigned long)cf);
+   electra_cf_timer(>timer);
return 0;
 
 fail3:
-- 
2.7.4

[PATCH 07/58] net/usb/usbnet: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. Since the callback is called from
both a timer and a tasklet, adjust the tasklet to pass the timer address
too. When tasklets have their .data field removed, this can be refactored
to call a central function after resolving the correct container_of() for a
separate callback function for timer and tasklet.

Cc: Oliver Neukum 
Cc: netdev@vger.kernel.org
Cc: linux-...@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/usb/usbnet.c | 12 +---
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 6510e5cc1817..80348b6a8646 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1509,9 +1509,9 @@ static int rx_alloc_submit(struct usbnet *dev, gfp_t 
flags)
 
 // tasklet (work deferred from completions, in_irq) or timer
 
-static void usbnet_bh (unsigned long param)
+static void usbnet_bh (struct timer_list *t)
 {
-   struct usbnet   *dev = (struct usbnet *) param;
+   struct usbnet   *dev = from_timer(dev, t, delay);
struct sk_buff  *skb;
struct skb_data *entry;
 
@@ -1694,13 +1694,11 @@ usbnet_probe (struct usb_interface *udev, const struct 
usb_device_id *prod)
skb_queue_head_init (>txq);
skb_queue_head_init (>done);
skb_queue_head_init(>rxq_pause);
-   dev->bh.func = usbnet_bh;
-   dev->bh.data = (unsigned long) dev;
+   dev->bh.func = (void (*)(unsigned long))usbnet_bh;
+   dev->bh.data = (unsigned long)>delay;
INIT_WORK (>kevent, usbnet_deferred_kevent);
init_usb_anchor(>deferred);
-   dev->delay.function = usbnet_bh;
-   dev->delay.data = (unsigned long) dev;
-   init_timer (>delay);
+   timer_setup(>delay, usbnet_bh, 0);
mutex_init (>phy_mutex);
mutex_init(>interrupt_mutex);
dev->interrupt_count = 0;
-- 
2.7.4

Re: RFC(v2): Audit Kernel Container IDs

[Richard Guy Briggs]

On 2017-10-12 16:33, Casey Schaufler wrote:
> On 10/12/2017 7:14 AM, Richard Guy Briggs wrote:
> > Containers are a userspace concept.  The kernel knows nothing of them.
> >
> > The Linux audit system needs a way to be able to track the container
> > provenance of events and actions.  Audit needs the kernel's help to do
> > this.
> >
> > Since the concept of a container is entirely a userspace concept, a
> > registration from the userspace container orchestration system initiates
> > this.  This will define a point in time and a set of resources
> > associated with a particular container with an audit container ID.
> >
> > The registration is a pseudo filesystem (proc, since PID tree already
> > exists) write of a u8[16] UUID representing the container ID to a file
> > representing a process that will become the first process in a new
> > container.  This write might place restrictions on mount namespaces
> > required to define a container, or at least careful checking of
> > namespaces in the kernel to verify permissions of the orchestrator so it
> > can't change its own container ID.  A bind mount of nsfs may be
> > necessary in the container orchestrator's mntNS.
> > Note: Use a 128-bit scalar rather than a string to make compares faster
> > and simpler.
> >
> > Require a new CAP_CONTAINER_ADMIN to be able to carry out the
> > registration.
> 
> Hang on. If containers are a user space concept, how can
> you want CAP_CONTAINER_ANYTHING? If there's not such thing as
> a container, how can you be asking for a capability to manage
> them?

There is such a thing, but the kernel doesn't know about it yet.  This
same situation exists for loginuid and sessionid which are userspace
concepts that the kernel tracks for the convenience of userspace.  As
for its name, I'm not particularly picky, so if you don't like
CAP_CONTAINER_* then I'm fine with CAP_AUDIT_CONTAINERID.  It really
needs to be distinct from CAP_AUDIT_WRITE and CAP_AUDIT_CONTROL since we
don't want to give the ability to set a containerID to any process that
is able to do audit logging (such as vsftpd) and similarly we don't want
to give the orchestrator the ability to control the setup of the audit
daemon.
> 
> >   At that time, record the target container's user-supplied
> > container identifier along with the target container's first process
> > (which may become the target container's "init" process) process ID
> > (referenced from the initial PID namespace), all namespace IDs (in the
> > form of a nsfs device number and inode number tuple) in a new auxilliary
> > record AUDIT_CONTAINER with a qualifying op=$action field.
> >
> > Issue a new auxilliary record AUDIT_CONTAINER_INFO for each valid
> > container ID present on an auditable action or event.
> >
> > Forked and cloned processes inherit their parent's container ID,
> > referenced in the process' task_struct.
> >
> > Mimic setns(2) and return an error if the process has already initiated
> > threading or forked since this registration should happen before the
> > process execution is started by the orchestrator and hence should not
> > yet have any threads or children.  If this is deemed overly restrictive,
> > switch all threads and children to the new containerID.
> >
> > Trust the orchestrator to judiciously use and restrict CAP_CONTAINER_ADMIN.
> >
> > Log the creation of every namespace, inheriting/adding its spawning
> > process' containerID(s), if applicable.  Include the spawning and
> > spawned namespace IDs (device and inode number tuples).
> > [AUDIT_NS_CREATE, AUDIT_NS_DESTROY] [clone(2), unshare(2), setns(2)]
> > Note: At this point it appears only network namespaces may need to track
> > container IDs apart from processes since incoming packets may cause an
> > auditable event before being associated with a process.
> >
> > Log the destruction of every namespace when it is no longer used by any
> > process, include the namespace IDs (device and inode number tuples).
> > [AUDIT_NS_DESTROY] [process exit, unshare(2), setns(2)]
> >
> > Issue a new auxilliary record AUDIT_NS_CHANGE listing (opt: op=$action)
> > the parent and child namespace IDs for any changes to a process'
> > namespaces. [setns(2)]
> > Note: It may be possible to combine AUDIT_NS_* record formats and
> > distinguish them with an op=$action field depending on the fields
> > required for each message type.
> >
> > When a container ceases to exist because the last process in that
> > container has exited and hence the last namespace has been destroyed and
> > its refcount dropping to zero, log the fact.
> > (This latter is likely needed for certification accountability.)  A
> > container object may need a list of processes and/or namespaces.
> >
> > A namespace cannot directly migrate from one container to another but
> > could be assigned to a newly spawned container.  A namespace can be
> > moved from one container to another indirectly by having that namespace
> > used in a second process in another 

[PATCH 20/58] atm: idt77252: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. This required adding a pointer back
to vc_map, and adjusting the locking around removal a bit.

Cc: Chas Williams <3ch...@gmail.com>
Cc: linux-atm-gene...@lists.sourceforge.net
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/atm/idt77252.c | 21 -
 drivers/atm/idt77252.h |  3 +++
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index 47f3c4ae0594..0e3b9c44c808 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -2073,21 +2073,19 @@ idt77252_rate_logindex(struct idt77252_dev *card, int 
pcr)
 }
 
 static void
-idt77252_est_timer(unsigned long data)
+idt77252_est_timer(struct timer_list *t)
 {
-   struct vc_map *vc = (struct vc_map *)data;
+   struct rate_estimator *est = from_timer(est, t, timer);
+   struct vc_map *vc = est->vc;
struct idt77252_dev *card = vc->card;
-   struct rate_estimator *est;
unsigned long flags;
u32 rate, cps;
u64 ncells;
u8 lacr;
 
spin_lock_irqsave(>lock, flags);
-   est = vc->estimator;
-   if (!est)
+   if (!vc->estimator)
goto out;
-
ncells = est->cells;
 
rate = ((u32)(ncells - est->last_cells)) << (7 - est->interval);
@@ -2126,10 +2124,11 @@ idt77252_init_est(struct vc_map *vc, int pcr)
est->maxcps = pcr < 0 ? -pcr : pcr;
est->cps = est->maxcps;
est->avcps = est->cps << 5;
+   est->vc = vc;
 
est->interval = 2;  /* XXX: make this configurable */
est->ewma_log = 2;  /* XXX: make this configurable */
-   setup_timer(>timer, idt77252_est_timer, (unsigned long)vc);
+   timer_setup(>timer, idt77252_est_timer, 0);
mod_timer(>timer, jiffies + ((HZ / 4) << est->interval));
 
return est;
@@ -2209,16 +2208,20 @@ static int
 idt77252_init_ubr(struct idt77252_dev *card, struct vc_map *vc,
  struct atm_vcc *vcc, struct atm_qos *qos)
 {
+   struct rate_estimator *est = NULL;
unsigned long flags;
int tcr;
 
spin_lock_irqsave(>lock, flags);
if (vc->estimator) {
-   del_timer(>estimator->timer);
-   kfree(vc->estimator);
+   est = vc->estimator;
vc->estimator = NULL;
}
spin_unlock_irqrestore(>lock, flags);
+   if (est) {
+   del_timer_sync(>timer);
+   kfree(est);
+   }
 
tcr = atm_pcr_goal(>txtp);
if (tcr == 0)
diff --git a/drivers/atm/idt77252.h b/drivers/atm/idt77252.h
index 3a82cc23a053..9339197d701c 100644
--- a/drivers/atm/idt77252.h
+++ b/drivers/atm/idt77252.h
@@ -184,6 +184,8 @@ struct aal1 {
unsigned char   sequence;
 };
 
+struct vc_map;
+
 struct rate_estimator {
struct timer_list   timer;
unsigned intinterval;
@@ -193,6 +195,7 @@ struct rate_estimator {
longavcps;
u32 cps;
u32 maxcps;
+   struct vc_map   *vc;
 };
 
 struct vc_map {
-- 
2.7.4

[PATCH 23/58] drivers/net/3com: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Steffen Klassert 
Cc: "David S. Miller" 
Cc: Jarod Wilson 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/3com/3c574_cs.c | 12 +---
 drivers/net/ethernet/3com/3c589_cs.c | 10 +-
 drivers/net/ethernet/3com/3c59x.c| 20 ++--
 3 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/drivers/net/ethernet/3com/3c574_cs.c 
b/drivers/net/ethernet/3com/3c574_cs.c
index 47c844cc9d27..48bc7fa0258c 100644
--- a/drivers/net/ethernet/3com/3c574_cs.c
+++ b/drivers/net/ethernet/3com/3c574_cs.c
@@ -225,7 +225,7 @@ static unsigned short read_eeprom(unsigned int ioaddr, int 
index);
 static void tc574_wait_for_completion(struct net_device *dev, int cmd);
 
 static void tc574_reset(struct net_device *dev);
-static void media_check(unsigned long arg);
+static void media_check(struct timer_list *t);
 static int el3_open(struct net_device *dev);
 static netdev_tx_t el3_start_xmit(struct sk_buff *skb,
struct net_device *dev);
@@ -377,7 +377,7 @@ static int tc574_config(struct pcmcia_device *link)
lp->autoselect = config & Autoselect ? 1 : 0;
}
 
-   init_timer(>media);
+   timer_setup(>media, media_check, 0);
 
{
int phy;
@@ -681,8 +681,6 @@ static int el3_open(struct net_device *dev)
netif_start_queue(dev);

tc574_reset(dev);
-   lp->media.function = media_check;
-   lp->media.data = (unsigned long) dev;
lp->media.expires = jiffies + HZ;
add_timer(>media);

@@ -859,10 +857,10 @@ static irqreturn_t el3_interrupt(int irq, void *dev_id)
(and as a last resort, poll the NIC for events), and to monitor
the MII, reporting changes in cable status.
 */
-static void media_check(unsigned long arg)
+static void media_check(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *) arg;
-   struct el3_private *lp = netdev_priv(dev);
+   struct el3_private *lp = from_timer(lp, t, media);
+   struct net_device *dev = lp->p_dev->priv;
unsigned int ioaddr = dev->base_addr;
unsigned long flags;
unsigned short /* cable, */ media, partner;
diff --git a/drivers/net/ethernet/3com/3c589_cs.c 
b/drivers/net/ethernet/3com/3c589_cs.c
index e28254a00599..2b2695311bda 100644
--- a/drivers/net/ethernet/3com/3c589_cs.c
+++ b/drivers/net/ethernet/3com/3c589_cs.c
@@ -163,7 +163,7 @@ static void tc589_release(struct pcmcia_device *link);
 
 static u16 read_eeprom(unsigned int ioaddr, int index);
 static void tc589_reset(struct net_device *dev);
-static void media_check(unsigned long arg);
+static void media_check(struct timer_list *t);
 static int el3_config(struct net_device *dev, struct ifmap *map);
 static int el3_open(struct net_device *dev);
 static netdev_tx_t el3_start_xmit(struct sk_buff *skb,
@@ -517,7 +517,7 @@ static int el3_open(struct net_device *dev)
netif_start_queue(dev);
 
tc589_reset(dev);
-   setup_timer(>media, media_check, (unsigned long)dev);
+   timer_setup(>media, media_check, 0);
mod_timer(>media, jiffies + HZ);
 
dev_dbg(>dev, "%s: opened, status %4.4x.\n",
@@ -676,10 +676,10 @@ static irqreturn_t el3_interrupt(int irq, void *dev_id)
return IRQ_RETVAL(handled);
 }
 
-static void media_check(unsigned long arg)
+static void media_check(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *)(arg);
-   struct el3_private *lp = netdev_priv(dev);
+   struct el3_private *lp = from_timer(lp, t, media);
+   struct net_device *dev = lp->p_dev->priv;
unsigned int ioaddr = dev->base_addr;
u16 media, errs;
unsigned long flags;
diff --git a/drivers/net/ethernet/3com/3c59x.c 
b/drivers/net/ethernet/3com/3c59x.c
index 402d9090ad29..f4e13a7014bd 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -759,8 +759,8 @@ static int vortex_open(struct net_device *dev);
 static void mdio_sync(struct vortex_private *vp, int bits);
 static int mdio_read(struct net_device *dev, int phy_id, int location);
 static void mdio_write(struct net_device *vp, int phy_id, int location, int 
value);
-static void vortex_timer(unsigned long arg);
-static void rx_oom_timer(unsigned long arg);
+static void vortex_timer(struct timer_list *t);
+static void rx_oom_timer(struct timer_list *t);
 static netdev_tx_t vortex_start_xmit(struct sk_buff *skb,
 struct net_device *dev);
 static netdev_tx_t boomerang_start_xmit(struct sk_buff *skb,
@@ -1599,9 +1599,9 @@ vortex_up(struct net_device *dev)
  

[PATCH 42/58] isdnloop: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. Added missing initialization for
rb_timer.

Cc: Karsten Keil 
Cc: "David S. Miller" 
Cc: Al Viro 
Cc: Stephen Hemminger 
Cc: Arnd Bergmann 
Cc: Johannes Berg 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/isdn/isdnloop/isdnloop.c | 33 ++---
 1 file changed, 14 insertions(+), 19 deletions(-)

diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index e97232646ba1..a4597e96c916 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -90,9 +90,9 @@ isdnloop_bchan_send(isdnloop_card *card, int ch)
  *   data = pointer to card struct, set by kernel timer.data
  */
 static void
-isdnloop_pollbchan(unsigned long data)
+isdnloop_pollbchan(struct timer_list *t)
 {
-   isdnloop_card *card = (isdnloop_card *) data;
+   isdnloop_card *card = from_timer(card, t, rb_timer);
unsigned long flags;
 
if (card->flags & ISDNLOOP_FLAGS_B1ACTIVE)
@@ -305,9 +305,9 @@ isdnloop_putmsg(isdnloop_card *card, unsigned char c)
  *   data = pointer to card struct
  */
 static void
-isdnloop_polldchan(unsigned long data)
+isdnloop_polldchan(struct timer_list *t)
 {
-   isdnloop_card *card = (isdnloop_card *) data;
+   isdnloop_card *card = from_timer(card, t, st_timer);
struct sk_buff *skb;
int avail;
int left;
@@ -373,8 +373,6 @@ isdnloop_polldchan(unsigned long data)
card->flags |= ISDNLOOP_FLAGS_RBTIMER;
spin_lock_irqsave(>isdnloop_lock, flags);
del_timer(>rb_timer);
-   card->rb_timer.function = isdnloop_pollbchan;
-   card->rb_timer.data = (unsigned long) card;
card->rb_timer.expires = jiffies + 
ISDNLOOP_TIMER_BCREAD;
add_timer(>rb_timer);
spin_unlock_irqrestore(>isdnloop_lock, flags);
@@ -588,9 +586,10 @@ isdnloop_atimeout(isdnloop_card *card, int ch)
  * Wrapper for isdnloop_atimeout().
  */
 static void
-isdnloop_atimeout0(unsigned long data)
+isdnloop_atimeout0(struct timer_list *t)
 {
-   isdnloop_card *card = (isdnloop_card *) data;
+   isdnloop_card *card = from_timer(card, t, c_timer[0]);
+
isdnloop_atimeout(card, 0);
 }
 
@@ -598,9 +597,10 @@ isdnloop_atimeout0(unsigned long data)
  * Wrapper for isdnloop_atimeout().
  */
 static void
-isdnloop_atimeout1(unsigned long data)
+isdnloop_atimeout1(struct timer_list *t)
 {
-   isdnloop_card *card = (isdnloop_card *) data;
+   isdnloop_card *card = from_timer(card, t, c_timer[1]);
+
isdnloop_atimeout(card, 1);
 }
 
@@ -617,13 +617,9 @@ isdnloop_start_ctimer(isdnloop_card *card, int ch)
unsigned long flags;
 
spin_lock_irqsave(>isdnloop_lock, flags);
-   init_timer(>c_timer[ch]);
+   timer_setup(>c_timer[ch], ch ? isdnloop_atimeout1
+  : isdnloop_atimeout0, 0);
card->c_timer[ch].expires = jiffies + ISDNLOOP_TIMER_ALERTWAIT;
-   if (ch)
-   card->c_timer[ch].function = isdnloop_atimeout1;
-   else
-   card->c_timer[ch].function = isdnloop_atimeout0;
-   card->c_timer[ch].data = (unsigned long) card;
add_timer(>c_timer[ch]);
spin_unlock_irqrestore(>isdnloop_lock, flags);
 }
@@ -1113,10 +1109,9 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
   sdef.ptype);
return -EINVAL;
}
-   init_timer(>st_timer);
+   timer_setup(>rb_timer, isdnloop_pollbchan, 0);
+   timer_setup(>st_timer, isdnloop_polldchan, 0);
card->st_timer.expires = jiffies + ISDNLOOP_TIMER_DCREAD;
-   card->st_timer.function = isdnloop_polldchan;
-   card->st_timer.data = (unsigned long) card;
add_timer(>st_timer);
card->flags |= ISDNLOOP_FLAGS_RUNNING;
spin_unlock_irqrestore(>isdnloop_lock, flags);
-- 
2.7.4

[PATCH 53/58] net: atm: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. Also drops a redundant initialization
that is already set up by DEFINE_TIMER.

Cc: "David S. Miller" 
Cc: Hans Liljestrand 
Cc: "Reshetova, Elena" 
Cc: Bhumika Goyal 
Cc: Johannes Berg 
Cc: Roopa Prabhu 
Cc: Augusto Mecking Caringi 
Cc: Jarod Wilson 
Cc: Kalle Valo 
Cc: Thomas Gleixner 
Cc: Alexey Dobriyan 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 net/atm/clip.c |  4 ++--
 net/atm/lec.c  | 19 +--
 net/atm/mpc.c  |  1 -
 3 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/net/atm/clip.c b/net/atm/clip.c
index 65f706e4344c..d4f6029d5109 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -153,7 +153,7 @@ static int neigh_check_cb(struct neighbour *n)
return 1;
 }
 
-static void idle_timer_check(unsigned long dummy)
+static void idle_timer_check(struct timer_list *unused)
 {
write_lock(_tbl.lock);
__neigh_for_each_release(_tbl, neigh_check_cb);
@@ -887,7 +887,7 @@ static int __init atm_clip_init(void)
register_netdevice_notifier(_dev_notifier);
register_inetaddr_notifier(_inet_notifier);
 
-   setup_timer(_timer, idle_timer_check, 0);
+   timer_setup(_timer, idle_timer_check, 0);
 
 #ifdef CONFIG_PROC_FS
{
diff --git a/net/atm/lec.c b/net/atm/lec.c
index a3d93a1bb133..c976196da3ea 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1232,7 +1232,7 @@ static void lane2_associate_ind(struct net_device *dev, 
const u8 *mac_addr,
 #define LEC_ARP_REFRESH_INTERVAL (3*HZ)
 
 static void lec_arp_check_expire(struct work_struct *work);
-static void lec_arp_expire_arp(unsigned long data);
+static void lec_arp_expire_arp(struct timer_list *t);
 
 /*
  * Arp table funcs
@@ -1559,8 +1559,7 @@ static struct lec_arp_table *make_entry(struct lec_priv 
*priv,
}
ether_addr_copy(to_return->mac_addr, mac_addr);
INIT_HLIST_NODE(_return->next);
-   setup_timer(_return->timer, lec_arp_expire_arp,
-   (unsigned long)to_return);
+   timer_setup(_return->timer, lec_arp_expire_arp, 0);
to_return->last_used = jiffies;
to_return->priv = priv;
skb_queue_head_init(_return->tx_wait);
@@ -1569,11 +1568,11 @@ static struct lec_arp_table *make_entry(struct lec_priv 
*priv,
 }
 
 /* Arp sent timer expired */
-static void lec_arp_expire_arp(unsigned long data)
+static void lec_arp_expire_arp(struct timer_list *t)
 {
struct lec_arp_table *entry;
 
-   entry = (struct lec_arp_table *)data;
+   entry = from_timer(entry, t, timer);
 
pr_debug("\n");
if (entry->status == ESI_ARP_PENDING) {
@@ -1591,10 +1590,10 @@ static void lec_arp_expire_arp(unsigned long data)
 }
 
 /* Unknown/unused vcc expire, remove associated entry */
-static void lec_arp_expire_vcc(unsigned long data)
+static void lec_arp_expire_vcc(struct timer_list *t)
 {
unsigned long flags;
-   struct lec_arp_table *to_remove = (struct lec_arp_table *)data;
+   struct lec_arp_table *to_remove = from_timer(to_remove, t, timer);
struct lec_priv *priv = to_remove->priv;
 
del_timer(_remove->timer);
@@ -1799,7 +1798,7 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv 
*priv,
else
send_to_lecd(priv, l_arp_xmt, mac_to_find, NULL, NULL);
entry->timer.expires = jiffies + (1 * HZ);
-   entry->timer.function = lec_arp_expire_arp;
+   entry->timer.function = (TIMER_FUNC_TYPE)lec_arp_expire_arp;
add_timer(>timer);
found = priv->mcast_vcc;
}
@@ -1999,7 +1998,7 @@ lec_vcc_added(struct lec_priv *priv, const struct 
atmlec_ioc *ioc_data,
entry->old_recv_push = old_push;
entry->status = ESI_UNKNOWN;
entry->timer.expires = jiffies + priv->vcc_timeout_period;
-   entry->timer.function = lec_arp_expire_vcc;
+   entry->timer.function = (TIMER_FUNC_TYPE)lec_arp_expire_vcc;
hlist_add_head(>next, >lec_no_forward);
add_timer(>timer);
dump_arp_table(priv);
@@ -2083,7 +2082,7 @@ lec_vcc_added(struct lec_priv *priv, const struct 
atmlec_ioc *ioc_data,
entry->status = ESI_UNKNOWN;
hlist_add_head(>next, >lec_arp_empty_ones);
entry->timer.expires = jiffies + priv->vcc_timeout_period;
-   entry->timer.function = lec_arp_expire_vcc;
+   entry->timer.function = (TIMER_FUNC_TYPE)lec_arp_expire_vcc;
add_timer(>timer);
pr_debug("After vcc was 

[PATCH 51/58] ethernet/intel: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. Switches test of .data field to
.function, since .data will be going away.

Cc: Jeff Kirsher 
Cc: intel-wired-...@lists.osuosl.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/intel/e100.c |  6 +++---
 drivers/net/ethernet/intel/e1000e/netdev.c| 14 ++
 drivers/net/ethernet/intel/fm10k/fm10k_pci.c  |  8 
 drivers/net/ethernet/intel/i40e/i40e_main.c   |  8 
 drivers/net/ethernet/intel/i40evf/i40evf_main.c   |  8 
 drivers/net/ethernet/intel/igb/igb_main.c | 18 --
 drivers/net/ethernet/intel/igbvf/netdev.c |  7 +++
 drivers/net/ethernet/intel/ixgb/ixgb_main.c   |  9 -
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c |  7 +++
 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c |  8 
 10 files changed, 43 insertions(+), 50 deletions(-)

diff --git a/drivers/net/ethernet/intel/e100.c 
b/drivers/net/ethernet/intel/e100.c
index 184f11242f56..44b3937f7e81 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -1710,9 +1710,9 @@ static void e100_adjust_adaptive_ifs(struct nic *nic, int 
speed, int duplex)
}
 }
 
-static void e100_watchdog(unsigned long data)
+static void e100_watchdog(struct timer_list *t)
 {
-   struct nic *nic = (struct nic *)data;
+   struct nic *nic = from_timer(nic, t, watchdog);
struct ethtool_cmd cmd = { .cmd = ETHTOOL_GSET };
u32 speed;
 
@@ -2920,7 +2920,7 @@ static int e100_probe(struct pci_dev *pdev, const struct 
pci_device_id *ent)
 
pci_set_master(pdev);
 
-   setup_timer(>watchdog, e100_watchdog, (unsigned long)nic);
+   timer_setup(>watchdog, e100_watchdog, 0);
 
INIT_WORK(>tx_timeout_task, e100_tx_timeout_task);
 
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c 
b/drivers/net/ethernet/intel/e1000e/netdev.c
index bf8f38f76953..f2f49239b015 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -4823,9 +4823,9 @@ static void e1000e_update_phy_task(struct work_struct 
*work)
  * Need to wait a few seconds after link up to get diagnostic information from
  * the phy
  **/
-static void e1000_update_phy_info(unsigned long data)
+static void e1000_update_phy_info(struct timer_list *t)
 {
-   struct e1000_adapter *adapter = (struct e1000_adapter *)data;
+   struct e1000_adapter *adapter = from_timer(adapter, t, phy_info_timer);
 
if (test_bit(__E1000_DOWN, >state))
return;
@@ -5159,9 +5159,9 @@ static void e1000e_check_82574_phy_workaround(struct 
e1000_adapter *adapter)
  * e1000_watchdog - Timer Call-back
  * @data: pointer to adapter cast into an unsigned long
  **/
-static void e1000_watchdog(unsigned long data)
+static void e1000_watchdog(struct timer_list *t)
 {
-   struct e1000_adapter *adapter = (struct e1000_adapter *)data;
+   struct e1000_adapter *adapter = from_timer(adapter, t, watchdog_timer);
 
/* Do the rest outside of interrupt context */
schedule_work(>watchdog_task);
@@ -7267,10 +7267,8 @@ static int e1000_probe(struct pci_dev *pdev, const 
struct pci_device_id *ent)
goto err_eeprom;
}
 
-   setup_timer(>watchdog_timer, e1000_watchdog,
-   (unsigned long)adapter);
-   setup_timer(>phy_info_timer, e1000_update_phy_info,
-   (unsigned long)adapter);
+   timer_setup(>watchdog_timer, e1000_watchdog, 0);
+   timer_setup(>phy_info_timer, e1000_update_phy_info, 0);
 
INIT_WORK(>reset_task, e1000_reset_task);
INIT_WORK(>watchdog_task, e1000_watchdog_task);
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c 
b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
index 1e9ae3197b17..7f605221a686 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
@@ -213,9 +213,10 @@ static void fm10k_start_service_event(struct fm10k_intfc 
*interface)
  * fm10k_service_timer - Timer Call-back
  * @data: pointer to interface cast into an unsigned long
  **/
-static void fm10k_service_timer(unsigned long data)
+static void fm10k_service_timer(struct timer_list *t)
 {
-   struct fm10k_intfc *interface = (struct fm10k_intfc *)data;
+   struct fm10k_intfc *interface = from_timer(interface, t,
+  service_timer);
 
/* Reset the timer */
mod_timer(>service_timer, (HZ * 2) + jiffies);
@@ -2315,8 +2316,7 @@ static int fm10k_probe(struct pci_dev *pdev, const struct 
pci_device_id *ent)
/* Initialize service timer and service task late in order to avoid
 * cleanup issues.

[PATCH 43/58] net: ethernet: apple: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Johannes Berg 
Cc: Jarod Wilson 
Cc: Rob Herring 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/apple/bmac.c | 12 +---
 drivers/net/ethernet/apple/mace.c | 12 +---
 2 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/drivers/net/ethernet/apple/bmac.c 
b/drivers/net/ethernet/apple/bmac.c
index eac740c476ce..5a655d289dd5 100644
--- a/drivers/net/ethernet/apple/bmac.c
+++ b/drivers/net/ethernet/apple/bmac.c
@@ -157,7 +157,7 @@ static irqreturn_t bmac_misc_intr(int irq, void *dev_id);
 static irqreturn_t bmac_txdma_intr(int irq, void *dev_id);
 static irqreturn_t bmac_rxdma_intr(int irq, void *dev_id);
 static void bmac_set_timeout(struct net_device *dev);
-static void bmac_tx_timeout(unsigned long data);
+static void bmac_tx_timeout(struct timer_list *t);
 static int bmac_output(struct sk_buff *skb, struct net_device *dev);
 static void bmac_start(struct net_device *dev);
 
@@ -555,8 +555,6 @@ static inline void bmac_set_timeout(struct net_device *dev)
if (bp->timeout_active)
del_timer(>tx_timeout);
bp->tx_timeout.expires = jiffies + TX_TIMEOUT;
-   bp->tx_timeout.function = bmac_tx_timeout;
-   bp->tx_timeout.data = (unsigned long) dev;
add_timer(>tx_timeout);
bp->timeout_active = 1;
spin_unlock_irqrestore(>lock, flags);
@@ -1321,7 +1319,7 @@ static int bmac_probe(struct macio_dev *mdev, const 
struct of_device_id *match)
bp->queue = (struct sk_buff_head *)(bp->rx_cmds + N_RX_RING + 1);
skb_queue_head_init(bp->queue);
 
-   init_timer(>tx_timeout);
+   timer_setup(>tx_timeout, bmac_tx_timeout, 0);
 
ret = request_irq(dev->irq, bmac_misc_intr, 0, "BMAC-misc", dev);
if (ret) {
@@ -1471,10 +1469,10 @@ bmac_output(struct sk_buff *skb, struct net_device *dev)
return NETDEV_TX_OK;
 }
 
-static void bmac_tx_timeout(unsigned long data)
+static void bmac_tx_timeout(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *) data;
-   struct bmac_data *bp = netdev_priv(dev);
+   struct bmac_data *bp = from_timer(bp, t, tx_timeout);
+   struct net_device *dev = macio_get_drvdata(bp->mdev);
volatile struct dbdma_regs __iomem *td = bp->tx_dma;
volatile struct dbdma_regs __iomem *rd = bp->rx_dma;
volatile struct dbdma_cmd *cp;
diff --git a/drivers/net/ethernet/apple/mace.c 
b/drivers/net/ethernet/apple/mace.c
index e58b157b7d7c..0b5429d76bcf 100644
--- a/drivers/net/ethernet/apple/mace.c
+++ b/drivers/net/ethernet/apple/mace.c
@@ -86,7 +86,7 @@ static irqreturn_t mace_interrupt(int irq, void *dev_id);
 static irqreturn_t mace_txdma_intr(int irq, void *dev_id);
 static irqreturn_t mace_rxdma_intr(int irq, void *dev_id);
 static void mace_set_timeout(struct net_device *dev);
-static void mace_tx_timeout(unsigned long data);
+static void mace_tx_timeout(struct timer_list *t);
 static inline void dbdma_reset(volatile struct dbdma_regs __iomem *dma);
 static inline void mace_clean_rings(struct mace_data *mp);
 static void __mace_set_address(struct net_device *dev, void *addr);
@@ -196,7 +196,7 @@ static int mace_probe(struct macio_dev *mdev, const struct 
of_device_id *match)
 
memset((char *) mp->tx_cmds, 0,
   (NCMDS_TX*N_TX_RING + N_RX_RING + 2) * sizeof(struct dbdma_cmd));
-   init_timer(>tx_timeout);
+   timer_setup(>tx_timeout, mace_tx_timeout, 0);
spin_lock_init(>lock);
mp->timeout_active = 0;
 
@@ -521,8 +521,6 @@ static inline void mace_set_timeout(struct net_device *dev)
 if (mp->timeout_active)
del_timer(>tx_timeout);
 mp->tx_timeout.expires = jiffies + TX_TIMEOUT;
-mp->tx_timeout.function = mace_tx_timeout;
-mp->tx_timeout.data = (unsigned long) dev;
 add_timer(>tx_timeout);
 mp->timeout_active = 1;
 }
@@ -801,10 +799,10 @@ static irqreturn_t mace_interrupt(int irq, void *dev_id)
 return IRQ_HANDLED;
 }
 
-static void mace_tx_timeout(unsigned long data)
+static void mace_tx_timeout(struct timer_list *t)
 {
-struct net_device *dev = (struct net_device *) data;
-struct mace_data *mp = netdev_priv(dev);
+struct mace_data *mp = from_timer(mp, t, tx_timeout);
+struct net_device *dev = macio_get_drvdata(mp->mdev);
 volatile struct mace __iomem *mb = mp->mace;
 volatile struct dbdma_regs __iomem *td = mp->tx_dma;
 volatile struct dbdma_regs __iomem *rd = mp->rx_dma;
-- 
2.7.4

[PATCH 48/58] net: usb: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Woojung Huh 
Cc: Microchip Linux Driver Support 
Cc: "David S. Miller" 
Cc: Ben Hutchings 
Cc: Philippe Reynes 
Cc: Jarod Wilson 
Cc: Arvind Yadav 
Cc: "Bjørn Mork" 
Cc: "Stefan Brüns" 
Cc: Alexey Dobriyan 
Cc: Greg Ungerer 
Cc: linux-...@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/usb/catc.c   |  6 +++---
 drivers/net/usb/lan78xx.c| 10 +++---
 drivers/net/usb/sierra_net.c | 12 
 3 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
index aeb62e17d19d..18d36dff97ea 100644
--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -611,9 +611,9 @@ static void catc_stats_done(struct catc *catc, struct 
ctrl_queue *q)
catc->stats_vals[index >> 1] = data;
 }
 
-static void catc_stats_timer(unsigned long data)
+static void catc_stats_timer(struct timer_list *t)
 {
-   struct catc *catc = (void *) data;
+   struct catc *catc = from_timer(catc, t, timer);
int i;
 
for (i = 0; i < 8; i++)
@@ -805,7 +805,7 @@ static int catc_probe(struct usb_interface *intf, const 
struct usb_device_id *id
spin_lock_init(>tx_lock);
spin_lock_init(>ctrl_lock);
 
-   setup_timer(>timer, catc_stats_timer, (long)catc);
+   timer_setup(>timer, catc_stats_timer, 0);
 
catc->ctrl_urb = usb_alloc_urb(0, GFP_KERNEL);
catc->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 0161f77641fa..94c7804903c4 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3516,11 +3516,9 @@ static const struct net_device_ops lan78xx_netdev_ops = {
.ndo_vlan_rx_kill_vid   = lan78xx_vlan_rx_kill_vid,
 };
 
-static void lan78xx_stat_monitor(unsigned long param)
+static void lan78xx_stat_monitor(struct timer_list *t)
 {
-   struct lan78xx_net *dev;
-
-   dev = (struct lan78xx_net *)param;
+   struct lan78xx_net *dev = from_timer(dev, t, stat_monitor);
 
lan78xx_defer_kevent(dev, EVENT_STAT_UPDATE);
 }
@@ -3571,10 +3569,8 @@ static int lan78xx_probe(struct usb_interface *intf,
netdev->watchdog_timeo = TX_TIMEOUT_JIFFIES;
netdev->ethtool_ops = _ethtool_ops;
 
-   dev->stat_monitor.function = lan78xx_stat_monitor;
-   dev->stat_monitor.data = (unsigned long)dev;
dev->delta = 1;
-   init_timer(>stat_monitor);
+   timer_setup(>stat_monitor, lan78xx_stat_monitor, 0);
 
mutex_init(>stats.access_lock);
 
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index 2110ab3513f0..c43087e06696 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -189,9 +189,6 @@ struct lsi_umts_dual {
 #define SIERRA_NET_LSI_UMTS_DS_STATUS_LEN \
(SIERRA_NET_LSI_UMTS_DS_LEN - SIERRA_NET_LSI_COMMON_LEN)
 
-/* Forward definitions */
-static void sierra_sync_timer(unsigned long syncdata);
-
 /* Our own net device operations structure */
 static const struct net_device_ops sierra_net_device_ops = {
.ndo_open   = usbnet_open,
@@ -475,8 +472,6 @@ static void sierra_net_dosync(struct usbnet *dev)
"Send SYNC failed, status %d\n", status);
 
/* Now, start a timer and make sure we get the Restart Indication */
-   priv->sync_timer.function = sierra_sync_timer;
-   priv->sync_timer.data = (unsigned long) dev;
priv->sync_timer.expires = jiffies + SIERRA_NET_SYNCDELAY;
add_timer(>sync_timer);
 }
@@ -593,9 +588,10 @@ static void sierra_net_defer_kevent(struct usbnet *dev, 
int work)
 /*
  * Sync Retransmit Timer Handler. On expiry, kick the work queue
  */
-static void sierra_sync_timer(unsigned long syncdata)
+static void sierra_sync_timer(struct timer_list *t)
 {
-   struct usbnet *dev = (struct usbnet *)syncdata;
+   struct sierra_net_data *priv = from_timer(priv, t, sync_timer);
+   struct usbnet *dev = priv->usbnet;
 
dev_dbg(>udev->dev, "%s", __func__);
/* Kick the tasklet */
@@ -752,7 +748,7 @@ static int sierra_net_bind(struct usbnet *dev, struct 
usb_interface *intf)
INIT_WORK(>sierra_net_kevent, sierra_net_kevent);
 
/* Only need to do this once */
-   init_timer(>sync_timer);
+   timer_setup(>sync_timer, sierra_sync_timer, 0);
 
/* verify fw attributes */
status = sierra_net_get_fw_attr(dev, );
-- 
2.7.4

[PATCH 49/58] net: neterion: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Jon Mason 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/net/ethernet/neterion/s2io.c | 13 -
 drivers/net/ethernet/neterion/s2io.h |  2 +-
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/neterion/s2io.c 
b/drivers/net/ethernet/neterion/s2io.c
index 462eda926b1c..b8983e73265a 100644
--- a/drivers/net/ethernet/neterion/s2io.c
+++ b/drivers/net/ethernet/neterion/s2io.c
@@ -337,12 +337,6 @@ static const char 
ethtool_driver_stats_keys[][ETH_GSTRING_LEN] = {
 #define S2IO_TEST_LEN  ARRAY_SIZE(s2io_gstrings)
 #define S2IO_STRINGS_LEN   (S2IO_TEST_LEN * ETH_GSTRING_LEN)
 
-#define S2IO_TIMER_CONF(timer, handle, arg, exp)   \
-   init_timer(); \
-   timer.function = handle;\
-   timer.data = (unsigned long)arg;\
-   mod_timer(, (jiffies + exp))  \
-
 /* copy mac addr to def_mac_addr array */
 static void do_s2io_copy_mac_addr(struct s2io_nic *sp, int offset, u64 
mac_addr)
 {
@@ -4193,9 +4187,9 @@ static netdev_tx_t s2io_xmit(struct sk_buff *skb, struct 
net_device *dev)
 }
 
 static void
-s2io_alarm_handle(unsigned long data)
+s2io_alarm_handle(struct timer_list *t)
 {
-   struct s2io_nic *sp = (struct s2io_nic *)data;
+   struct s2io_nic *sp = from_timer(sp, t, alarm_timer);
struct net_device *dev = sp->dev;
 
s2io_handle_errors(dev);
@@ -7186,7 +7180,8 @@ static int s2io_card_up(struct s2io_nic *sp)
return -ENODEV;
}
 
-   S2IO_TIMER_CONF(sp->alarm_timer, s2io_alarm_handle, sp, (HZ/2));
+   timer_setup(>alarm_timer, s2io_alarm_handle, 0);
+   mod_timer(>alarm_timer, jiffies + HZ / 2);
 
set_bit(__S2IO_STATE_CARD_UP, >state);
 
diff --git a/drivers/net/ethernet/neterion/s2io.h 
b/drivers/net/ethernet/neterion/s2io.h
index 6c5997dc8afc..1a24a7218794 100644
--- a/drivers/net/ethernet/neterion/s2io.h
+++ b/drivers/net/ethernet/neterion/s2io.h
@@ -1094,7 +1094,7 @@ static int s2io_poll_msix(struct napi_struct *napi, int 
budget);
 static int s2io_poll_inta(struct napi_struct *napi, int budget);
 static void s2io_init_pci(struct s2io_nic * sp);
 static int do_s2io_prog_unicast(struct net_device *dev, u8 *addr);
-static void s2io_alarm_handle(unsigned long data);
+static void s2io_alarm_handle(struct timer_list *t);
 static irqreturn_t
 s2io_msix_ring_handle(int irq, void *dev_id);
 static irqreturn_t
-- 
2.7.4

[PATCH 30/58] mISDN: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: Karsten Keil 
Cc: Geliang Tang 
Cc: "David S. Miller" 
Cc: Masahiro Yamada 
Cc: Andrew Morton 
Cc: Anton Vasilyev 
Cc: Ingo Molnar 
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 drivers/isdn/hardware/mISDN/mISDNipac.c |  7 +++
 drivers/isdn/hardware/mISDN/w6692.c |  7 +++
 drivers/isdn/mISDN/dsp.h|  2 +-
 drivers/isdn/mISDN/dsp_core.c   |  6 ++
 drivers/isdn/mISDN/dsp_tones.c  |  6 ++
 drivers/isdn/mISDN/fsm.c|  7 +++
 drivers/isdn/mISDN/l1oip_core.c | 15 +++
 drivers/isdn/mISDN/timerdev.c   |  6 +++---
 8 files changed, 24 insertions(+), 32 deletions(-)

diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c 
b/drivers/isdn/hardware/mISDN/mISDNipac.c
index e240010b93fa..4d78f870435e 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -172,7 +172,6 @@ isac_fill_fifo(struct isac_hw *isac)
pr_debug("%s: %s dbusytimer running\n", isac->name, __func__);
del_timer(>dch.timer);
}
-   init_timer(>dch.timer);
isac->dch.timer.expires = jiffies + ((DBUSY_TIMER_VALUE * HZ)/1000);
add_timer(>dch.timer);
if (isac->dch.debug & DEBUG_HW_DFIFO) {
@@ -727,8 +726,9 @@ isac_release(struct isac_hw *isac)
 }
 
 static void
-dbusy_timer_handler(struct isac_hw *isac)
+dbusy_timer_handler(struct timer_list *t)
 {
+   struct isac_hw *isac = from_timer(isac, t, dch.timer);
int rbch, star;
u_long flags;
 
@@ -796,8 +796,7 @@ isac_init(struct isac_hw *isac)
}
isac->mon_tx = NULL;
isac->mon_rx = NULL;
-   setup_timer(>dch.timer, (void *)dbusy_timer_handler,
-   (long)isac);
+   timer_setup(>dch.timer, dbusy_timer_handler, 0);
isac->mocr = 0xaa;
if (isac->type & IPAC_TYPE_ISACX) {
/* Disable all IRQ */
diff --git a/drivers/isdn/hardware/mISDN/w6692.c 
b/drivers/isdn/hardware/mISDN/w6692.c
index d80072fef434..536d5137f49d 100644
--- a/drivers/isdn/hardware/mISDN/w6692.c
+++ b/drivers/isdn/hardware/mISDN/w6692.c
@@ -311,7 +311,6 @@ W6692_fill_Dfifo(struct w6692_hw *card)
pr_debug("%s: fill_Dfifo dbusytimer running\n", card->name);
del_timer(>timer);
}
-   init_timer(>timer);
dch->timer.expires = jiffies + ((DBUSY_TIMER_VALUE * HZ) / 1000);
add_timer(>timer);
if (debug & DEBUG_HW_DFIFO) {
@@ -819,8 +818,9 @@ w6692_irq(int intno, void *dev_id)
 }
 
 static void
-dbusy_timer_handler(struct dchannel *dch)
+dbusy_timer_handler(struct timer_list *t)
 {
+   struct dchannel *dch = from_timer(dch, t, timer);
struct w6692_hw *card = dch->hw;
int rbch, star;
u_long  flags;
@@ -852,8 +852,7 @@ static void initW6692(struct w6692_hw *card)
 {
u8  val;
 
-   setup_timer(>dch.timer, (void *)dbusy_timer_handler,
-   (u_long)>dch);
+   timer_setup(>dch.timer, dbusy_timer_handler, 0);
w6692_mode(>bc[0], ISDN_P_NONE);
w6692_mode(>bc[1], ISDN_P_NONE);
WriteW6692(card, W_D_CTL, 0x00);
diff --git a/drivers/isdn/mISDN/dsp.h b/drivers/isdn/mISDN/dsp.h
index fc1733a08845..fa09d511a8ed 100644
--- a/drivers/isdn/mISDN/dsp.h
+++ b/drivers/isdn/mISDN/dsp.h
@@ -259,7 +259,7 @@ extern u8 *dsp_dtmf_goertzel_decode(struct dsp *dsp, u8 
*data, int len,
 
 extern int dsp_tone(struct dsp *dsp, int tone);
 extern void dsp_tone_copy(struct dsp *dsp, u8 *data, int len);
-extern void dsp_tone_timeout(void *arg);
+extern void dsp_tone_timeout(struct timer_list *t);
 
 extern void dsp_bf_encrypt(struct dsp *dsp, u8 *data, int len);
 extern void dsp_bf_decrypt(struct dsp *dsp, u8 *data, int len);
diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c
index 880e9d367a39..cd036e87335a 100644
--- a/drivers/isdn/mISDN/dsp_core.c
+++ b/drivers/isdn/mISDN/dsp_core.c
@@ -1092,7 +1092,7 @@ dspcreate(struct channel_req *crq)
ndsp->pcm_bank_tx = -1;
ndsp->hfc_conf = -1; /* current conference number */
/* set tone timer */
-   setup_timer(>tone.tl, (void *)dsp_tone_timeout, (long)ndsp);
+   timer_setup(>tone.tl, dsp_tone_timeout, 0);
 
if (dtmfthreshold < 20 || dtmfthreshold > 500)
dtmfthreshold = 200;
@@ -1202,9 +1202,7 @@ static int __init dsp_init(void)
}
 
/* set sample timer */
-   dsp_spl_tl.function = (void *)dsp_cmx_send;
-   dsp_spl_tl.data = 0;
-   init_timer(_spl_tl);
+   timer_setup(_spl_tl, (void 

[PATCH 01/58] net/decnet: Convert timers to use timer_setup()

[Kees Cook]

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

Cc: "David S. Miller" 
Cc: Johannes Berg 
Cc: David Ahern 
Cc: linux-decnet-u...@lists.sourceforge.net
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook 
---
 include/net/dn.h|  7 ---
 include/net/dn_nsp.h|  1 -
 net/decnet/af_decnet.c  |  4 
 net/decnet/dn_dev.c | 12 +---
 net/decnet/dn_nsp_out.c | 11 ---
 5 files changed, 5 insertions(+), 30 deletions(-)

diff --git a/include/net/dn.h b/include/net/dn.h
index 913b73d239f5..4394f7d5cfe8 100644
--- a/include/net/dn.h
+++ b/include/net/dn.h
@@ -122,13 +122,6 @@ struct dn_scp   /* Session 
Control Port */
unsigned long keepalive;
void (*keepalive_fxn)(struct sock *sk);
 
-   /*
-* This stuff is for the fast timer for delayed acks
-*/
-   struct timer_list delack_timer;
-   int delack_pending;
-   void (*delack_fxn)(struct sock *sk);
-
 };
 
 static inline struct dn_scp *DN_SK(struct sock *sk)
diff --git a/include/net/dn_nsp.h b/include/net/dn_nsp.h
index 3a3e33d18456..413a15e5339c 100644
--- a/include/net/dn_nsp.h
+++ b/include/net/dn_nsp.h
@@ -17,7 +17,6 @@
 
 void dn_nsp_send_data_ack(struct sock *sk);
 void dn_nsp_send_oth_ack(struct sock *sk);
-void dn_nsp_delayed_ack(struct sock *sk);
 void dn_send_conn_ack(struct sock *sk);
 void dn_send_conn_conf(struct sock *sk, gfp_t gfp);
 void dn_nsp_send_disc(struct sock *sk, unsigned char type,
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 73a0399dc7a2..d4c9a8bbad3e 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -533,10 +533,6 @@ static struct sock *dn_alloc_sock(struct net *net, struct 
socket *sock, gfp_t gf
scp->keepalive = 10 * HZ;
scp->keepalive_fxn = dn_keepalive;
 
-   init_timer(>delack_timer);
-   scp->delack_pending = 0;
-   scp->delack_fxn = dn_nsp_delayed_ack;
-
dn_start_slow_timer(sk);
 out:
return sk;
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 4d339de56862..92dbaa3f1eae 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1038,14 +1038,14 @@ static void dn_eth_down(struct net_device *dev)
 
 static void dn_dev_set_timer(struct net_device *dev);
 
-static void dn_dev_timer_func(unsigned long arg)
+static void dn_dev_timer_func(struct timer_list *t)
 {
-   struct net_device *dev = (struct net_device *)arg;
-   struct dn_dev *dn_db;
+   struct dn_dev *dn_db = from_timer(dn_db, t, timer);
+   struct net_device *dev;
struct dn_ifaddr *ifa;
 
rcu_read_lock();
-   dn_db = rcu_dereference(dev->dn_ptr);
+   dev = dn_db->dev;
if (dn_db->t3 <= dn_db->parms.t2) {
if (dn_db->parms.timer3) {
for (ifa = rcu_dereference(dn_db->ifa_list);
@@ -1070,8 +1070,6 @@ static void dn_dev_set_timer(struct net_device *dev)
if (dn_db->parms.t2 > dn_db->parms.t3)
dn_db->parms.t2 = dn_db->parms.t3;
 
-   dn_db->timer.data = (unsigned long)dev;
-   dn_db->timer.function = dn_dev_timer_func;
dn_db->timer.expires = jiffies + (dn_db->parms.t2 * HZ);
 
add_timer(_db->timer);
@@ -1100,7 +1098,7 @@ static struct dn_dev *dn_dev_create(struct net_device 
*dev, int *err)
 
rcu_assign_pointer(dev->dn_ptr, dn_db);
dn_db->dev = dev;
-   init_timer(_db->timer);
+   timer_setup(_db->timer, dn_dev_timer_func, 0);
 
dn_db->uptime = jiffies;
 
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index 66f035e476ea..e50a4adfcf7e 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -491,17 +491,6 @@ void dn_send_conn_ack (struct sock *sk)
dn_nsp_send(skb);
 }
 
-void dn_nsp_delayed_ack(struct sock *sk)
-{
-   struct dn_scp *scp = DN_SK(sk);
-
-   if (scp->ackxmt_oth != scp->numoth_rcv)
-   dn_nsp_send_oth_ack(sk);
-
-   if (scp->ackxmt_dat != scp->numdat_rcv)
-   dn_nsp_send_data_ack(sk);
-}
-
 static int dn_nsp_retrans_conn_conf(struct sock *sk)
 {
struct dn_scp *scp = DN_SK(sk);
-- 
2.7.4

Re: [PATCH v2 09/15] ACPI: configfs: make config_item_type const

[Rafael J. Wysocki]

On Monday, October 16, 2017 5:18:48 PM CEST Bhumika Goyal wrote:
> Make these structures const as they are either passed to the functions
> having the argument as const or stored as a reference in the "ci_type"
> const field of a config_item structure.
> 
> Done using Coccienlle.
> 
> Signed-off-by: Bhumika Goyal 
> ---
> * Changes in v2- Combine all the followup patches and the constification
> patches into a series.
> 
>  drivers/acpi/acpi_configfs.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/acpi/acpi_configfs.c b/drivers/acpi/acpi_configfs.c
> index 853bc7f..b588503 100644
> --- a/drivers/acpi/acpi_configfs.c
> +++ b/drivers/acpi/acpi_configfs.c
> @@ -204,7 +204,7 @@ struct configfs_attribute *acpi_table_attrs[] = {
>   NULL,
>  };
>  
> -static struct config_item_type acpi_table_type = {
> +static const struct config_item_type acpi_table_type = {
>   .ct_owner = THIS_MODULE,
>   .ct_bin_attrs = acpi_table_bin_attrs,
>   .ct_attrs = acpi_table_attrs,
> @@ -237,12 +237,12 @@ struct configfs_group_operations acpi_table_group_ops = 
> {
>   .drop_item = acpi_table_drop_item,
>  };
>  
> -static struct config_item_type acpi_tables_type = {
> +static const struct config_item_type acpi_tables_type = {
>   .ct_owner = THIS_MODULE,
>   .ct_group_ops = _table_group_ops,
>  };
>  
> -static struct config_item_type acpi_root_group_type = {
> +static const struct config_item_type acpi_root_group_type = {
>   .ct_owner = THIS_MODULE,
>  };
>  
> 

Acked-by: Rafael J. Wysocki 

[net-next PATCH] net/mqprio: Fix build error due to non-exported symbol

[Alexander Duyck]

From: Alexander Duyck 

I overlooked the fact that netdev_txq_to_tc was not an exported symbol. To
fix that I am providing the export for the symbol in order to avoid
breaking builds where mqprio is not built into the kernel.

Signed-off-by: Alexander Duyck 
---
 net/core/dev.c |1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index fb766d906148..0aa255f3a866 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2008,6 +2008,7 @@ int netdev_txq_to_tc(struct net_device *dev, unsigned int 
txq)
 
return 0;
 }
+EXPORT_SYMBOL(netdev_txq_to_tc);
 
 #ifdef CONFIG_XPS
 static DEFINE_MUTEX(xps_map_mutex);

Re: Linux 4.12+ memory leak on router with i40e NICs

[Alexander Duyck]

On Mon, Oct 16, 2017 at 4:34 PM, Paweł Staszewski  wrote:
>
>
> W dniu 2017-10-16 o 18:26, Paweł Staszewski pisze:
>
>>
>>
>> W dniu 2017-10-16 o 13:20, Pavlos Parissis pisze:
>>>
>>> On 15/10/2017 02:58 πμ, Alexander Duyck wrote:

 Hi Pawel,

 To clarify is that Dave Miller's tree or Linus's that you are talking
 about? If it is Dave's tree how long ago was it you pulled it since I
 think the fix was just pushed by Jeff Kirsher a few days ago.

 The issue should be fixed in the following commit:

 https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/drivers/net/ethernet/intel/i40e/i40e_txrx.c?id=2b9478ffc550f17c6cd8c69057234e91150f5972

>>>
>>> Do you know when it is going to be available on net-next and linux-stable
>>> repos?
>>>
>>> Cheers,
>>> Pavlos
>>>
>>>
>> I will make some tests today night with "net" git tree where this patch is
>> included.
>> Starting from 0:00 CET
>> :)
>>
>>
> Upgraded and looks like problem is not solved with that patch
> Currently running system with
> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/
> kernel
>
> Still about 0.5GB of memory is leaking somewhere
>
> Also can confirm that the latest kernel where memory is not leaking (with
> use i40e driver intel 710 cards) is 4.11.12
> With kernel 4.11.12 - after hour no change in memory usage.
>
> also checked that with ixgbe instead of i40e with same  net.git kernel there
> is no memleak - after hour same memory usage - so for 100% this is i40e
> driver problem.

So how long was the run to get the .5GB of memory leaking?

Also is there any chance of you being able to bisect to determine
where the memory leak was introduced since as you pointed out it
didn't exist in 4.11.12 so odds are it was introduced somewhere
between 4.11 and the latest kernel release.

Thanks.

- Alex

[PATCH net-next 3/4] bpf: move knowledge about post-translation offsets out of verifier

[Jakub Kicinski]

Use the fact that verifier ops are now separate from program
ops to define a separate set of callbacks for verification of
already translated programs.

Since we expect the analyzer ops to be defined only for
a small subset of all program types initialize their array
by hand (don't use linux/bpf_types.h).

Signed-off-by: Jakub Kicinski 
---
 include/linux/bpf.h   |  3 +++
 kernel/bpf/verifier.c | 55 +++
 net/core/filter.c | 40 +
 3 files changed, 59 insertions(+), 39 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 1d704dd5765f..068b4175c03a 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -291,6 +291,9 @@ DECLARE_PER_CPU(int, bpf_prog_active);
 #undef BPF_PROG_TYPE
 #undef BPF_MAP_TYPE
 
+extern const struct bpf_verifier_ops tc_cls_act_analyzer_ops;
+extern const struct bpf_verifier_ops xdp_analyzer_ops;
+
 struct bpf_prog *bpf_prog_get(u32 ufd);
 struct bpf_prog *bpf_prog_get_type(u32 ufd, enum bpf_prog_type type);
 struct bpf_prog * __must_check bpf_prog_add(struct bpf_prog *prog, int i);
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 84b5a00975e4..a2bbfbf00baf 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -822,36 +822,6 @@ static int check_packet_access(struct bpf_verifier_env 
*env, u32 regno, int off,
return err;
 }
 
-static bool analyzer_is_valid_access(struct bpf_verifier_env *env, int off,
-struct bpf_insn_access_aux *info)
-{
-   switch (env->prog->type) {
-   case BPF_PROG_TYPE_XDP:
-   switch (off) {
-   case offsetof(struct xdp_buff, data):
-   info->reg_type = PTR_TO_PACKET;
-   return true;
-   case offsetof(struct xdp_buff, data_end):
-   info->reg_type = PTR_TO_PACKET_END;
-   return true;
-   }
-   return false;
-   case BPF_PROG_TYPE_SCHED_CLS:
-   switch (off) {
-   case offsetof(struct sk_buff, data):
-   info->reg_type = PTR_TO_PACKET;
-   return true;
-   case offsetof(struct sk_buff, cb) +
-offsetof(struct bpf_skb_data_end, data_end):
-   info->reg_type = PTR_TO_PACKET_END;
-   return true;
-   }
-   return false;
-   default:
-   return false;
-   }
-}
-
 /* check access to 'struct bpf_context' fields.  Supports fixed offsets only */
 static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int 
off, int size,
enum bpf_access_type t, enum bpf_reg_type *reg_type)
@@ -860,13 +830,8 @@ static int check_ctx_access(struct bpf_verifier_env *env, 
int insn_idx, int off,
.reg_type = *reg_type,
};
 
-   if (env->analyzer_ops) {
-   if (analyzer_is_valid_access(env, off, )) {
-   *reg_type = info.reg_type;
-   return 0;
-   }
-   } else if (env->ops->is_valid_access &&
-  env->ops->is_valid_access(off, size, t, )) {
+   if (env->ops->is_valid_access &&
+   env->ops->is_valid_access(off, size, t, )) {
/* A non zero info.ctx_field_size indicates that this field is a
 * candidate for later verifier transformation to load the whole
 * field and then apply a mask when accessed with a narrower
@@ -874,9 +839,12 @@ static int check_ctx_access(struct bpf_verifier_env *env, 
int insn_idx, int off,
 * will only allow for whole field access and rejects any other
 * type of narrower access.
 */
-   env->insn_aux_data[insn_idx].ctx_field_size = 
info.ctx_field_size;
*reg_type = info.reg_type;
 
+   if (env->analyzer_ops)
+   return 0;
+
+   env->insn_aux_data[insn_idx].ctx_field_size = 
info.ctx_field_size;
/* remember the offset of last byte accessed in ctx */
if (env->prog->aux->max_ctx_offset < off + size)
env->prog->aux->max_ctx_offset = off + size;
@@ -4394,12 +4362,21 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr 
*attr)
return ret;
 }
 
+static const struct bpf_verifier_ops * const bpf_analyzer_ops[] = {
+   [BPF_PROG_TYPE_XDP] = _analyzer_ops,
+   [BPF_PROG_TYPE_SCHED_CLS]   = _cls_act_analyzer_ops,
+};
+
 int bpf_analyzer(struct bpf_prog *prog, const struct bpf_ext_analyzer_ops *ops,
 void *priv)
 {
struct bpf_verifier_env *env;
int ret;
 
+   if (prog->type >= ARRAY_SIZE(bpf_analyzer_ops) ||
+   !bpf_analyzer_ops[prog->type])
+   return -EOPNOTSUPP;
+
  

[PATCH net-next 2/4] bpf: remove the verifier ops from program structure

[Jakub Kicinski]

Since the verifier ops don't have to be associated with
the program for its entire lifetime we can move it to
verifier's struct bpf_verifier_env.

Signed-off-by: Jakub Kicinski 
---
 include/linux/bpf.h  |  1 -
 include/linux/bpf_verifier.h |  1 +
 kernel/bpf/syscall.c | 10 --
 kernel/bpf/verifier.c| 23 +--
 4 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 010bb48fb1d8..1d704dd5765f 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -188,7 +188,6 @@ struct bpf_prog_aux {
struct latch_tree_node ksym_tnode;
struct list_head ksym_lnode;
const struct bpf_prog_ops *ops;
-   const struct bpf_verifier_ops *vops;
struct bpf_map **used_maps;
struct bpf_prog *prog;
struct user_struct *user;
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index f00ef751c1c5..feeaea93d959 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -141,6 +141,7 @@ struct bpf_ext_analyzer_ops {
  */
 struct bpf_verifier_env {
struct bpf_prog *prog;  /* eBPF program being verified */
+   const struct bpf_verifier_ops *ops;
struct bpf_verifier_stack_elem *head; /* stack of verifier states to be 
processed */
int stack_size; /* number of states to be processed */
bool strict_alignment;  /* perform strict pointer alignment 
checks */
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 714c3b758aa7..5b2ee50ff2c1 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -742,22 +742,12 @@ static const struct bpf_prog_ops * const bpf_prog_types[] 
= {
 #undef BPF_MAP_TYPE
 };
 
-static const struct bpf_verifier_ops * const bpf_verifier_ops[] = {
-#define BPF_PROG_TYPE(_id, _name) \
-   [_id] = & _name ## _verifier_ops,
-#define BPF_MAP_TYPE(_id, _ops)
-#include 
-#undef BPF_PROG_TYPE
-#undef BPF_MAP_TYPE
-};
-
 static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
 {
if (type >= ARRAY_SIZE(bpf_prog_types) || !bpf_prog_types[type])
return -EINVAL;
 
prog->aux->ops = bpf_prog_types[type];
-   prog->aux->vops = bpf_verifier_ops[type];
prog->type = type;
return 0;
 }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6fd5edce5fa8..84b5a00975e4 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -23,6 +23,15 @@
 
 #include "disasm.h"
 
+static const struct bpf_verifier_ops * const bpf_verifier_ops[] = {
+#define BPF_PROG_TYPE(_id, _name) \
+   [_id] = & _name ## _verifier_ops,
+#define BPF_MAP_TYPE(_id, _ops)
+#include 
+#undef BPF_PROG_TYPE
+#undef BPF_MAP_TYPE
+};
+
 /* bpf_check() is a static code analyzer that walks eBPF program
  * instruction by instruction and updates register/stack state.
  * All paths of conditional branches are analyzed until 'bpf_exit' insn.
@@ -856,8 +865,8 @@ static int check_ctx_access(struct bpf_verifier_env *env, 
int insn_idx, int off,
*reg_type = info.reg_type;
return 0;
}
-   } else if (env->prog->aux->vops->is_valid_access &&
-  env->prog->aux->vops->is_valid_access(off, size, t, )) {
+   } else if (env->ops->is_valid_access &&
+  env->ops->is_valid_access(off, size, t, )) {
/* A non zero info.ctx_field_size indicates that this field is a
 * candidate for later verifier transformation to load the whole
 * field and then apply a mask when accessed with a narrower
@@ -1559,8 +1568,8 @@ static int check_call(struct bpf_verifier_env *env, int 
func_id, int insn_idx)
return -EINVAL;
}
 
-   if (env->prog->aux->vops->get_func_proto)
-   fn = env->prog->aux->vops->get_func_proto(func_id);
+   if (env->ops->get_func_proto)
+   fn = env->ops->get_func_proto(func_id);
 
if (!fn) {
verbose(env, "unknown func %s#%d\n", func_id_name(func_id),
@@ -4029,7 +4038,7 @@ static struct bpf_prog *bpf_patch_insn_data(struct 
bpf_verifier_env *env, u32 of
  */
 static int convert_ctx_accesses(struct bpf_verifier_env *env)
 {
-   const struct bpf_verifier_ops *ops = env->prog->aux->vops;
+   const struct bpf_verifier_ops *ops = env->ops;
int i, cnt, size, ctx_field_size, delta = 0;
const int insn_cnt = env->prog->len;
struct bpf_insn insn_buf[16], *insn;
@@ -4230,7 +4239,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
insn  = new_prog->insnsi + i + delta;
}
 patch_call_imm:
-   fn = prog->aux->vops->get_func_proto(insn->imm);
+   fn = env->ops->get_func_proto(insn->imm);
/* all functions that have prototype and verifier allowed
  

[PATCH net-next 1/4] bpf: split verifier and program ops

[Jakub Kicinski]

struct bpf_verifier_ops contains both verifier ops and operations
used later during program's lifetime (test_run).  Split the runtime
ops into a different structure.

BPF_PROG_TYPE() will now append ## _prog_ops or ## _verifier_ops
to the names.

Signed-off-by: Jakub Kicinski 
---
 include/linux/bpf.h   | 15 ++-
 include/linux/bpf_types.h | 28 ++--
 kernel/bpf/syscall.c  | 16 +---
 kernel/bpf/verifier.c | 12 ++--
 kernel/trace/bpf_trace.c  | 15 ---
 net/core/filter.c | 45 -
 6 files changed, 91 insertions(+), 40 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 4373125de1f3..010bb48fb1d8 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -157,6 +157,11 @@ bpf_ctx_record_field_size(struct bpf_insn_access_aux *aux, 
u32 size)
aux->ctx_field_size = size;
 }
 
+struct bpf_prog_ops {
+   int (*test_run)(struct bpf_prog *prog, const union bpf_attr *kattr,
+   union bpf_attr __user *uattr);
+};
+
 struct bpf_verifier_ops {
/* return eBPF function prototype for verification */
const struct bpf_func_proto *(*get_func_proto)(enum bpf_func_id 
func_id);
@@ -172,8 +177,6 @@ struct bpf_verifier_ops {
  const struct bpf_insn *src,
  struct bpf_insn *dst,
  struct bpf_prog *prog, u32 *target_size);
-   int (*test_run)(struct bpf_prog *prog, const union bpf_attr *kattr,
-   union bpf_attr __user *uattr);
 };
 
 struct bpf_prog_aux {
@@ -184,7 +187,8 @@ struct bpf_prog_aux {
u32 id;
struct latch_tree_node ksym_tnode;
struct list_head ksym_lnode;
-   const struct bpf_verifier_ops *ops;
+   const struct bpf_prog_ops *ops;
+   const struct bpf_verifier_ops *vops;
struct bpf_map **used_maps;
struct bpf_prog *prog;
struct user_struct *user;
@@ -279,8 +283,9 @@ int bpf_prog_array_copy_to_user(struct bpf_prog_array __rcu 
*progs,
 #ifdef CONFIG_BPF_SYSCALL
 DECLARE_PER_CPU(int, bpf_prog_active);
 
-#define BPF_PROG_TYPE(_id, _ops) \
-   extern const struct bpf_verifier_ops _ops;
+#define BPF_PROG_TYPE(_id, _name) \
+   extern const struct bpf_prog_ops _name ## _prog_ops; \
+   extern const struct bpf_verifier_ops _name ## _verifier_ops;
 #define BPF_MAP_TYPE(_id, _ops) \
extern const struct bpf_map_ops _ops;
 #include 
diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h
index 6f1a567667b8..eeed0e1c3ea4 100644
--- a/include/linux/bpf_types.h
+++ b/include/linux/bpf_types.h
@@ -1,22 +1,22 @@
 /* internal file - do not include directly */
 
 #ifdef CONFIG_NET
-BPF_PROG_TYPE(BPF_PROG_TYPE_SOCKET_FILTER, sk_filter_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_SCHED_CLS, tc_cls_act_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_SCHED_ACT, tc_cls_act_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_XDP, xdp_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_CGROUP_SKB, cg_skb_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_CGROUP_SOCK, cg_sock_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_IN, lwt_inout_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_OUT, lwt_inout_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_XMIT, lwt_xmit_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_SOCK_OPS, sock_ops_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_SK_SKB, sk_skb_prog_ops)
+BPF_PROG_TYPE(BPF_PROG_TYPE_SOCKET_FILTER, sk_filter)
+BPF_PROG_TYPE(BPF_PROG_TYPE_SCHED_CLS, tc_cls_act)
+BPF_PROG_TYPE(BPF_PROG_TYPE_SCHED_ACT, tc_cls_act)
+BPF_PROG_TYPE(BPF_PROG_TYPE_XDP, xdp)
+BPF_PROG_TYPE(BPF_PROG_TYPE_CGROUP_SKB, cg_skb)
+BPF_PROG_TYPE(BPF_PROG_TYPE_CGROUP_SOCK, cg_sock)
+BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_IN, lwt_inout)
+BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_OUT, lwt_inout)
+BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_XMIT, lwt_xmit)
+BPF_PROG_TYPE(BPF_PROG_TYPE_SOCK_OPS, sock_ops)
+BPF_PROG_TYPE(BPF_PROG_TYPE_SK_SKB, sk_skb)
 #endif
 #ifdef CONFIG_BPF_EVENTS
-BPF_PROG_TYPE(BPF_PROG_TYPE_KPROBE, kprobe_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_TRACEPOINT, tracepoint_prog_ops)
-BPF_PROG_TYPE(BPF_PROG_TYPE_PERF_EVENT, perf_event_prog_ops)
+BPF_PROG_TYPE(BPF_PROG_TYPE_KPROBE, kprobe)
+BPF_PROG_TYPE(BPF_PROG_TYPE_TRACEPOINT, tracepoint)
+BPF_PROG_TYPE(BPF_PROG_TYPE_PERF_EVENT, perf_event)
 #endif
 
 BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index d124e702e040..714c3b758aa7 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -733,9 +733,18 @@ static int map_get_next_key(union bpf_attr *attr)
return err;
 }
 
-static const struct bpf_verifier_ops * const bpf_prog_types[] = {
-#define BPF_PROG_TYPE(_id, _ops) \
-   [_id] = &_ops,
+static const struct bpf_prog_ops * const bpf_prog_types[] = {
+#define BPF_PROG_TYPE(_id, _name) \
+   [_id] = & _name ## _prog_ops,
+#define BPF_MAP_TYPE(_id, _ops)
+#include 
+#undef 

[PATCH net-next 4/4] bpf: allow access to skb->len from offloads

[Jakub Kicinski]

Since we are now doing strict checking of what offloads
may access, make sure skb->len is on that list.

Signed-off-by: Jakub Kicinski 
---
 net/core/filter.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index a908e5da5ffc..f8cd4d9aeb94 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3656,6 +3656,8 @@ tc_cls_act_is_valid_access_analyzer(int off, int size,
struct bpf_insn_access_aux *info)
 {
switch (off) {
+   case offsetof(struct sk_buff, len):
+   return true;
case offsetof(struct sk_buff, data):
info->reg_type = PTR_TO_PACKET;
return true;
-- 
2.14.1