]> git.pld-linux.org Git - packages/kernel.git/blame_incremental - kernel-vserver-2.3.patch
projects / packages / kernel.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
- 4.4.140
[packages/kernel.git] / kernel-vserver-2.3.patch
... / ...
CommitLineData
1diff -NurpP --minimal linux-4.4.116/Documentation/vserver/debug.txt linux-4.4.116-vs2.3.9.7/Documentation/vserver/debug.txt
2--- linux-4.4.116/Documentation/vserver/debug.txt 1970-01-01 00:00:00.000000000 +0000
3+++ linux-4.4.116-vs2.3.9.7/Documentation/vserver/debug.txt 2018-01-09 16:36:20.000000000 +0000
4@@ -0,0 +1,154 @@
5+
6+debug_cvirt:
7+
8+ 2 4 "vx_map_tgid: %p/%llx: %d -> %d"
9+ "vx_rmap_tgid: %p/%llx: %d -> %d"
10+
11+debug_dlim:
12+
13+ 0 1 "ALLOC (%p,#%d)%c inode (%d)"
14+ "FREE (%p,#%d)%c inode"
15+ 1 2 "ALLOC (%p,#%d)%c %lld bytes (%d)"
16+ "FREE (%p,#%d)%c %lld bytes"
17+ 2 4 "ADJUST: %lld,%lld on %ld,%ld [mult=%d]"
18+ 3 8 "ext3_has_free_blocks(%p): %lu<%lu+1, %c, %u!=%u r=%d"
19+ "ext3_has_free_blocks(%p): free=%lu, root=%lu"
20+ "rcu_free_dl_info(%p)"
21+ 4 10 "alloc_dl_info(%p,%d) = %p"
22+ "dealloc_dl_info(%p)"
23+ "get_dl_info(%p[#%d.%d])"
24+ "put_dl_info(%p[#%d.%d])"
25+ 5 20 "alloc_dl_info(%p,%d)*"
26+ 6 40 "__hash_dl_info: %p[#%d]"
27+ "__unhash_dl_info: %p[#%d]"
28+ 7 80 "locate_dl_info(%p,#%d) = %p"
29+
30+debug_misc:
31+
32+ 0 1 "destroy_dqhash: %p [#0x%08x] c=%d"
33+ "new_dqhash: %p [#0x%08x]"
34+ "vroot[%d]_clr_dev: dev=%p[%lu,%d:%d]"
35+ "vroot[%d]_get_real_bdev: dev=%p[%lu,%d:%d]"
36+ "vroot[%d]_set_dev: dev=%p[%lu,%d:%d]"
37+ "vroot_get_real_bdev not set"
38+ 1 2 "cow_break_link(?%s?)"
39+ "temp copy ?%s?"
40+ 2 4 "dentry_open(new): %p"
41+ "dentry_open(old): %p"
42+ "lookup_create(new): %p"
43+ "old path ?%s?"
44+ "path_lookup(old): %d"
45+ "vfs_create(new): %d"
46+ "vfs_rename: %d"
47+ "vfs_sendfile: %d"
48+ 3 8 "fput(new_file=%p[#%d])"
49+ "fput(old_file=%p[#%d])"
50+ 4 10 "vx_info_kill(%p[#%d],%d,%d) = %d"
51+ "vx_info_kill(%p[#%d],%d,%d)*"
52+ 5 20 "vs_reboot(%p[#%d],%d)"
53+ 6 40 "dropping task %p[#%u,%u] for %p[#%u,%u]"
54+
55+debug_net:
56+
57+ 2 4 "nx_addr_conflict(%p,%p) %d.%d,%d.%d"
58+ 3 8 "inet_bind(%p) %d.%d.%d.%d, %d.%d.%d.%d, %d.%d.%d.%d"
59+ "inet_bind(%p)* %p,%p;%lx %d.%d.%d.%d"
60+ 4 10 "ip_route_connect(%p) %p,%p;%lx"
61+ 5 20 "__addr_in_socket(%p,%d.%d.%d.%d) %p:%d.%d.%d.%d %p;%lx"
62+ 6 40 "sk,egf: %p [#%d] (from %d)"
63+ "sk,egn: %p [#%d] (from %d)"
64+ "sk,req: %p [#%d] (from %d)"
65+ "sk: %p [#%d] (from %d)"
66+ "tw: %p [#%d] (from %d)"
67+ 7 80 "__sock_recvmsg: %p[%p,%p,%p;%d]:%d/%d"
68+ "__sock_sendmsg: %p[%p,%p,%p;%d]:%d/%d"
69+
70+debug_nid:
71+
72+ 0 1 "__lookup_nx_info(#%u): %p[#%u]"
73+ "alloc_nx_info(%d) = %p"
74+ "create_nx_info(%d) (dynamic rejected)"
75+ "create_nx_info(%d) = %p (already there)"
76+ "create_nx_info(%d) = %p (new)"
77+ "dealloc_nx_info(%p)"
78+ 1 2 "alloc_nx_info(%d)*"
79+ "create_nx_info(%d)*"
80+ 2 4 "get_nx_info(%p[#%d.%d])"
81+ "put_nx_info(%p[#%d.%d])"
82+ 3 8 "claim_nx_info(%p[#%d.%d.%d]) %p"
83+ "clr_nx_info(%p[#%d.%d])"
84+ "init_nx_info(%p[#%d.%d])"
85+ "release_nx_info(%p[#%d.%d.%d]) %p"
86+ "set_nx_info(%p[#%d.%d])"
87+ 4 10 "__hash_nx_info: %p[#%d]"
88+ "__nx_dynamic_id: [#%d]"
89+ "__unhash_nx_info: %p[#%d.%d.%d]"
90+ 5 20 "moved task %p into nxi:%p[#%d]"
91+ "nx_migrate_task(%p,%p[#%d.%d.%d])"
92+ "task_get_nx_info(%p)"
93+ 6 40 "nx_clear_persistent(%p[#%d])"
94+
95+debug_quota:
96+
97+ 0 1 "quota_sync_dqh(%p,%d) discard inode %p"
98+ 1 2 "quota_sync_dqh(%p,%d)"
99+ "sync_dquots(%p,%d)"
100+ "sync_dquots_dqh(%p,%d)"
101+ 3 8 "do_quotactl(%p,%d,cmd=%d,id=%d,%p)"
102+
103+debug_switch:
104+
105+ 0 1 "vc: VCMD_%02d_%d[%d], %d,%p [%d,%d,%x,%x]"
106+ 1 2 "vc: VCMD_%02d_%d[%d] = %08lx(%ld) [%d,%d]"
107+ 4 10 "%s: (%s %s) returned %s with %d"
108+
109+debug_tag:
110+
111+ 7 80 "dx_parse_tag(?%s?): %d:#%d"
112+ "dx_propagate_tag(%p[#%lu.%d]): %d,%d"
113+
114+debug_xid:
115+
116+ 0 1 "__lookup_vx_info(#%u): %p[#%u]"
117+ "alloc_vx_info(%d) = %p"
118+ "alloc_vx_info(%d)*"
119+ "create_vx_info(%d) (dynamic rejected)"
120+ "create_vx_info(%d) = %p (already there)"
121+ "create_vx_info(%d) = %p (new)"
122+ "dealloc_vx_info(%p)"
123+ "loc_vx_info(%d) = %p (found)"
124+ "loc_vx_info(%d) = %p (new)"
125+ "loc_vx_info(%d) = %p (not available)"
126+ 1 2 "create_vx_info(%d)*"
127+ "loc_vx_info(%d)*"
128+ 2 4 "get_vx_info(%p[#%d.%d])"
129+ "put_vx_info(%p[#%d.%d])"
130+ 3 8 "claim_vx_info(%p[#%d.%d.%d]) %p"
131+ "clr_vx_info(%p[#%d.%d])"
132+ "init_vx_info(%p[#%d.%d])"
133+ "release_vx_info(%p[#%d.%d.%d]) %p"
134+ "set_vx_info(%p[#%d.%d])"
135+ 4 10 "__hash_vx_info: %p[#%d]"
136+ "__unhash_vx_info: %p[#%d.%d.%d]"
137+ "__vx_dynamic_id: [#%d]"
138+ 5 20 "enter_vx_info(%p[#%d],%p) %p[#%d,%p]"
139+ "leave_vx_info(%p[#%d,%p]) %p[#%d,%p]"
140+ "moved task %p into vxi:%p[#%d]"
141+ "task_get_vx_info(%p)"
142+ "vx_migrate_task(%p,%p[#%d.%d])"
143+ 6 40 "vx_clear_persistent(%p[#%d])"
144+ "vx_exit_init(%p[#%d],%p[#%d,%d,%d])"
145+ "vx_set_init(%p[#%d],%p[#%d,%d,%d])"
146+ "vx_set_persistent(%p[#%d])"
147+ "vx_set_reaper(%p[#%d],%p[#%d,%d])"
148+ 7 80 "vx_child_reaper(%p[#%u,%u]) = %p[#%u,%u]"
149+
150+
151+debug_limit:
152+
153+ n 2^n "vx_acc_cres[%5d,%s,%2d]: %5d%s"
154+ "vx_cres_avail[%5d,%s,%2d]: %5ld > %5d + %5d"
155+
156+ m 2^m "vx_acc_page[%5d,%s,%2d]: %5d%s"
157+ "vx_acc_pages[%5d,%s,%2d]: %5d += %5d"
158+ "vx_pages_avail[%5d,%s,%2d]: %5ld > %5d + %5d"
159diff -NurpP --minimal linux-4.4.116/arch/alpha/Kconfig linux-4.4.116-vs2.3.9.7/arch/alpha/Kconfig
160--- linux-4.4.116/arch/alpha/Kconfig 2016-07-05 04:11:34.000000000 +0000
161+++ linux-4.4.116-vs2.3.9.7/arch/alpha/Kconfig 2018-01-09 16:36:20.000000000 +0000
162@@ -745,6 +745,8 @@ config DUMMY_CONSOLE
163 depends on VGA_HOSE
164 default y
165
166+source "kernel/vserver/Kconfig"
167+
168 source "security/Kconfig"
169
170 source "crypto/Kconfig"
171diff -NurpP --minimal linux-4.4.116/arch/alpha/kernel/systbls.S linux-4.4.116-vs2.3.9.7/arch/alpha/kernel/systbls.S
172--- linux-4.4.116/arch/alpha/kernel/systbls.S 2015-07-06 20:41:36.000000000 +0000
173+++ linux-4.4.116-vs2.3.9.7/arch/alpha/kernel/systbls.S 2018-01-09 16:36:20.000000000 +0000
174@@ -446,7 +446,7 @@ sys_call_table:
175 .quad sys_stat64 /* 425 */
176 .quad sys_lstat64
177 .quad sys_fstat64
178- .quad sys_ni_syscall /* sys_vserver */
179+ .quad sys_vserver /* sys_vserver */
180 .quad sys_ni_syscall /* sys_mbind */
181 .quad sys_ni_syscall /* sys_get_mempolicy */
182 .quad sys_ni_syscall /* sys_set_mempolicy */
183diff -NurpP --minimal linux-4.4.116/arch/alpha/kernel/traps.c linux-4.4.116-vs2.3.9.7/arch/alpha/kernel/traps.c
184--- linux-4.4.116/arch/alpha/kernel/traps.c 2015-07-06 20:41:36.000000000 +0000
185+++ linux-4.4.116-vs2.3.9.7/arch/alpha/kernel/traps.c 2018-01-09 16:36:20.000000000 +0000
186@@ -174,7 +174,8 @@ die_if_kernel(char * str, struct pt_regs
187 #ifdef CONFIG_SMP
188 printk("CPU %d ", hard_smp_processor_id());
189 #endif
190- printk("%s(%d): %s %ld\n", current->comm, task_pid_nr(current), str, err);
191+ printk("%s(%d:#%u): %s %ld\n", current->comm,
192+ task_pid_nr(current), current->xid, str, err);
193 dik_show_regs(regs, r9_15);
194 add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
195 dik_show_trace((unsigned long *)(regs+1));
196diff -NurpP --minimal linux-4.4.116/arch/arm/Kconfig linux-4.4.116-vs2.3.9.7/arch/arm/Kconfig
197--- linux-4.4.116/arch/arm/Kconfig 2016-07-05 04:14:23.000000000 +0000
198+++ linux-4.4.116-vs2.3.9.7/arch/arm/Kconfig 2018-01-09 16:36:20.000000000 +0000
199@@ -2159,6 +2159,8 @@ source "fs/Kconfig"
200
201 source "arch/arm/Kconfig.debug"
202
203+source "kernel/vserver/Kconfig"
204+
205 source "security/Kconfig"
206
207 source "crypto/Kconfig"
208diff -NurpP --minimal linux-4.4.116/arch/arm/kernel/calls.S linux-4.4.116-vs2.3.9.7/arch/arm/kernel/calls.S
209--- linux-4.4.116/arch/arm/kernel/calls.S 2016-07-05 04:14:26.000000000 +0000
210+++ linux-4.4.116-vs2.3.9.7/arch/arm/kernel/calls.S 2018-01-09 16:36:20.000000000 +0000
211@@ -322,7 +322,7 @@
212 /* 310 */ CALL(sys_request_key)
213 CALL(sys_keyctl)
214 CALL(ABI(sys_semtimedop, sys_oabi_semtimedop))
215-/* vserver */ CALL(sys_ni_syscall)
216+ CALL(sys_vserver)
217 CALL(sys_ioprio_set)
218 /* 315 */ CALL(sys_ioprio_get)
219 CALL(sys_inotify_init)
220diff -NurpP --minimal linux-4.4.116/arch/arm/kernel/traps.c linux-4.4.116-vs2.3.9.7/arch/arm/kernel/traps.c
221--- linux-4.4.116/arch/arm/kernel/traps.c 2018-02-22 21:18:48.000000000 +0000
222+++ linux-4.4.116-vs2.3.9.7/arch/arm/kernel/traps.c 2018-01-09 16:36:20.000000000 +0000
223@@ -258,8 +258,8 @@ static int __die(const char *str, int er
224
225 print_modules();
226 __show_regs(regs);
227- pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n",
228- TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), end_of_stack(tsk));
229+ pr_emerg("Process %.*s (pid: %d:%u, stack limit = 0x%p)\n",
230+ TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), tsk->xid, end_of_stack(tsk));
231
232 if (!user_mode(regs) || in_interrupt()) {
233 dump_mem(KERN_EMERG, "Stack: ", regs->ARM_sp,
234diff -NurpP --minimal linux-4.4.116/arch/cris/Kconfig linux-4.4.116-vs2.3.9.7/arch/cris/Kconfig
235--- linux-4.4.116/arch/cris/Kconfig 2016-07-05 04:14:27.000000000 +0000
236+++ linux-4.4.116-vs2.3.9.7/arch/cris/Kconfig 2018-01-09 16:36:20.000000000 +0000
237@@ -581,6 +581,8 @@ source "fs/Kconfig"
238
239 source "arch/cris/Kconfig.debug"
240
241+source "kernel/vserver/Kconfig"
242+
243 source "security/Kconfig"
244
245 source "crypto/Kconfig"
246diff -NurpP --minimal linux-4.4.116/arch/ia64/Kconfig linux-4.4.116-vs2.3.9.7/arch/ia64/Kconfig
247--- linux-4.4.116/arch/ia64/Kconfig 2016-07-05 04:11:39.000000000 +0000
248+++ linux-4.4.116-vs2.3.9.7/arch/ia64/Kconfig 2018-01-09 16:36:21.000000000 +0000
249@@ -606,6 +606,8 @@ source "fs/Kconfig"
250
251 source "arch/ia64/Kconfig.debug"
252
253+source "kernel/vserver/Kconfig"
254+
255 source "security/Kconfig"
256
257 source "crypto/Kconfig"
258diff -NurpP --minimal linux-4.4.116/arch/ia64/kernel/entry.S linux-4.4.116-vs2.3.9.7/arch/ia64/kernel/entry.S
259--- linux-4.4.116/arch/ia64/kernel/entry.S 2016-07-05 04:14:27.000000000 +0000
260+++ linux-4.4.116-vs2.3.9.7/arch/ia64/kernel/entry.S 2018-01-09 16:36:21.000000000 +0000
261@@ -1694,7 +1694,7 @@ sys_call_table:
262 data8 sys_mq_notify
263 data8 sys_mq_getsetattr
264 data8 sys_kexec_load
265- data8 sys_ni_syscall // reserved for vserver
266+ data8 sys_vserver
267 data8 sys_waitid // 1270
268 data8 sys_add_key
269 data8 sys_request_key
270diff -NurpP --minimal linux-4.4.116/arch/ia64/kernel/ptrace.c linux-4.4.116-vs2.3.9.7/arch/ia64/kernel/ptrace.c
271--- linux-4.4.116/arch/ia64/kernel/ptrace.c 2015-04-12 22:12:50.000000000 +0000
272+++ linux-4.4.116-vs2.3.9.7/arch/ia64/kernel/ptrace.c 2018-01-09 16:36:21.000000000 +0000
273@@ -21,6 +21,7 @@
274 #include <linux/regset.h>
275 #include <linux/elf.h>
276 #include <linux/tracehook.h>
277+#include <linux/vs_base.h>
278
279 #include <asm/pgtable.h>
280 #include <asm/processor.h>
281diff -NurpP --minimal linux-4.4.116/arch/ia64/kernel/traps.c linux-4.4.116-vs2.3.9.7/arch/ia64/kernel/traps.c
282--- linux-4.4.116/arch/ia64/kernel/traps.c 2015-04-12 22:12:50.000000000 +0000
283+++ linux-4.4.116-vs2.3.9.7/arch/ia64/kernel/traps.c 2018-01-09 16:36:21.000000000 +0000
284@@ -60,8 +60,9 @@ die (const char *str, struct pt_regs *re
285 put_cpu();
286
287 if (++die.lock_owner_depth < 3) {
288- printk("%s[%d]: %s %ld [%d]\n",
289- current->comm, task_pid_nr(current), str, err, ++die_counter);
290+ printk("%s[%d:#%u]: %s %ld [%d]\n",
291+ current->comm, task_pid_nr(current), current->xid,
292+ str, err, ++die_counter);
293 if (notify_die(DIE_OOPS, str, regs, err, 255, SIGSEGV)
294 != NOTIFY_STOP)
295 show_regs(regs);
296@@ -324,8 +325,9 @@ handle_fpu_swa (int fp_fault, struct pt_
297 if ((last.count & 15) < 5 && (ia64_fetchadd(1, &last.count, acq) & 15) < 5) {
298 last.time = current_jiffies + 5 * HZ;
299 printk(KERN_WARNING
300- "%s(%d): floating-point assist fault at ip %016lx, isr %016lx\n",
301- current->comm, task_pid_nr(current), regs->cr_iip + ia64_psr(regs)->ri, isr);
302+ "%s(%d:#%u): floating-point assist fault at ip %016lx, isr %016lx\n",
303+ current->comm, task_pid_nr(current), current->xid,
304+ regs->cr_iip + ia64_psr(regs)->ri, isr);
305 }
306 }
307 }
308diff -NurpP --minimal linux-4.4.116/arch/m32r/kernel/traps.c linux-4.4.116-vs2.3.9.7/arch/m32r/kernel/traps.c
309--- linux-4.4.116/arch/m32r/kernel/traps.c 2015-04-12 22:12:50.000000000 +0000
310+++ linux-4.4.116-vs2.3.9.7/arch/m32r/kernel/traps.c 2018-01-09 16:36:21.000000000 +0000
311@@ -184,8 +184,9 @@ static void show_registers(struct pt_reg
312 } else {
313 printk("SPI: %08lx\n", sp);
314 }
315- printk("Process %s (pid: %d, process nr: %d, stackpage=%08lx)",
316- current->comm, task_pid_nr(current), 0xffff & i, 4096+(unsigned long)current);
317+ printk("Process %s (pid: %d:#%u, process nr: %d, stackpage=%08lx)",
318+ current->comm, task_pid_nr(current), current->xid,
319+ 0xffff & i, 4096+(unsigned long)current);
320
321 /*
322 * When in-kernel, we also print out the stack and code at the
323diff -NurpP --minimal linux-4.4.116/arch/m68k/Kconfig linux-4.4.116-vs2.3.9.7/arch/m68k/Kconfig
324--- linux-4.4.116/arch/m68k/Kconfig 2016-07-05 04:11:39.000000000 +0000
325+++ linux-4.4.116-vs2.3.9.7/arch/m68k/Kconfig 2018-01-09 16:36:21.000000000 +0000
326@@ -164,6 +164,8 @@ source "fs/Kconfig"
327
328 source "arch/m68k/Kconfig.debug"
329
330+source "kernel/vserver/Kconfig"
331+
332 source "security/Kconfig"
333
334 source "crypto/Kconfig"
335diff -NurpP --minimal linux-4.4.116/arch/mips/Kconfig linux-4.4.116-vs2.3.9.7/arch/mips/Kconfig
336--- linux-4.4.116/arch/mips/Kconfig 2018-02-22 21:18:55.000000000 +0000
337+++ linux-4.4.116-vs2.3.9.7/arch/mips/Kconfig 2018-01-09 16:36:21.000000000 +0000
338@@ -3026,6 +3026,8 @@ source "fs/Kconfig"
339
340 source "arch/mips/Kconfig.debug"
341
342+source "kernel/vserver/Kconfig"
343+
344 source "security/Kconfig"
345
346 source "crypto/Kconfig"
347diff -NurpP --minimal linux-4.4.116/arch/mips/kernel/ptrace.c linux-4.4.116-vs2.3.9.7/arch/mips/kernel/ptrace.c
348--- linux-4.4.116/arch/mips/kernel/ptrace.c 2018-02-22 21:18:56.000000000 +0000
349+++ linux-4.4.116-vs2.3.9.7/arch/mips/kernel/ptrace.c 2018-01-25 00:25:00.000000000 +0000
350@@ -30,6 +30,7 @@
351 #include <linux/audit.h>
352 #include <linux/seccomp.h>
353 #include <linux/ftrace.h>
354+#include <linux/vs_base.h>
355
356 #include <asm/byteorder.h>
357 #include <asm/cpu.h>
358@@ -787,6 +788,9 @@ long arch_ptrace(struct task_struct *chi
359 void __user *datavp = (void __user *) data;
360 unsigned long __user *datalp = (void __user *) data;
361
362+ if (!vx_check(vx_task_xid(child), VS_WATCH_P | VS_IDENT))
363+ goto out;
364+
365 switch (request) {
366 /* when I and D space are separate, these will need to be fixed. */
367 case PTRACE_PEEKTEXT: /* read word at location addr. */
368diff -NurpP --minimal linux-4.4.116/arch/mips/kernel/scall32-o32.S linux-4.4.116-vs2.3.9.7/arch/mips/kernel/scall32-o32.S
369--- linux-4.4.116/arch/mips/kernel/scall32-o32.S 2018-02-22 21:18:56.000000000 +0000
370+++ linux-4.4.116-vs2.3.9.7/arch/mips/kernel/scall32-o32.S 2018-01-09 16:36:21.000000000 +0000
371@@ -512,7 +512,7 @@ EXPORT(sys_call_table)
372 PTR sys_mq_timedreceive
373 PTR sys_mq_notify /* 4275 */
374 PTR sys_mq_getsetattr
375- PTR sys_ni_syscall /* sys_vserver */
376+ PTR sys_vserver
377 PTR sys_waitid
378 PTR sys_ni_syscall /* available, was setaltroot */
379 PTR sys_add_key /* 4280 */
380diff -NurpP --minimal linux-4.4.116/arch/mips/kernel/scall64-64.S linux-4.4.116-vs2.3.9.7/arch/mips/kernel/scall64-64.S
381--- linux-4.4.116/arch/mips/kernel/scall64-64.S 2018-02-22 21:18:56.000000000 +0000
382+++ linux-4.4.116-vs2.3.9.7/arch/mips/kernel/scall64-64.S 2018-01-09 16:36:21.000000000 +0000
383@@ -349,7 +349,7 @@ EXPORT(sys_call_table)
384 PTR sys_mq_timedreceive
385 PTR sys_mq_notify
386 PTR sys_mq_getsetattr /* 5235 */
387- PTR sys_ni_syscall /* sys_vserver */
388+ PTR sys_vserver
389 PTR sys_waitid
390 PTR sys_ni_syscall /* available, was setaltroot */
391 PTR sys_add_key
392diff -NurpP --minimal linux-4.4.116/arch/mips/kernel/scall64-n32.S linux-4.4.116-vs2.3.9.7/arch/mips/kernel/scall64-n32.S
393--- linux-4.4.116/arch/mips/kernel/scall64-n32.S 2018-02-22 21:18:56.000000000 +0000
394+++ linux-4.4.116-vs2.3.9.7/arch/mips/kernel/scall64-n32.S 2018-01-09 16:36:21.000000000 +0000
395@@ -339,7 +339,7 @@ EXPORT(sysn32_call_table)
396 PTR compat_sys_mq_timedreceive
397 PTR compat_sys_mq_notify
398 PTR compat_sys_mq_getsetattr
399- PTR sys_ni_syscall /* 6240, sys_vserver */
400+ PTR sys32_vserver /* 6240 */
401 PTR compat_sys_waitid
402 PTR sys_ni_syscall /* available, was setaltroot */
403 PTR sys_add_key
404diff -NurpP --minimal linux-4.4.116/arch/mips/kernel/scall64-o32.S linux-4.4.116-vs2.3.9.7/arch/mips/kernel/scall64-o32.S
405--- linux-4.4.116/arch/mips/kernel/scall64-o32.S 2018-02-22 21:18:56.000000000 +0000
406+++ linux-4.4.116-vs2.3.9.7/arch/mips/kernel/scall64-o32.S 2018-01-09 16:36:21.000000000 +0000
407@@ -495,7 +495,7 @@ EXPORT(sys32_call_table)
408 PTR compat_sys_mq_timedreceive
409 PTR compat_sys_mq_notify /* 4275 */
410 PTR compat_sys_mq_getsetattr
411- PTR sys_ni_syscall /* sys_vserver */
412+ PTR sys32_vserver
413 PTR compat_sys_waitid
414 PTR sys_ni_syscall /* available, was setaltroot */
415 PTR sys_add_key /* 4280 */
416diff -NurpP --minimal linux-4.4.116/arch/mips/kernel/traps.c linux-4.4.116-vs2.3.9.7/arch/mips/kernel/traps.c
417--- linux-4.4.116/arch/mips/kernel/traps.c 2018-02-22 21:18:56.000000000 +0000
418+++ linux-4.4.116-vs2.3.9.7/arch/mips/kernel/traps.c 2018-01-09 16:36:21.000000000 +0000
419@@ -353,9 +353,10 @@ void show_registers(struct pt_regs *regs
420
421 __show_regs(regs);
422 print_modules();
423- printk("Process %s (pid: %d, threadinfo=%p, task=%p, tls=%0*lx)\n",
424- current->comm, current->pid, current_thread_info(), current,
425- field, current_thread_info()->tp_value);
426+ printk("Process %s (pid: %d:#%u, threadinfo=%p, task=%p, tls=%0*lx)\n",
427+ current->comm, task_pid_nr(current), current->xid,
428+ current_thread_info(), current,
429+ field, current_thread_info()->tp_value);
430 if (cpu_has_userlocal) {
431 unsigned long tls;
432
433diff -NurpP --minimal linux-4.4.116/arch/parisc/Kconfig linux-4.4.116-vs2.3.9.7/arch/parisc/Kconfig
434--- linux-4.4.116/arch/parisc/Kconfig 2016-07-05 04:14:29.000000000 +0000
435+++ linux-4.4.116-vs2.3.9.7/arch/parisc/Kconfig 2018-01-09 16:36:21.000000000 +0000
436@@ -341,6 +341,8 @@ config SECCOMP
437
438 If unsure, say Y. Only embedded should say N here.
439
440+source "kernel/vserver/Kconfig"
441+
442 source "security/Kconfig"
443
444 source "crypto/Kconfig"
445diff -NurpP --minimal linux-4.4.116/arch/parisc/kernel/syscall_table.S linux-4.4.116-vs2.3.9.7/arch/parisc/kernel/syscall_table.S
446--- linux-4.4.116/arch/parisc/kernel/syscall_table.S 2018-02-22 21:18:58.000000000 +0000
447+++ linux-4.4.116-vs2.3.9.7/arch/parisc/kernel/syscall_table.S 2018-01-09 16:36:21.000000000 +0000
448@@ -358,7 +358,7 @@
449 ENTRY_COMP(mbind) /* 260 */
450 ENTRY_COMP(get_mempolicy)
451 ENTRY_COMP(set_mempolicy)
452- ENTRY_SAME(ni_syscall) /* 263: reserved for vserver */
453+ ENTRY_DIFF(vserver)
454 ENTRY_SAME(add_key)
455 ENTRY_SAME(request_key) /* 265 */
456 ENTRY_COMP(keyctl)
457diff -NurpP --minimal linux-4.4.116/arch/parisc/kernel/traps.c linux-4.4.116-vs2.3.9.7/arch/parisc/kernel/traps.c
458--- linux-4.4.116/arch/parisc/kernel/traps.c 2018-02-22 21:18:58.000000000 +0000
459+++ linux-4.4.116-vs2.3.9.7/arch/parisc/kernel/traps.c 2018-01-09 16:36:21.000000000 +0000
460@@ -235,8 +235,9 @@ void die_if_kernel(char *str, struct pt_
461 return; /* STFU */
462
463 parisc_printk_ratelimited(1, regs,
464- KERN_CRIT "%s (pid %d): %s (code %ld) at " RFMT "\n",
465- current->comm, task_pid_nr(current), str, err, regs->iaoq[0]);
466+ KERN_CRIT "%s (pid %d:#%u): %s (code %ld) at " RFMT "\n",
467+ current->comm, task_pid_nr(current), current->xid,
468+ str, err, regs->iaoq[0]);
469
470 return;
471 }
472@@ -266,8 +267,8 @@ void die_if_kernel(char *str, struct pt_
473 pdc_console_restart();
474
475 if (err)
476- printk(KERN_CRIT "%s (pid %d): %s (code %ld)\n",
477- current->comm, task_pid_nr(current), str, err);
478+ printk(KERN_CRIT "%s (pid %d:#%u): %s (code %ld)\n",
479+ current->comm, task_pid_nr(current), current->xid, str, err);
480
481 /* Wot's wrong wif bein' racy? */
482 if (current->thread.flags & PARISC_KERNEL_DEATH) {
483diff -NurpP --minimal linux-4.4.116/arch/powerpc/Kconfig linux-4.4.116-vs2.3.9.7/arch/powerpc/Kconfig
484--- linux-4.4.116/arch/powerpc/Kconfig 2018-02-22 21:18:58.000000000 +0000
485+++ linux-4.4.116-vs2.3.9.7/arch/powerpc/Kconfig 2018-02-22 21:30:19.000000000 +0000
486@@ -1081,6 +1081,8 @@ source "lib/Kconfig"
487
488 source "arch/powerpc/Kconfig.debug"
489
490+source "kernel/vserver/Kconfig"
491+
492 source "security/Kconfig"
493
494 source "crypto/Kconfig"
495diff -NurpP --minimal linux-4.4.116/arch/powerpc/include/uapi/asm/unistd.h linux-4.4.116-vs2.3.9.7/arch/powerpc/include/uapi/asm/unistd.h
496--- linux-4.4.116/arch/powerpc/include/uapi/asm/unistd.h 2016-07-05 04:14:29.000000000 +0000
497+++ linux-4.4.116-vs2.3.9.7/arch/powerpc/include/uapi/asm/unistd.h 2018-01-09 16:36:21.000000000 +0000
498@@ -275,7 +275,7 @@
499 #endif
500 #define __NR_rtas 255
501 #define __NR_sys_debug_setcontext 256
502-/* Number 257 is reserved for vserver */
503+#define __NR_vserver 257
504 #define __NR_migrate_pages 258
505 #define __NR_mbind 259
506 #define __NR_get_mempolicy 260
507diff -NurpP --minimal linux-4.4.116/arch/powerpc/kernel/traps.c linux-4.4.116-vs2.3.9.7/arch/powerpc/kernel/traps.c
508--- linux-4.4.116/arch/powerpc/kernel/traps.c 2018-02-22 21:19:02.000000000 +0000
509+++ linux-4.4.116-vs2.3.9.7/arch/powerpc/kernel/traps.c 2018-01-09 16:36:21.000000000 +0000
510@@ -1315,8 +1315,9 @@ void nonrecoverable_exception(struct pt_
511
512 void trace_syscall(struct pt_regs *regs)
513 {
514- printk("Task: %p(%d), PC: %08lX/%08lX, Syscall: %3ld, Result: %s%ld %s\n",
515- current, task_pid_nr(current), regs->nip, regs->link, regs->gpr[0],
516+ printk("Task: %p(%d:#%u), PC: %08lX/%08lX, Syscall: %3ld, Result: %s%ld %s\n",
517+ current, task_pid_nr(current), current->xid,
518+ regs->nip, regs->link, regs->gpr[0],
519 regs->ccr&0x10000000?"Error=":"", regs->gpr[3], print_tainted());
520 }
521
522diff -NurpP --minimal linux-4.4.116/arch/s390/Kconfig linux-4.4.116-vs2.3.9.7/arch/s390/Kconfig
523--- linux-4.4.116/arch/s390/Kconfig 2018-02-22 21:19:03.000000000 +0000
524+++ linux-4.4.116-vs2.3.9.7/arch/s390/Kconfig 2018-02-10 15:16:50.000000000 +0000
525@@ -730,6 +730,8 @@ source "fs/Kconfig"
526
527 source "arch/s390/Kconfig.debug"
528
529+source "kernel/vserver/Kconfig"
530+
531 source "security/Kconfig"
532
533 source "crypto/Kconfig"
534diff -NurpP --minimal linux-4.4.116/arch/s390/include/asm/tlb.h linux-4.4.116-vs2.3.9.7/arch/s390/include/asm/tlb.h
535--- linux-4.4.116/arch/s390/include/asm/tlb.h 2015-07-06 20:41:37.000000000 +0000
536+++ linux-4.4.116-vs2.3.9.7/arch/s390/include/asm/tlb.h 2018-01-09 16:36:21.000000000 +0000
537@@ -24,6 +24,7 @@
538 #include <linux/mm.h>
539 #include <linux/pagemap.h>
540 #include <linux/swap.h>
541+
542 #include <asm/processor.h>
543 #include <asm/pgalloc.h>
544 #include <asm/tlbflush.h>
545diff -NurpP --minimal linux-4.4.116/arch/s390/include/uapi/asm/unistd.h linux-4.4.116-vs2.3.9.7/arch/s390/include/uapi/asm/unistd.h
546--- linux-4.4.116/arch/s390/include/uapi/asm/unistd.h 2016-07-05 04:14:30.000000000 +0000
547+++ linux-4.4.116-vs2.3.9.7/arch/s390/include/uapi/asm/unistd.h 2018-01-09 16:48:33.000000000 +0000
548@@ -200,7 +200,7 @@
549 #define __NR_clock_gettime 260
550 #define __NR_clock_getres 261
551 #define __NR_clock_nanosleep 262
552-/* Number 263 is reserved for vserver */
553+#define __NR_vserver 263
554 #define __NR_statfs64 265
555 #define __NR_fstatfs64 266
556 #define __NR_remap_file_pages 267
557diff -NurpP --minimal linux-4.4.116/arch/s390/kernel/ptrace.c linux-4.4.116-vs2.3.9.7/arch/s390/kernel/ptrace.c
558--- linux-4.4.116/arch/s390/kernel/ptrace.c 2018-02-22 21:19:04.000000000 +0000
559+++ linux-4.4.116-vs2.3.9.7/arch/s390/kernel/ptrace.c 2018-01-09 16:36:21.000000000 +0000
560@@ -21,6 +21,7 @@
561 #include <linux/tracehook.h>
562 #include <linux/seccomp.h>
563 #include <linux/compat.h>
564+#include <linux/vs_base.h>
565 #include <trace/syscall.h>
566 #include <asm/segment.h>
567 #include <asm/page.h>
568diff -NurpP --minimal linux-4.4.116/arch/s390/kernel/syscalls.S linux-4.4.116-vs2.3.9.7/arch/s390/kernel/syscalls.S
569--- linux-4.4.116/arch/s390/kernel/syscalls.S 2018-02-22 21:19:04.000000000 +0000
570+++ linux-4.4.116-vs2.3.9.7/arch/s390/kernel/syscalls.S 2018-01-09 16:36:21.000000000 +0000
571@@ -271,7 +271,7 @@ SYSCALL(sys_clock_settime,compat_sys_clo
572 SYSCALL(sys_clock_gettime,compat_sys_clock_gettime) /* 260 */
573 SYSCALL(sys_clock_getres,compat_sys_clock_getres)
574 SYSCALL(sys_clock_nanosleep,compat_sys_clock_nanosleep)
575-NI_SYSCALL /* reserved for vserver */
576+SYSCALL(sys_vserver,sys_vserver,sys32_vserver)
577 SYSCALL(sys_ni_syscall,compat_sys_s390_fadvise64_64)
578 SYSCALL(sys_statfs64,compat_sys_statfs64)
579 SYSCALL(sys_fstatfs64,compat_sys_fstatfs64)
580diff -NurpP --minimal linux-4.4.116/arch/sh/Kconfig linux-4.4.116-vs2.3.9.7/arch/sh/Kconfig
581--- linux-4.4.116/arch/sh/Kconfig 2016-07-05 04:11:46.000000000 +0000
582+++ linux-4.4.116-vs2.3.9.7/arch/sh/Kconfig 2018-01-09 16:36:21.000000000 +0000
583@@ -883,6 +883,8 @@ source "fs/Kconfig"
584
585 source "arch/sh/Kconfig.debug"
586
587+source "kernel/vserver/Kconfig"
588+
589 source "security/Kconfig"
590
591 source "crypto/Kconfig"
592diff -NurpP --minimal linux-4.4.116/arch/sh/kernel/irq.c linux-4.4.116-vs2.3.9.7/arch/sh/kernel/irq.c
593--- linux-4.4.116/arch/sh/kernel/irq.c 2016-07-05 04:11:46.000000000 +0000
594+++ linux-4.4.116-vs2.3.9.7/arch/sh/kernel/irq.c 2018-01-09 16:36:21.000000000 +0000
595@@ -14,6 +14,7 @@
596 #include <linux/ftrace.h>
597 #include <linux/delay.h>
598 #include <linux/ratelimit.h>
599+// #include <linux/vs_context.h>
600 #include <asm/processor.h>
601 #include <asm/machvec.h>
602 #include <asm/uaccess.h>
603diff -NurpP --minimal linux-4.4.116/arch/sparc/Kconfig linux-4.4.116-vs2.3.9.7/arch/sparc/Kconfig
604--- linux-4.4.116/arch/sparc/Kconfig 2018-02-22 21:19:04.000000000 +0000
605+++ linux-4.4.116-vs2.3.9.7/arch/sparc/Kconfig 2018-01-09 16:36:21.000000000 +0000
606@@ -561,6 +561,8 @@ source "fs/Kconfig"
607
608 source "arch/sparc/Kconfig.debug"
609
610+source "kernel/vserver/Kconfig"
611+
612 source "security/Kconfig"
613
614 source "crypto/Kconfig"
615diff -NurpP --minimal linux-4.4.116/arch/sparc/include/uapi/asm/unistd.h linux-4.4.116-vs2.3.9.7/arch/sparc/include/uapi/asm/unistd.h
616--- linux-4.4.116/arch/sparc/include/uapi/asm/unistd.h 2016-07-05 04:14:33.000000000 +0000
617+++ linux-4.4.116-vs2.3.9.7/arch/sparc/include/uapi/asm/unistd.h 2018-01-09 16:36:21.000000000 +0000
618@@ -332,7 +332,7 @@
619 #define __NR_timer_getoverrun 264
620 #define __NR_timer_delete 265
621 #define __NR_timer_create 266
622-/* #define __NR_vserver 267 Reserved for VSERVER */
623+#define __NR_vserver 267
624 #define __NR_io_setup 268
625 #define __NR_io_destroy 269
626 #define __NR_io_submit 270
627diff -NurpP --minimal linux-4.4.116/arch/sparc/kernel/systbls_32.S linux-4.4.116-vs2.3.9.7/arch/sparc/kernel/systbls_32.S
628--- linux-4.4.116/arch/sparc/kernel/systbls_32.S 2016-07-05 04:14:33.000000000 +0000
629+++ linux-4.4.116-vs2.3.9.7/arch/sparc/kernel/systbls_32.S 2018-01-09 16:36:21.000000000 +0000
630@@ -70,7 +70,7 @@ sys_call_table:
631 /*250*/ .long sys_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_ni_syscall
632 /*255*/ .long sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
633 /*260*/ .long sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
634-/*265*/ .long sys_timer_delete, sys_timer_create, sys_nis_syscall, sys_io_setup, sys_io_destroy
635+/*265*/ .long sys_timer_delete, sys_timer_create, sys_vserver, sys_io_setup, sys_io_destroy
636 /*270*/ .long sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink
637 /*275*/ .long sys_mq_timedsend, sys_mq_timedreceive, sys_mq_notify, sys_mq_getsetattr, sys_waitid
638 /*280*/ .long sys_tee, sys_add_key, sys_request_key, sys_keyctl, sys_openat
639diff -NurpP --minimal linux-4.4.116/arch/sparc/kernel/systbls_64.S linux-4.4.116-vs2.3.9.7/arch/sparc/kernel/systbls_64.S
640--- linux-4.4.116/arch/sparc/kernel/systbls_64.S 2016-07-05 04:14:33.000000000 +0000
641+++ linux-4.4.116-vs2.3.9.7/arch/sparc/kernel/systbls_64.S 2018-01-09 16:36:21.000000000 +0000
642@@ -71,7 +71,7 @@ sys_call_table32:
643 /*250*/ .word sys_mremap, compat_sys_sysctl, sys_getsid, sys_fdatasync, sys_nis_syscall
644 .word sys32_sync_file_range, compat_sys_clock_settime, compat_sys_clock_gettime, compat_sys_clock_getres, sys32_clock_nanosleep
645 /*260*/ .word compat_sys_sched_getaffinity, compat_sys_sched_setaffinity, sys32_timer_settime, compat_sys_timer_gettime, sys_timer_getoverrun
646- .word sys_timer_delete, compat_sys_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
647+ .word sys_timer_delete, compat_sys_timer_create, sys32_vserver, compat_sys_io_setup, sys_io_destroy
648 /*270*/ .word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
649 .word compat_sys_mq_timedsend, compat_sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
650 /*280*/ .word sys_tee, sys_add_key, sys_request_key, compat_sys_keyctl, compat_sys_openat
651@@ -152,7 +152,7 @@ sys_call_table:
652 /*250*/ .word sys_64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nis_syscall
653 .word sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
654 /*260*/ .word sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
655- .word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_io_setup, sys_io_destroy
656+ .word sys_timer_delete, sys_timer_create, sys_vserver, sys_io_setup, sys_io_destroy
657 /*270*/ .word sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink
658 .word sys_mq_timedsend, sys_mq_timedreceive, sys_mq_notify, sys_mq_getsetattr, sys_waitid
659 /*280*/ .word sys_tee, sys_add_key, sys_request_key, sys_keyctl, sys_openat
660diff -NurpP --minimal linux-4.4.116/arch/um/Kconfig.rest linux-4.4.116-vs2.3.9.7/arch/um/Kconfig.rest
661--- linux-4.4.116/arch/um/Kconfig.rest 2015-04-12 22:12:50.000000000 +0000
662+++ linux-4.4.116-vs2.3.9.7/arch/um/Kconfig.rest 2018-01-09 16:36:21.000000000 +0000
663@@ -12,6 +12,8 @@ source "arch/um/Kconfig.net"
664
665 source "fs/Kconfig"
666
667+source "kernel/vserver/Kconfig"
668+
669 source "security/Kconfig"
670
671 source "crypto/Kconfig"
672diff -NurpP --minimal linux-4.4.116/arch/x86/Kconfig linux-4.4.116-vs2.3.9.7/arch/x86/Kconfig
673--- linux-4.4.116/arch/x86/Kconfig 2018-02-22 21:19:06.000000000 +0000
674+++ linux-4.4.116-vs2.3.9.7/arch/x86/Kconfig 2018-02-10 15:16:50.000000000 +0000
675@@ -2687,6 +2687,8 @@ source "fs/Kconfig"
676
677 source "arch/x86/Kconfig.debug"
678
679+source "kernel/vserver/Kconfig"
680+
681 source "security/Kconfig"
682
683 source "crypto/Kconfig"
684diff -NurpP --minimal linux-4.4.116/arch/x86/entry/syscalls/syscall_32.tbl linux-4.4.116-vs2.3.9.7/arch/x86/entry/syscalls/syscall_32.tbl
685--- linux-4.4.116/arch/x86/entry/syscalls/syscall_32.tbl 2018-02-22 21:19:07.000000000 +0000
686+++ linux-4.4.116-vs2.3.9.7/arch/x86/entry/syscalls/syscall_32.tbl 2018-01-10 01:51:14.000000000 +0000
687@@ -279,7 +279,7 @@
688 270 i386 tgkill sys_tgkill
689 271 i386 utimes sys_utimes compat_sys_utimes
690 272 i386 fadvise64_64 sys_fadvise64_64 sys32_fadvise64_64
691-273 i386 vserver
692+273 i386 vserver sys_vserver sys32_vserver
693 274 i386 mbind sys_mbind
694 275 i386 get_mempolicy sys_get_mempolicy compat_sys_get_mempolicy
695 276 i386 set_mempolicy sys_set_mempolicy
696diff -NurpP --minimal linux-4.4.116/arch/x86/entry/syscalls/syscall_64.tbl linux-4.4.116-vs2.3.9.7/arch/x86/entry/syscalls/syscall_64.tbl
697--- linux-4.4.116/arch/x86/entry/syscalls/syscall_64.tbl 2016-07-05 04:14:33.000000000 +0000
698+++ linux-4.4.116-vs2.3.9.7/arch/x86/entry/syscalls/syscall_64.tbl 2018-01-10 01:51:32.000000000 +0000
699@@ -242,7 +242,7 @@
700 233 common epoll_ctl sys_epoll_ctl
701 234 common tgkill sys_tgkill
702 235 common utimes sys_utimes
703-236 64 vserver
704+236 64 vserver sys_vserver
705 237 common mbind sys_mbind
706 238 common set_mempolicy sys_set_mempolicy
707 239 common get_mempolicy sys_get_mempolicy
708diff -NurpP --minimal linux-4.4.116/block/ioprio.c linux-4.4.116-vs2.3.9.7/block/ioprio.c
709--- linux-4.4.116/block/ioprio.c 2018-02-22 21:19:12.000000000 +0000
710+++ linux-4.4.116-vs2.3.9.7/block/ioprio.c 2018-01-09 16:36:23.000000000 +0000
711@@ -28,6 +28,7 @@
712 #include <linux/syscalls.h>
713 #include <linux/security.h>
714 #include <linux/pid_namespace.h>
715+#include <linux/vs_base.h>
716
717 int set_task_ioprio(struct task_struct *task, int ioprio)
718 {
719@@ -105,6 +106,8 @@ SYSCALL_DEFINE3(ioprio_set, int, which,
720 else
721 pgrp = find_vpid(who);
722 do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
723+ if (!vx_check(p->xid, VS_ADMIN_P | VS_IDENT))
724+ continue;
725 ret = set_task_ioprio(p, ioprio);
726 if (ret)
727 break;
728@@ -203,6 +206,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which,
729 else
730 pgrp = find_vpid(who);
731 do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
732+ if (!vx_check(p->xid, VS_ADMIN_P | VS_IDENT))
733+ continue;
734 tmpio = get_task_ioprio(p);
735 if (tmpio < 0)
736 continue;
737diff -NurpP --minimal linux-4.4.116/drivers/block/Kconfig linux-4.4.116-vs2.3.9.7/drivers/block/Kconfig
738--- linux-4.4.116/drivers/block/Kconfig 2016-07-05 04:14:35.000000000 +0000
739+++ linux-4.4.116-vs2.3.9.7/drivers/block/Kconfig 2018-01-09 16:36:23.000000000 +0000
740@@ -283,6 +283,13 @@ config BLK_DEV_CRYPTOLOOP
741
742 source "drivers/block/drbd/Kconfig"
743
744+config BLK_DEV_VROOT
745+ tristate "Virtual Root device support"
746+ depends on QUOTACTL
747+ ---help---
748+ Saying Y here will allow you to use quota/fs ioctls on a shared
749+ partition within a virtual server without compromising security.
750+
751 config BLK_DEV_NBD
752 tristate "Network block device support"
753 depends on NET
754diff -NurpP --minimal linux-4.4.116/drivers/block/Makefile linux-4.4.116-vs2.3.9.7/drivers/block/Makefile
755--- linux-4.4.116/drivers/block/Makefile 2016-07-05 04:14:35.000000000 +0000
756+++ linux-4.4.116-vs2.3.9.7/drivers/block/Makefile 2018-01-09 16:36:23.000000000 +0000
757@@ -32,6 +32,7 @@ obj-$(CONFIG_VIRTIO_BLK) += virtio_blk.o
758
759 obj-$(CONFIG_BLK_DEV_SX8) += sx8.o
760 obj-$(CONFIG_BLK_DEV_HD) += hd.o
761+obj-$(CONFIG_BLK_DEV_VROOT) += vroot.o
762
763 obj-$(CONFIG_XEN_BLKDEV_FRONTEND) += xen-blkfront.o
764 obj-$(CONFIG_XEN_BLKDEV_BACKEND) += xen-blkback/
765diff -NurpP --minimal linux-4.4.116/drivers/block/loop.c linux-4.4.116-vs2.3.9.7/drivers/block/loop.c
766--- linux-4.4.116/drivers/block/loop.c 2018-02-22 21:19:16.000000000 +0000
767+++ linux-4.4.116-vs2.3.9.7/drivers/block/loop.c 2018-02-10 15:16:50.000000000 +0000
768@@ -76,6 +76,7 @@
769 #include <linux/miscdevice.h>
770 #include <linux/falloc.h>
771 #include <linux/uio.h>
772+#include <linux/vs_context.h>
773 #include "loop.h"
774
775 #include <asm/uaccess.h>
776@@ -935,6 +936,7 @@ static int loop_set_fd(struct loop_devic
777 lo->lo_blocksize = lo_blocksize;
778 lo->lo_device = bdev;
779 lo->lo_flags = lo_flags;
780+ lo->lo_xid = vx_current_xid();
781 lo->lo_backing_file = file;
782 lo->transfer = NULL;
783 lo->ioctl = NULL;
784@@ -1055,6 +1057,7 @@ static int loop_clr_fd(struct loop_devic
785 lo->lo_offset = 0;
786 lo->lo_sizelimit = 0;
787 lo->lo_encrypt_key_size = 0;
788+ lo->lo_xid = 0;
789 memset(lo->lo_encrypt_key, 0, LO_KEY_SIZE);
790 memset(lo->lo_crypt_name, 0, LO_NAME_SIZE);
791 memset(lo->lo_file_name, 0, LO_NAME_SIZE);
792@@ -1101,7 +1104,7 @@ loop_set_status(struct loop_device *lo,
793
794 if (lo->lo_encrypt_key_size &&
795 !uid_eq(lo->lo_key_owner, uid) &&
796- !capable(CAP_SYS_ADMIN))
797+ !vx_capable(CAP_SYS_ADMIN, VXC_ADMIN_CLOOP))
798 return -EPERM;
799 if (lo->lo_state != Lo_bound)
800 return -ENXIO;
801@@ -1202,7 +1205,8 @@ loop_get_status(struct loop_device *lo,
802 memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
803 info->lo_encrypt_type =
804 lo->lo_encryption ? lo->lo_encryption->number : 0;
805- if (lo->lo_encrypt_key_size && capable(CAP_SYS_ADMIN)) {
806+ if (lo->lo_encrypt_key_size &&
807+ vx_capable(CAP_SYS_ADMIN, VXC_ADMIN_CLOOP)) {
808 info->lo_encrypt_key_size = lo->lo_encrypt_key_size;
809 memcpy(info->lo_encrypt_key, lo->lo_encrypt_key,
810 lo->lo_encrypt_key_size);
811@@ -1563,6 +1567,11 @@ static int lo_open(struct block_device *
812 goto out;
813 }
814
815+ if (!vx_check(lo->lo_xid, VS_IDENT|VS_HOSTID|VS_ADMIN_P)) {
816+ err = -EACCES;
817+ goto out;
818+ }
819+
820 atomic_inc(&lo->lo_refcnt);
821 out:
822 mutex_unlock(&loop_index_mutex);
823diff -NurpP --minimal linux-4.4.116/drivers/block/loop.h linux-4.4.116-vs2.3.9.7/drivers/block/loop.h
824--- linux-4.4.116/drivers/block/loop.h 2016-07-05 04:14:35.000000000 +0000
825+++ linux-4.4.116-vs2.3.9.7/drivers/block/loop.h 2018-01-09 16:36:23.000000000 +0000
826@@ -43,6 +43,7 @@ struct loop_device {
827 struct loop_func_table *lo_encryption;
828 __u32 lo_init[2];
829 kuid_t lo_key_owner; /* Who set the key */
830+ vxid_t lo_xid;
831 int (*ioctl)(struct loop_device *, int cmd,
832 unsigned long arg);
833
834diff -NurpP --minimal linux-4.4.116/drivers/block/vroot.c linux-4.4.116-vs2.3.9.7/drivers/block/vroot.c
835--- linux-4.4.116/drivers/block/vroot.c 1970-01-01 00:00:00.000000000 +0000
836+++ linux-4.4.116-vs2.3.9.7/drivers/block/vroot.c 2018-01-11 07:37:22.000000000 +0000
837@@ -0,0 +1,291 @@
838+/*
839+ * linux/drivers/block/vroot.c
840+ *
841+ * written by Herbert P?tzl, 9/11/2002
842+ * ported to 2.6.10 by Herbert P?tzl, 30/12/2004
843+ *
844+ * based on the loop.c code by Theodore Ts'o.
845+ *
846+ * Copyright (C) 2002-2007 by Herbert P?tzl.
847+ * Redistribution of this file is permitted under the
848+ * GNU General Public License.
849+ *
850+ */
851+
852+#include <linux/module.h>
853+#include <linux/moduleparam.h>
854+#include <linux/file.h>
855+#include <linux/major.h>
856+#include <linux/blkdev.h>
857+#include <linux/slab.h>
858+
859+#include <linux/vroot.h>
860+#include <linux/vs_context.h>
861+
862+
863+static int max_vroot = 8;
864+
865+static struct vroot_device *vroot_dev;
866+static struct gendisk **disks;
867+
868+
869+static int vroot_set_dev(
870+ struct vroot_device *vr,
871+ struct block_device *bdev,
872+ unsigned int arg)
873+{
874+ struct block_device *real_bdev;
875+ struct file *file;
876+ struct inode *inode;
877+ int error;
878+
879+ error = -EBUSY;
880+ if (vr->vr_state != Vr_unbound)
881+ goto out;
882+
883+ error = -EBADF;
884+ file = fget(arg);
885+ if (!file)
886+ goto out;
887+
888+ error = -EINVAL;
889+ inode = file->f_path.dentry->d_inode;
890+
891+
892+ if (S_ISBLK(inode->i_mode)) {
893+ real_bdev = inode->i_bdev;
894+ vr->vr_device = real_bdev;
895+ __iget(real_bdev->bd_inode);
896+ } else
897+ goto out_fput;
898+
899+ vxdprintk(VXD_CBIT(misc, 0),
900+ "vroot[%d]_set_dev: dev=" VXF_DEV,
901+ vr->vr_number, VXD_DEV(real_bdev));
902+
903+ vr->vr_state = Vr_bound;
904+ error = 0;
905+
906+ out_fput:
907+ fput(file);
908+ out:
909+ return error;
910+}
911+
912+static int vroot_clr_dev(
913+ struct vroot_device *vr,
914+ struct block_device *bdev)
915+{
916+ struct block_device *real_bdev;
917+
918+ if (vr->vr_state != Vr_bound)
919+ return -ENXIO;
920+ if (vr->vr_refcnt > 1) /* we needed one fd for the ioctl */
921+ return -EBUSY;
922+
923+ real_bdev = vr->vr_device;
924+
925+ vxdprintk(VXD_CBIT(misc, 0),
926+ "vroot[%d]_clr_dev: dev=" VXF_DEV,
927+ vr->vr_number, VXD_DEV(real_bdev));
928+
929+ bdput(real_bdev);
930+ vr->vr_state = Vr_unbound;
931+ vr->vr_device = NULL;
932+ return 0;
933+}
934+
935+
936+static int vr_ioctl(struct block_device *bdev, fmode_t mode,
937+ unsigned int cmd, unsigned long arg)
938+{
939+ struct vroot_device *vr = bdev->bd_disk->private_data;
940+ int err;
941+
942+ down(&vr->vr_ctl_mutex);
943+ switch (cmd) {
944+ case VROOT_SET_DEV:
945+ err = vroot_set_dev(vr, bdev, arg);
946+ break;
947+ case VROOT_CLR_DEV:
948+ err = vroot_clr_dev(vr, bdev);
949+ break;
950+ default:
951+ err = -EINVAL;
952+ break;
953+ }
954+ up(&vr->vr_ctl_mutex);
955+ return err;
956+}
957+
958+static int vr_open(struct block_device *bdev, fmode_t mode)
959+{
960+ struct vroot_device *vr = bdev->bd_disk->private_data;
961+
962+ down(&vr->vr_ctl_mutex);
963+ vr->vr_refcnt++;
964+ up(&vr->vr_ctl_mutex);
965+ return 0;
966+}
967+
968+static void vr_release(struct gendisk *disk, fmode_t mode)
969+{
970+ struct vroot_device *vr = disk->private_data;
971+
972+ down(&vr->vr_ctl_mutex);
973+ --vr->vr_refcnt;
974+ up(&vr->vr_ctl_mutex);
975+}
976+
977+static struct block_device_operations vr_fops = {
978+ .owner = THIS_MODULE,
979+ .open = vr_open,
980+ .release = vr_release,
981+ .ioctl = vr_ioctl,
982+};
983+
984+static blk_qc_t vroot_make_request(struct request_queue *q, struct bio *bio)
985+{
986+ printk("vroot_make_request %p, %p\n", q, bio);
987+ bio_io_error(bio);
988+ return BLK_QC_T_NONE;
989+}
990+
991+struct block_device *__vroot_get_real_bdev(struct block_device *bdev)
992+{
993+ struct inode *inode = bdev->bd_inode;
994+ struct vroot_device *vr;
995+ struct block_device *real_bdev;
996+ int minor = iminor(inode);
997+
998+ vr = &vroot_dev[minor];
999+ real_bdev = vr->vr_device;
1000+
1001+ vxdprintk(VXD_CBIT(misc, 0),
1002+ "vroot[%d]_get_real_bdev: dev=" VXF_DEV,
1003+ vr->vr_number, VXD_DEV(real_bdev));
1004+
1005+ if (vr->vr_state != Vr_bound)
1006+ return ERR_PTR(-ENXIO);
1007+
1008+ __iget(real_bdev->bd_inode);
1009+ return real_bdev;
1010+}
1011+
1012+
1013+
1014+/*
1015+ * And now the modules code and kernel interface.
1016+ */
1017+
1018+module_param(max_vroot, int, 0);
1019+
1020+MODULE_PARM_DESC(max_vroot, "Maximum number of vroot devices (1-256)");
1021+MODULE_LICENSE("GPL");
1022+MODULE_ALIAS_BLOCKDEV_MAJOR(VROOT_MAJOR);
1023+
1024+MODULE_AUTHOR ("Herbert P?tzl");
1025+MODULE_DESCRIPTION ("Virtual Root Device Mapper");
1026+
1027+
1028+int __init vroot_init(void)
1029+{
1030+ int err, i;
1031+
1032+ if (max_vroot < 1 || max_vroot > 256) {
1033+ max_vroot = MAX_VROOT_DEFAULT;
1034+ printk(KERN_WARNING "vroot: invalid max_vroot "
1035+ "(must be between 1 and 256), "
1036+ "using default (%d)\n", max_vroot);
1037+ }
1038+
1039+ if (register_blkdev(VROOT_MAJOR, "vroot"))
1040+ return -EIO;
1041+
1042+ err = -ENOMEM;
1043+ vroot_dev = kmalloc(max_vroot * sizeof(struct vroot_device), GFP_KERNEL);
1044+ if (!vroot_dev)
1045+ goto out_mem1;
1046+ memset(vroot_dev, 0, max_vroot * sizeof(struct vroot_device));
1047+
1048+ disks = kmalloc(max_vroot * sizeof(struct gendisk *), GFP_KERNEL);
1049+ if (!disks)
1050+ goto out_mem2;
1051+
1052+ for (i = 0; i < max_vroot; i++) {
1053+ disks[i] = alloc_disk(1);
1054+ if (!disks[i])
1055+ goto out_mem3;
1056+ disks[i]->queue = blk_alloc_queue(GFP_KERNEL);
1057+ if (!disks[i]->queue)
1058+ goto out_mem3;
1059+ blk_queue_make_request(disks[i]->queue, vroot_make_request);
1060+ }
1061+
1062+ for (i = 0; i < max_vroot; i++) {
1063+ struct vroot_device *vr = &vroot_dev[i];
1064+ struct gendisk *disk = disks[i];
1065+
1066+ memset(vr, 0, sizeof(*vr));
1067+ sema_init(&vr->vr_ctl_mutex, 1);
1068+ vr->vr_number = i;
1069+ disk->major = VROOT_MAJOR;
1070+ disk->first_minor = i;
1071+ disk->fops = &vr_fops;
1072+ sprintf(disk->disk_name, "vroot%d", i);
1073+ disk->private_data = vr;
1074+ }
1075+
1076+ err = register_vroot_grb(&__vroot_get_real_bdev);
1077+ if (err)
1078+ goto out_mem3;
1079+
1080+ for (i = 0; i < max_vroot; i++)
1081+ add_disk(disks[i]);
1082+ printk(KERN_INFO "vroot: loaded (max %d devices)\n", max_vroot);
1083+ return 0;
1084+
1085+out_mem3:
1086+ while (i--)
1087+ put_disk(disks[i]);
1088+ kfree(disks);
1089+out_mem2:
1090+ kfree(vroot_dev);
1091+out_mem1:
1092+ unregister_blkdev(VROOT_MAJOR, "vroot");
1093+ printk(KERN_ERR "vroot: ran out of memory\n");
1094+ return err;
1095+}
1096+
1097+void vroot_exit(void)
1098+{
1099+ int i;
1100+
1101+ if (unregister_vroot_grb(&__vroot_get_real_bdev))
1102+ printk(KERN_WARNING "vroot: cannot unregister grb\n");
1103+
1104+ for (i = 0; i < max_vroot; i++) {
1105+ del_gendisk(disks[i]);
1106+ put_disk(disks[i]);
1107+ }
1108+ unregister_blkdev(VROOT_MAJOR, "vroot");
1109+
1110+ kfree(disks);
1111+ kfree(vroot_dev);
1112+}
1113+
1114+module_init(vroot_init);
1115+module_exit(vroot_exit);
1116+
1117+#ifndef MODULE
1118+
1119+static int __init max_vroot_setup(char *str)
1120+{
1121+ max_vroot = simple_strtol(str, NULL, 0);
1122+ return 1;
1123+}
1124+
1125+__setup("max_vroot=", max_vroot_setup);
1126+
1127+#endif
1128+
1129diff -NurpP --minimal linux-4.4.116/drivers/infiniband/core/addr.c linux-4.4.116-vs2.3.9.7/drivers/infiniband/core/addr.c
1130--- linux-4.4.116/drivers/infiniband/core/addr.c 2018-02-22 21:19:25.000000000 +0000
1131+++ linux-4.4.116-vs2.3.9.7/drivers/infiniband/core/addr.c 2018-01-09 16:49:06.000000000 +0000
1132@@ -283,7 +283,7 @@ static int addr6_resolve(struct sockaddr
1133
1134 if (ipv6_addr_any(&fl6.saddr)) {
1135 ret = ipv6_dev_get_saddr(addr->net, ip6_dst_idev(dst)->dev,
1136- &fl6.daddr, 0, &fl6.saddr);
1137+ &fl6.daddr, 0, &fl6.saddr, NULL);
1138 if (ret)
1139 goto put;
1140
1141diff -NurpP --minimal linux-4.4.116/drivers/md/dm-ioctl.c linux-4.4.116-vs2.3.9.7/drivers/md/dm-ioctl.c
1142--- linux-4.4.116/drivers/md/dm-ioctl.c 2018-02-22 21:19:28.000000000 +0000
1143+++ linux-4.4.116-vs2.3.9.7/drivers/md/dm-ioctl.c 2018-01-09 16:36:23.000000000 +0000
1144@@ -16,6 +16,7 @@
1145 #include <linux/dm-ioctl.h>
1146 #include <linux/hdreg.h>
1147 #include <linux/compat.h>
1148+#include <linux/vs_context.h>
1149
1150 #include <asm/uaccess.h>
1151
1152@@ -114,7 +115,8 @@ static struct hash_cell *__get_name_cell
1153 unsigned int h = hash_str(str);
1154
1155 list_for_each_entry (hc, _name_buckets + h, name_list)
1156- if (!strcmp(hc->name, str)) {
1157+ if (vx_check(dm_get_xid(hc->md), VS_WATCH_P | VS_IDENT) &&
1158+ !strcmp(hc->name, str)) {
1159 dm_get(hc->md);
1160 return hc;
1161 }
1162@@ -128,7 +130,8 @@ static struct hash_cell *__get_uuid_cell
1163 unsigned int h = hash_str(str);
1164
1165 list_for_each_entry (hc, _uuid_buckets + h, uuid_list)
1166- if (!strcmp(hc->uuid, str)) {
1167+ if (vx_check(dm_get_xid(hc->md), VS_WATCH_P | VS_IDENT) &&
1168+ !strcmp(hc->uuid, str)) {
1169 dm_get(hc->md);
1170 return hc;
1171 }
1172@@ -139,13 +142,15 @@ static struct hash_cell *__get_uuid_cell
1173 static struct hash_cell *__get_dev_cell(uint64_t dev)
1174 {
1175 struct mapped_device *md;
1176- struct hash_cell *hc;
1177+ struct hash_cell *hc = NULL;
1178
1179 md = dm_get_md(huge_decode_dev(dev));
1180 if (!md)
1181 return NULL;
1182
1183- hc = dm_get_mdptr(md);
1184+ if (vx_check(dm_get_xid(md), VS_WATCH_P | VS_IDENT))
1185+ hc = dm_get_mdptr(md);
1186+
1187 if (!hc) {
1188 dm_put(md);
1189 return NULL;
1190@@ -467,6 +472,9 @@ typedef int (*ioctl_fn)(struct dm_ioctl
1191
1192 static int remove_all(struct dm_ioctl *param, size_t param_size)
1193 {
1194+ if (!vx_check(0, VS_ADMIN))
1195+ return -EPERM;
1196+
1197 dm_hash_remove_all(true, !!(param->flags & DM_DEFERRED_REMOVE), false);
1198 param->data_size = 0;
1199 return 0;
1200@@ -514,6 +522,8 @@ static int list_devices(struct dm_ioctl
1201 */
1202 for (i = 0; i < NUM_BUCKETS; i++) {
1203 list_for_each_entry (hc, _name_buckets + i, name_list) {
1204+ if (!vx_check(dm_get_xid(hc->md), VS_WATCH_P | VS_IDENT))
1205+ continue;
1206 needed += sizeof(struct dm_name_list);
1207 needed += strlen(hc->name) + 1;
1208 needed += ALIGN_MASK;
1209@@ -537,6 +547,8 @@ static int list_devices(struct dm_ioctl
1210 */
1211 for (i = 0; i < NUM_BUCKETS; i++) {
1212 list_for_each_entry (hc, _name_buckets + i, name_list) {
1213+ if (!vx_check(dm_get_xid(hc->md), VS_WATCH_P | VS_IDENT))
1214+ continue;
1215 if (old_nl)
1216 old_nl->next = (uint32_t) ((void *) nl -
1217 (void *) old_nl);
1218@@ -1801,8 +1813,8 @@ static int ctl_ioctl(uint command, struc
1219 size_t input_param_size;
1220 struct dm_ioctl param_kernel;
1221
1222- /* only root can play with this */
1223- if (!capable(CAP_SYS_ADMIN))
1224+ /* only root and certain contexts can play with this */
1225+ if (!vx_capable(CAP_SYS_ADMIN, VXC_ADMIN_MAPPER))
1226 return -EACCES;
1227
1228 if (_IOC_TYPE(command) != DM_IOCTL)
1229diff -NurpP --minimal linux-4.4.116/drivers/md/dm.c linux-4.4.116-vs2.3.9.7/drivers/md/dm.c
1230--- linux-4.4.116/drivers/md/dm.c 2018-02-22 21:19:28.000000000 +0000
1231+++ linux-4.4.116-vs2.3.9.7/drivers/md/dm.c 2018-01-09 16:49:30.000000000 +0000
1232@@ -25,6 +25,7 @@
1233 #include <linux/elevator.h> /* for rq_end_sector() */
1234 #include <linux/blk-mq.h>
1235 #include <linux/pr.h>
1236+#include <linux/vs_base.h>
1237
1238 #include <trace/events/block.h>
1239
1240@@ -144,6 +145,7 @@ struct mapped_device {
1241 struct mutex suspend_lock;
1242 atomic_t holders;
1243 atomic_t open_count;
1244+ vxid_t xid;
1245
1246 /*
1247 * The current mapping.
1248@@ -445,6 +447,7 @@ int dm_deleting_md(struct mapped_device
1249 static int dm_blk_open(struct block_device *bdev, fmode_t mode)
1250 {
1251 struct mapped_device *md;
1252+ int ret = -ENXIO;
1253
1254 spin_lock(&_minor_lock);
1255
1256@@ -453,17 +456,19 @@ static int dm_blk_open(struct block_devi
1257 goto out;
1258
1259 if (test_bit(DMF_FREEING, &md->flags) ||
1260- dm_deleting_md(md)) {
1261- md = NULL;
1262+ dm_deleting_md(md))
1263+ goto out;
1264+
1265+ ret = -EACCES;
1266+ if (!vx_check(md->xid, VS_IDENT|VS_HOSTID))
1267 goto out;
1268- }
1269
1270 dm_get(md);
1271 atomic_inc(&md->open_count);
1272+ ret = 0;
1273 out:
1274 spin_unlock(&_minor_lock);
1275-
1276- return md ? 0 : -ENXIO;
1277+ return ret;
1278 }
1279
1280 static void dm_blk_close(struct gendisk *disk, fmode_t mode)
1281@@ -909,6 +914,14 @@ int dm_set_geometry(struct mapped_device
1282 return 0;
1283 }
1284
1285+/*
1286+ * Get the xid associated with a dm device
1287+ */
1288+vxid_t dm_get_xid(struct mapped_device *md)
1289+{
1290+ return md->xid;
1291+}
1292+
1293 /*-----------------------------------------------------------------
1294 * CRUD START:
1295 * A more elegant soln is in the works that uses the queue
1296@@ -2380,6 +2393,7 @@ static struct mapped_device *alloc_dev(i
1297 INIT_LIST_HEAD(&md->table_devices);
1298 spin_lock_init(&md->uevent_lock);
1299
1300+ md->xid = vx_current_xid();
1301 md->queue = blk_alloc_queue(GFP_KERNEL);
1302 if (!md->queue)
1303 goto bad;
1304diff -NurpP --minimal linux-4.4.116/drivers/md/dm.h linux-4.4.116-vs2.3.9.7/drivers/md/dm.h
1305--- linux-4.4.116/drivers/md/dm.h 2016-07-05 04:12:06.000000000 +0000
1306+++ linux-4.4.116-vs2.3.9.7/drivers/md/dm.h 2018-01-09 16:36:24.000000000 +0000
1307@@ -52,6 +52,8 @@ struct dm_dev_internal {
1308 struct dm_table;
1309 struct dm_md_mempools;
1310
1311+vxid_t dm_get_xid(struct mapped_device *md);
1312+
1313 /*-----------------------------------------------------------------
1314 * Internal table functions.
1315 *---------------------------------------------------------------*/
1316diff -NurpP --minimal linux-4.4.116/drivers/net/tun.c linux-4.4.116-vs2.3.9.7/drivers/net/tun.c
1317--- linux-4.4.116/drivers/net/tun.c 2018-02-22 21:19:36.000000000 +0000
1318+++ linux-4.4.116-vs2.3.9.7/drivers/net/tun.c 2018-01-09 16:36:24.000000000 +0000
1319@@ -65,6 +65,7 @@
1320 #include <linux/nsproxy.h>
1321 #include <linux/virtio_net.h>
1322 #include <linux/rcupdate.h>
1323+#include <linux/vs_network.h>
1324 #include <net/net_namespace.h>
1325 #include <net/netns/generic.h>
1326 #include <net/rtnetlink.h>
1327@@ -181,6 +182,7 @@ struct tun_struct {
1328 unsigned int flags;
1329 kuid_t owner;
1330 kgid_t group;
1331+ vnid_t nid;
1332
1333 struct net_device *dev;
1334 netdev_features_t set_features;
1335@@ -475,6 +477,7 @@ static inline bool tun_not_capable(struc
1336 return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
1337 (gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
1338 !ns_capable(net->user_ns, CAP_NET_ADMIN);
1339+ /* !cap_raised(current_cap(), CAP_NET_ADMIN) */
1340 }
1341
1342 static void tun_set_real_num_queues(struct tun_struct *tun)
1343@@ -1463,6 +1466,7 @@ static void tun_setup(struct net_device
1344
1345 tun->owner = INVALID_UID;
1346 tun->group = INVALID_GID;
1347+ tun->nid = nx_current_nid();
1348
1349 dev->ethtool_ops = &tun_ethtool_ops;
1350 dev->destructor = tun_free_netdev;
1351@@ -1657,7 +1661,7 @@ static int tun_set_iff(struct net *net,
1352 int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
1353 MAX_TAP_QUEUES : 1;
1354
1355- if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1356+ if (!nx_ns_capable(net->user_ns, CAP_NET_ADMIN, NXC_TUN_CREATE))
1357 return -EPERM;
1358 err = security_tun_dev_create();
1359 if (err < 0)
1360@@ -2010,6 +2014,16 @@ static long __tun_chr_ioctl(struct file
1361 from_kgid(&init_user_ns, tun->group));
1362 break;
1363
1364+ case TUNSETNID:
1365+ if (!capable(CAP_CONTEXT))
1366+ return -EPERM;
1367+
1368+ /* Set nid owner of the device */
1369+ tun->nid = (vnid_t) arg;
1370+
1371+ tun_debug(KERN_INFO, tun, "nid owner set to %u\n", tun->nid);
1372+ break;
1373+
1374 case TUNSETLINK:
1375 /* Only allow setting the type when the interface is down */
1376 if (tun->dev->flags & IFF_UP) {
1377diff -NurpP --minimal linux-4.4.116/drivers/scsi/cxgbi/libcxgbi.c linux-4.4.116-vs2.3.9.7/drivers/scsi/cxgbi/libcxgbi.c
1378--- linux-4.4.116/drivers/scsi/cxgbi/libcxgbi.c 2015-10-29 09:21:24.000000000 +0000
1379+++ linux-4.4.116-vs2.3.9.7/drivers/scsi/cxgbi/libcxgbi.c 2018-01-09 16:36:24.000000000 +0000
1380@@ -768,7 +768,8 @@ static struct cxgbi_sock *cxgbi_check_ro
1381 struct inet6_dev *idev = ip6_dst_idev((struct dst_entry *)rt);
1382
1383 err = ipv6_dev_get_saddr(&init_net, idev ? idev->dev : NULL,
1384- &daddr6->sin6_addr, 0, &pref_saddr);
1385+ &daddr6->sin6_addr, 0, &pref_saddr,
1386+ NULL);
1387 if (err) {
1388 pr_info("failed to get source address to reach %pI6\n",
1389 &daddr6->sin6_addr);
1390diff -NurpP --minimal linux-4.4.116/drivers/tty/sysrq.c linux-4.4.116-vs2.3.9.7/drivers/tty/sysrq.c
1391--- linux-4.4.116/drivers/tty/sysrq.c 2018-02-22 21:19:46.000000000 +0000
1392+++ linux-4.4.116-vs2.3.9.7/drivers/tty/sysrq.c 2018-01-25 00:25:02.000000000 +0000
1393@@ -47,6 +47,7 @@
1394 #include <linux/syscalls.h>
1395 #include <linux/of.h>
1396 #include <linux/rcupdate.h>
1397+#include <linux/vserver/debug.h>
1398
1399 #include <asm/ptrace.h>
1400 #include <asm/irq_regs.h>
1401@@ -427,6 +428,21 @@ static struct sysrq_key_op sysrq_unrt_op
1402 .enable_mask = SYSRQ_ENABLE_RTNICE,
1403 };
1404
1405+
1406+#ifdef CONFIG_VSERVER_DEBUG
1407+static void sysrq_handle_vxinfo(int key)
1408+{
1409+ dump_vx_info_inactive((key == 'x') ? 0 : 1);
1410+}
1411+
1412+static struct sysrq_key_op sysrq_showvxinfo_op = {
1413+ .handler = sysrq_handle_vxinfo,
1414+ .help_msg = "conteXt",
1415+ .action_msg = "Show Context Info",
1416+ .enable_mask = SYSRQ_ENABLE_DUMP,
1417+};
1418+#endif
1419+
1420 /* Key Operations table and lock */
1421 static DEFINE_SPINLOCK(sysrq_key_table_lock);
1422
1423@@ -483,7 +499,11 @@ static struct sysrq_key_op *sysrq_key_ta
1424 /* x: May be registered on mips for TLB dump */
1425 /* x: May be registered on ppc/powerpc for xmon */
1426 /* x: May be registered on sparc64 for global PMU dump */
1427+#ifdef CONFIG_VSERVER_DEBUG
1428+ &sysrq_showvxinfo_op, /* x */
1429+#else
1430 NULL, /* x */
1431+#endif
1432 /* y: May be registered on sparc64 for global register dump */
1433 NULL, /* y */
1434 &sysrq_ftrace_dump_op, /* z */
1435@@ -498,6 +518,8 @@ static int sysrq_key_table_key2index(int
1436 retval = key - '0';
1437 else if ((key >= 'a') && (key <= 'z'))
1438 retval = key + 10 - 'a';
1439+ else if ((key >= 'A') && (key <= 'Z'))
1440+ retval = key + 10 - 'A';
1441 else
1442 retval = -1;
1443 return retval;
1444diff -NurpP --minimal linux-4.4.116/drivers/tty/tty_io.c linux-4.4.116-vs2.3.9.7/drivers/tty/tty_io.c
1445--- linux-4.4.116/drivers/tty/tty_io.c 2018-02-22 21:19:46.000000000 +0000
1446+++ linux-4.4.116-vs2.3.9.7/drivers/tty/tty_io.c 2018-01-09 16:36:24.000000000 +0000
1447@@ -104,6 +104,7 @@
1448
1449 #include <linux/kmod.h>
1450 #include <linux/nsproxy.h>
1451+#include <linux/vs_pid.h>
1452
1453 #undef TTY_DEBUG_HANGUP
1454 #ifdef TTY_DEBUG_HANGUP
1455@@ -2280,7 +2281,8 @@ static int tiocsti(struct tty_struct *tt
1456 char ch, mbz = 0;
1457 struct tty_ldisc *ld;
1458
1459- if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
1460+ if (((current->signal->tty != tty) &&
1461+ !vx_capable(CAP_SYS_ADMIN, VXC_TIOCSTI)))
1462 return -EPERM;
1463 if (get_user(ch, p))
1464 return -EFAULT;
1465@@ -2593,6 +2595,7 @@ static int tiocspgrp(struct tty_struct *
1466 return -ENOTTY;
1467 if (get_user(pgrp_nr, p))
1468 return -EFAULT;
1469+ pgrp_nr = vx_rmap_pid(pgrp_nr);
1470 if (pgrp_nr < 0)
1471 return -EINVAL;
1472 rcu_read_lock();
1473diff -NurpP --minimal linux-4.4.116/fs/attr.c linux-4.4.116-vs2.3.9.7/fs/attr.c
1474--- linux-4.4.116/fs/attr.c 2018-02-22 21:19:50.000000000 +0000
1475+++ linux-4.4.116-vs2.3.9.7/fs/attr.c 2018-01-09 17:27:12.000000000 +0000
1476@@ -15,6 +15,9 @@
1477 #include <linux/security.h>
1478 #include <linux/evm.h>
1479 #include <linux/ima.h>
1480+#include <linux/proc_fs.h>
1481+#include <linux/devpts_fs.h>
1482+#include <linux/vs_tag.h>
1483
1484 /**
1485 * inode_change_ok - check if attribute changes to an inode are allowed
1486@@ -77,6 +80,10 @@ int inode_change_ok(const struct inode *
1487 return -EPERM;
1488 }
1489
1490+ /* check for inode tag permission */
1491+ if (dx_permission(inode, MAY_WRITE))
1492+ return -EACCES;
1493+
1494 return 0;
1495 }
1496 EXPORT_SYMBOL(inode_change_ok);
1497@@ -147,6 +154,8 @@ void setattr_copy(struct inode *inode, c
1498 inode->i_uid = attr->ia_uid;
1499 if (ia_valid & ATTR_GID)
1500 inode->i_gid = attr->ia_gid;
1501+ if ((ia_valid & ATTR_TAG) && IS_TAGGED(inode))
1502+ inode->i_tag = attr->ia_tag;
1503 if (ia_valid & ATTR_ATIME)
1504 inode->i_atime = timespec_trunc(attr->ia_atime,
1505 inode->i_sb->s_time_gran);
1506@@ -197,7 +206,8 @@ int notify_change(struct dentry * dentry
1507
1508 WARN_ON_ONCE(!mutex_is_locked(&inode->i_mutex));
1509
1510- if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_TIMES_SET)) {
1511+ if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
1512+ ATTR_TAG | ATTR_TIMES_SET)) {
1513 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
1514 return -EPERM;
1515 }
1516diff -NurpP --minimal linux-4.4.116/fs/block_dev.c linux-4.4.116-vs2.3.9.7/fs/block_dev.c
1517--- linux-4.4.116/fs/block_dev.c 2018-02-22 21:19:50.000000000 +0000
1518+++ linux-4.4.116-vs2.3.9.7/fs/block_dev.c 2018-01-09 17:16:29.000000000 +0000
1519@@ -29,6 +29,7 @@
1520 #include <linux/log2.h>
1521 #include <linux/cleancache.h>
1522 #include <linux/dax.h>
1523+#include <linux/vs_device.h>
1524 #include <asm/uaccess.h>
1525 #include "internal.h"
1526
1527@@ -645,6 +646,7 @@ struct block_device *bdget(dev_t dev)
1528 bdev->bd_invalidated = 0;
1529 inode->i_mode = S_IFBLK;
1530 inode->i_rdev = dev;
1531+ inode->i_mdev = dev;
1532 inode->i_bdev = bdev;
1533 inode->i_data.a_ops = &def_blk_aops;
1534 mapping_set_gfp_mask(&inode->i_data, GFP_USER);
1535@@ -691,6 +693,11 @@ EXPORT_SYMBOL(bdput);
1536 static struct block_device *bd_acquire(struct inode *inode)
1537 {
1538 struct block_device *bdev;
1539+ dev_t mdev;
1540+
1541+ if (!vs_map_blkdev(inode->i_rdev, &mdev, DATTR_OPEN))
1542+ return NULL;
1543+ inode->i_mdev = mdev;
1544
1545 spin_lock(&bdev_lock);
1546 bdev = inode->i_bdev;
1547@@ -701,7 +708,7 @@ static struct block_device *bd_acquire(s
1548 }
1549 spin_unlock(&bdev_lock);
1550
1551- bdev = bdget(inode->i_rdev);
1552+ bdev = bdget(mdev);
1553 if (bdev) {
1554 spin_lock(&bdev_lock);
1555 if (!inode->i_bdev) {
1556diff -NurpP --minimal linux-4.4.116/fs/btrfs/ctree.h linux-4.4.116-vs2.3.9.7/fs/btrfs/ctree.h
1557--- linux-4.4.116/fs/btrfs/ctree.h 2018-02-22 21:19:50.000000000 +0000
1558+++ linux-4.4.116-vs2.3.9.7/fs/btrfs/ctree.h 2018-01-09 16:36:24.000000000 +0000
1559@@ -731,11 +731,14 @@ struct btrfs_inode_item {
1560 /* modification sequence number for NFS */
1561 __le64 sequence;
1562
1563+ __le16 tag;
1564 /*
1565 * a little future expansion, for more than this we can
1566 * just grow the inode item and version it
1567 */
1568- __le64 reserved[4];
1569+ __le16 reserved16;
1570+ __le32 reserved32;
1571+ __le64 reserved[3];
1572 struct btrfs_timespec atime;
1573 struct btrfs_timespec ctime;
1574 struct btrfs_timespec mtime;
1575@@ -2189,6 +2192,8 @@ struct btrfs_ioctl_defrag_range_args {
1576 #define BTRFS_DEFAULT_COMMIT_INTERVAL (30)
1577 #define BTRFS_DEFAULT_MAX_INLINE (8192)
1578
1579+#define BTRFS_MOUNT_TAGGED (1 << 24)
1580+
1581 #define btrfs_clear_opt(o, opt) ((o) &= ~BTRFS_MOUNT_##opt)
1582 #define btrfs_set_opt(o, opt) ((o) |= BTRFS_MOUNT_##opt)
1583 #define btrfs_raw_test_opt(o, opt) ((o) & BTRFS_MOUNT_##opt)
1584@@ -2528,6 +2533,7 @@ BTRFS_SETGET_FUNCS(inode_block_group, st
1585 BTRFS_SETGET_FUNCS(inode_nlink, struct btrfs_inode_item, nlink, 32);
1586 BTRFS_SETGET_FUNCS(inode_uid, struct btrfs_inode_item, uid, 32);
1587 BTRFS_SETGET_FUNCS(inode_gid, struct btrfs_inode_item, gid, 32);
1588+BTRFS_SETGET_FUNCS(inode_tag, struct btrfs_inode_item, tag, 16);
1589 BTRFS_SETGET_FUNCS(inode_mode, struct btrfs_inode_item, mode, 32);
1590 BTRFS_SETGET_FUNCS(inode_rdev, struct btrfs_inode_item, rdev, 64);
1591 BTRFS_SETGET_FUNCS(inode_flags, struct btrfs_inode_item, flags, 64);
1592@@ -2575,6 +2581,10 @@ BTRFS_SETGET_FUNCS(extent_flags, struct
1593
1594 BTRFS_SETGET_FUNCS(extent_refs_v0, struct btrfs_extent_item_v0, refs, 32);
1595
1596+#define BTRFS_INODE_IXUNLINK (1 << 24)
1597+#define BTRFS_INODE_BARRIER (1 << 25)
1598+#define BTRFS_INODE_COW (1 << 26)
1599+
1600
1601 BTRFS_SETGET_FUNCS(tree_block_level, struct btrfs_tree_block_info, level, 8);
1602
1603@@ -4022,6 +4032,7 @@ long btrfs_ioctl(struct file *file, unsi
1604 void btrfs_update_iflags(struct inode *inode);
1605 void btrfs_inherit_iflags(struct inode *inode, struct inode *dir);
1606 int btrfs_is_empty_uuid(u8 *uuid);
1607+int btrfs_sync_flags(struct inode *inode, int, int);
1608 int btrfs_defrag_file(struct inode *inode, struct file *file,
1609 struct btrfs_ioctl_defrag_range_args *range,
1610 u64 newer_than, unsigned long max_pages);
1611diff -NurpP --minimal linux-4.4.116/fs/btrfs/disk-io.c linux-4.4.116-vs2.3.9.7/fs/btrfs/disk-io.c
1612--- linux-4.4.116/fs/btrfs/disk-io.c 2018-02-22 21:19:50.000000000 +0000
1613+++ linux-4.4.116-vs2.3.9.7/fs/btrfs/disk-io.c 2018-01-09 16:36:24.000000000 +0000
1614@@ -2736,6 +2736,9 @@ int open_ctree(struct super_block *sb,
1615 goto fail_alloc;
1616 }
1617
1618+ if (btrfs_test_opt(tree_root, TAGGED))
1619+ sb->s_flags |= MS_TAGGED;
1620+
1621 features = btrfs_super_incompat_flags(disk_super) &
1622 ~BTRFS_FEATURE_INCOMPAT_SUPP;
1623 if (features) {
1624diff -NurpP --minimal linux-4.4.116/fs/btrfs/inode.c linux-4.4.116-vs2.3.9.7/fs/btrfs/inode.c
1625--- linux-4.4.116/fs/btrfs/inode.c 2018-02-22 21:19:50.000000000 +0000
1626+++ linux-4.4.116-vs2.3.9.7/fs/btrfs/inode.c 2018-02-22 21:30:19.000000000 +0000
1627@@ -43,6 +43,7 @@
1628 #include <linux/blkdev.h>
1629 #include <linux/posix_acl_xattr.h>
1630 #include <linux/uio.h>
1631+#include <linux/vs_tag.h>
1632 #include "ctree.h"
1633 #include "disk-io.h"
1634 #include "transaction.h"
1635@@ -3619,6 +3620,9 @@ static void btrfs_read_locked_inode(stru
1636 unsigned long ptr;
1637 int maybe_acls;
1638 u32 rdev;
1639+ kuid_t kuid;
1640+ kgid_t kgid;
1641+ ktag_t ktag;
1642 int ret;
1643 bool filled = false;
1644 int first_xattr_slot;
1645@@ -3646,8 +3650,14 @@ static void btrfs_read_locked_inode(stru
1646 struct btrfs_inode_item);
1647 inode->i_mode = btrfs_inode_mode(leaf, inode_item);
1648 set_nlink(inode, btrfs_inode_nlink(leaf, inode_item));
1649- i_uid_write(inode, btrfs_inode_uid(leaf, inode_item));
1650- i_gid_write(inode, btrfs_inode_gid(leaf, inode_item));
1651+
1652+ kuid = make_kuid(&init_user_ns, btrfs_inode_uid(leaf, inode_item));
1653+ kgid = make_kgid(&init_user_ns, btrfs_inode_gid(leaf, inode_item));
1654+ ktag = make_ktag(&init_user_ns, btrfs_inode_tag(leaf, inode_item));
1655+
1656+ inode->i_uid = INOTAG_KUID(DX_TAG(inode), kuid, kgid);
1657+ inode->i_gid = INOTAG_KGID(DX_TAG(inode), kuid, kgid);
1658+ inode->i_tag = INOTAG_KTAG(DX_TAG(inode), kuid, kgid, ktag);
1659 btrfs_i_size_write(inode, btrfs_inode_size(leaf, inode_item));
1660
1661 inode->i_atime.tv_sec = btrfs_timespec_sec(leaf, &inode_item->atime);
1662@@ -3803,11 +3813,18 @@ static void fill_inode_item(struct btrfs
1663 struct inode *inode)
1664 {
1665 struct btrfs_map_token token;
1666+ uid_t uid = from_kuid(&init_user_ns,
1667+ TAGINO_KUID(DX_TAG(inode), inode->i_uid, inode->i_tag));
1668+ gid_t gid = from_kgid(&init_user_ns,
1669+ TAGINO_KGID(DX_TAG(inode), inode->i_gid, inode->i_tag));
1670
1671 btrfs_init_map_token(&token);
1672
1673- btrfs_set_token_inode_uid(leaf, item, i_uid_read(inode), &token);
1674- btrfs_set_token_inode_gid(leaf, item, i_gid_read(inode), &token);
1675+ btrfs_set_token_inode_uid(leaf, item, uid, &token);
1676+ btrfs_set_token_inode_gid(leaf, item, gid, &token);
1677+#ifdef CONFIG_TAGGING_INTERN
1678+ btrfs_set_token_inode_tag(leaf, item, i_tag_read(inode), &token);
1679+#endif
1680 btrfs_set_token_inode_size(leaf, item, BTRFS_I(inode)->disk_i_size,
1681 &token);
1682 btrfs_set_token_inode_mode(leaf, item, inode->i_mode, &token);
1683@@ -10070,6 +10087,7 @@ static const struct inode_operations btr
1684 .listxattr = btrfs_listxattr,
1685 .removexattr = btrfs_removexattr,
1686 .permission = btrfs_permission,
1687+ .sync_flags = btrfs_sync_flags,
1688 .get_acl = btrfs_get_acl,
1689 .set_acl = btrfs_set_acl,
1690 .update_time = btrfs_update_time,
1691@@ -10078,6 +10096,7 @@ static const struct inode_operations btr
1692 static const struct inode_operations btrfs_dir_ro_inode_operations = {
1693 .lookup = btrfs_lookup,
1694 .permission = btrfs_permission,
1695+ .sync_flags = btrfs_sync_flags,
1696 .get_acl = btrfs_get_acl,
1697 .set_acl = btrfs_set_acl,
1698 .update_time = btrfs_update_time,
1699@@ -10148,6 +10167,7 @@ static const struct inode_operations btr
1700 .removexattr = btrfs_removexattr,
1701 .permission = btrfs_permission,
1702 .fiemap = btrfs_fiemap,
1703+ .sync_flags = btrfs_sync_flags,
1704 .get_acl = btrfs_get_acl,
1705 .set_acl = btrfs_set_acl,
1706 .update_time = btrfs_update_time,
1707diff -NurpP --minimal linux-4.4.116/fs/btrfs/ioctl.c linux-4.4.116-vs2.3.9.7/fs/btrfs/ioctl.c
1708--- linux-4.4.116/fs/btrfs/ioctl.c 2018-02-22 21:19:50.000000000 +0000
1709+++ linux-4.4.116-vs2.3.9.7/fs/btrfs/ioctl.c 2018-01-09 16:36:24.000000000 +0000
1710@@ -108,10 +108,13 @@ static unsigned int btrfs_flags_to_ioctl
1711 {
1712 unsigned int iflags = 0;
1713
1714- if (flags & BTRFS_INODE_SYNC)
1715- iflags |= FS_SYNC_FL;
1716 if (flags & BTRFS_INODE_IMMUTABLE)
1717 iflags |= FS_IMMUTABLE_FL;
1718+ if (flags & BTRFS_INODE_IXUNLINK)
1719+ iflags |= FS_IXUNLINK_FL;
1720+
1721+ if (flags & BTRFS_INODE_SYNC)
1722+ iflags |= FS_SYNC_FL;
1723 if (flags & BTRFS_INODE_APPEND)
1724 iflags |= FS_APPEND_FL;
1725 if (flags & BTRFS_INODE_NODUMP)
1726@@ -128,34 +131,84 @@ static unsigned int btrfs_flags_to_ioctl
1727 else if (flags & BTRFS_INODE_NOCOMPRESS)
1728 iflags |= FS_NOCOMP_FL;
1729
1730+ if (flags & BTRFS_INODE_BARRIER)
1731+ iflags |= FS_BARRIER_FL;
1732+ if (flags & BTRFS_INODE_COW)
1733+ iflags |= FS_COW_FL;
1734 return iflags;
1735 }
1736
1737 /*
1738- * Update inode->i_flags based on the btrfs internal flags.
1739+ * Update inode->i_(v)flags based on the btrfs internal flags.
1740 */
1741 void btrfs_update_iflags(struct inode *inode)
1742 {
1743 struct btrfs_inode *ip = BTRFS_I(inode);
1744 unsigned int new_fl = 0;
1745
1746- if (ip->flags & BTRFS_INODE_SYNC)
1747- new_fl |= S_SYNC;
1748 if (ip->flags & BTRFS_INODE_IMMUTABLE)
1749 new_fl |= S_IMMUTABLE;
1750+ if (ip->flags & BTRFS_INODE_IXUNLINK)
1751+ new_fl |= S_IXUNLINK;
1752+
1753+ if (ip->flags & BTRFS_INODE_SYNC)
1754+ new_fl |= S_SYNC;
1755 if (ip->flags & BTRFS_INODE_APPEND)
1756 new_fl |= S_APPEND;
1757 if (ip->flags & BTRFS_INODE_NOATIME)
1758 new_fl |= S_NOATIME;
1759 if (ip->flags & BTRFS_INODE_DIRSYNC)
1760 new_fl |= S_DIRSYNC;
1761-
1762 set_mask_bits(&inode->i_flags,
1763- S_SYNC | S_APPEND | S_IMMUTABLE | S_NOATIME | S_DIRSYNC,
1764+ S_SYNC | S_APPEND | S_IMMUTABLE | S_IXUNLINK | S_NOATIME | S_DIRSYNC,
1765 new_fl);
1766+
1767+ new_fl = 0;
1768+ if (ip->flags & BTRFS_INODE_BARRIER)
1769+ new_fl |= V_BARRIER;
1770+ if (ip->flags & BTRFS_INODE_COW)
1771+ new_fl |= V_COW;
1772+
1773+ set_mask_bits(&inode->i_vflags,
1774+ V_BARRIER | V_COW, new_fl);
1775 }
1776
1777 /*
1778+ * Update btrfs internal flags from inode->i_(v)flags.
1779+ */
1780+void btrfs_update_flags(struct inode *inode)
1781+{
1782+ struct btrfs_inode *ip = BTRFS_I(inode);
1783+
1784+ unsigned int flags = inode->i_flags;
1785+ unsigned int vflags = inode->i_vflags;
1786+
1787+ ip->flags &= ~(BTRFS_INODE_SYNC | BTRFS_INODE_APPEND |
1788+ BTRFS_INODE_IMMUTABLE | BTRFS_INODE_IXUNLINK |
1789+ BTRFS_INODE_NOATIME | BTRFS_INODE_DIRSYNC |
1790+ BTRFS_INODE_BARRIER | BTRFS_INODE_COW);
1791+
1792+ if (flags & S_IMMUTABLE)
1793+ ip->flags |= BTRFS_INODE_IMMUTABLE;
1794+ if (flags & S_IXUNLINK)
1795+ ip->flags |= BTRFS_INODE_IXUNLINK;
1796+
1797+ if (flags & S_SYNC)
1798+ ip->flags |= BTRFS_INODE_SYNC;
1799+ if (flags & S_APPEND)
1800+ ip->flags |= BTRFS_INODE_APPEND;
1801+ if (flags & S_NOATIME)
1802+ ip->flags |= BTRFS_INODE_NOATIME;
1803+ if (flags & S_DIRSYNC)
1804+ ip->flags |= BTRFS_INODE_DIRSYNC;
1805+
1806+ if (vflags & V_BARRIER)
1807+ ip->flags |= BTRFS_INODE_BARRIER;
1808+ if (vflags & V_COW)
1809+ ip->flags |= BTRFS_INODE_COW;
1810+ }
1811+
1812+/*
1813 * Inherit flags from the parent inode.
1814 *
1815 * Currently only the compression flags and the cow flags are inherited.
1816@@ -168,6 +221,7 @@ void btrfs_inherit_iflags(struct inode *
1817 return;
1818
1819 flags = BTRFS_I(dir)->flags;
1820+ flags &= ~BTRFS_INODE_BARRIER;
1821
1822 if (flags & BTRFS_INODE_NOCOMPRESS) {
1823 BTRFS_I(inode)->flags &= ~BTRFS_INODE_COMPRESS;
1824@@ -186,6 +240,30 @@ void btrfs_inherit_iflags(struct inode *
1825 btrfs_update_iflags(inode);
1826 }
1827
1828+int btrfs_sync_flags(struct inode *inode, int flags, int vflags)
1829+{
1830+ struct btrfs_inode *ip = BTRFS_I(inode);
1831+ struct btrfs_root *root = ip->root;
1832+ struct btrfs_trans_handle *trans;
1833+ int ret;
1834+
1835+ trans = btrfs_join_transaction(root);
1836+ BUG_ON(!trans);
1837+
1838+ inode->i_flags = flags;
1839+ inode->i_vflags = vflags;
1840+ btrfs_update_flags(inode);
1841+
1842+ ret = btrfs_update_inode(trans, root, inode);
1843+ BUG_ON(ret);
1844+
1845+ btrfs_update_iflags(inode);
1846+ inode->i_ctime = CURRENT_TIME;
1847+ btrfs_end_transaction(trans, root);
1848+
1849+ return 0;
1850+}
1851+
1852 static int btrfs_ioctl_getflags(struct file *file, void __user *arg)
1853 {
1854 struct btrfs_inode *ip = BTRFS_I(file_inode(file));
1855@@ -248,21 +326,27 @@ static int btrfs_ioctl_setflags(struct f
1856
1857 flags = btrfs_mask_flags(inode->i_mode, flags);
1858 oldflags = btrfs_flags_to_ioctl(ip->flags);
1859- if ((flags ^ oldflags) & (FS_APPEND_FL | FS_IMMUTABLE_FL)) {
1860+ if ((flags ^ oldflags) & (FS_APPEND_FL |
1861+ FS_IMMUTABLE_FL | FS_IXUNLINK_FL)) {
1862 if (!capable(CAP_LINUX_IMMUTABLE)) {
1863 ret = -EPERM;
1864 goto out_unlock;
1865 }
1866 }
1867
1868- if (flags & FS_SYNC_FL)
1869- ip->flags |= BTRFS_INODE_SYNC;
1870- else
1871- ip->flags &= ~BTRFS_INODE_SYNC;
1872 if (flags & FS_IMMUTABLE_FL)
1873 ip->flags |= BTRFS_INODE_IMMUTABLE;
1874 else
1875 ip->flags &= ~BTRFS_INODE_IMMUTABLE;
1876+ if (flags & FS_IXUNLINK_FL)
1877+ ip->flags |= BTRFS_INODE_IXUNLINK;
1878+ else
1879+ ip->flags &= ~BTRFS_INODE_IXUNLINK;
1880+
1881+ if (flags & FS_SYNC_FL)
1882+ ip->flags |= BTRFS_INODE_SYNC;
1883+ else
1884+ ip->flags &= ~BTRFS_INODE_SYNC;
1885 if (flags & FS_APPEND_FL)
1886 ip->flags |= BTRFS_INODE_APPEND;
1887 else
1888diff -NurpP --minimal linux-4.4.116/fs/btrfs/super.c linux-4.4.116-vs2.3.9.7/fs/btrfs/super.c
1889--- linux-4.4.116/fs/btrfs/super.c 2018-02-22 21:19:50.000000000 +0000
1890+++ linux-4.4.116-vs2.3.9.7/fs/btrfs/super.c 2018-01-09 17:25:27.000000000 +0000
1891@@ -306,7 +306,7 @@ enum {
1892 #ifdef CONFIG_BTRFS_DEBUG
1893 Opt_fragment_data, Opt_fragment_metadata, Opt_fragment_all,
1894 #endif
1895- Opt_err,
1896+ Opt_tag, Opt_notag, Opt_tagid, Opt_err,
1897 };
1898
1899 static match_table_t tokens = {
1900@@ -363,6 +363,9 @@ static match_table_t tokens = {
1901 {Opt_fragment_metadata, "fragment=metadata"},
1902 {Opt_fragment_all, "fragment=all"},
1903 #endif
1904+ {Opt_tag, "tag"},
1905+ {Opt_notag, "notag"},
1906+ {Opt_tagid, "tagid=%u"},
1907 {Opt_err, NULL},
1908 };
1909
1910@@ -745,6 +748,22 @@ int btrfs_parse_options(struct btrfs_roo
1911 btrfs_set_opt(info->mount_opt, FRAGMENT_DATA);
1912 break;
1913 #endif
1914+#ifndef CONFIG_TAGGING_NONE
1915+ case Opt_tag:
1916+ printk(KERN_INFO "btrfs: use tagging\n");
1917+ btrfs_set_opt(info->mount_opt, TAGGED);
1918+ break;
1919+ case Opt_notag:
1920+ printk(KERN_INFO "btrfs: disabled tagging\n");
1921+ btrfs_clear_opt(info->mount_opt, TAGGED);
1922+ break;
1923+#endif
1924+#ifdef CONFIG_PROPAGATE
1925+ case Opt_tagid:
1926+ /* use args[0] */
1927+ btrfs_set_opt(info->mount_opt, TAGGED);
1928+ break;
1929+#endif
1930 case Opt_err:
1931 btrfs_info(root->fs_info, "unrecognized mount option '%s'", p);
1932 ret = -EINVAL;
1933@@ -1647,6 +1666,12 @@ static int btrfs_remount(struct super_bl
1934 btrfs_resize_thread_pool(fs_info,
1935 fs_info->thread_pool_size, old_thread_pool_size);
1936
1937+ if (btrfs_test_opt(root, TAGGED) && !(sb->s_flags & MS_TAGGED)) {
1938+ printk("btrfs: %s: tagging not permitted on remount.\n",
1939+ sb->s_id);
1940+ return -EINVAL;
1941+ }
1942+
1943 if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
1944 goto out;
1945
1946diff -NurpP --minimal linux-4.4.116/fs/char_dev.c linux-4.4.116-vs2.3.9.7/fs/char_dev.c
1947--- linux-4.4.116/fs/char_dev.c 2016-07-05 04:12:30.000000000 +0000
1948+++ linux-4.4.116-vs2.3.9.7/fs/char_dev.c 2018-01-09 16:36:24.000000000 +0000
1949@@ -21,6 +21,8 @@
1950 #include <linux/mutex.h>
1951 #include <linux/backing-dev.h>
1952 #include <linux/tty.h>
1953+#include <linux/vs_context.h>
1954+#include <linux/vs_device.h>
1955
1956 #include "internal.h"
1957
1958@@ -350,14 +352,21 @@ static int chrdev_open(struct inode *ino
1959 struct cdev *p;
1960 struct cdev *new = NULL;
1961 int ret = 0;
1962+ dev_t mdev;
1963+
1964+ if (!vs_map_chrdev(inode->i_rdev, &mdev, DATTR_OPEN))
1965+ return -EPERM;
1966+ inode->i_mdev = mdev;
1967
1968 spin_lock(&cdev_lock);
1969 p = inode->i_cdev;
1970 if (!p) {
1971 struct kobject *kobj;
1972 int idx;
1973+
1974 spin_unlock(&cdev_lock);
1975- kobj = kobj_lookup(cdev_map, inode->i_rdev, &idx);
1976+
1977+ kobj = kobj_lookup(cdev_map, mdev, &idx);
1978 if (!kobj)
1979 return -ENXIO;
1980 new = container_of(kobj, struct cdev, kobj);
1981diff -NurpP --minimal linux-4.4.116/fs/dcache.c linux-4.4.116-vs2.3.9.7/fs/dcache.c
1982--- linux-4.4.116/fs/dcache.c 2018-02-22 21:19:51.000000000 +0000
1983+++ linux-4.4.116-vs2.3.9.7/fs/dcache.c 2018-01-09 16:36:24.000000000 +0000
1984@@ -39,6 +39,7 @@
1985 #include <linux/ratelimit.h>
1986 #include <linux/list_lru.h>
1987 #include <linux/kasan.h>
1988+#include <linux/vs_limit.h>
1989
1990 #include "internal.h"
1991 #include "mount.h"
1992@@ -677,6 +678,7 @@ static inline bool fast_dput(struct dent
1993 spin_lock(&dentry->d_lock);
1994 if (dentry->d_lockref.count > 1) {
1995 dentry->d_lockref.count--;
1996+ vx_dentry_dec(dentry);
1997 spin_unlock(&dentry->d_lock);
1998 return 1;
1999 }
2000@@ -806,6 +808,7 @@ repeat:
2001 dentry_lru_add(dentry);
2002
2003 dentry->d_lockref.count--;
2004+ vx_dentry_dec(dentry);
2005 spin_unlock(&dentry->d_lock);
2006 return;
2007
2008@@ -823,6 +826,7 @@ EXPORT_SYMBOL(dput);
2009 static inline void __dget_dlock(struct dentry *dentry)
2010 {
2011 dentry->d_lockref.count++;
2012+ vx_dentry_inc(dentry);
2013 }
2014
2015 static inline void __dget(struct dentry *dentry)
2016@@ -835,6 +839,8 @@ struct dentry *dget_parent(struct dentry
2017 int gotref;
2018 struct dentry *ret;
2019
2020+ vx_dentry_dec(dentry);
2021+
2022 /*
2023 * Do optimistic parent lookup without any
2024 * locking.
2025@@ -865,6 +871,7 @@ repeat:
2026 rcu_read_unlock();
2027 BUG_ON(!ret->d_lockref.count);
2028 ret->d_lockref.count++;
2029+ vx_dentry_inc(ret);
2030 spin_unlock(&ret->d_lock);
2031 return ret;
2032 }
2033@@ -1019,6 +1026,7 @@ static void shrink_dentry_list(struct li
2034 parent = lock_parent(dentry);
2035 if (dentry->d_lockref.count != 1) {
2036 dentry->d_lockref.count--;
2037+ vx_dentry_dec(dentry);
2038 spin_unlock(&dentry->d_lock);
2039 if (parent)
2040 spin_unlock(&parent->d_lock);
2041@@ -1581,6 +1589,9 @@ struct dentry *__d_alloc(struct super_bl
2042 struct dentry *dentry;
2043 char *dname;
2044
2045+ if (!vx_dentry_avail(1))
2046+ return NULL;
2047+
2048 dentry = kmem_cache_alloc(dentry_cache, GFP_KERNEL);
2049 if (!dentry)
2050 return NULL;
2051@@ -1619,6 +1630,7 @@ struct dentry *__d_alloc(struct super_bl
2052
2053 dentry->d_lockref.count = 1;
2054 dentry->d_flags = 0;
2055+ vx_dentry_inc(dentry);
2056 spin_lock_init(&dentry->d_lock);
2057 seqcount_init(&dentry->d_seq);
2058 dentry->d_inode = NULL;
2059@@ -2355,6 +2367,7 @@ struct dentry *__d_lookup(const struct d
2060 }
2061
2062 dentry->d_lockref.count++;
2063+ vx_dentry_inc(dentry);
2064 found = dentry;
2065 spin_unlock(&dentry->d_lock);
2066 break;
2067@@ -3371,6 +3384,7 @@ static enum d_walk_ret d_genocide_kill(v
2068 if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
2069 dentry->d_flags |= DCACHE_GENOCIDE;
2070 dentry->d_lockref.count--;
2071+ vx_dentry_dec(dentry);
2072 }
2073 }
2074 return D_WALK_CONTINUE;
2075diff -NurpP --minimal linux-4.4.116/fs/devpts/inode.c linux-4.4.116-vs2.3.9.7/fs/devpts/inode.c
2076--- linux-4.4.116/fs/devpts/inode.c 2018-02-22 21:19:51.000000000 +0000
2077+++ linux-4.4.116-vs2.3.9.7/fs/devpts/inode.c 2018-01-09 16:36:24.000000000 +0000
2078@@ -27,6 +27,7 @@
2079 #include <linux/parser.h>
2080 #include <linux/fsnotify.h>
2081 #include <linux/seq_file.h>
2082+#include <linux/vs_base.h>
2083
2084 #define DEVPTS_DEFAULT_MODE 0600
2085 /*
2086@@ -38,6 +39,21 @@
2087 #define DEVPTS_DEFAULT_PTMX_MODE 0000
2088 #define PTMX_MINOR 2
2089
2090+static int devpts_permission(struct inode *inode, int mask)
2091+{
2092+ int ret = -EACCES;
2093+
2094+ /* devpts is xid tagged */
2095+ if (vx_check((vxid_t)i_tag_read(inode), VS_WATCH_P | VS_IDENT))
2096+ ret = generic_permission(inode, mask);
2097+ return ret;
2098+}
2099+
2100+static struct inode_operations devpts_file_inode_operations = {
2101+ .permission = devpts_permission,
2102+};
2103+
2104+
2105 /*
2106 * sysctl support for setting limits on the number of Unix98 ptys allocated.
2107 * Otherwise one can eat up all kernel memory by opening /dev/ptmx repeatedly.
2108@@ -353,6 +369,34 @@ static int devpts_show_options(struct se
2109 return 0;
2110 }
2111
2112+static int devpts_filter(struct dentry *de)
2113+{
2114+ vxid_t xid = 0;
2115+
2116+ /* devpts is xid tagged */
2117+ if (de && de->d_inode)
2118+ xid = (vxid_t)i_tag_read(de->d_inode);
2119+#ifdef CONFIG_VSERVER_WARN_DEVPTS
2120+ else
2121+ vxwprintk_task(1, "devpts " VS_Q("%.*s") " without inode.",
2122+ de->d_name.len, de->d_name.name);
2123+#endif
2124+ return vx_check(xid, VS_WATCH_P | VS_IDENT);
2125+}
2126+
2127+static int devpts_readdir(struct file * filp, struct dir_context *ctx)
2128+{
2129+ return dcache_readdir_filter(filp, ctx, devpts_filter);
2130+}
2131+
2132+static struct file_operations devpts_dir_operations = {
2133+ .open = dcache_dir_open,
2134+ .release = dcache_dir_close,
2135+ .llseek = dcache_dir_lseek,
2136+ .read = generic_read_dir,
2137+ .iterate = devpts_readdir,
2138+};
2139+
2140 static const struct super_operations devpts_sops = {
2141 .statfs = simple_statfs,
2142 .remount_fs = devpts_remount,
2143@@ -397,8 +441,10 @@ devpts_fill_super(struct super_block *s,
2144 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
2145 inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR;
2146 inode->i_op = &simple_dir_inode_operations;
2147- inode->i_fop = &simple_dir_operations;
2148+ inode->i_fop = &devpts_dir_operations;
2149 set_nlink(inode, 2);
2150+ /* devpts is xid tagged */
2151+ i_tag_write(inode, (vtag_t)vx_current_xid());
2152
2153 s->s_root = d_make_root(inode);
2154 if (s->s_root)
2155@@ -630,6 +676,9 @@ struct inode *devpts_pty_new(struct pts_
2156 inode->i_gid = opts->setgid ? opts->gid : current_fsgid();
2157 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
2158 init_special_inode(inode, S_IFCHR|opts->mode, device);
2159+ /* devpts is xid tagged */
2160+ i_tag_write(inode, (vtag_t)vx_current_xid());
2161+ inode->i_op = &devpts_file_inode_operations;
2162 inode->i_private = priv;
2163
2164 sprintf(s, "%d", index);
2165diff -NurpP --minimal linux-4.4.116/fs/ext2/balloc.c linux-4.4.116-vs2.3.9.7/fs/ext2/balloc.c
2166--- linux-4.4.116/fs/ext2/balloc.c 2015-04-12 22:12:50.000000000 +0000
2167+++ linux-4.4.116-vs2.3.9.7/fs/ext2/balloc.c 2018-01-09 16:36:24.000000000 +0000
2168@@ -693,7 +693,6 @@ ext2_try_to_allocate(struct super_block
2169 start = 0;
2170 end = EXT2_BLOCKS_PER_GROUP(sb);
2171 }
2172-
2173 BUG_ON(start > EXT2_BLOCKS_PER_GROUP(sb));
2174
2175 repeat:
2176diff -NurpP --minimal linux-4.4.116/fs/ext2/ext2.h linux-4.4.116-vs2.3.9.7/fs/ext2/ext2.h
2177--- linux-4.4.116/fs/ext2/ext2.h 2016-07-05 04:15:07.000000000 +0000
2178+++ linux-4.4.116-vs2.3.9.7/fs/ext2/ext2.h 2018-01-09 16:36:24.000000000 +0000
2179@@ -244,8 +244,12 @@ struct ext2_group_desc
2180 #define EXT2_NOTAIL_FL FS_NOTAIL_FL /* file tail should not be merged */
2181 #define EXT2_DIRSYNC_FL FS_DIRSYNC_FL /* dirsync behaviour (directories only) */
2182 #define EXT2_TOPDIR_FL FS_TOPDIR_FL /* Top of directory hierarchies*/
2183+#define EXT2_IXUNLINK_FL FS_IXUNLINK_FL /* Immutable invert on unlink */
2184 #define EXT2_RESERVED_FL FS_RESERVED_FL /* reserved for ext2 lib */
2185
2186+#define EXT2_BARRIER_FL FS_BARRIER_FL /* Barrier for chroot() */
2187+#define EXT2_COW_FL FS_COW_FL /* Copy on Write marker */
2188+
2189 #define EXT2_FL_USER_VISIBLE FS_FL_USER_VISIBLE /* User visible flags */
2190 #define EXT2_FL_USER_MODIFIABLE FS_FL_USER_MODIFIABLE /* User modifiable flags */
2191
2192@@ -329,7 +333,8 @@ struct ext2_inode {
2193 __u16 i_pad1;
2194 __le16 l_i_uid_high; /* these 2 fields */
2195 __le16 l_i_gid_high; /* were reserved2[0] */
2196- __u32 l_i_reserved2;
2197+ __le16 l_i_tag; /* Context Tag */
2198+ __u16 l_i_reserved2;
2199 } linux2;
2200 struct {
2201 __u8 h_i_frag; /* Fragment number */
2202@@ -357,6 +362,7 @@ struct ext2_inode {
2203 #define i_gid_low i_gid
2204 #define i_uid_high osd2.linux2.l_i_uid_high
2205 #define i_gid_high osd2.linux2.l_i_gid_high
2206+#define i_raw_tag osd2.linux2.l_i_tag
2207 #define i_reserved2 osd2.linux2.l_i_reserved2
2208
2209 /*
2210@@ -389,6 +395,7 @@ struct ext2_inode {
2211 #else
2212 #define EXT2_MOUNT_DAX 0
2213 #endif
2214+#define EXT2_MOUNT_TAGGED 0x200000 /* Enable Context Tags */
2215
2216
2217 #define clear_opt(o, opt) o &= ~EXT2_MOUNT_##opt
2218@@ -776,6 +783,7 @@ extern void ext2_set_inode_flags(struct
2219 extern void ext2_get_inode_flags(struct ext2_inode_info *);
2220 extern int ext2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
2221 u64 start, u64 len);
2222+extern int ext2_sync_flags(struct inode *, int, int);
2223
2224 /* ioctl.c */
2225 extern long ext2_ioctl(struct file *, unsigned int, unsigned long);
2226diff -NurpP --minimal linux-4.4.116/fs/ext2/file.c linux-4.4.116-vs2.3.9.7/fs/ext2/file.c
2227--- linux-4.4.116/fs/ext2/file.c 2016-07-05 04:15:07.000000000 +0000
2228+++ linux-4.4.116-vs2.3.9.7/fs/ext2/file.c 2018-01-09 16:36:24.000000000 +0000
2229@@ -202,4 +202,5 @@ const struct inode_operations ext2_file_
2230 .get_acl = ext2_get_acl,
2231 .set_acl = ext2_set_acl,
2232 .fiemap = ext2_fiemap,
2233+ .sync_flags = ext2_sync_flags,
2234 };
2235diff -NurpP --minimal linux-4.4.116/fs/ext2/ialloc.c linux-4.4.116-vs2.3.9.7/fs/ext2/ialloc.c
2236--- linux-4.4.116/fs/ext2/ialloc.c 2016-07-05 04:12:30.000000000 +0000
2237+++ linux-4.4.116-vs2.3.9.7/fs/ext2/ialloc.c 2018-01-09 16:36:24.000000000 +0000
2238@@ -17,6 +17,7 @@
2239 #include <linux/backing-dev.h>
2240 #include <linux/buffer_head.h>
2241 #include <linux/random.h>
2242+#include <linux/vs_tag.h>
2243 #include "ext2.h"
2244 #include "xattr.h"
2245 #include "acl.h"
2246@@ -546,6 +547,7 @@ got:
2247 inode->i_mode = mode;
2248 inode->i_uid = current_fsuid();
2249 inode->i_gid = dir->i_gid;
2250+ i_tag_write(inode, dx_current_fstag(sb));
2251 } else
2252 inode_init_owner(inode, dir, mode);
2253
2254diff -NurpP --minimal linux-4.4.116/fs/ext2/inode.c linux-4.4.116-vs2.3.9.7/fs/ext2/inode.c
2255--- linux-4.4.116/fs/ext2/inode.c 2016-07-05 04:15:07.000000000 +0000
2256+++ linux-4.4.116-vs2.3.9.7/fs/ext2/inode.c 2018-01-09 16:36:24.000000000 +0000
2257@@ -33,6 +33,7 @@
2258 #include <linux/fiemap.h>
2259 #include <linux/namei.h>
2260 #include <linux/uio.h>
2261+#include <linux/vs_tag.h>
2262 #include "ext2.h"
2263 #include "acl.h"
2264 #include "xattr.h"
2265@@ -1284,39 +1285,62 @@ void ext2_set_inode_flags(struct inode *
2266 {
2267 unsigned int flags = EXT2_I(inode)->i_flags;
2268
2269- inode->i_flags &= ~(S_SYNC | S_APPEND | S_IMMUTABLE | S_NOATIME |
2270- S_DIRSYNC | S_DAX);
2271+ inode->i_flags &= ~(S_IMMUTABLE | S_IXUNLINK | S_DAX |
2272+ S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
2273+
2274+ if (flags & EXT2_IMMUTABLE_FL)
2275+ inode->i_flags |= S_IMMUTABLE;
2276+ if (flags & EXT2_IXUNLINK_FL)
2277+ inode->i_flags |= S_IXUNLINK;
2278+
2279 if (flags & EXT2_SYNC_FL)
2280 inode->i_flags |= S_SYNC;
2281 if (flags & EXT2_APPEND_FL)
2282 inode->i_flags |= S_APPEND;
2283- if (flags & EXT2_IMMUTABLE_FL)
2284- inode->i_flags |= S_IMMUTABLE;
2285 if (flags & EXT2_NOATIME_FL)
2286 inode->i_flags |= S_NOATIME;
2287 if (flags & EXT2_DIRSYNC_FL)
2288 inode->i_flags |= S_DIRSYNC;
2289 if (test_opt(inode->i_sb, DAX))
2290 inode->i_flags |= S_DAX;
2291+
2292+ inode->i_vflags &= ~(V_BARRIER | V_COW);
2293+
2294+ if (flags & EXT2_BARRIER_FL)
2295+ inode->i_vflags |= V_BARRIER;
2296+ if (flags & EXT2_COW_FL)
2297+ inode->i_vflags |= V_COW;
2298 }
2299
2300 /* Propagate flags from i_flags to EXT2_I(inode)->i_flags */
2301 void ext2_get_inode_flags(struct ext2_inode_info *ei)
2302 {
2303 unsigned int flags = ei->vfs_inode.i_flags;
2304+ unsigned int vflags = ei->vfs_inode.i_vflags;
2305+
2306+ ei->i_flags &= ~(EXT2_SYNC_FL | EXT2_APPEND_FL |
2307+ EXT2_IMMUTABLE_FL | EXT2_IXUNLINK_FL |
2308+ EXT2_NOATIME_FL | EXT2_DIRSYNC_FL |
2309+ EXT2_BARRIER_FL | EXT2_COW_FL);
2310+
2311+ if (flags & S_IMMUTABLE)
2312+ ei->i_flags |= EXT2_IMMUTABLE_FL;
2313+ if (flags & S_IXUNLINK)
2314+ ei->i_flags |= EXT2_IXUNLINK_FL;
2315
2316- ei->i_flags &= ~(EXT2_SYNC_FL|EXT2_APPEND_FL|
2317- EXT2_IMMUTABLE_FL|EXT2_NOATIME_FL|EXT2_DIRSYNC_FL);
2318 if (flags & S_SYNC)
2319 ei->i_flags |= EXT2_SYNC_FL;
2320 if (flags & S_APPEND)
2321 ei->i_flags |= EXT2_APPEND_FL;
2322- if (flags & S_IMMUTABLE)
2323- ei->i_flags |= EXT2_IMMUTABLE_FL;
2324 if (flags & S_NOATIME)
2325 ei->i_flags |= EXT2_NOATIME_FL;
2326 if (flags & S_DIRSYNC)
2327 ei->i_flags |= EXT2_DIRSYNC_FL;
2328+
2329+ if (vflags & V_BARRIER)
2330+ ei->i_flags |= EXT2_BARRIER_FL;
2331+ if (vflags & V_COW)
2332+ ei->i_flags |= EXT2_COW_FL;
2333 }
2334
2335 struct inode *ext2_iget (struct super_block *sb, unsigned long ino)
2336@@ -1352,8 +1376,10 @@ struct inode *ext2_iget (struct super_bl
2337 i_uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
2338 i_gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
2339 }
2340- i_uid_write(inode, i_uid);
2341- i_gid_write(inode, i_gid);
2342+ i_uid_write(inode, INOTAG_UID(DX_TAG(inode), i_uid, i_gid));
2343+ i_gid_write(inode, INOTAG_GID(DX_TAG(inode), i_uid, i_gid));
2344+ i_tag_write(inode, INOTAG_TAG(DX_TAG(inode), i_uid, i_gid,
2345+ le16_to_cpu(raw_inode->i_raw_tag)));
2346 set_nlink(inode, le16_to_cpu(raw_inode->i_links_count));
2347 inode->i_size = le32_to_cpu(raw_inode->i_size);
2348 inode->i_atime.tv_sec = (signed)le32_to_cpu(raw_inode->i_atime);
2349@@ -1449,8 +1475,10 @@ static int __ext2_write_inode(struct ino
2350 struct ext2_inode_info *ei = EXT2_I(inode);
2351 struct super_block *sb = inode->i_sb;
2352 ino_t ino = inode->i_ino;
2353- uid_t uid = i_uid_read(inode);
2354- gid_t gid = i_gid_read(inode);
2355+ uid_t uid = from_kuid(&init_user_ns,
2356+ TAGINO_KUID(DX_TAG(inode), inode->i_uid, inode->i_tag));
2357+ gid_t gid = from_kgid(&init_user_ns,
2358+ TAGINO_KGID(DX_TAG(inode), inode->i_gid, inode->i_tag));
2359 struct buffer_head * bh;
2360 struct ext2_inode * raw_inode = ext2_get_inode(sb, ino, &bh);
2361 int n;
2362@@ -1486,6 +1514,9 @@ static int __ext2_write_inode(struct ino
2363 raw_inode->i_uid_high = 0;
2364 raw_inode->i_gid_high = 0;
2365 }
2366+#ifdef CONFIG_TAGGING_INTERN
2367+ raw_inode->i_raw_tag = cpu_to_le16(i_tag_read(inode));
2368+#endif
2369 raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
2370 raw_inode->i_size = cpu_to_le32(inode->i_size);
2371 raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec);
2372@@ -1569,7 +1600,8 @@ int ext2_setattr(struct dentry *dentry,
2373 return error;
2374 }
2375 if ((iattr->ia_valid & ATTR_UID && !uid_eq(iattr->ia_uid, inode->i_uid)) ||
2376- (iattr->ia_valid & ATTR_GID && !gid_eq(iattr->ia_gid, inode->i_gid))) {
2377+ (iattr->ia_valid & ATTR_GID && !gid_eq(iattr->ia_gid, inode->i_gid)) ||
2378+ (iattr->ia_valid & ATTR_TAG && !tag_eq(iattr->ia_tag, inode->i_tag))) {
2379 error = dquot_transfer(inode, iattr);
2380 if (error)
2381 return error;
2382diff -NurpP --minimal linux-4.4.116/fs/ext2/ioctl.c linux-4.4.116-vs2.3.9.7/fs/ext2/ioctl.c
2383--- linux-4.4.116/fs/ext2/ioctl.c 2015-04-12 22:12:50.000000000 +0000
2384+++ linux-4.4.116-vs2.3.9.7/fs/ext2/ioctl.c 2018-01-09 16:36:24.000000000 +0000
2385@@ -17,6 +17,16 @@
2386 #include <asm/uaccess.h>
2387
2388
2389+int ext2_sync_flags(struct inode *inode, int flags, int vflags)
2390+{
2391+ inode->i_flags = flags;
2392+ inode->i_vflags = vflags;
2393+ ext2_get_inode_flags(EXT2_I(inode));
2394+ inode->i_ctime = CURRENT_TIME_SEC;
2395+ mark_inode_dirty(inode);
2396+ return 0;
2397+}
2398+
2399 long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
2400 {
2401 struct inode *inode = file_inode(filp);
2402@@ -51,6 +61,11 @@ long ext2_ioctl(struct file *filp, unsig
2403
2404 flags = ext2_mask_flags(inode->i_mode, flags);
2405
2406+ if (IS_BARRIER(inode)) {
2407+ vxwprintk_task(1, "messing with the barrier.");
2408+ return -EACCES;
2409+ }
2410+
2411 mutex_lock(&inode->i_mutex);
2412 /* Is it quota file? Do not allow user to mess with it */
2413 if (IS_NOQUOTA(inode)) {
2414@@ -66,7 +81,9 @@ long ext2_ioctl(struct file *filp, unsig
2415 *
2416 * This test looks nicer. Thanks to Pauline Middelink
2417 */
2418- if ((flags ^ oldflags) & (EXT2_APPEND_FL | EXT2_IMMUTABLE_FL)) {
2419+ if ((oldflags & EXT2_IMMUTABLE_FL) ||
2420+ ((flags ^ oldflags) & (EXT2_APPEND_FL |
2421+ EXT2_IMMUTABLE_FL | EXT2_IXUNLINK_FL))) {
2422 if (!capable(CAP_LINUX_IMMUTABLE)) {
2423 mutex_unlock(&inode->i_mutex);
2424 ret = -EPERM;
2425@@ -74,7 +91,7 @@ long ext2_ioctl(struct file *filp, unsig
2426 }
2427 }
2428
2429- flags = flags & EXT2_FL_USER_MODIFIABLE;
2430+ flags &= EXT2_FL_USER_MODIFIABLE;
2431 flags |= oldflags & ~EXT2_FL_USER_MODIFIABLE;
2432 ei->i_flags = flags;
2433
2434diff -NurpP --minimal linux-4.4.116/fs/ext2/namei.c linux-4.4.116-vs2.3.9.7/fs/ext2/namei.c
2435--- linux-4.4.116/fs/ext2/namei.c 2016-07-05 04:15:07.000000000 +0000
2436+++ linux-4.4.116-vs2.3.9.7/fs/ext2/namei.c 2018-01-09 16:36:24.000000000 +0000
2437@@ -32,6 +32,7 @@
2438
2439 #include <linux/pagemap.h>
2440 #include <linux/quotaops.h>
2441+#include <linux/vs_tag.h>
2442 #include "ext2.h"
2443 #include "xattr.h"
2444 #include "acl.h"
2445@@ -72,6 +73,7 @@ static struct dentry *ext2_lookup(struct
2446 (unsigned long) ino);
2447 return ERR_PTR(-EIO);
2448 }
2449+ dx_propagate_tag(nd, inode);
2450 }
2451 return d_splice_alias(inode, dentry);
2452 }
2453@@ -446,6 +448,7 @@ const struct inode_operations ext2_speci
2454 .removexattr = generic_removexattr,
2455 #endif
2456 .setattr = ext2_setattr,
2457+ .sync_flags = ext2_sync_flags,
2458 .get_acl = ext2_get_acl,
2459 .set_acl = ext2_set_acl,
2460 };
2461diff -NurpP --minimal linux-4.4.116/fs/ext2/super.c linux-4.4.116-vs2.3.9.7/fs/ext2/super.c
2462--- linux-4.4.116/fs/ext2/super.c 2016-07-05 04:15:07.000000000 +0000
2463+++ linux-4.4.116-vs2.3.9.7/fs/ext2/super.c 2018-01-09 16:36:24.000000000 +0000
2464@@ -408,7 +408,8 @@ enum {
2465 Opt_err_ro, Opt_nouid32, Opt_nocheck, Opt_debug,
2466 Opt_oldalloc, Opt_orlov, Opt_nobh, Opt_user_xattr, Opt_nouser_xattr,
2467 Opt_acl, Opt_noacl, Opt_xip, Opt_dax, Opt_ignore, Opt_err, Opt_quota,
2468- Opt_usrquota, Opt_grpquota, Opt_reservation, Opt_noreservation
2469+ Opt_usrquota, Opt_grpquota, Opt_reservation, Opt_noreservation,
2470+ Opt_tag, Opt_notag, Opt_tagid
2471 };
2472
2473 static const match_table_t tokens = {
2474@@ -436,6 +437,9 @@ static const match_table_t tokens = {
2475 {Opt_acl, "acl"},
2476 {Opt_noacl, "noacl"},
2477 {Opt_xip, "xip"},
2478+ {Opt_tag, "tag"},
2479+ {Opt_notag, "notag"},
2480+ {Opt_tagid, "tagid=%u"},
2481 {Opt_dax, "dax"},
2482 {Opt_grpquota, "grpquota"},
2483 {Opt_ignore, "noquota"},
2484@@ -520,6 +524,20 @@ static int parse_options(char *options,
2485 case Opt_nouid32:
2486 set_opt (sbi->s_mount_opt, NO_UID32);
2487 break;
2488+#ifndef CONFIG_TAGGING_NONE
2489+ case Opt_tag:
2490+ set_opt (sbi->s_mount_opt, TAGGED);
2491+ break;
2492+ case Opt_notag:
2493+ clear_opt (sbi->s_mount_opt, TAGGED);
2494+ break;
2495+#endif
2496+#ifdef CONFIG_PROPAGATE
2497+ case Opt_tagid:
2498+ /* use args[0] */
2499+ set_opt (sbi->s_mount_opt, TAGGED);
2500+ break;
2501+#endif
2502 case Opt_nocheck:
2503 clear_opt (sbi->s_mount_opt, CHECK);
2504 break;
2505@@ -884,6 +902,8 @@ static int ext2_fill_super(struct super_
2506 if (!parse_options((char *) data, sb))
2507 goto failed_mount;
2508
2509+ if (EXT2_SB(sb)->s_mount_opt & EXT2_MOUNT_TAGGED)
2510+ sb->s_flags |= MS_TAGGED;
2511 sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
2512 ((EXT2_SB(sb)->s_mount_opt & EXT2_MOUNT_POSIX_ACL) ?
2513 MS_POSIXACL : 0);
2514@@ -1294,6 +1314,14 @@ static int ext2_remount (struct super_bl
2515 err = -EINVAL;
2516 goto restore_opts;
2517 }
2518+
2519+ if ((sbi->s_mount_opt & EXT2_MOUNT_TAGGED) &&
2520+ !(sb->s_flags & MS_TAGGED)) {
2521+ printk("EXT2-fs: %s: tagging not permitted on remount.\n",
2522+ sb->s_id);
2523+ err = -EINVAL;
2524+ goto restore_opts;
2525+ }
2526
2527 sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
2528 ((sbi->s_mount_opt & EXT2_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
2529diff -NurpP --minimal linux-4.4.116/fs/ext4/ext4.h linux-4.4.116-vs2.3.9.7/fs/ext4/ext4.h
2530--- linux-4.4.116/fs/ext4/ext4.h 2018-02-22 21:19:51.000000000 +0000
2531+++ linux-4.4.116-vs2.3.9.7/fs/ext4/ext4.h 2018-01-09 17:33:10.000000000 +0000
2532@@ -375,8 +375,11 @@ struct flex_groups {
2533 #define EXT4_EXTENTS_FL 0x00080000 /* Inode uses extents */
2534 #define EXT4_EA_INODE_FL 0x00200000 /* Inode used for large EA */
2535 #define EXT4_EOFBLOCKS_FL 0x00400000 /* Blocks allocated beyond EOF */
2536+#define EXT4_BARRIER_FL 0x04000000 /* Barrier for chroot() */
2537+#define EXT4_IXUNLINK_FL 0x08000000 /* Immutable invert on unlink */
2538 #define EXT4_INLINE_DATA_FL 0x10000000 /* Inode has inline data. */
2539 #define EXT4_PROJINHERIT_FL 0x20000000 /* Create with parents projid */
2540+#define EXT4_COW_FL 0x40000000 /* Copy on Write marker */
2541 #define EXT4_RESERVED_FL 0x80000000 /* reserved for ext4 lib */
2542
2543 #define EXT4_FL_USER_VISIBLE 0x004BDFFF /* User visible flags */
2544@@ -674,7 +677,7 @@ struct ext4_inode {
2545 __le16 l_i_uid_high; /* these 2 fields */
2546 __le16 l_i_gid_high; /* were reserved2[0] */
2547 __le16 l_i_checksum_lo;/* crc32c(uuid+inum+inode) LE */
2548- __le16 l_i_reserved;
2549+ __le16 l_i_tag; /* Context Tag */
2550 } linux2;
2551 struct {
2552 __le16 h_i_reserved1; /* Obsoleted fragment number/size which are removed in ext4 */
2553@@ -831,6 +834,7 @@ do { \
2554 #define i_gid_low i_gid
2555 #define i_uid_high osd2.linux2.l_i_uid_high
2556 #define i_gid_high osd2.linux2.l_i_gid_high
2557+#define i_raw_tag osd2.linux2.l_i_tag
2558 #define i_checksum_lo osd2.linux2.l_i_checksum_lo
2559
2560 #elif defined(__GNU__)
2561@@ -1068,6 +1072,7 @@ struct ext4_inode_info {
2562 #define EXT4_MOUNT_POSIX_ACL 0x08000 /* POSIX Access Control Lists */
2563 #define EXT4_MOUNT_NO_AUTO_DA_ALLOC 0x10000 /* No auto delalloc mapping */
2564 #define EXT4_MOUNT_BARRIER 0x20000 /* Use block barriers */
2565+#define EXT4_MOUNT_TAGGED 0x40000 /* Enable Context Tags */
2566 #define EXT4_MOUNT_QUOTA 0x80000 /* Some quota option set */
2567 #define EXT4_MOUNT_USRQUOTA 0x100000 /* "old" user quota */
2568 #define EXT4_MOUNT_GRPQUOTA 0x200000 /* "old" group quota */
2569@@ -2501,6 +2506,7 @@ extern int ext4_punch_hole(struct inode
2570 extern int ext4_truncate_restart_trans(handle_t *, struct inode *, int nblocks);
2571 extern void ext4_set_inode_flags(struct inode *);
2572 extern void ext4_get_inode_flags(struct ext4_inode_info *);
2573+extern int ext4_sync_flags(struct inode *, int, int);
2574 extern int ext4_alloc_da_blocks(struct inode *inode);
2575 extern void ext4_set_aops(struct inode *inode);
2576 extern int ext4_writepage_trans_blocks(struct inode *);
2577diff -NurpP --minimal linux-4.4.116/fs/ext4/file.c linux-4.4.116-vs2.3.9.7/fs/ext4/file.c
2578--- linux-4.4.116/fs/ext4/file.c 2018-02-22 21:19:51.000000000 +0000
2579+++ linux-4.4.116-vs2.3.9.7/fs/ext4/file.c 2018-01-09 16:36:31.000000000 +0000
2580@@ -749,5 +749,6 @@ const struct inode_operations ext4_file_
2581 .get_acl = ext4_get_acl,
2582 .set_acl = ext4_set_acl,
2583 .fiemap = ext4_fiemap,
2584+ .sync_flags = ext4_sync_flags,
2585 };
2586
2587diff -NurpP --minimal linux-4.4.116/fs/ext4/ialloc.c linux-4.4.116-vs2.3.9.7/fs/ext4/ialloc.c
2588--- linux-4.4.116/fs/ext4/ialloc.c 2018-02-22 21:19:51.000000000 +0000
2589+++ linux-4.4.116-vs2.3.9.7/fs/ext4/ialloc.c 2018-01-09 16:36:31.000000000 +0000
2590@@ -21,6 +21,7 @@
2591 #include <linux/random.h>
2592 #include <linux/bitops.h>
2593 #include <linux/blkdev.h>
2594+#include <linux/vs_tag.h>
2595 #include <asm/byteorder.h>
2596
2597 #include "ext4.h"
2598@@ -799,6 +800,7 @@ struct inode *__ext4_new_inode(handle_t
2599 inode->i_mode = mode;
2600 inode->i_uid = current_fsuid();
2601 inode->i_gid = dir->i_gid;
2602+ i_tag_write(inode, dx_current_fstag(sb));
2603 } else
2604 inode_init_owner(inode, dir, mode);
2605 err = dquot_initialize(inode);
2606diff -NurpP --minimal linux-4.4.116/fs/ext4/inode.c linux-4.4.116-vs2.3.9.7/fs/ext4/inode.c
2607--- linux-4.4.116/fs/ext4/inode.c 2018-02-22 21:19:51.000000000 +0000
2608+++ linux-4.4.116-vs2.3.9.7/fs/ext4/inode.c 2018-02-22 21:30:19.000000000 +0000
2609@@ -37,6 +37,7 @@
2610 #include <linux/printk.h>
2611 #include <linux/slab.h>
2612 #include <linux/bitops.h>
2613+#include <linux/vs_tag.h>
2614
2615 #include "ext4_jbd2.h"
2616 #include "xattr.h"
2617@@ -4128,12 +4129,15 @@ void ext4_set_inode_flags(struct inode *
2618 unsigned int flags = EXT4_I(inode)->i_flags;
2619 unsigned int new_fl = 0;
2620
2621+ if (flags & EXT4_IMMUTABLE_FL)
2622+ new_fl |= S_IMMUTABLE;
2623+ if (flags & EXT4_IXUNLINK_FL)
2624+ new_fl |= S_IXUNLINK;
2625+
2626 if (flags & EXT4_SYNC_FL)
2627 new_fl |= S_SYNC;
2628 if (flags & EXT4_APPEND_FL)
2629 new_fl |= S_APPEND;
2630- if (flags & EXT4_IMMUTABLE_FL)
2631- new_fl |= S_IMMUTABLE;
2632 if (flags & EXT4_NOATIME_FL)
2633 new_fl |= S_NOATIME;
2634 if (flags & EXT4_DIRSYNC_FL)
2635@@ -4141,31 +4145,52 @@ void ext4_set_inode_flags(struct inode *
2636 if (test_opt(inode->i_sb, DAX))
2637 new_fl |= S_DAX;
2638 inode_set_flags(inode, new_fl,
2639- S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC|S_DAX);
2640+ S_IXUNLINK | S_IMMUTABLE | S_DAX |
2641+ S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
2642+
2643+ new_fl = 0;
2644+ if (flags & EXT4_BARRIER_FL)
2645+ new_fl |= V_BARRIER;
2646+ if (flags & EXT4_COW_FL)
2647+ new_fl |= V_COW;
2648+
2649+ set_mask_bits(&inode->i_vflags,
2650+ V_BARRIER | V_COW, new_fl);
2651 }
2652
2653 /* Propagate flags from i_flags to EXT4_I(inode)->i_flags */
2654 void ext4_get_inode_flags(struct ext4_inode_info *ei)
2655 {
2656- unsigned int vfs_fl;
2657+ unsigned int vfs_fl, vfs_vf;
2658 unsigned long old_fl, new_fl;
2659
2660 do {
2661 vfs_fl = ei->vfs_inode.i_flags;
2662+ vfs_vf = ei->vfs_inode.i_vflags;
2663 old_fl = ei->i_flags;
2664 new_fl = old_fl & ~(EXT4_SYNC_FL|EXT4_APPEND_FL|
2665 EXT4_IMMUTABLE_FL|EXT4_NOATIME_FL|
2666- EXT4_DIRSYNC_FL);
2667+ EXT4_DIRSYNC_FL|EXT4_BARRIER_FL|
2668+ EXT4_COW_FL);
2669+
2670+ if (vfs_fl & S_IMMUTABLE)
2671+ new_fl |= EXT4_IMMUTABLE_FL;
2672+ if (vfs_fl & S_IXUNLINK)
2673+ new_fl |= EXT4_IXUNLINK_FL;
2674+
2675 if (vfs_fl & S_SYNC)
2676 new_fl |= EXT4_SYNC_FL;
2677 if (vfs_fl & S_APPEND)
2678 new_fl |= EXT4_APPEND_FL;
2679- if (vfs_fl & S_IMMUTABLE)
2680- new_fl |= EXT4_IMMUTABLE_FL;
2681 if (vfs_fl & S_NOATIME)
2682 new_fl |= EXT4_NOATIME_FL;
2683 if (vfs_fl & S_DIRSYNC)
2684 new_fl |= EXT4_DIRSYNC_FL;
2685+
2686+ if (vfs_vf & V_BARRIER)
2687+ new_fl |= EXT4_BARRIER_FL;
2688+ if (vfs_vf & V_COW)
2689+ new_fl |= EXT4_COW_FL;
2690 } while (cmpxchg(&ei->i_flags, old_fl, new_fl) != old_fl);
2691 }
2692
2693@@ -4269,8 +4294,10 @@ struct inode *ext4_iget(struct super_blo
2694 i_uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
2695 i_gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
2696 }
2697- i_uid_write(inode, i_uid);
2698- i_gid_write(inode, i_gid);
2699+ i_uid_write(inode, INOTAG_UID(DX_TAG(inode), i_uid, i_gid));
2700+ i_gid_write(inode, INOTAG_GID(DX_TAG(inode), i_uid, i_gid));
2701+ i_tag_write(inode, INOTAG_TAG(DX_TAG(inode), i_uid, i_gid,
2702+ le16_to_cpu(raw_inode->i_raw_tag)));
2703 set_nlink(inode, le16_to_cpu(raw_inode->i_links_count));
2704
2705 ext4_clear_state_flags(ei); /* Only relevant on 32-bit archs */
2706@@ -4584,8 +4611,10 @@ static int ext4_do_update_inode(handle_t
2707
2708 ext4_get_inode_flags(ei);
2709 raw_inode->i_mode = cpu_to_le16(inode->i_mode);
2710- i_uid = i_uid_read(inode);
2711- i_gid = i_gid_read(inode);
2712+ i_uid = from_kuid(&init_user_ns,
2713+ TAGINO_KUID(DX_TAG(inode), inode->i_uid, inode->i_tag));
2714+ i_gid = from_kgid(&init_user_ns,
2715+ TAGINO_KGID(DX_TAG(inode), inode->i_gid, inode->i_tag));
2716 if (!(test_opt(inode->i_sb, NO_UID32))) {
2717 raw_inode->i_uid_low = cpu_to_le16(low_16_bits(i_uid));
2718 raw_inode->i_gid_low = cpu_to_le16(low_16_bits(i_gid));
2719@@ -4608,6 +4637,9 @@ static int ext4_do_update_inode(handle_t
2720 raw_inode->i_uid_high = 0;
2721 raw_inode->i_gid_high = 0;
2722 }
2723+#ifdef CONFIG_TAGGING_INTERN
2724+ raw_inode->i_raw_tag = cpu_to_le16(i_tag_read(inode));
2725+#endif
2726 raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
2727
2728 EXT4_INODE_SET_XTIME(i_ctime, inode, raw_inode);
2729@@ -4853,7 +4885,8 @@ int ext4_setattr(struct dentry *dentry,
2730 return error;
2731 }
2732 if ((ia_valid & ATTR_UID && !uid_eq(attr->ia_uid, inode->i_uid)) ||
2733- (ia_valid & ATTR_GID && !gid_eq(attr->ia_gid, inode->i_gid))) {
2734+ (ia_valid & ATTR_GID && !gid_eq(attr->ia_gid, inode->i_gid)) ||
2735+ (ia_valid & ATTR_TAG && !tag_eq(attr->ia_tag, inode->i_tag))) {
2736 handle_t *handle;
2737
2738 /* (user+group)*(old+new) structure, inode write (sb,
2739@@ -4876,6 +4909,8 @@ int ext4_setattr(struct dentry *dentry,
2740 inode->i_uid = attr->ia_uid;
2741 if (attr->ia_valid & ATTR_GID)
2742 inode->i_gid = attr->ia_gid;
2743+ if ((attr->ia_valid & ATTR_TAG) && IS_TAGGED(inode))
2744+ inode->i_tag = attr->ia_tag;
2745 error = ext4_mark_inode_dirty(handle, inode);
2746 ext4_journal_stop(handle);
2747 }
2748diff -NurpP --minimal linux-4.4.116/fs/ext4/ioctl.c linux-4.4.116-vs2.3.9.7/fs/ext4/ioctl.c
2749--- linux-4.4.116/fs/ext4/ioctl.c 2018-02-22 21:19:51.000000000 +0000
2750+++ linux-4.4.116-vs2.3.9.7/fs/ext4/ioctl.c 2018-01-09 16:36:31.000000000 +0000
2751@@ -14,6 +14,7 @@
2752 #include <linux/mount.h>
2753 #include <linux/file.h>
2754 #include <linux/random.h>
2755+#include <linux/vs_tag.h>
2756 #include <asm/uaccess.h>
2757 #include "ext4_jbd2.h"
2758 #include "ext4.h"
2759@@ -202,6 +203,33 @@ static int uuid_is_zero(__u8 u[16])
2760 return 1;
2761 }
2762
2763+int ext4_sync_flags(struct inode *inode, int flags, int vflags)
2764+{
2765+ handle_t *handle = NULL;
2766+ struct ext4_iloc iloc;
2767+ int err;
2768+
2769+ handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
2770+ if (IS_ERR(handle))
2771+ return PTR_ERR(handle);
2772+
2773+ if (IS_SYNC(inode))
2774+ ext4_handle_sync(handle);
2775+ err = ext4_reserve_inode_write(handle, inode, &iloc);
2776+ if (err)
2777+ goto flags_err;
2778+
2779+ inode->i_flags = flags;
2780+ inode->i_vflags = vflags;
2781+ ext4_get_inode_flags(EXT4_I(inode));
2782+ inode->i_ctime = ext4_current_time(inode);
2783+
2784+ err = ext4_mark_iloc_dirty(handle, inode, &iloc);
2785+flags_err:
2786+ ext4_journal_stop(handle);
2787+ return err;
2788+}
2789+
2790 long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
2791 {
2792 struct inode *inode = file_inode(filp);
2793@@ -235,6 +263,11 @@ long ext4_ioctl(struct file *filp, unsig
2794
2795 flags = ext4_mask_flags(inode->i_mode, flags);
2796
2797+ if (IS_BARRIER(inode)) {
2798+ vxwprintk_task(1, "messing with the barrier.");
2799+ return -EACCES;
2800+ }
2801+
2802 err = -EPERM;
2803 mutex_lock(&inode->i_mutex);
2804 /* Is it quota file? Do not allow user to mess with it */
2805@@ -252,7 +285,9 @@ long ext4_ioctl(struct file *filp, unsig
2806 *
2807 * This test looks nicer. Thanks to Pauline Middelink
2808 */
2809- if ((flags ^ oldflags) & (EXT4_APPEND_FL | EXT4_IMMUTABLE_FL)) {
2810+ if ((oldflags & EXT4_IMMUTABLE_FL) ||
2811+ ((flags ^ oldflags) & (EXT4_APPEND_FL |
2812+ EXT4_IMMUTABLE_FL | EXT4_IXUNLINK_FL))) {
2813 if (!capable(CAP_LINUX_IMMUTABLE))
2814 goto flags_out;
2815 }
2816diff -NurpP --minimal linux-4.4.116/fs/ext4/namei.c linux-4.4.116-vs2.3.9.7/fs/ext4/namei.c
2817--- linux-4.4.116/fs/ext4/namei.c 2018-02-22 21:19:51.000000000 +0000
2818+++ linux-4.4.116-vs2.3.9.7/fs/ext4/namei.c 2018-02-22 21:30:19.000000000 +0000
2819@@ -33,6 +33,7 @@
2820 #include <linux/quotaops.h>
2821 #include <linux/buffer_head.h>
2822 #include <linux/bio.h>
2823+#include <linux/vs_tag.h>
2824 #include "ext4.h"
2825 #include "ext4_jbd2.h"
2826
2827@@ -1444,6 +1445,7 @@ restart:
2828 ll_rw_block(READ | REQ_META | REQ_PRIO,
2829 1, &bh);
2830 }
2831+ dx_propagate_tag(nd, inode);
2832 }
2833 if ((bh = bh_use[ra_ptr++]) == NULL)
2834 goto next;
2835@@ -3882,6 +3884,7 @@ const struct inode_operations ext4_dir_i
2836 .get_acl = ext4_get_acl,
2837 .set_acl = ext4_set_acl,
2838 .fiemap = ext4_fiemap,
2839+ .sync_flags = ext4_sync_flags,
2840 };
2841
2842 const struct inode_operations ext4_special_inode_operations = {
2843diff -NurpP --minimal linux-4.4.116/fs/ext4/super.c linux-4.4.116-vs2.3.9.7/fs/ext4/super.c
2844--- linux-4.4.116/fs/ext4/super.c 2018-02-22 21:19:51.000000000 +0000
2845+++ linux-4.4.116-vs2.3.9.7/fs/ext4/super.c 2018-01-09 16:36:32.000000000 +0000
2846@@ -1165,6 +1165,7 @@ enum {
2847 Opt_dioread_nolock, Opt_dioread_lock,
2848 Opt_discard, Opt_nodiscard, Opt_init_itable, Opt_noinit_itable,
2849 Opt_max_dir_size_kb, Opt_nojournal_checksum,
2850+ Opt_tag, Opt_notag, Opt_tagid
2851 };
2852
2853 static const match_table_t tokens = {
2854@@ -1250,6 +1251,9 @@ static const match_table_t tokens = {
2855 {Opt_removed, "reservation"}, /* mount option from ext2/3 */
2856 {Opt_removed, "noreservation"}, /* mount option from ext2/3 */
2857 {Opt_removed, "journal=%u"}, /* mount option from ext2/3 */
2858+ {Opt_tag, "tag"},
2859+ {Opt_notag, "notag"},
2860+ {Opt_tagid, "tagid=%u"},
2861 {Opt_err, NULL},
2862 };
2863
2864@@ -1492,6 +1496,20 @@ static int handle_mount_opt(struct super
2865 case Opt_nolazytime:
2866 sb->s_flags &= ~MS_LAZYTIME;
2867 return 1;
2868+#ifndef CONFIG_TAGGING_NONE
2869+ case Opt_tag:
2870+ set_opt(sb, TAGGED);
2871+ return 1;
2872+ case Opt_notag:
2873+ clear_opt(sb, TAGGED);
2874+ return 1;
2875+#endif
2876+#ifdef CONFIG_PROPAGATE
2877+ case Opt_tagid:
2878+ /* use args[0] */
2879+ set_opt(sb, TAGGED);
2880+ return 1;
2881+#endif
2882 }
2883
2884 for (m = ext4_mount_opts; m->token != Opt_err; m++)
2885@@ -3379,6 +3397,9 @@ static int ext4_fill_super(struct super_
2886 sb->s_iflags |= SB_I_CGROUPWB;
2887 }
2888
2889+ if (EXT4_SB(sb)->s_mount_opt & EXT4_MOUNT_TAGGED)
2890+ sb->s_flags |= MS_TAGGED;
2891+
2892 sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
2893 (test_opt(sb, POSIX_ACL) ? MS_POSIXACL : 0);
2894
2895@@ -4727,6 +4748,14 @@ static int ext4_remount(struct super_blo
2896 if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED)
2897 ext4_abort(sb, "Abort forced by user");
2898
2899+ if ((sbi->s_mount_opt & EXT4_MOUNT_TAGGED) &&
2900+ !(sb->s_flags & MS_TAGGED)) {
2901+ printk("EXT4-fs: %s: tagging not permitted on remount.\n",
2902+ sb->s_id);
2903+ err = -EINVAL;
2904+ goto restore_opts;
2905+ }
2906+
2907 sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
2908 (test_opt(sb, POSIX_ACL) ? MS_POSIXACL : 0);
2909
2910diff -NurpP --minimal linux-4.4.116/fs/fcntl.c linux-4.4.116-vs2.3.9.7/fs/fcntl.c
2911--- linux-4.4.116/fs/fcntl.c 2018-02-22 21:19:52.000000000 +0000
2912+++ linux-4.4.116-vs2.3.9.7/fs/fcntl.c 2018-02-10 15:16:50.000000000 +0000
2913@@ -22,6 +22,7 @@
2914 #include <linux/pid_namespace.h>
2915 #include <linux/user_namespace.h>
2916 #include <linux/shmem_fs.h>
2917+#include <linux/vs_limit.h>
2918
2919 #include <asm/poll.h>
2920 #include <asm/siginfo.h>
2921@@ -389,6 +390,8 @@ SYSCALL_DEFINE3(fcntl64, unsigned int, f
2922
2923 if (!f.file)
2924 goto out;
2925+ if (!vx_files_avail(1))
2926+ goto out;
2927
2928 if (unlikely(f.file->f_mode & FMODE_PATH)) {
2929 if (!check_fcntl_cmd(cmd))
2930diff -NurpP --minimal linux-4.4.116/fs/file.c linux-4.4.116-vs2.3.9.7/fs/file.c
2931--- linux-4.4.116/fs/file.c 2016-07-05 04:15:07.000000000 +0000
2932+++ linux-4.4.116-vs2.3.9.7/fs/file.c 2018-01-09 16:36:32.000000000 +0000
2933@@ -22,6 +22,7 @@
2934 #include <linux/spinlock.h>
2935 #include <linux/rcupdate.h>
2936 #include <linux/workqueue.h>
2937+#include <linux/vs_limit.h>
2938
2939 int sysctl_nr_open __read_mostly = 1024*1024;
2940 int sysctl_nr_open_min = BITS_PER_LONG;
2941@@ -356,6 +357,8 @@ struct files_struct *dup_fd(struct files
2942 struct file *f = *old_fds++;
2943 if (f) {
2944 get_file(f);
2945+ /* TODO: sum it first for check and performance */
2946+ vx_openfd_inc(open_files - i);
2947 } else {
2948 /*
2949 * The fd may be claimed in the fd bitmap but not yet
2950@@ -405,9 +408,11 @@ static struct fdtable *close_files(struc
2951 filp_close(file, files);
2952 cond_resched_rcu_qs();
2953 }
2954+ vx_openfd_dec(i);
2955 }
2956 i++;
2957 set >>= 1;
2958+ cond_resched();
2959 }
2960 }
2961
2962@@ -538,6 +543,7 @@ repeat:
2963 else
2964 __clear_close_on_exec(fd, fdt);
2965 error = fd;
2966+ vx_openfd_inc(fd);
2967 #if 1
2968 /* Sanity check */
2969 if (rcu_access_pointer(fdt->fd[fd]) != NULL) {
2970@@ -568,6 +574,7 @@ static void __put_unused_fd(struct files
2971 __clear_open_fd(fd, fdt);
2972 if (fd < files->next_fd)
2973 files->next_fd = fd;
2974+ vx_openfd_dec(fd);
2975 }
2976
2977 void put_unused_fd(unsigned int fd)
2978@@ -850,6 +857,8 @@ __releases(&files->file_lock)
2979
2980 if (tofree)
2981 filp_close(tofree, files);
2982+ else
2983+ vx_openfd_inc(fd); /* fd was unused */
2984
2985 return fd;
2986
2987diff -NurpP --minimal linux-4.4.116/fs/file_table.c linux-4.4.116-vs2.3.9.7/fs/file_table.c
2988--- linux-4.4.116/fs/file_table.c 2015-10-29 09:21:35.000000000 +0000
2989+++ linux-4.4.116-vs2.3.9.7/fs/file_table.c 2018-01-09 17:25:51.000000000 +0000
2990@@ -26,6 +26,8 @@
2991 #include <linux/task_work.h>
2992 #include <linux/ima.h>
2993 #include <linux/swap.h>
2994+#include <linux/vs_limit.h>
2995+#include <linux/vs_context.h>
2996
2997 #include <linux/atomic.h>
2998
2999@@ -137,6 +139,8 @@ struct file *get_empty_filp(void)
3000 mutex_init(&f->f_pos_lock);
3001 eventpoll_init_file(f);
3002 /* f->f_version: 0 */
3003+ f->f_xid = vx_current_xid();
3004+ vx_files_inc(f);
3005 return f;
3006
3007 over:
3008@@ -219,6 +223,8 @@ static void __fput(struct file *file)
3009 put_write_access(inode);
3010 __mnt_drop_write(mnt);
3011 }
3012+ vx_files_dec(file);
3013+ file->f_xid = 0;
3014 file->f_path.dentry = NULL;
3015 file->f_path.mnt = NULL;
3016 file->f_inode = NULL;
3017@@ -305,6 +311,8 @@ void put_filp(struct file *file)
3018 {
3019 if (atomic_long_dec_and_test(&file->f_count)) {
3020 security_file_free(file);
3021+ vx_files_dec(file);
3022+ file->f_xid = 0;
3023 file_free(file);
3024 }
3025 }
3026diff -NurpP --minimal linux-4.4.116/fs/fs_struct.c linux-4.4.116-vs2.3.9.7/fs/fs_struct.c
3027--- linux-4.4.116/fs/fs_struct.c 2015-04-12 22:12:50.000000000 +0000
3028+++ linux-4.4.116-vs2.3.9.7/fs/fs_struct.c 2018-01-09 16:36:32.000000000 +0000
3029@@ -4,6 +4,7 @@
3030 #include <linux/path.h>
3031 #include <linux/slab.h>
3032 #include <linux/fs_struct.h>
3033+#include <linux/vserver/global.h>
3034 #include "internal.h"
3035
3036 /*
3037@@ -87,6 +88,7 @@ void free_fs_struct(struct fs_struct *fs
3038 {
3039 path_put(&fs->root);
3040 path_put(&fs->pwd);
3041+ atomic_dec(&vs_global_fs);
3042 kmem_cache_free(fs_cachep, fs);
3043 }
3044
3045@@ -124,6 +126,7 @@ struct fs_struct *copy_fs_struct(struct
3046 fs->pwd = old->pwd;
3047 path_get(&fs->pwd);
3048 spin_unlock(&old->lock);
3049+ atomic_inc(&vs_global_fs);
3050 }
3051 return fs;
3052 }
3053diff -NurpP --minimal linux-4.4.116/fs/gfs2/file.c linux-4.4.116-vs2.3.9.7/fs/gfs2/file.c
3054--- linux-4.4.116/fs/gfs2/file.c 2018-02-22 21:19:52.000000000 +0000
3055+++ linux-4.4.116-vs2.3.9.7/fs/gfs2/file.c 2018-01-09 17:23:53.000000000 +0000
3056@@ -137,6 +137,9 @@ static const u32 fsflags_to_gfs2[32] = {
3057 [12] = GFS2_DIF_EXHASH,
3058 [14] = GFS2_DIF_INHERIT_JDATA,
3059 [17] = GFS2_DIF_TOPDIR,
3060+ [27] = GFS2_DIF_IXUNLINK,
3061+ [26] = GFS2_DIF_BARRIER,
3062+ [29] = GFS2_DIF_COW,
3063 };
3064
3065 static const u32 gfs2_to_fsflags[32] = {
3066@@ -147,6 +150,9 @@ static const u32 gfs2_to_fsflags[32] = {
3067 [gfs2fl_ExHash] = FS_INDEX_FL,
3068 [gfs2fl_TopLevel] = FS_TOPDIR_FL,
3069 [gfs2fl_InheritJdata] = FS_JOURNAL_DATA_FL,
3070+ [gfs2fl_IXUnlink] = FS_IXUNLINK_FL,
3071+ [gfs2fl_Barrier] = FS_BARRIER_FL,
3072+ [gfs2fl_Cow] = FS_COW_FL,
3073 };
3074
3075 static int gfs2_get_flags(struct file *filp, u32 __user *ptr)
3076@@ -177,12 +183,17 @@ void gfs2_set_inode_flags(struct inode *
3077 {
3078 struct gfs2_inode *ip = GFS2_I(inode);
3079 unsigned int flags = inode->i_flags;
3080+ unsigned int vflags = inode->i_vflags;
3081
3082- flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC|S_NOSEC);
3083+ flags &= ~(S_IMMUTABLE | S_IXUNLINK |
3084+ S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC | S_NOSEC);
3085+
3086 if ((ip->i_eattr == 0) && !is_sxid(inode->i_mode))
3087 flags |= S_NOSEC;
3088 if (ip->i_diskflags & GFS2_DIF_IMMUTABLE)
3089 flags |= S_IMMUTABLE;
3090+ if (ip->i_diskflags & GFS2_DIF_IXUNLINK)
3091+ flags |= S_IXUNLINK;
3092 if (ip->i_diskflags & GFS2_DIF_APPENDONLY)
3093 flags |= S_APPEND;
3094 if (ip->i_diskflags & GFS2_DIF_NOATIME)
3095@@ -190,6 +201,43 @@ void gfs2_set_inode_flags(struct inode *
3096 if (ip->i_diskflags & GFS2_DIF_SYNC)
3097 flags |= S_SYNC;
3098 inode->i_flags = flags;
3099+
3100+ vflags &= ~(V_BARRIER | V_COW);
3101+
3102+ if (ip->i_diskflags & GFS2_DIF_BARRIER)
3103+ vflags |= V_BARRIER;
3104+ if (ip->i_diskflags & GFS2_DIF_COW)
3105+ vflags |= V_COW;
3106+ inode->i_vflags = vflags;
3107+}
3108+
3109+void gfs2_get_inode_flags(struct inode *inode)
3110+{
3111+ struct gfs2_inode *ip = GFS2_I(inode);
3112+ unsigned int flags = inode->i_flags;
3113+ unsigned int vflags = inode->i_vflags;
3114+
3115+ ip->i_diskflags &= ~(GFS2_DIF_APPENDONLY |
3116+ GFS2_DIF_NOATIME | GFS2_DIF_SYNC |
3117+ GFS2_DIF_IMMUTABLE | GFS2_DIF_IXUNLINK |
3118+ GFS2_DIF_BARRIER | GFS2_DIF_COW);
3119+
3120+ if (flags & S_IMMUTABLE)
3121+ ip->i_diskflags |= GFS2_DIF_IMMUTABLE;
3122+ if (flags & S_IXUNLINK)
3123+ ip->i_diskflags |= GFS2_DIF_IXUNLINK;
3124+
3125+ if (flags & S_APPEND)
3126+ ip->i_diskflags |= GFS2_DIF_APPENDONLY;
3127+ if (flags & S_NOATIME)
3128+ ip->i_diskflags |= GFS2_DIF_NOATIME;
3129+ if (flags & S_SYNC)
3130+ ip->i_diskflags |= GFS2_DIF_SYNC;
3131+
3132+ if (vflags & V_BARRIER)
3133+ ip->i_diskflags |= GFS2_DIF_BARRIER;
3134+ if (vflags & V_COW)
3135+ ip->i_diskflags |= GFS2_DIF_COW;
3136 }
3137
3138 /* Flags that can be set by user space */
3139@@ -305,6 +353,37 @@ static int gfs2_set_flags(struct file *f
3140 return do_gfs2_set_flags(filp, gfsflags, ~GFS2_DIF_JDATA);
3141 }
3142
3143+int gfs2_sync_flags(struct inode *inode, int flags, int vflags)
3144+{
3145+ struct gfs2_inode *ip = GFS2_I(inode);
3146+ struct gfs2_sbd *sdp = GFS2_SB(inode);
3147+ struct buffer_head *bh;
3148+ struct gfs2_holder gh;
3149+ int error;
3150+
3151+ error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
3152+ if (error)
3153+ return error;
3154+ error = gfs2_trans_begin(sdp, RES_DINODE, 0);
3155+ if (error)
3156+ goto out;
3157+ error = gfs2_meta_inode_buffer(ip, &bh);
3158+ if (error)
3159+ goto out_trans_end;
3160+ gfs2_trans_add_meta(ip->i_gl, bh);
3161+ inode->i_flags = flags;
3162+ inode->i_vflags = vflags;
3163+ gfs2_get_inode_flags(inode);
3164+ gfs2_dinode_out(ip, bh->b_data);
3165+ brelse(bh);
3166+ gfs2_set_aops(inode);
3167+out_trans_end:
3168+ gfs2_trans_end(sdp);
3169+out:
3170+ gfs2_glock_dq_uninit(&gh);
3171+ return error;
3172+}
3173+
3174 static long gfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
3175 {
3176 switch(cmd) {
3177diff -NurpP --minimal linux-4.4.116/fs/gfs2/inode.h linux-4.4.116-vs2.3.9.7/fs/gfs2/inode.h
3178--- linux-4.4.116/fs/gfs2/inode.h 2015-04-12 22:12:50.000000000 +0000
3179+++ linux-4.4.116-vs2.3.9.7/fs/gfs2/inode.h 2018-01-09 16:36:32.000000000 +0000
3180@@ -118,6 +118,7 @@ extern const struct file_operations gfs2
3181 extern const struct file_operations gfs2_dir_fops_nolock;
3182
3183 extern void gfs2_set_inode_flags(struct inode *inode);
3184+extern int gfs2_sync_flags(struct inode *inode, int flags, int vflags);
3185
3186 #ifdef CONFIG_GFS2_FS_LOCKING_DLM
3187 extern const struct file_operations gfs2_file_fops;
3188diff -NurpP --minimal linux-4.4.116/fs/hostfs/hostfs.h linux-4.4.116-vs2.3.9.7/fs/hostfs/hostfs.h
3189--- linux-4.4.116/fs/hostfs/hostfs.h 2015-07-06 20:41:42.000000000 +0000
3190+++ linux-4.4.116-vs2.3.9.7/fs/hostfs/hostfs.h 2018-01-09 16:36:32.000000000 +0000
3191@@ -42,6 +42,7 @@ struct hostfs_iattr {
3192 unsigned short ia_mode;
3193 uid_t ia_uid;
3194 gid_t ia_gid;
3195+ vtag_t ia_tag;
3196 loff_t ia_size;
3197 struct timespec ia_atime;
3198 struct timespec ia_mtime;
3199diff -NurpP --minimal linux-4.4.116/fs/inode.c linux-4.4.116-vs2.3.9.7/fs/inode.c
3200--- linux-4.4.116/fs/inode.c 2018-02-22 21:19:52.000000000 +0000
3201+++ linux-4.4.116-vs2.3.9.7/fs/inode.c 2018-02-22 21:30:19.000000000 +0000
3202@@ -18,6 +18,7 @@
3203 #include <linux/buffer_head.h> /* for inode_has_buffers */
3204 #include <linux/ratelimit.h>
3205 #include <linux/list_lru.h>
3206+#include <linux/vs_tag.h>
3207 #include <trace/events/writeback.h>
3208 #include "internal.h"
3209
3210@@ -133,6 +134,8 @@ int inode_init_always(struct super_block
3211 struct address_space *const mapping = &inode->i_data;
3212
3213 inode->i_sb = sb;
3214+
3215+ /* essential because of inode slab reuse */
3216 inode->i_blkbits = sb->s_blocksize_bits;
3217 inode->i_flags = 0;
3218 atomic_set(&inode->i_count, 1);
3219@@ -142,6 +145,7 @@ int inode_init_always(struct super_block
3220 inode->i_opflags = 0;
3221 i_uid_write(inode, 0);
3222 i_gid_write(inode, 0);
3223+ i_tag_write(inode, 0);
3224 atomic_set(&inode->i_writecount, 0);
3225 inode->i_size = 0;
3226 inode->i_blocks = 0;
3227@@ -152,6 +156,7 @@ int inode_init_always(struct super_block
3228 inode->i_cdev = NULL;
3229 inode->i_link = NULL;
3230 inode->i_rdev = 0;
3231+ inode->i_mdev = 0;
3232 inode->dirtied_when = 0;
3233
3234 if (security_inode_alloc(inode))
3235@@ -469,6 +474,8 @@ void __insert_inode_hash(struct inode *i
3236 }
3237 EXPORT_SYMBOL(__insert_inode_hash);
3238
3239+EXPORT_SYMBOL_GPL(__iget);
3240+
3241 /**
3242 * __remove_inode_hash - remove an inode from the hash
3243 * @inode: inode to unhash
3244@@ -1911,9 +1918,11 @@ void init_special_inode(struct inode *in
3245 if (S_ISCHR(mode)) {
3246 inode->i_fop = &def_chr_fops;
3247 inode->i_rdev = rdev;
3248+ inode->i_mdev = rdev;
3249 } else if (S_ISBLK(mode)) {
3250 inode->i_fop = &def_blk_fops;
3251 inode->i_rdev = rdev;
3252+ inode->i_mdev = rdev;
3253 } else if (S_ISFIFO(mode))
3254 inode->i_fop = &pipefifo_fops;
3255 else if (S_ISSOCK(mode))
3256@@ -1942,6 +1951,7 @@ void inode_init_owner(struct inode *inod
3257 } else
3258 inode->i_gid = current_fsgid();
3259 inode->i_mode = mode;
3260+ i_tag_write(inode, dx_current_fstag(inode->i_sb));
3261 }
3262 EXPORT_SYMBOL(inode_init_owner);
3263
3264diff -NurpP --minimal linux-4.4.116/fs/ioctl.c linux-4.4.116-vs2.3.9.7/fs/ioctl.c
3265--- linux-4.4.116/fs/ioctl.c 2015-04-12 22:12:50.000000000 +0000
3266+++ linux-4.4.116-vs2.3.9.7/fs/ioctl.c 2018-01-09 16:36:32.000000000 +0000
3267@@ -15,6 +15,9 @@
3268 #include <linux/writeback.h>
3269 #include <linux/buffer_head.h>
3270 #include <linux/falloc.h>
3271+#include <linux/proc_fs.h>
3272+#include <linux/vserver/inode.h>
3273+#include <linux/vs_tag.h>
3274
3275 #include <asm/ioctls.h>
3276
3277diff -NurpP --minimal linux-4.4.116/fs/jfs/file.c linux-4.4.116-vs2.3.9.7/fs/jfs/file.c
3278--- linux-4.4.116/fs/jfs/file.c 2016-07-05 04:12:33.000000000 +0000
3279+++ linux-4.4.116-vs2.3.9.7/fs/jfs/file.c 2018-01-09 16:36:32.000000000 +0000
3280@@ -113,7 +113,8 @@ int jfs_setattr(struct dentry *dentry, s
3281 return rc;
3282 }
3283 if ((iattr->ia_valid & ATTR_UID && !uid_eq(iattr->ia_uid, inode->i_uid)) ||
3284- (iattr->ia_valid & ATTR_GID && !gid_eq(iattr->ia_gid, inode->i_gid))) {
3285+ (iattr->ia_valid & ATTR_GID && !gid_eq(iattr->ia_gid, inode->i_gid)) ||
3286+ (iattr->ia_valid & ATTR_TAG && !tag_eq(iattr->ia_tag, inode->i_tag))) {
3287 rc = dquot_transfer(inode, iattr);
3288 if (rc)
3289 return rc;
3290@@ -149,6 +150,7 @@ const struct inode_operations jfs_file_i
3291 .get_acl = jfs_get_acl,
3292 .set_acl = jfs_set_acl,
3293 #endif
3294+ .sync_flags = jfs_sync_flags,
3295 };
3296
3297 const struct file_operations jfs_file_operations = {
3298diff -NurpP --minimal linux-4.4.116/fs/jfs/ioctl.c linux-4.4.116-vs2.3.9.7/fs/jfs/ioctl.c
3299--- linux-4.4.116/fs/jfs/ioctl.c 2015-10-29 09:21:36.000000000 +0000
3300+++ linux-4.4.116-vs2.3.9.7/fs/jfs/ioctl.c 2018-01-09 16:36:32.000000000 +0000
3301@@ -12,6 +12,7 @@
3302 #include <linux/time.h>
3303 #include <linux/sched.h>
3304 #include <linux/blkdev.h>
3305+#include <linux/mount.h>
3306 #include <asm/current.h>
3307 #include <asm/uaccess.h>
3308
3309@@ -56,6 +57,16 @@ static long jfs_map_ext2(unsigned long f
3310 }
3311
3312
3313+int jfs_sync_flags(struct inode *inode, int flags, int vflags)
3314+{
3315+ inode->i_flags = flags;
3316+ inode->i_vflags = vflags;
3317+ jfs_get_inode_flags(JFS_IP(inode));
3318+ inode->i_ctime = CURRENT_TIME_SEC;
3319+ mark_inode_dirty(inode);
3320+ return 0;
3321+}
3322+
3323 long jfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
3324 {
3325 struct inode *inode = file_inode(filp);
3326@@ -89,6 +100,11 @@ long jfs_ioctl(struct file *filp, unsign
3327 if (!S_ISDIR(inode->i_mode))
3328 flags &= ~JFS_DIRSYNC_FL;
3329
3330+ if (IS_BARRIER(inode)) {
3331+ vxwprintk_task(1, "messing with the barrier.");
3332+ return -EACCES;
3333+ }
3334+
3335 /* Is it quota file? Do not allow user to mess with it */
3336 if (IS_NOQUOTA(inode)) {
3337 err = -EPERM;
3338@@ -106,8 +122,8 @@ long jfs_ioctl(struct file *filp, unsign
3339 * the relevant capability.
3340 */
3341 if ((oldflags & JFS_IMMUTABLE_FL) ||
3342- ((flags ^ oldflags) &
3343- (JFS_APPEND_FL | JFS_IMMUTABLE_FL))) {
3344+ ((flags ^ oldflags) & (JFS_APPEND_FL |
3345+ JFS_IMMUTABLE_FL | JFS_IXUNLINK_FL))) {
3346 if (!capable(CAP_LINUX_IMMUTABLE)) {
3347 mutex_unlock(&inode->i_mutex);
3348 err = -EPERM;
3349@@ -115,7 +131,7 @@ long jfs_ioctl(struct file *filp, unsign
3350 }
3351 }
3352
3353- flags = flags & JFS_FL_USER_MODIFIABLE;
3354+ flags &= JFS_FL_USER_MODIFIABLE;
3355 flags |= oldflags & ~JFS_FL_USER_MODIFIABLE;
3356 jfs_inode->mode2 = flags;
3357
3358diff -NurpP --minimal linux-4.4.116/fs/jfs/jfs_dinode.h linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_dinode.h
3359--- linux-4.4.116/fs/jfs/jfs_dinode.h 2015-04-12 22:12:50.000000000 +0000
3360+++ linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_dinode.h 2018-01-09 16:36:32.000000000 +0000
3361@@ -161,9 +161,13 @@ struct dinode {
3362
3363 #define JFS_APPEND_FL 0x01000000 /* writes to file may only append */
3364 #define JFS_IMMUTABLE_FL 0x02000000 /* Immutable file */
3365+#define JFS_IXUNLINK_FL 0x08000000 /* Immutable invert on unlink */
3366
3367-#define JFS_FL_USER_VISIBLE 0x03F80000
3368-#define JFS_FL_USER_MODIFIABLE 0x03F80000
3369+#define JFS_BARRIER_FL 0x04000000 /* Barrier for chroot() */
3370+#define JFS_COW_FL 0x20000000 /* Copy on Write marker */
3371+
3372+#define JFS_FL_USER_VISIBLE 0x07F80000
3373+#define JFS_FL_USER_MODIFIABLE 0x07F80000
3374 #define JFS_FL_INHERIT 0x03C80000
3375
3376 /* These are identical to EXT[23]_IOC_GETFLAGS/SETFLAGS */
3377diff -NurpP --minimal linux-4.4.116/fs/jfs/jfs_filsys.h linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_filsys.h
3378--- linux-4.4.116/fs/jfs/jfs_filsys.h 2015-04-12 22:12:50.000000000 +0000
3379+++ linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_filsys.h 2018-01-09 16:36:32.000000000 +0000
3380@@ -266,6 +266,7 @@
3381 #define JFS_NAME_MAX 255
3382 #define JFS_PATH_MAX BPSIZE
3383
3384+#define JFS_TAGGED 0x00800000 /* Context Tagging */
3385
3386 /*
3387 * file system state (superblock state)
3388diff -NurpP --minimal linux-4.4.116/fs/jfs/jfs_imap.c linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_imap.c
3389--- linux-4.4.116/fs/jfs/jfs_imap.c 2015-04-12 22:12:50.000000000 +0000
3390+++ linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_imap.c 2018-01-09 16:36:32.000000000 +0000
3391@@ -46,6 +46,7 @@
3392 #include <linux/pagemap.h>
3393 #include <linux/quotaops.h>
3394 #include <linux/slab.h>
3395+#include <linux/vs_tag.h>
3396
3397 #include "jfs_incore.h"
3398 #include "jfs_inode.h"
3399@@ -3047,6 +3048,8 @@ static int copy_from_dinode(struct dinod
3400 {
3401 struct jfs_inode_info *jfs_ip = JFS_IP(ip);
3402 struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb);
3403+ kuid_t kuid;
3404+ kgid_t kgid;
3405
3406 jfs_ip->fileset = le32_to_cpu(dip->di_fileset);
3407 jfs_ip->mode2 = le32_to_cpu(dip->di_mode);
3408@@ -3067,14 +3070,18 @@ static int copy_from_dinode(struct dinod
3409 }
3410 set_nlink(ip, le32_to_cpu(dip->di_nlink));
3411
3412- jfs_ip->saved_uid = make_kuid(&init_user_ns, le32_to_cpu(dip->di_uid));
3413+ kuid = make_kuid(&init_user_ns, le32_to_cpu(dip->di_uid));
3414+ kgid = make_kgid(&init_user_ns, le32_to_cpu(dip->di_gid));
3415+ ip->i_tag = INOTAG_KTAG(DX_TAG(ip), kuid, kgid, GLOBAL_ROOT_TAG);
3416+
3417+ jfs_ip->saved_uid = INOTAG_KUID(DX_TAG(ip), kuid, kgid);
3418 if (!uid_valid(sbi->uid))
3419 ip->i_uid = jfs_ip->saved_uid;
3420 else {
3421 ip->i_uid = sbi->uid;
3422 }
3423
3424- jfs_ip->saved_gid = make_kgid(&init_user_ns, le32_to_cpu(dip->di_gid));
3425+ jfs_ip->saved_gid = INOTAG_KGID(DX_TAG(ip), kuid, kgid);
3426 if (!gid_valid(sbi->gid))
3427 ip->i_gid = jfs_ip->saved_gid;
3428 else {
3429@@ -3139,16 +3146,14 @@ static void copy_to_dinode(struct dinode
3430 dip->di_size = cpu_to_le64(ip->i_size);
3431 dip->di_nblocks = cpu_to_le64(PBLK2LBLK(ip->i_sb, ip->i_blocks));
3432 dip->di_nlink = cpu_to_le32(ip->i_nlink);
3433- if (!uid_valid(sbi->uid))
3434- dip->di_uid = cpu_to_le32(i_uid_read(ip));
3435- else
3436- dip->di_uid =cpu_to_le32(from_kuid(&init_user_ns,
3437- jfs_ip->saved_uid));
3438- if (!gid_valid(sbi->gid))
3439- dip->di_gid = cpu_to_le32(i_gid_read(ip));
3440- else
3441- dip->di_gid = cpu_to_le32(from_kgid(&init_user_ns,
3442- jfs_ip->saved_gid));
3443+ dip->di_uid = cpu_to_le32(from_kuid(&init_user_ns,
3444+ TAGINO_KUID(DX_TAG(ip),
3445+ !uid_valid(sbi->uid) ? ip->i_uid : jfs_ip->saved_uid,
3446+ ip->i_tag)));
3447+ dip->di_gid = cpu_to_le32(from_kgid(&init_user_ns,
3448+ TAGINO_KGID(DX_TAG(ip),
3449+ !gid_valid(sbi->gid) ? ip->i_gid : jfs_ip->saved_gid,
3450+ ip->i_tag)));
3451 jfs_get_inode_flags(jfs_ip);
3452 /*
3453 * mode2 is only needed for storing the higher order bits.
3454diff -NurpP --minimal linux-4.4.116/fs/jfs/jfs_inode.c linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_inode.c
3455--- linux-4.4.116/fs/jfs/jfs_inode.c 2016-07-05 04:12:33.000000000 +0000
3456+++ linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_inode.c 2018-01-14 06:39:51.000000000 +0000
3457@@ -18,6 +18,7 @@
3458
3459 #include <linux/fs.h>
3460 #include <linux/quotaops.h>
3461+#include <linux/vs_tag.h>
3462 #include "jfs_incore.h"
3463 #include "jfs_inode.h"
3464 #include "jfs_filsys.h"
3465@@ -33,6 +34,9 @@ void jfs_set_inode_flags(struct inode *i
3466
3467 if (flags & JFS_IMMUTABLE_FL)
3468 new_fl |= S_IMMUTABLE;
3469+ if (flags & JFS_IXUNLINK_FL)
3470+ new_fl |= S_IXUNLINK;
3471+
3472 if (flags & JFS_APPEND_FL)
3473 new_fl |= S_APPEND;
3474 if (flags & JFS_NOATIME_FL)
3475@@ -41,18 +45,35 @@ void jfs_set_inode_flags(struct inode *i
3476 new_fl |= S_DIRSYNC;
3477 if (flags & JFS_SYNC_FL)
3478 new_fl |= S_SYNC;
3479- inode_set_flags(inode, new_fl, S_IMMUTABLE | S_APPEND | S_NOATIME |
3480- S_DIRSYNC | S_SYNC);
3481+
3482+ inode_set_flags(inode, new_fl, S_IMMUTABLE | S_IXUNLINK |
3483+ S_APPEND | S_NOATIME | S_DIRSYNC | S_SYNC);
3484+
3485+ new_fl = 0;
3486+ if (flags & JFS_BARRIER_FL)
3487+ new_fl |= V_BARRIER;
3488+ if (flags & JFS_COW_FL)
3489+ new_fl |= V_COW;
3490+
3491+ set_mask_bits(&inode->i_vflags,
3492+ V_BARRIER | V_COW, new_fl);
3493 }
3494
3495 void jfs_get_inode_flags(struct jfs_inode_info *jfs_ip)
3496 {
3497 unsigned int flags = jfs_ip->vfs_inode.i_flags;
3498+ unsigned int vflags = jfs_ip->vfs_inode.i_vflags;
3499+
3500+ jfs_ip->mode2 &= ~(JFS_IMMUTABLE_FL | JFS_IXUNLINK_FL |
3501+ JFS_APPEND_FL | JFS_NOATIME_FL |
3502+ JFS_DIRSYNC_FL | JFS_SYNC_FL |
3503+ JFS_BARRIER_FL | JFS_COW_FL);
3504
3505- jfs_ip->mode2 &= ~(JFS_IMMUTABLE_FL | JFS_APPEND_FL | JFS_NOATIME_FL |
3506- JFS_DIRSYNC_FL | JFS_SYNC_FL);
3507 if (flags & S_IMMUTABLE)
3508 jfs_ip->mode2 |= JFS_IMMUTABLE_FL;
3509+ if (flags & S_IXUNLINK)
3510+ jfs_ip->mode2 |= JFS_IXUNLINK_FL;
3511+
3512 if (flags & S_APPEND)
3513 jfs_ip->mode2 |= JFS_APPEND_FL;
3514 if (flags & S_NOATIME)
3515@@ -61,6 +82,11 @@ void jfs_get_inode_flags(struct jfs_inod
3516 jfs_ip->mode2 |= JFS_DIRSYNC_FL;
3517 if (flags & S_SYNC)
3518 jfs_ip->mode2 |= JFS_SYNC_FL;
3519+
3520+ if (vflags & V_BARRIER)
3521+ jfs_ip->mode2 |= JFS_BARRIER_FL;
3522+ if (vflags & V_COW)
3523+ jfs_ip->mode2 |= JFS_COW_FL;
3524 }
3525
3526 /*
3527diff -NurpP --minimal linux-4.4.116/fs/jfs/jfs_inode.h linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_inode.h
3528--- linux-4.4.116/fs/jfs/jfs_inode.h 2015-04-12 22:12:50.000000000 +0000
3529+++ linux-4.4.116-vs2.3.9.7/fs/jfs/jfs_inode.h 2018-01-09 16:36:32.000000000 +0000
3530@@ -39,6 +39,7 @@ extern struct dentry *jfs_fh_to_dentry(s
3531 extern struct dentry *jfs_fh_to_parent(struct super_block *sb, struct fid *fid,
3532 int fh_len, int fh_type);
3533 extern void jfs_set_inode_flags(struct inode *);
3534+extern int jfs_sync_flags(struct inode *, int, int);
3535 extern int jfs_get_block(struct inode *, sector_t, struct buffer_head *, int);
3536 extern int jfs_setattr(struct dentry *, struct iattr *);
3537
3538diff -NurpP --minimal linux-4.4.116/fs/jfs/namei.c linux-4.4.116-vs2.3.9.7/fs/jfs/namei.c
3539--- linux-4.4.116/fs/jfs/namei.c 2016-07-05 04:15:08.000000000 +0000
3540+++ linux-4.4.116-vs2.3.9.7/fs/jfs/namei.c 2018-01-09 16:36:32.000000000 +0000
3541@@ -22,6 +22,7 @@
3542 #include <linux/ctype.h>
3543 #include <linux/quotaops.h>
3544 #include <linux/exportfs.h>
3545+#include <linux/vs_tag.h>
3546 #include "jfs_incore.h"
3547 #include "jfs_superblock.h"
3548 #include "jfs_inode.h"
3549@@ -1480,6 +1481,7 @@ static struct dentry *jfs_lookup(struct
3550 jfs_err("jfs_lookup: iget failed on inum %d", (uint)inum);
3551 }
3552
3553+ dx_propagate_tag(nd, ip);
3554 return d_splice_alias(ip, dentry);
3555 }
3556
3557@@ -1545,6 +1547,7 @@ const struct inode_operations jfs_dir_in
3558 .get_acl = jfs_get_acl,
3559 .set_acl = jfs_set_acl,
3560 #endif
3561+ .sync_flags = jfs_sync_flags,
3562 };
3563
3564 const struct file_operations jfs_dir_operations = {
3565diff -NurpP --minimal linux-4.4.116/fs/jfs/super.c linux-4.4.116-vs2.3.9.7/fs/jfs/super.c
3566--- linux-4.4.116/fs/jfs/super.c 2018-02-22 21:19:52.000000000 +0000
3567+++ linux-4.4.116-vs2.3.9.7/fs/jfs/super.c 2018-01-09 16:36:32.000000000 +0000
3568@@ -206,7 +206,8 @@ enum {
3569 Opt_integrity, Opt_nointegrity, Opt_iocharset, Opt_resize,
3570 Opt_resize_nosize, Opt_errors, Opt_ignore, Opt_err, Opt_quota,
3571 Opt_usrquota, Opt_grpquota, Opt_uid, Opt_gid, Opt_umask,
3572- Opt_discard, Opt_nodiscard, Opt_discard_minblk
3573+ Opt_discard, Opt_nodiscard, Opt_discard_minblk,
3574+ Opt_tag, Opt_notag, Opt_tagid
3575 };
3576
3577 static const match_table_t tokens = {
3578@@ -216,6 +217,10 @@ static const match_table_t tokens = {
3579 {Opt_resize, "resize=%u"},
3580 {Opt_resize_nosize, "resize"},
3581 {Opt_errors, "errors=%s"},
3582+ {Opt_tag, "tag"},
3583+ {Opt_notag, "notag"},
3584+ {Opt_tagid, "tagid=%u"},
3585+ {Opt_tag, "tagxid"},
3586 {Opt_ignore, "noquota"},
3587 {Opt_ignore, "quota"},
3588 {Opt_usrquota, "usrquota"},
3589@@ -405,7 +410,20 @@ static int parse_options(char *options,
3590 pr_err("JFS: discard option not supported on device\n");
3591 break;
3592 }
3593-
3594+#ifndef CONFIG_TAGGING_NONE
3595+ case Opt_tag:
3596+ *flag |= JFS_TAGGED;
3597+ break;
3598+ case Opt_notag:
3599+ *flag &= JFS_TAGGED;
3600+ break;
3601+#endif
3602+#ifdef CONFIG_PROPAGATE
3603+ case Opt_tagid:
3604+ /* use args[0] */
3605+ *flag |= JFS_TAGGED;
3606+ break;
3607+#endif
3608 default:
3609 printk("jfs: Unrecognized mount option \"%s\" or missing value\n",
3610 p);
3611@@ -437,6 +455,12 @@ static int jfs_remount(struct super_bloc
3612 if (!parse_options(data, sb, &newLVSize, &flag))
3613 return -EINVAL;
3614
3615+ if ((flag & JFS_TAGGED) && !(sb->s_flags & MS_TAGGED)) {
3616+ printk(KERN_ERR "JFS: %s: tagging not permitted on remount.\n",
3617+ sb->s_id);
3618+ return -EINVAL;
3619+ }
3620+
3621 if (newLVSize) {
3622 if (sb->s_flags & MS_RDONLY) {
3623 pr_err("JFS: resize requires volume to be mounted read-write\n");
3624@@ -517,6 +541,9 @@ static int jfs_fill_super(struct super_b
3625 #ifdef CONFIG_JFS_POSIX_ACL
3626 sb->s_flags |= MS_POSIXACL;
3627 #endif
3628+ /* map mount option tagxid */
3629+ if (sbi->flag & JFS_TAGGED)
3630+ sb->s_flags |= MS_TAGGED;
3631
3632 if (newLVSize) {
3633 pr_err("resize option for remount only\n");
3634diff -NurpP --minimal linux-4.4.116/fs/libfs.c linux-4.4.116-vs2.3.9.7/fs/libfs.c
3635--- linux-4.4.116/fs/libfs.c 2016-07-05 04:12:33.000000000 +0000
3636+++ linux-4.4.116-vs2.3.9.7/fs/libfs.c 2018-01-09 16:36:32.000000000 +0000
3637@@ -141,13 +141,14 @@ static inline unsigned char dt_type(stru
3638 * both impossible due to the lock on directory.
3639 */
3640
3641-int dcache_readdir(struct file *file, struct dir_context *ctx)
3642+static inline int do_dcache_readdir_filter(struct file *filp,
3643+ struct dir_context *ctx, int (*filter)(struct dentry *dentry))
3644 {
3645- struct dentry *dentry = file->f_path.dentry;
3646- struct dentry *cursor = file->private_data;
3647+ struct dentry *dentry = filp->f_path.dentry;
3648+ struct dentry *cursor = filp->private_data;
3649 struct list_head *p, *q = &cursor->d_child;
3650
3651- if (!dir_emit_dots(file, ctx))
3652+ if (!dir_emit_dots(filp, ctx))
3653 return 0;
3654 spin_lock(&dentry->d_lock);
3655 if (ctx->pos == 2)
3656@@ -155,6 +156,8 @@ int dcache_readdir(struct file *file, st
3657
3658 for (p = q->next; p != &dentry->d_subdirs; p = p->next) {
3659 struct dentry *next = list_entry(p, struct dentry, d_child);
3660+ if (filter && !filter(next))
3661+ continue;
3662 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
3663 if (!simple_positive(next)) {
3664 spin_unlock(&next->d_lock);
3665@@ -177,8 +180,22 @@ int dcache_readdir(struct file *file, st
3666 spin_unlock(&dentry->d_lock);
3667 return 0;
3668 }
3669+
3670 EXPORT_SYMBOL(dcache_readdir);
3671
3672+int dcache_readdir(struct file *filp, struct dir_context *ctx)
3673+{
3674+ return do_dcache_readdir_filter(filp, ctx, NULL);
3675+}
3676+
3677+EXPORT_SYMBOL(dcache_readdir_filter);
3678+
3679+int dcache_readdir_filter(struct file *filp, struct dir_context *ctx,
3680+ int (*filter)(struct dentry *))
3681+{
3682+ return do_dcache_readdir_filter(filp, ctx, filter);
3683+}
3684+
3685 ssize_t generic_read_dir(struct file *filp, char __user *buf, size_t siz, loff_t *ppos)
3686 {
3687 return -EISDIR;
3688diff -NurpP --minimal linux-4.4.116/fs/locks.c linux-4.4.116-vs2.3.9.7/fs/locks.c
3689--- linux-4.4.116/fs/locks.c 2018-02-22 21:19:52.000000000 +0000
3690+++ linux-4.4.116-vs2.3.9.7/fs/locks.c 2018-01-25 00:25:02.000000000 +0000
3691@@ -129,6 +129,8 @@
3692 #include <linux/hashtable.h>
3693 #include <linux/percpu.h>
3694 #include <linux/lglock.h>
3695+#include <linux/vs_base.h>
3696+#include <linux/vs_limit.h>
3697
3698 #define CREATE_TRACE_POINTS
3699 #include <trace/events/filelock.h>
3700@@ -255,11 +257,15 @@ static void locks_init_lock_heads(struct
3701 /* Allocate an empty lock structure. */
3702 struct file_lock *locks_alloc_lock(void)
3703 {
3704- struct file_lock *fl = kmem_cache_zalloc(filelock_cache, GFP_KERNEL);
3705+ struct file_lock *fl;
3706
3707- if (fl)
3708- locks_init_lock_heads(fl);
3709+ fl = kmem_cache_zalloc(filelock_cache, GFP_KERNEL);
3710
3711+ if (fl) {
3712+ locks_init_lock_heads(fl);
3713+ vx_locks_inc(fl);
3714+ fl->fl_xid = -1;
3715+ }
3716 return fl;
3717 }
3718 EXPORT_SYMBOL_GPL(locks_alloc_lock);
3719@@ -311,6 +317,7 @@ void locks_init_lock(struct file_lock *f
3720 {
3721 memset(fl, 0, sizeof(struct file_lock));
3722 locks_init_lock_heads(fl);
3723+ fl->fl_xid = -1;
3724 }
3725
3726 EXPORT_SYMBOL(locks_init_lock);
3727@@ -328,6 +335,7 @@ void locks_copy_conflock(struct file_loc
3728 new->fl_start = fl->fl_start;
3729 new->fl_end = fl->fl_end;
3730 new->fl_lmops = fl->fl_lmops;
3731+ new->fl_xid = fl->fl_xid;
3732 new->fl_ops = NULL;
3733
3734 if (fl->fl_lmops) {
3735@@ -389,7 +397,10 @@ flock_make_lock(struct file *filp, unsig
3736 fl->fl_flags = FL_FLOCK;
3737 fl->fl_type = type;
3738 fl->fl_end = OFFSET_MAX;
3739-
3740+
3741+ vxd_assert(filp->f_xid == vx_current_xid(),
3742+ "f_xid(%d) == current(%d)", filp->f_xid, vx_current_xid());
3743+ fl->fl_xid = filp->f_xid;
3744 return fl;
3745 }
3746
3747@@ -511,6 +522,7 @@ static int lease_init(struct file *filp,
3748
3749 fl->fl_owner = filp;
3750 fl->fl_pid = current->tgid;
3751+ fl->fl_xid = vx_current_xid();
3752
3753 fl->fl_file = filp;
3754 fl->fl_flags = FL_LEASE;
3755@@ -530,6 +542,10 @@ static struct file_lock *lease_alloc(str
3756 if (fl == NULL)
3757 return ERR_PTR(error);
3758
3759+ fl->fl_xid = vx_current_xid();
3760+ if (filp)
3761+ vxd_assert(filp->f_xid == fl->fl_xid,
3762+ "f_xid(%d) == fl_xid(%d)", filp->f_xid, fl->fl_xid);
3763 error = lease_init(filp, type, fl);
3764 if (error) {
3765 locks_free_lock(fl);
3766@@ -908,6 +924,7 @@ static int flock_lock_inode(struct inode
3767 goto out;
3768 }
3769
3770+ new_fl->fl_xid = -1;
3771 find_conflict:
3772 list_for_each_entry(fl, &ctx->flc_flock, fl_list) {
3773 if (!flock_locks_conflict(request, fl))
3774@@ -934,7 +951,8 @@ out:
3775 return error;
3776 }
3777
3778-static int __posix_lock_file(struct inode *inode, struct file_lock *request, struct file_lock *conflock)
3779+static int __posix_lock_file(struct inode *inode, struct file_lock *request,
3780+ struct file_lock *conflock, vxid_t xid)
3781 {
3782 struct file_lock *fl, *tmp;
3783 struct file_lock *new_fl = NULL;
3784@@ -950,6 +968,9 @@ static int __posix_lock_file(struct inod
3785 if (!ctx)
3786 return (request->fl_type == F_UNLCK) ? 0 : -ENOMEM;
3787
3788+ if (xid)
3789+ vxd_assert(xid == vx_current_xid(),
3790+ "xid(%d) == current(%d)", xid, vx_current_xid());
3791 /*
3792 * We may need two file_lock structures for this operation,
3793 * so we get them in advance to avoid races.
3794@@ -960,7 +981,11 @@ static int __posix_lock_file(struct inod
3795 (request->fl_type != F_UNLCK ||
3796 request->fl_start != 0 || request->fl_end != OFFSET_MAX)) {
3797 new_fl = locks_alloc_lock();
3798+ new_fl->fl_xid = xid;
3799+ // vx_locks_inc(new_fl);
3800 new_fl2 = locks_alloc_lock();
3801+ new_fl2->fl_xid = xid;
3802+ // vx_locks_inc(new_fl2);
3803 }
3804
3805 spin_lock(&ctx->flc_lock);
3806@@ -1162,7 +1187,8 @@ static int __posix_lock_file(struct inod
3807 int posix_lock_file(struct file *filp, struct file_lock *fl,
3808 struct file_lock *conflock)
3809 {
3810- return __posix_lock_file(file_inode(filp), fl, conflock);
3811+ return __posix_lock_file(file_inode(filp),
3812+ fl, conflock, filp->f_xid);
3813 }
3814 EXPORT_SYMBOL(posix_lock_file);
3815
3816@@ -1178,7 +1204,7 @@ static int posix_lock_inode_wait(struct
3817 int error;
3818 might_sleep ();
3819 for (;;) {
3820- error = __posix_lock_file(inode, fl, NULL);
3821+ error = __posix_lock_file(inode, fl, NULL, 0);
3822 if (error != FILE_LOCK_DEFERRED)
3823 break;
3824 error = wait_event_interruptible(fl->fl_wait, !fl->fl_next);
3825@@ -1257,10 +1283,13 @@ int locks_mandatory_area(int read_write,
3826 fl.fl_end = offset + count - 1;
3827
3828 for (;;) {
3829+ vxid_t f_xid = 0;
3830+
3831 if (filp) {
3832 fl.fl_owner = filp;
3833 fl.fl_flags &= ~FL_SLEEP;
3834- error = __posix_lock_file(inode, &fl, NULL);
3835+ f_xid = filp->f_xid;
3836+ error = __posix_lock_file(inode, &fl, NULL, f_xid);
3837 if (!error)
3838 break;
3839 }
3840@@ -1268,7 +1297,7 @@ int locks_mandatory_area(int read_write,
3841 if (sleep)
3842 fl.fl_flags |= FL_SLEEP;
3843 fl.fl_owner = current->files;
3844- error = __posix_lock_file(inode, &fl, NULL);
3845+ error = __posix_lock_file(inode, &fl, NULL, f_xid);
3846 if (error != FILE_LOCK_DEFERRED)
3847 break;
3848 error = wait_event_interruptible(fl.fl_wait, !fl.fl_next);
3849@@ -2165,6 +2194,11 @@ int fcntl_setlk(unsigned int fd, struct
3850 if (file_lock == NULL)
3851 return -ENOLCK;
3852
3853+ vxd_assert(filp->f_xid == vx_current_xid(),
3854+ "f_xid(%d) == current(%d)", filp->f_xid, vx_current_xid());
3855+ file_lock->fl_xid = filp->f_xid;
3856+ // vx_locks_inc(file_lock);
3857+
3858 /*
3859 * This might block, so we do it before checking the inode.
3860 */
3861@@ -2309,6 +2343,11 @@ int fcntl_setlk64(unsigned int fd, struc
3862 if (file_lock == NULL)
3863 return -ENOLCK;
3864
3865+ vxd_assert(filp->f_xid == vx_current_xid(),
3866+ "f_xid(%d) == current(%d)", filp->f_xid, vx_current_xid());
3867+ file_lock->fl_xid = filp->f_xid;
3868+ // vx_locks_inc(file_lock);
3869+
3870 /*
3871 * This might block, so we do it before checking the inode.
3872 */
3873@@ -2624,8 +2663,11 @@ static int locks_show(struct seq_file *f
3874
3875 lock_get_status(f, fl, iter->li_pos, "");
3876
3877- list_for_each_entry(bfl, &fl->fl_block, fl_block)
3878+ list_for_each_entry(bfl, &fl->fl_block, fl_block) {
3879+ if (!vx_check(fl->fl_xid, VS_WATCH_P | VS_IDENT))
3880+ continue;
3881 lock_get_status(f, bfl, iter->li_pos, " ->");
3882+ }
3883
3884 return 0;
3885 }
3886diff -NurpP --minimal linux-4.4.116/fs/mount.h linux-4.4.116-vs2.3.9.7/fs/mount.h
3887--- linux-4.4.116/fs/mount.h 2018-02-22 21:19:52.000000000 +0000
3888+++ linux-4.4.116-vs2.3.9.7/fs/mount.h 2018-01-09 16:36:32.000000000 +0000
3889@@ -68,6 +68,7 @@ struct mount {
3890 struct hlist_head mnt_pins;
3891 struct fs_pin mnt_umount;
3892 struct dentry *mnt_ex_mountpoint;
3893+ vtag_t mnt_tag; /* tagging used for vfsmount */
3894 };
3895
3896 #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
3897diff -NurpP --minimal linux-4.4.116/fs/namei.c linux-4.4.116-vs2.3.9.7/fs/namei.c
3898--- linux-4.4.116/fs/namei.c 2018-02-22 21:19:52.000000000 +0000
3899+++ linux-4.4.116-vs2.3.9.7/fs/namei.c 2018-01-13 03:11:55.000000000 +0000
3900@@ -34,10 +34,20 @@
3901 #include <linux/device_cgroup.h>
3902 #include <linux/fs_struct.h>
3903 #include <linux/posix_acl.h>
3904+#include <linux/proc_fs.h>
3905+#include <linux/magic.h>
3906+#include <linux/vserver/inode.h>
3907+#include <linux/vs_base.h>
3908+#include <linux/vs_tag.h>
3909+#include <linux/vs_cowbl.h>
3910+#include <linux/vs_device.h>
3911+#include <linux/vs_context.h>
3912+#include <linux/pid_namespace.h>
3913 #include <linux/hash.h>
3914 #include <asm/uaccess.h>
3915
3916 #include "internal.h"
3917+#include "proc/internal.h"
3918 #include "mount.h"
3919
3920 /* [Feb-1997 T. Schoebel-Theuer]
3921@@ -283,6 +293,93 @@ static int check_acl(struct inode *inode
3922 return -EAGAIN;
3923 }
3924
3925+static inline int dx_barrier(const struct inode *inode)
3926+{
3927+ if (IS_BARRIER(inode) && !vx_check(0, VS_ADMIN | VS_WATCH)) {
3928+ vxwprintk_task(1, "did hit the barrier.");
3929+ return 1;
3930+ }
3931+ return 0;
3932+}
3933+
3934+static int __dx_permission(const struct inode *inode, int mask)
3935+{
3936+ if (dx_barrier(inode))
3937+ return -EACCES;
3938+
3939+ if (inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC) {
3940+ /* devpts is xid tagged */
3941+ if (S_ISDIR(inode->i_mode) ||
3942+ vx_check((vxid_t)i_tag_read(inode), VS_IDENT | VS_WATCH_P))
3943+ return 0;
3944+
3945+ /* just pretend we didn't find anything */
3946+ return -ENOENT;
3947+ }
3948+ else if (inode->i_sb->s_magic == PROC_SUPER_MAGIC) {
3949+ struct proc_dir_entry *de = PDE(inode);
3950+
3951+ if (de && !vx_hide_check(0, de->vx_flags)) {
3952+ vxdprintk(VXD_CBIT(misc, 9),
3953+ VS_Q("%*s") " hidden by _dx_permission",
3954+ de->namelen, de->name);
3955+ goto out;
3956+ }
3957+
3958+ if ((mask & (MAY_WRITE | MAY_APPEND))) {
3959+ struct pid *pid;
3960+ struct task_struct *tsk;
3961+
3962+ if (vx_check(0, VS_ADMIN | VS_WATCH_P) ||
3963+ vx_flags(VXF_STATE_SETUP, 0))
3964+ return 0;
3965+
3966+ pid = PROC_I(inode)->pid;
3967+ if (!pid)
3968+ goto out;
3969+
3970+ rcu_read_lock();
3971+ tsk = pid_task(pid, PIDTYPE_PID);
3972+ vxdprintk(VXD_CBIT(tag, 0), "accessing %p[#%u]",
3973+ tsk, (tsk ? vx_task_xid(tsk) : 0));
3974+ if (tsk &&
3975+ vx_check(vx_task_xid(tsk), VS_IDENT | VS_WATCH_P)) {
3976+ rcu_read_unlock();
3977+ return 0;
3978+ }
3979+ rcu_read_unlock();
3980+ }
3981+ else {
3982+ /* FIXME: Should we block some entries here? */
3983+ return 0;
3984+ }
3985+ }
3986+ else {
3987+ if (dx_notagcheck(inode->i_sb) ||
3988+ dx_check((vxid_t)i_tag_read(inode),
3989+ DX_HOSTID | DX_ADMIN | DX_WATCH | DX_IDENT))
3990+ return 0;
3991+ }
3992+
3993+out:
3994+ return -EACCES;
3995+}
3996+
3997+int dx_permission(const struct inode *inode, int mask)
3998+{
3999+ int ret = __dx_permission(inode, mask);
4000+ if (unlikely(ret)) {
4001+#ifndef CONFIG_VSERVER_WARN_DEVPTS
4002+ if (inode->i_sb->s_magic != DEVPTS_SUPER_MAGIC)
4003+#endif
4004+ vxwprintk_task(1,
4005+ "denied [0x%x] access to inode %s:%p[#%d,%lu]",
4006+ mask, inode->i_sb->s_id, inode,
4007+ i_tag_read(inode), inode->i_ino);
4008+ }
4009+ return ret;
4010+}
4011+
4012 /*
4013 * This does the basic permission checking
4014 */
4015@@ -407,10 +504,14 @@ int __inode_permission(struct inode *ino
4016 /*
4017 * Nobody gets write access to an immutable file.
4018 */
4019- if (IS_IMMUTABLE(inode))
4020+ if (IS_IMMUTABLE(inode) && !IS_COW(inode))
4021 return -EACCES;
4022 }
4023
4024+ retval = dx_permission(inode, mask);
4025+ if (retval)
4026+ return retval;
4027+
4028 retval = do_inode_permission(inode, mask);
4029 if (retval)
4030 return retval;
4031@@ -1583,6 +1684,9 @@ static int lookup_fast(struct nameidata
4032 */
4033 if (negative)
4034 return -ENOENT;
4035+
4036+ /* FIXME: check dx permission */
4037+
4038 path->mnt = mnt;
4039 path->dentry = dentry;
4040 if (likely(__follow_mount_rcu(nd, path, inode, seqp)))
4041@@ -1613,6 +1717,8 @@ unlazy:
4042 dput(dentry);
4043 return -ENOENT;
4044 }
4045+
4046+ /* FIXME: check dx permission */
4047 path->mnt = mnt;
4048 path->dentry = dentry;
4049 err = follow_managed(path, nd);
4050@@ -2571,7 +2677,7 @@ static int may_delete(struct inode *dir,
4051 return -EPERM;
4052
4053 if (check_sticky(dir, inode) || IS_APPEND(inode) ||
4054- IS_IMMUTABLE(inode) || IS_SWAPFILE(inode))
4055+ IS_IXORUNLINK(inode) || IS_SWAPFILE(inode))
4056 return -EPERM;
4057 if (isdir) {
4058 if (!d_is_dir(victim))
4059@@ -2653,19 +2759,25 @@ int vfs_create(struct inode *dir, struct
4060 bool want_excl)
4061 {
4062 int error = may_create(dir, dentry);
4063- if (error)
4064+ if (error) {
4065+ vxdprintk(VXD_CBIT(misc, 3), "may_create failed with %d", error);
4066 return error;
4067+ }
4068
4069 if (!dir->i_op->create)
4070 return -EACCES; /* shouldn't it be ENOSYS? */
4071 mode &= S_IALLUGO;
4072 mode |= S_IFREG;
4073 error = security_inode_create(dir, dentry, mode);
4074- if (error)
4075+ if (error) {
4076+ vxdprintk(VXD_CBIT(misc, 3), "security_inode_create failed with %d", error);
4077 return error;
4078+ }
4079 error = dir->i_op->create(dir, dentry, mode, want_excl);
4080 if (!error)
4081 fsnotify_create(dir, dentry);
4082+ else
4083+ vxdprintk(VXD_CBIT(misc, 3), "i_op->create failed with %d", error);
4084 return error;
4085 }
4086 EXPORT_SYMBOL(vfs_create);
4087@@ -2701,6 +2813,15 @@ static int may_open(struct path *path, i
4088 break;
4089 }
4090
4091+#ifdef CONFIG_VSERVER_COWBL
4092+ if (IS_COW(inode) &&
4093+ ((flag & O_ACCMODE) != O_RDONLY)) {
4094+ if (IS_COW_LINK(inode))
4095+ return -EMLINK;
4096+ inode->i_flags &= ~(S_IXUNLINK|S_IMMUTABLE);
4097+ mark_inode_dirty(inode);
4098+ }
4099+#endif
4100 error = inode_permission(inode, acc_mode);
4101 if (error)
4102 return error;
4103@@ -3178,6 +3299,16 @@ finish_open:
4104 }
4105 finish_open_created:
4106 error = may_open(&nd->path, acc_mode, open_flag);
4107+#ifdef CONFIG_VSERVER_COWBL
4108+ if (error == -EMLINK) {
4109+ struct dentry *dentry;
4110+ dentry = cow_break_link(nd->name->name);
4111+ if (IS_ERR(dentry))
4112+ error = PTR_ERR(dentry);
4113+ else
4114+ dput(dentry);
4115+ }
4116+#endif
4117 if (error)
4118 goto out;
4119
4120@@ -3302,6 +3433,9 @@ static struct file *path_openat(struct n
4121 int opened = 0;
4122 int error;
4123
4124+#ifdef CONFIG_VSERVER_COWBL
4125+restart:
4126+#endif
4127 file = get_empty_filp();
4128 if (IS_ERR(file))
4129 return file;
4130@@ -3328,6 +3462,12 @@ static struct file *path_openat(struct n
4131 }
4132 }
4133 terminate_walk(nd);
4134+#ifdef CONFIG_VSERVER_COWBL
4135+ if (error == -EMLINK) {
4136+ // path_cleanup(nd);
4137+ goto restart;
4138+ }
4139+#endif
4140 out2:
4141 if (!(opened & FILE_OPENED)) {
4142 BUG_ON(!error);
4143@@ -3448,6 +3588,11 @@ static struct dentry *filename_create(in
4144 goto fail;
4145 }
4146 putname(name);
4147+ vxdprintk(VXD_CBIT(misc, 3), "filename_create path.dentry = %p (%.*s), dentry = %p (%.*s), d_inode = %p",
4148+ path->dentry, path->dentry->d_name.len,
4149+ path->dentry->d_name.name, dentry,
4150+ dentry->d_name.len, dentry->d_name.name,
4151+ path->dentry->d_inode);
4152 return dentry;
4153 fail:
4154 dput(dentry);
4155@@ -3564,6 +3709,7 @@ retry:
4156 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
4157 break;
4158 }
4159+
4160 out:
4161 done_path_create(&path, dentry);
4162 if (retry_estale(error, lookup_flags)) {
4163@@ -4010,7 +4156,7 @@ int vfs_link(struct dentry *old_dentry,
4164 /*
4165 * A link to an append-only or immutable file cannot be created.
4166 */
4167- if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
4168+ if (IS_APPEND(inode) || IS_IXORUNLINK(inode))
4169 return -EPERM;
4170 if (!dir->i_op->link)
4171 return -EPERM;
4172@@ -4519,6 +4665,330 @@ int generic_readlink(struct dentry *dent
4173 }
4174 EXPORT_SYMBOL(generic_readlink);
4175
4176+
4177+#ifdef CONFIG_VSERVER_COWBL
4178+
4179+static inline
4180+void dump_path(const char *name, struct path *path)
4181+{
4182+ vxdprintk(VXD_CBIT(misc, 3),
4183+ "%s: path=%p mnt=%p dentry=%p", name, path,
4184+ path ? path->mnt : NULL,
4185+ path ? path->dentry : NULL);
4186+
4187+ if (path && path->mnt)
4188+ vxdprintk(VXD_CBIT(misc, 3),
4189+ "%s: path mnt_sb=%p[#%d,#%d] mnt_root=%p[#%d]", name,
4190+ path->mnt->mnt_sb,
4191+ path->mnt->mnt_sb ? path->mnt->mnt_sb->s_count : -1,
4192+ path->mnt->mnt_sb ? atomic_read(&path->mnt->mnt_sb->s_active) : -1,
4193+ path->mnt->mnt_root,
4194+ path->mnt->mnt_root ? path->mnt->mnt_root->d_lockref.count : -1);
4195+
4196+ if (path && path->dentry)
4197+ vxdprintk(VXD_CBIT(misc, 3),
4198+ "%s: path dentry=%p[#%d]", name,
4199+ path->dentry,
4200+ path->dentry ? path->dentry->d_lockref.count : -1);
4201+}
4202+
4203+static inline
4204+long do_cow_splice(struct file *in, struct file *out, size_t len)
4205+{
4206+ loff_t ppos = 0;
4207+ loff_t opos = 0;
4208+
4209+ return do_splice_direct(in, &ppos, out, &opos, len, 0);
4210+}
4211+
4212+struct dentry *cow_break_link(const char *pathname)
4213+{
4214+ int ret, mode, pathlen, redo = 0, drop = 1;
4215+ struct path old_path = {}, par_path = {}, dir_path = {}, *new_path = NULL;
4216+ struct dentry *dir, *old_dentry, *new_dentry = NULL;
4217+ struct file *old_file;
4218+ struct file *new_file;
4219+ struct qstr new_qstr;
4220+ int new_type;
4221+ char *to, *path, pad='\251';
4222+ loff_t size;
4223+ struct filename *filename = getname_kernel(pathname);
4224+ struct filename *to_filename;
4225+
4226+ vxdprintk(VXD_CBIT(misc, 1),
4227+ "cow_break_link(" VS_Q("%s") ")", pathname);
4228+
4229+ path = kmalloc(PATH_MAX, GFP_KERNEL);
4230+ ret = -ENOMEM;
4231+ if (!path || IS_ERR(filename))
4232+ goto out;
4233+
4234+ /* old_path will have refs to dentry and mnt */
4235+ ret = filename_lookup(AT_FDCWD, filename, LOOKUP_FOLLOW, &old_path, NULL);
4236+ vxdprintk(VXD_CBIT(misc, 2),
4237+ "do_path_lookup(old): %d", ret);
4238+ if (ret < 0)
4239+ goto out_free_path;
4240+
4241+ dump_path("cow (old)", &old_path);
4242+
4243+ /* no explicit reference for old_dentry here */
4244+ old_dentry = old_path.dentry;
4245+
4246+ /* speculative put */
4247+ // dput(old_dentry);
4248+
4249+ mode = old_dentry->d_inode->i_mode;
4250+ to = d_path(&old_path, path, PATH_MAX-2);
4251+ pathlen = strlen(to);
4252+ vxdprintk(VXD_CBIT(misc, 2),
4253+ "old path " VS_Q("%s") " [%p:" VS_Q("%.*s") ":%d]", to,
4254+ old_dentry,
4255+ old_dentry->d_name.len, old_dentry->d_name.name,
4256+ old_dentry->d_name.len);
4257+
4258+ to[pathlen + 1] = 0;
4259+retry:
4260+ new_dentry = NULL;
4261+ to[pathlen] = pad--;
4262+ ret = -ELOOP;
4263+ if (pad <= '\240')
4264+ goto out_rel_old;
4265+
4266+ vxdprintk(VXD_CBIT(misc, 1), "temp copy " VS_Q("%s"), to);
4267+
4268+ /* dir_path will have refs to dentry and mnt */
4269+ to_filename = getname_kernel(to);
4270+ to_filename = filename_parentat(AT_FDCWD, to_filename,
4271+ LOOKUP_PARENT | LOOKUP_OPEN | LOOKUP_CREATE, &par_path, &new_qstr, &new_type);
4272+ vxdprintk(VXD_CBIT(misc, 2), "filename_parentat(new): %p", to_filename);
4273+ dump_path("cow (par)", &par_path);
4274+ if (IS_ERR(to_filename))
4275+ goto retry;
4276+
4277+ vxdprintk(VXD_CBIT(misc, 2), "to_filename refcnt=%d", to_filename->refcnt);
4278+ // putname(to_filename);
4279+
4280+ /* this puppy downs the dir inode mutex if successful.
4281+ dir_path will hold refs to dentry and mnt and
4282+ we'll have write access to the mnt */
4283+ new_dentry = filename_create(AT_FDCWD, to_filename, &dir_path, 0);
4284+ if (!new_dentry || IS_ERR(new_dentry)) {
4285+ path_put(&par_path);
4286+ vxdprintk(VXD_CBIT(misc, 2),
4287+ "filename_create(new) failed with %ld",
4288+ PTR_ERR(new_dentry));
4289+ goto retry;
4290+ }
4291+ vxdprintk(VXD_CBIT(misc, 2),
4292+ "filename_create(new): %p [" VS_Q("%.*s") ":%d]",
4293+ new_dentry,
4294+ new_dentry->d_name.len, new_dentry->d_name.name,
4295+ new_dentry->d_name.len);
4296+
4297+ dump_path("cow (dir)", &dir_path);
4298+
4299+ /* take a reference on new_dentry */
4300+ dget(new_dentry);
4301+
4302+ /* dentry/mnt refs handed over to new_path */
4303+ new_path = &dir_path;
4304+
4305+ /* dentry for old/new dir */
4306+ dir = par_path.dentry;
4307+
4308+ /* give up reference on dir */
4309+ dput(new_path->dentry);
4310+
4311+ /* new_dentry already has a reference */
4312+ new_path->dentry = new_dentry;
4313+
4314+ ret = vfs_create(dir->d_inode, new_dentry, mode, 1);
4315+ vxdprintk(VXD_CBIT(misc, 2),
4316+ "vfs_create(new): %d", ret);
4317+ if (ret == -EEXIST) {
4318+ path_put(&par_path);
4319+ mutex_unlock(&dir->d_inode->i_mutex);
4320+ mnt_drop_write(new_path->mnt);
4321+ path_put(new_path);
4322+ new_dentry = NULL;
4323+ goto retry;
4324+ }
4325+ else if (ret < 0)
4326+ goto out_unlock_new;
4327+
4328+ /* the old file went away */
4329+ ret = -ENOENT;
4330+ if ((redo = d_unhashed(old_dentry)))
4331+ goto out_unlock_new;
4332+
4333+ /* doesn't change refs for old_path */
4334+ old_file = dentry_open(&old_path, O_RDONLY, current_cred());
4335+ vxdprintk(VXD_CBIT(misc, 2),
4336+ "dentry_open(old): %p", old_file);
4337+ if (IS_ERR(old_file)) {
4338+ ret = PTR_ERR(old_file);
4339+ goto out_unlock_new;
4340+ }
4341+
4342+ /* doesn't change refs for new_path */
4343+ new_file = dentry_open(new_path, O_WRONLY, current_cred());
4344+ vxdprintk(VXD_CBIT(misc, 2),
4345+ "dentry_open(new): %p", new_file);
4346+ if (IS_ERR(new_file)) {
4347+ ret = PTR_ERR(new_file);
4348+ goto out_fput_old;
4349+ }
4350+
4351+ /* unlock the inode mutex from filename_create() */
4352+ mutex_unlock(&dir->d_inode->i_mutex);
4353+
4354+ /* drop write access to mnt */
4355+ mnt_drop_write(new_path->mnt);
4356+
4357+ drop = 0;
4358+
4359+ size = i_size_read(old_file->f_path.dentry->d_inode);
4360+ ret = do_cow_splice(old_file, new_file, size);
4361+ vxdprintk(VXD_CBIT(misc, 2), "do_splice_direct: %d", ret);
4362+ if (ret < 0) {
4363+ goto out_fput_both;
4364+ } else if (ret < size) {
4365+ ret = -ENOSPC;
4366+ goto out_fput_both;
4367+ } else {
4368+ struct inode *old_inode = old_dentry->d_inode;
4369+ struct inode *new_inode = new_dentry->d_inode;
4370+ struct iattr attr = {
4371+ .ia_uid = old_inode->i_uid,
4372+ .ia_gid = old_inode->i_gid,
4373+ .ia_valid = ATTR_UID | ATTR_GID
4374+ };
4375+
4376+ setattr_copy(new_inode, &attr);
4377+ mark_inode_dirty(new_inode);
4378+ }
4379+
4380+ /* lock rename mutex */
4381+ mutex_lock(&old_dentry->d_inode->i_sb->s_vfs_rename_mutex);
4382+
4383+ /* drop out late */
4384+ ret = -ENOENT;
4385+ if ((redo = d_unhashed(old_dentry)))
4386+ goto out_unlock;
4387+
4388+ vxdprintk(VXD_CBIT(misc, 2),
4389+ "vfs_rename: [" VS_Q("%*s") ":%d] -> [" VS_Q("%*s") ":%d]",
4390+ new_dentry->d_name.len, new_dentry->d_name.name,
4391+ new_dentry->d_name.len,
4392+ old_dentry->d_name.len, old_dentry->d_name.name,
4393+ old_dentry->d_name.len);
4394+ ret = vfs_rename(par_path.dentry->d_inode, new_dentry,
4395+ old_dentry->d_parent->d_inode, old_dentry, NULL, 0);
4396+ vxdprintk(VXD_CBIT(misc, 2), "vfs_rename: %d", ret);
4397+
4398+out_unlock:
4399+ mutex_unlock(&old_dentry->d_inode->i_sb->s_vfs_rename_mutex);
4400+
4401+out_fput_both:
4402+ vxdprintk(VXD_CBIT(misc, 3),
4403+ "fput(new_file=%p[#%ld])", new_file,
4404+ atomic_long_read(&new_file->f_count));
4405+ fput(new_file);
4406+
4407+out_fput_old:
4408+ vxdprintk(VXD_CBIT(misc, 3),
4409+ "fput(old_file=%p[#%ld])", old_file,
4410+ atomic_long_read(&old_file->f_count));
4411+ fput(old_file);
4412+
4413+out_unlock_new:
4414+ /* drop references from par_path */
4415+ path_put(&par_path);
4416+
4417+ if (drop) {
4418+ /* unlock the inode mutex from filename_create() */
4419+ mutex_unlock(&dir->d_inode->i_mutex);
4420+
4421+ /* drop write access to mnt */
4422+ mnt_drop_write(new_path->mnt);
4423+ }
4424+
4425+ if (!ret)
4426+ goto out_redo;
4427+
4428+ /* error path cleanup */
4429+ vfs_unlink(dir->d_inode, new_dentry, NULL);
4430+
4431+out_redo:
4432+ if (!redo)
4433+ goto out_rel_both;
4434+
4435+ /* lookup dentry once again
4436+ old_path will be freed as old_path in out_rel_old */
4437+ ret = filename_lookup(AT_FDCWD, filename, LOOKUP_FOLLOW, &old_path, NULL);
4438+ if (ret)
4439+ goto out_rel_both;
4440+
4441+ /* drop reference on new_dentry */
4442+ dput(new_dentry);
4443+ new_dentry = old_path.dentry;
4444+ dget(new_dentry);
4445+ vxdprintk(VXD_CBIT(misc, 2),
4446+ "do_path_lookup(redo): %p [" VS_Q("%.*s") ":%d]",
4447+ new_dentry,
4448+ new_dentry->d_name.len, new_dentry->d_name.name,
4449+ new_dentry->d_name.len);
4450+
4451+out_rel_both:
4452+ dump_path("put (new)", new_path);
4453+ if (new_path)
4454+ path_put(new_path);
4455+out_rel_old:
4456+ dump_path("put (old)", &old_path);
4457+ path_put(&old_path);
4458+out_free_path:
4459+ kfree(path);
4460+out:
4461+ if (ret) {
4462+ dput(new_dentry);
4463+ new_dentry = ERR_PTR(ret);
4464+ }
4465+ // if (!IS_ERR(filename))
4466+ // putname(filename);
4467+ vxdprintk(VXD_CBIT(misc, 3),
4468+ "cow_break_link returning with %p", new_dentry);
4469+ return new_dentry;
4470+}
4471+
4472+#endif
4473+
4474+int vx_info_mnt_namespace(struct mnt_namespace *ns, char *buffer)
4475+{
4476+ struct path path;
4477+ struct vfsmount *vmnt;
4478+ char *pstr, *root;
4479+ int length = 0;
4480+
4481+ pstr = kmalloc(PATH_MAX, GFP_KERNEL);
4482+ if (!pstr)
4483+ return 0;
4484+
4485+ vmnt = &ns->root->mnt;
4486+ path.mnt = vmnt;
4487+ path.dentry = vmnt->mnt_root;
4488+ root = d_path(&path, pstr, PATH_MAX - 2);
4489+ length = sprintf(buffer + length,
4490+ "Namespace:\t%p [#%u]\n"
4491+ "RootPath:\t%s\n",
4492+ ns, atomic_read(&ns->count),
4493+ root);
4494+ kfree(pstr);
4495+ return length;
4496+}
4497+
4498+EXPORT_SYMBOL(vx_info_mnt_namespace);
4499+
4500 /* get the link contents into pagecache */
4501 static char *page_getlink(struct dentry * dentry, struct page **ppage)
4502 {
4503diff -NurpP --minimal linux-4.4.116/fs/namespace.c linux-4.4.116-vs2.3.9.7/fs/namespace.c
4504--- linux-4.4.116/fs/namespace.c 2018-02-22 21:19:52.000000000 +0000
4505+++ linux-4.4.116-vs2.3.9.7/fs/namespace.c 2018-01-09 16:36:32.000000000 +0000
4506@@ -24,6 +24,11 @@
4507 #include <linux/magic.h>
4508 #include <linux/bootmem.h>
4509 #include <linux/task_work.h>
4510+#include <linux/vs_base.h>
4511+#include <linux/vs_context.h>
4512+#include <linux/vs_tag.h>
4513+#include <linux/vserver/space.h>
4514+#include <linux/vserver/global.h>
4515 #include "pnode.h"
4516 #include "internal.h"
4517
4518@@ -971,6 +976,10 @@ vfs_kern_mount(struct file_system_type *
4519 if (!type)
4520 return ERR_PTR(-ENODEV);
4521
4522+ if ((type->fs_flags & FS_BINARY_MOUNTDATA) &&
4523+ !vx_capable(CAP_SYS_ADMIN, VXC_BINARY_MOUNT))
4524+ return ERR_PTR(-EPERM);
4525+
4526 mnt = alloc_vfsmnt(name);
4527 if (!mnt)
4528 return ERR_PTR(-ENOMEM);
4529@@ -1046,6 +1055,7 @@ static struct mount *clone_mnt(struct mo
4530 mnt->mnt.mnt_root = dget(root);
4531 mnt->mnt_mountpoint = mnt->mnt.mnt_root;
4532 mnt->mnt_parent = mnt;
4533+ mnt->mnt_tag = old->mnt_tag;
4534 lock_mount_hash();
4535 list_add_tail(&mnt->mnt_instance, &sb->s_mounts);
4536 unlock_mount_hash();
4537@@ -1620,7 +1630,8 @@ out_unlock:
4538 */
4539 static inline bool may_mount(void)
4540 {
4541- return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
4542+ return vx_ns_capable(current->nsproxy->mnt_ns->user_ns,
4543+ CAP_SYS_ADMIN, VXC_SECURE_MOUNT);
4544 }
4545
4546 /*
4547@@ -2121,6 +2132,7 @@ static int do_change_type(struct path *p
4548 if (err)
4549 goto out_unlock;
4550 }
4551+ // mnt->mnt_flags = mnt_flags;
4552
4553 lock_mount_hash();
4554 for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
4555@@ -2149,12 +2161,14 @@ static bool has_locked_children(struct m
4556 * do loopback mount.
4557 */
4558 static int do_loopback(struct path *path, const char *old_name,
4559- int recurse)
4560+ vtag_t tag, unsigned long flags, int mnt_flags)
4561 {
4562 struct path old_path;
4563 struct mount *mnt = NULL, *old, *parent;
4564 struct mountpoint *mp;
4565+ int recurse = flags & MS_REC;
4566 int err;
4567+
4568 if (!old_name || !*old_name)
4569 return -EINVAL;
4570 err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
4571@@ -2234,7 +2248,7 @@ static int change_mount_flags(struct vfs
4572 * on it - tough luck.
4573 */
4574 static int do_remount(struct path *path, int flags, int mnt_flags,
4575- void *data)
4576+ void *data, vxid_t xid)
4577 {
4578 int err;
4579 struct super_block *sb = path->mnt->mnt_sb;
4580@@ -2742,6 +2756,7 @@ long do_mount(const char *dev_name, cons
4581 struct path path;
4582 int retval = 0;
4583 int mnt_flags = 0;
4584+ vtag_t tag = 0;
4585
4586 /* Discard magic */
4587 if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
4588@@ -2767,6 +2782,12 @@ long do_mount(const char *dev_name, cons
4589 if (!(flags & MS_NOATIME))
4590 mnt_flags |= MNT_RELATIME;
4591
4592+ if (dx_parse_tag(data_page, &tag, 1, &mnt_flags, &flags)) {
4593+ /* FIXME: bind and re-mounts get the tag flag? */
4594+ if (flags & (MS_BIND|MS_REMOUNT))
4595+ flags |= MS_TAGID;
4596+ }
4597+
4598 /* Separate the per-mountpoint flags */
4599 if (flags & MS_NOSUID)
4600 mnt_flags |= MNT_NOSUID;
4601@@ -2791,15 +2812,17 @@ long do_mount(const char *dev_name, cons
4602 mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK;
4603 }
4604
4605+ if (!vx_capable(CAP_SYS_ADMIN, VXC_DEV_MOUNT))
4606+ mnt_flags |= MNT_NODEV;
4607 flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
4608 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
4609 MS_STRICTATIME);
4610
4611 if (flags & MS_REMOUNT)
4612 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
4613- data_page);
4614+ data_page, tag);
4615 else if (flags & MS_BIND)
4616- retval = do_loopback(&path, dev_name, flags & MS_REC);
4617+ retval = do_loopback(&path, dev_name, tag, flags, mnt_flags);
4618 else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
4619 retval = do_change_type(&path, flags);
4620 else if (flags & MS_MOVE)
4621@@ -2919,6 +2942,7 @@ struct mnt_namespace *copy_mnt_ns(unsign
4622 p = next_mnt(p, old);
4623 }
4624 namespace_unlock();
4625+ atomic_inc(&vs_global_mnt_ns);
4626
4627 if (rootmnt)
4628 mntput(rootmnt);
4629@@ -3094,9 +3118,10 @@ SYSCALL_DEFINE2(pivot_root, const char _
4630 new_mnt = real_mount(new.mnt);
4631 root_mnt = real_mount(root.mnt);
4632 old_mnt = real_mount(old.mnt);
4633- if (IS_MNT_SHARED(old_mnt) ||
4634+ if ((IS_MNT_SHARED(old_mnt) ||
4635 IS_MNT_SHARED(new_mnt->mnt_parent) ||
4636- IS_MNT_SHARED(root_mnt->mnt_parent))
4637+ IS_MNT_SHARED(root_mnt->mnt_parent)) &&
4638+ !vx_flags(VXF_STATE_SETUP, 0))
4639 goto out4;
4640 if (!check_mnt(root_mnt) || !check_mnt(new_mnt))
4641 goto out4;
4642@@ -3234,6 +3259,7 @@ void put_mnt_ns(struct mnt_namespace *ns
4643 if (!atomic_dec_and_test(&ns->count))
4644 return;
4645 drop_collected_mounts(&ns->root->mnt);
4646+ atomic_dec(&vs_global_mnt_ns);
4647 free_mnt_ns(ns);
4648 }
4649
4650diff -NurpP --minimal linux-4.4.116/fs/nfs/client.c linux-4.4.116-vs2.3.9.7/fs/nfs/client.c
4651--- linux-4.4.116/fs/nfs/client.c 2016-07-05 04:15:08.000000000 +0000
4652+++ linux-4.4.116-vs2.3.9.7/fs/nfs/client.c 2018-01-09 16:36:32.000000000 +0000
4653@@ -583,6 +583,9 @@ int nfs_init_server_rpcclient(struct nfs
4654 if (server->flags & NFS_MOUNT_SOFT)
4655 server->client->cl_softrtry = 1;
4656
4657+ server->client->cl_tag = 0;
4658+ if (server->flags & NFS_MOUNT_TAGGED)
4659+ server->client->cl_tag = 1;
4660 return 0;
4661 }
4662 EXPORT_SYMBOL_GPL(nfs_init_server_rpcclient);
4663@@ -760,6 +763,10 @@ static void nfs_server_set_fsinfo(struct
4664 server->acdirmin = server->acdirmax = 0;
4665 }
4666
4667+ /* FIXME: needs fsinfo
4668+ if (server->flags & NFS_MOUNT_TAGGED)
4669+ sb->s_flags |= MS_TAGGED; */
4670+
4671 server->maxfilesize = fsinfo->maxfilesize;
4672
4673 server->time_delta = fsinfo->time_delta;
4674diff -NurpP --minimal linux-4.4.116/fs/nfs/dir.c linux-4.4.116-vs2.3.9.7/fs/nfs/dir.c
4675--- linux-4.4.116/fs/nfs/dir.c 2018-02-22 21:19:52.000000000 +0000
4676+++ linux-4.4.116-vs2.3.9.7/fs/nfs/dir.c 2018-01-09 16:36:32.000000000 +0000
4677@@ -37,6 +37,7 @@
4678 #include <linux/sched.h>
4679 #include <linux/kmemleak.h>
4680 #include <linux/xattr.h>
4681+#include <linux/vs_tag.h>
4682
4683 #include "delegation.h"
4684 #include "iostat.h"
4685@@ -1396,6 +1397,7 @@ struct dentry *nfs_lookup(struct inode *
4686 /* Success: notify readdir to use READDIRPLUS */
4687 nfs_advise_use_readdirplus(dir);
4688
4689+ dx_propagate_tag(nd, inode);
4690 no_entry:
4691 res = d_splice_alias(inode, dentry);
4692 if (res != NULL) {
4693diff -NurpP --minimal linux-4.4.116/fs/nfs/inode.c linux-4.4.116-vs2.3.9.7/fs/nfs/inode.c
4694--- linux-4.4.116/fs/nfs/inode.c 2018-02-22 21:19:52.000000000 +0000
4695+++ linux-4.4.116-vs2.3.9.7/fs/nfs/inode.c 2018-01-09 16:36:32.000000000 +0000
4696@@ -38,6 +38,7 @@
4697 #include <linux/slab.h>
4698 #include <linux/compat.h>
4699 #include <linux/freezer.h>
4700+#include <linux/vs_tag.h>
4701
4702 #include <asm/uaccess.h>
4703
4704@@ -376,6 +377,8 @@ nfs_fhget(struct super_block *sb, struct
4705 if (inode->i_state & I_NEW) {
4706 struct nfs_inode *nfsi = NFS_I(inode);
4707 unsigned long now = jiffies;
4708+ kuid_t kuid;
4709+ kgid_t kgid;
4710
4711 /* We set i_ino for the few things that still rely on it,
4712 * such as stat(2) */
4713@@ -419,8 +422,8 @@ nfs_fhget(struct super_block *sb, struct
4714 inode->i_version = 0;
4715 inode->i_size = 0;
4716 clear_nlink(inode);
4717- inode->i_uid = make_kuid(&init_user_ns, -2);
4718- inode->i_gid = make_kgid(&init_user_ns, -2);
4719+ kuid = make_kuid(&init_user_ns, -2);
4720+ kgid = make_kgid(&init_user_ns, -2);
4721 inode->i_blocks = 0;
4722 memset(nfsi->cookieverf, 0, sizeof(nfsi->cookieverf));
4723 nfsi->write_io = 0;
4724@@ -455,11 +458,11 @@ nfs_fhget(struct super_block *sb, struct
4725 else if (nfs_server_capable(inode, NFS_CAP_NLINK))
4726 nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
4727 if (fattr->valid & NFS_ATTR_FATTR_OWNER)
4728- inode->i_uid = fattr->uid;
4729+ kuid = fattr->uid;
4730 else if (nfs_server_capable(inode, NFS_CAP_OWNER))
4731 nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
4732 if (fattr->valid & NFS_ATTR_FATTR_GROUP)
4733- inode->i_gid = fattr->gid;
4734+ kgid = fattr->gid;
4735 else if (nfs_server_capable(inode, NFS_CAP_OWNER_GROUP))
4736 nfs_set_cache_invalid(inode, NFS_INO_INVALID_ATTR);
4737 if (fattr->valid & NFS_ATTR_FATTR_BLOCKS_USED)
4738@@ -470,6 +473,10 @@ nfs_fhget(struct super_block *sb, struct
4739 */
4740 inode->i_blocks = nfs_calc_block_size(fattr->du.nfs3.used);
4741 }
4742+ inode->i_uid = INOTAG_KUID(DX_TAG(inode), kuid, kgid);
4743+ inode->i_gid = INOTAG_KGID(DX_TAG(inode), kuid, kgid);
4744+ inode->i_tag = INOTAG_KTAG(DX_TAG(inode), kuid, kgid, GLOBAL_ROOT_TAG);
4745+ /* maybe fattr->xid someday */
4746
4747 nfs_setsecurity(inode, fattr, label);
4748
4749@@ -611,6 +618,8 @@ void nfs_setattr_update_inode(struct ino
4750 inode->i_uid = attr->ia_uid;
4751 if ((attr->ia_valid & ATTR_GID) != 0)
4752 inode->i_gid = attr->ia_gid;
4753+ if ((attr->ia_valid & ATTR_TAG) && IS_TAGGED(inode))
4754+ inode->i_tag = attr->ia_tag;
4755 nfs_set_cache_invalid(inode, NFS_INO_INVALID_ACCESS
4756 | NFS_INO_INVALID_ACL);
4757 }
4758@@ -1235,7 +1244,9 @@ static int nfs_check_inode_attributes(st
4759 struct nfs_inode *nfsi = NFS_I(inode);
4760 loff_t cur_size, new_isize;
4761 unsigned long invalid = 0;
4762-
4763+ kuid_t kuid;
4764+ kgid_t kgid;
4765+ ktag_t ktag;
4766
4767 if (nfs_have_delegated_attributes(inode))
4768 return 0;
4769@@ -1262,13 +1273,18 @@ static int nfs_check_inode_attributes(st
4770 if (nfsi->nrequests != 0)
4771 invalid &= ~NFS_INO_REVAL_PAGECACHE;
4772
4773+ kuid = INOTAG_KUID(DX_TAG(inode), fattr->uid, fattr->gid);
4774+ kgid = INOTAG_KGID(DX_TAG(inode), fattr->uid, fattr->gid);
4775+ ktag = INOTAG_KTAG(DX_TAG(inode), fattr->uid, fattr->gid, GLOBAL_ROOT_TAG);
4776+
4777 /* Have any file permissions changed? */
4778 if ((fattr->valid & NFS_ATTR_FATTR_MODE) && (inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO))
4779 invalid |= NFS_INO_INVALID_ATTR | NFS_INO_INVALID_ACCESS | NFS_INO_INVALID_ACL;
4780- if ((fattr->valid & NFS_ATTR_FATTR_OWNER) && !uid_eq(inode->i_uid, fattr->uid))
4781+ if ((fattr->valid & NFS_ATTR_FATTR_OWNER) && !uid_eq(inode->i_uid, kuid))
4782 invalid |= NFS_INO_INVALID_ATTR | NFS_INO_INVALID_ACCESS | NFS_INO_INVALID_ACL;
4783- if ((fattr->valid & NFS_ATTR_FATTR_GROUP) && !gid_eq(inode->i_gid, fattr->gid))
4784+ if ((fattr->valid & NFS_ATTR_FATTR_GROUP) && !gid_eq(inode->i_gid, kgid))
4785 invalid |= NFS_INO_INVALID_ATTR | NFS_INO_INVALID_ACCESS | NFS_INO_INVALID_ACL;
4786+ /* maybe check for tag too? */
4787
4788 /* Has the link count changed? */
4789 if ((fattr->valid & NFS_ATTR_FATTR_NLINK) && inode->i_nlink != fattr->nlink)
4790@@ -1642,6 +1658,9 @@ static int nfs_update_inode(struct inode
4791 unsigned long now = jiffies;
4792 unsigned long save_cache_validity;
4793 bool cache_revalidated = true;
4794+ kuid_t kuid;
4795+ kgid_t kgid;
4796+ ktag_t ktag;
4797
4798 dfprintk(VFS, "NFS: %s(%s/%lu fh_crc=0x%08x ct=%d info=0x%x)\n",
4799 __func__, inode->i_sb->s_id, inode->i_ino,
4800@@ -1752,6 +1771,9 @@ static int nfs_update_inode(struct inode
4801 cache_revalidated = false;
4802 }
4803
4804+ kuid = TAGINO_KUID(DX_TAG(inode), inode->i_uid, inode->i_tag);
4805+ kgid = TAGINO_KGID(DX_TAG(inode), inode->i_gid, inode->i_tag);
4806+ ktag = TAGINO_KTAG(DX_TAG(inode), inode->i_tag);
4807
4808 if (fattr->valid & NFS_ATTR_FATTR_ATIME)
4809 memcpy(&inode->i_atime, &fattr->atime, sizeof(inode->i_atime));
4810@@ -1806,6 +1828,10 @@ static int nfs_update_inode(struct inode
4811 cache_revalidated = false;
4812 }
4813
4814+ inode->i_uid = INOTAG_KUID(DX_TAG(inode), kuid, kgid);
4815+ inode->i_gid = INOTAG_KGID(DX_TAG(inode), kuid, kgid);
4816+ inode->i_tag = INOTAG_KTAG(DX_TAG(inode), kuid, kgid, ktag);
4817+
4818 if (fattr->valid & NFS_ATTR_FATTR_NLINK) {
4819 if (inode->i_nlink != fattr->nlink) {
4820 invalid |= NFS_INO_INVALID_ATTR;
4821diff -NurpP --minimal linux-4.4.116/fs/nfs/nfs3xdr.c linux-4.4.116-vs2.3.9.7/fs/nfs/nfs3xdr.c
4822--- linux-4.4.116/fs/nfs/nfs3xdr.c 2016-07-05 04:12:33.000000000 +0000
4823+++ linux-4.4.116-vs2.3.9.7/fs/nfs/nfs3xdr.c 2018-01-09 17:17:07.000000000 +0000
4824@@ -20,6 +20,7 @@
4825 #include <linux/nfs3.h>
4826 #include <linux/nfs_fs.h>
4827 #include <linux/nfsacl.h>
4828+#include <linux/vs_tag.h>
4829 #include "internal.h"
4830
4831 #define NFSDBG_FACILITY NFSDBG_XDR
4832@@ -558,7 +559,8 @@ static __be32 *xdr_decode_nfstime3(__be3
4833 * set_mtime mtime;
4834 * };
4835 */
4836-static void encode_sattr3(struct xdr_stream *xdr, const struct iattr *attr)
4837+static void encode_sattr3(struct xdr_stream *xdr,
4838+ const struct iattr *attr, int tag)
4839 {
4840 u32 nbytes;
4841 __be32 *p;
4842@@ -590,15 +592,19 @@ static void encode_sattr3(struct xdr_str
4843 } else
4844 *p++ = xdr_zero;
4845
4846- if (attr->ia_valid & ATTR_UID) {
4847+ if (attr->ia_valid & ATTR_UID ||
4848+ (tag && (attr->ia_valid & ATTR_TAG))) {
4849 *p++ = xdr_one;
4850- *p++ = cpu_to_be32(from_kuid(&init_user_ns, attr->ia_uid));
4851+ *p++ = cpu_to_be32(from_kuid(&init_user_ns,
4852+ TAGINO_KUID(tag, attr->ia_uid, attr->ia_tag)));
4853 } else
4854 *p++ = xdr_zero;
4855
4856- if (attr->ia_valid & ATTR_GID) {
4857+ if (attr->ia_valid & ATTR_GID ||
4858+ (tag && (attr->ia_valid & ATTR_TAG))) {
4859 *p++ = xdr_one;
4860- *p++ = cpu_to_be32(from_kgid(&init_user_ns, attr->ia_gid));
4861+ *p++ = cpu_to_be32(from_kgid(&init_user_ns,
4862+ TAGINO_KGID(tag, attr->ia_gid, attr->ia_tag)));
4863 } else
4864 *p++ = xdr_zero;
4865
4866@@ -887,7 +893,7 @@ static void nfs3_xdr_enc_setattr3args(st
4867 const struct nfs3_sattrargs *args)
4868 {
4869 encode_nfs_fh3(xdr, args->fh);
4870- encode_sattr3(xdr, args->sattr);
4871+ encode_sattr3(xdr, args->sattr, req->rq_task->tk_client->cl_tag);
4872 encode_sattrguard3(xdr, args);
4873 }
4874
4875@@ -1037,13 +1043,13 @@ static void nfs3_xdr_enc_write3args(stru
4876 * };
4877 */
4878 static void encode_createhow3(struct xdr_stream *xdr,
4879- const struct nfs3_createargs *args)
4880+ const struct nfs3_createargs *args, int tag)
4881 {
4882 encode_uint32(xdr, args->createmode);
4883 switch (args->createmode) {
4884 case NFS3_CREATE_UNCHECKED:
4885 case NFS3_CREATE_GUARDED:
4886- encode_sattr3(xdr, args->sattr);
4887+ encode_sattr3(xdr, args->sattr, tag);
4888 break;
4889 case NFS3_CREATE_EXCLUSIVE:
4890 encode_createverf3(xdr, args->verifier);
4891@@ -1058,7 +1064,7 @@ static void nfs3_xdr_enc_create3args(str
4892 const struct nfs3_createargs *args)
4893 {
4894 encode_diropargs3(xdr, args->fh, args->name, args->len);
4895- encode_createhow3(xdr, args);
4896+ encode_createhow3(xdr, args, req->rq_task->tk_client->cl_tag);
4897 }
4898
4899 /*
4900@@ -1074,7 +1080,7 @@ static void nfs3_xdr_enc_mkdir3args(stru
4901 const struct nfs3_mkdirargs *args)
4902 {
4903 encode_diropargs3(xdr, args->fh, args->name, args->len);
4904- encode_sattr3(xdr, args->sattr);
4905+ encode_sattr3(xdr, args->sattr, req->rq_task->tk_client->cl_tag);
4906 }
4907
4908 /*
4909@@ -1091,9 +1097,9 @@ static void nfs3_xdr_enc_mkdir3args(stru
4910 * };
4911 */
4912 static void encode_symlinkdata3(struct xdr_stream *xdr,
4913- const struct nfs3_symlinkargs *args)
4914+ const struct nfs3_symlinkargs *args, int tag)
4915 {
4916- encode_sattr3(xdr, args->sattr);
4917+ encode_sattr3(xdr, args->sattr, tag);
4918 encode_nfspath3(xdr, args->pages, args->pathlen);
4919 }
4920
4921@@ -1102,7 +1108,7 @@ static void nfs3_xdr_enc_symlink3args(st
4922 const struct nfs3_symlinkargs *args)
4923 {
4924 encode_diropargs3(xdr, args->fromfh, args->fromname, args->fromlen);
4925- encode_symlinkdata3(xdr, args);
4926+ encode_symlinkdata3(xdr, args, req->rq_task->tk_client->cl_tag);
4927 xdr->buf->flags |= XDRBUF_WRITE;
4928 }
4929
4930@@ -1131,24 +1137,24 @@ static void nfs3_xdr_enc_symlink3args(st
4931 * };
4932 */
4933 static void encode_devicedata3(struct xdr_stream *xdr,
4934- const struct nfs3_mknodargs *args)
4935+ const struct nfs3_mknodargs *args, int tag)
4936 {
4937- encode_sattr3(xdr, args->sattr);
4938+ encode_sattr3(xdr, args->sattr, tag);
4939 encode_specdata3(xdr, args->rdev);
4940 }
4941
4942 static void encode_mknoddata3(struct xdr_stream *xdr,
4943- const struct nfs3_mknodargs *args)
4944+ const struct nfs3_mknodargs *args, int tag)
4945 {
4946 encode_ftype3(xdr, args->type);
4947 switch (args->type) {
4948 case NF3CHR:
4949 case NF3BLK:
4950- encode_devicedata3(xdr, args);
4951+ encode_devicedata3(xdr, args, tag);
4952 break;
4953 case NF3SOCK:
4954 case NF3FIFO:
4955- encode_sattr3(xdr, args->sattr);
4956+ encode_sattr3(xdr, args->sattr, tag);
4957 break;
4958 case NF3REG:
4959 case NF3DIR:
4960@@ -1163,7 +1169,7 @@ static void nfs3_xdr_enc_mknod3args(stru
4961 const struct nfs3_mknodargs *args)
4962 {
4963 encode_diropargs3(xdr, args->fh, args->name, args->len);
4964- encode_mknoddata3(xdr, args);
4965+ encode_mknoddata3(xdr, args, req->rq_task->tk_client->cl_tag);
4966 }
4967
4968 /*
4969diff -NurpP --minimal linux-4.4.116/fs/nfs/super.c linux-4.4.116-vs2.3.9.7/fs/nfs/super.c
4970--- linux-4.4.116/fs/nfs/super.c 2018-02-22 21:19:52.000000000 +0000
4971+++ linux-4.4.116-vs2.3.9.7/fs/nfs/super.c 2018-01-09 16:36:32.000000000 +0000
4972@@ -54,6 +54,7 @@
4973 #include <linux/parser.h>
4974 #include <linux/nsproxy.h>
4975 #include <linux/rcupdate.h>
4976+#include <linux/vs_tag.h>
4977
4978 #include <asm/uaccess.h>
4979
4980@@ -102,6 +103,7 @@ enum {
4981 Opt_mountport,
4982 Opt_mountvers,
4983 Opt_minorversion,
4984+ Opt_tagid,
4985
4986 /* Mount options that take string arguments */
4987 Opt_nfsvers,
4988@@ -114,6 +116,9 @@ enum {
4989 /* Special mount options */
4990 Opt_userspace, Opt_deprecated, Opt_sloppy,
4991
4992+ /* Linux-VServer tagging options */
4993+ Opt_tag, Opt_notag,
4994+
4995 Opt_err
4996 };
4997
4998@@ -183,6 +188,10 @@ static const match_table_t nfs_mount_opt
4999 { Opt_fscache_uniq, "fsc=%s" },
5000 { Opt_local_lock, "local_lock=%s" },
5001
5002+ { Opt_tag, "tag" },
5003+ { Opt_notag, "notag" },
5004+ { Opt_tagid, "tagid=%u" },
5005+
5006 /* The following needs to be listed after all other options */
5007 { Opt_nfsvers, "v%s" },
5008
5009@@ -642,6 +651,7 @@ static void nfs_show_mount_options(struc
5010 { NFS_MOUNT_NORDIRPLUS, ",nordirplus", "" },
5011 { NFS_MOUNT_UNSHARED, ",nosharecache", "" },
5012 { NFS_MOUNT_NORESVPORT, ",noresvport", "" },
5013+ { NFS_MOUNT_TAGGED, ",tag", "" },
5014 { 0, NULL, NULL }
5015 };
5016 const struct proc_nfs_info *nfs_infop;
5017@@ -1324,6 +1334,14 @@ static int nfs_parse_mount_options(char
5018 case Opt_nomigration:
5019 mnt->options &= ~NFS_OPTION_MIGRATION;
5020 break;
5021+#ifndef CONFIG_TAGGING_NONE
5022+ case Opt_tag:
5023+ mnt->flags |= NFS_MOUNT_TAGGED;
5024+ break;
5025+ case Opt_notag:
5026+ mnt->flags &= ~NFS_MOUNT_TAGGED;
5027+ break;
5028+#endif
5029
5030 /*
5031 * options that take numeric values
5032@@ -1410,6 +1428,12 @@ static int nfs_parse_mount_options(char
5033 goto out_invalid_value;
5034 mnt->minorversion = option;
5035 break;
5036+#ifdef CONFIG_PROPAGATE
5037+ case Opt_tagid:
5038+ /* use args[0] */
5039+ nfs_data.flags |= NFS_MOUNT_TAGGED;
5040+ break;
5041+#endif
5042
5043 /*
5044 * options that take text values
5045diff -NurpP --minimal linux-4.4.116/fs/nfsd/auth.c linux-4.4.116-vs2.3.9.7/fs/nfsd/auth.c
5046--- linux-4.4.116/fs/nfsd/auth.c 2018-02-22 21:19:52.000000000 +0000
5047+++ linux-4.4.116-vs2.3.9.7/fs/nfsd/auth.c 2018-02-10 15:16:50.000000000 +0000
5048@@ -1,6 +1,7 @@
5049 /* Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de> */
5050
5051 #include <linux/sched.h>
5052+#include <linux/vs_tag.h>
5053 #include "nfsd.h"
5054 #include "auth.h"
5055
5056@@ -35,6 +36,9 @@ int nfsd_setuser(struct svc_rqst *rqstp,
5057
5058 new->fsuid = rqstp->rq_cred.cr_uid;
5059 new->fsgid = rqstp->rq_cred.cr_gid;
5060+ /* FIXME: this desperately needs a tag :)
5061+ new->xid = (vxid_t)INOTAG_TAG(DX_TAG_NFSD, cred.cr_uid, cred.cr_gid, 0);
5062+ */
5063
5064 rqgi = rqstp->rq_cred.cr_group_info;
5065
5066diff -NurpP --minimal linux-4.4.116/fs/nfsd/nfs3xdr.c linux-4.4.116-vs2.3.9.7/fs/nfsd/nfs3xdr.c
5067--- linux-4.4.116/fs/nfsd/nfs3xdr.c 2018-02-22 21:19:52.000000000 +0000
5068+++ linux-4.4.116-vs2.3.9.7/fs/nfsd/nfs3xdr.c 2018-01-09 16:36:32.000000000 +0000
5069@@ -8,6 +8,7 @@
5070
5071 #include <linux/namei.h>
5072 #include <linux/sunrpc/svc_xprt.h>
5073+#include <linux/vs_tag.h>
5074 #include "xdr3.h"
5075 #include "auth.h"
5076 #include "netns.h"
5077@@ -98,6 +99,8 @@ static __be32 *
5078 decode_sattr3(__be32 *p, struct iattr *iap)
5079 {
5080 u32 tmp;
5081+ kuid_t kuid = GLOBAL_ROOT_UID;
5082+ kgid_t kgid = GLOBAL_ROOT_GID;
5083
5084 iap->ia_valid = 0;
5085
5086@@ -106,15 +109,18 @@ decode_sattr3(__be32 *p, struct iattr *i
5087 iap->ia_mode = ntohl(*p++);
5088 }
5089 if (*p++) {
5090- iap->ia_uid = make_kuid(&init_user_ns, ntohl(*p++));
5091+ kuid = make_kuid(&init_user_ns, ntohl(*p++));
5092 if (uid_valid(iap->ia_uid))
5093 iap->ia_valid |= ATTR_UID;
5094 }
5095 if (*p++) {
5096- iap->ia_gid = make_kgid(&init_user_ns, ntohl(*p++));
5097+ kgid = make_kgid(&init_user_ns, ntohl(*p++));
5098 if (gid_valid(iap->ia_gid))
5099 iap->ia_valid |= ATTR_GID;
5100 }
5101+ iap->ia_uid = INOTAG_KUID(DX_TAG_NFSD, kuid, kgid);
5102+ iap->ia_gid = INOTAG_KGID(DX_TAG_NFSD, kuid, kgid);
5103+ iap->ia_tag = INOTAG_KTAG(DX_TAG_NFSD, kuid, kgid, GLOBAL_ROOT_TAG);
5104 if (*p++) {
5105 u64 newsize;
5106
5107@@ -167,8 +173,12 @@ encode_fattr3(struct svc_rqst *rqstp, __
5108 *p++ = htonl(nfs3_ftypes[(stat->mode & S_IFMT) >> 12]);
5109 *p++ = htonl((u32) (stat->mode & S_IALLUGO));
5110 *p++ = htonl((u32) stat->nlink);
5111- *p++ = htonl((u32) from_kuid(&init_user_ns, stat->uid));
5112- *p++ = htonl((u32) from_kgid(&init_user_ns, stat->gid));
5113+ *p++ = htonl((u32) from_kuid(&init_user_ns,
5114+ TAGINO_KUID(0 /* FIXME: DX_TAG(dentry->d_inode) */,
5115+ stat->uid, stat->tag)));
5116+ *p++ = htonl((u32) from_kgid(&init_user_ns,
5117+ TAGINO_KGID(0 /* FIXME: DX_TAG(dentry->d_inode) */,
5118+ stat->gid, stat->tag)));
5119 if (S_ISLNK(stat->mode) && stat->size > NFS3_MAXPATHLEN) {
5120 p = xdr_encode_hyper(p, (u64) NFS3_MAXPATHLEN);
5121 } else {
5122diff -NurpP --minimal linux-4.4.116/fs/nfsd/nfs4xdr.c linux-4.4.116-vs2.3.9.7/fs/nfsd/nfs4xdr.c
5123--- linux-4.4.116/fs/nfsd/nfs4xdr.c 2018-02-22 21:19:53.000000000 +0000
5124+++ linux-4.4.116-vs2.3.9.7/fs/nfsd/nfs4xdr.c 2018-01-09 16:36:32.000000000 +0000
5125@@ -40,6 +40,7 @@
5126 #include <linux/utsname.h>
5127 #include <linux/pagemap.h>
5128 #include <linux/sunrpc/svcauth_gss.h>
5129+#include <linux/vs_tag.h>
5130
5131 #include "idmap.h"
5132 #include "acl.h"
5133@@ -2637,12 +2638,16 @@ out_acl:
5134 *p++ = cpu_to_be32(stat.nlink);
5135 }
5136 if (bmval1 & FATTR4_WORD1_OWNER) {
5137- status = nfsd4_encode_user(xdr, rqstp, stat.uid);
5138+ status = nfsd4_encode_user(xdr, rqstp,
5139+ TAGINO_KUID(DX_TAG(dentry->d_inode),
5140+ stat.uid, stat.tag));
5141 if (status)
5142 goto out;
5143 }
5144 if (bmval1 & FATTR4_WORD1_OWNER_GROUP) {
5145- status = nfsd4_encode_group(xdr, rqstp, stat.gid);
5146+ status = nfsd4_encode_group(xdr, rqstp,
5147+ TAGINO_KGID(DX_TAG(dentry->d_inode),
5148+ stat.gid, stat.tag));
5149 if (status)
5150 goto out;
5151 }
5152diff -NurpP --minimal linux-4.4.116/fs/nfsd/nfsxdr.c linux-4.4.116-vs2.3.9.7/fs/nfsd/nfsxdr.c
5153--- linux-4.4.116/fs/nfsd/nfsxdr.c 2018-02-22 21:19:53.000000000 +0000
5154+++ linux-4.4.116-vs2.3.9.7/fs/nfsd/nfsxdr.c 2018-01-09 16:36:32.000000000 +0000
5155@@ -7,6 +7,7 @@
5156 #include "vfs.h"
5157 #include "xdr.h"
5158 #include "auth.h"
5159+#include <linux/vs_tag.h>
5160
5161 #define NFSDDBG_FACILITY NFSDDBG_XDR
5162
5163@@ -89,6 +90,8 @@ static __be32 *
5164 decode_sattr(__be32 *p, struct iattr *iap)
5165 {
5166 u32 tmp, tmp1;
5167+ kuid_t kuid = GLOBAL_ROOT_UID;
5168+ kgid_t kgid = GLOBAL_ROOT_GID;
5169
5170 iap->ia_valid = 0;
5171
5172@@ -101,15 +104,18 @@ decode_sattr(__be32 *p, struct iattr *ia
5173 iap->ia_mode = tmp;
5174 }
5175 if ((tmp = ntohl(*p++)) != (u32)-1) {
5176- iap->ia_uid = make_kuid(&init_user_ns, tmp);
5177+ kuid = make_kuid(&init_user_ns, tmp);
5178 if (uid_valid(iap->ia_uid))
5179 iap->ia_valid |= ATTR_UID;
5180 }
5181 if ((tmp = ntohl(*p++)) != (u32)-1) {
5182- iap->ia_gid = make_kgid(&init_user_ns, tmp);
5183+ kgid = make_kgid(&init_user_ns, tmp);
5184 if (gid_valid(iap->ia_gid))
5185 iap->ia_valid |= ATTR_GID;
5186 }
5187+ iap->ia_uid = INOTAG_KUID(DX_TAG_NFSD, kuid, kgid);
5188+ iap->ia_gid = INOTAG_KGID(DX_TAG_NFSD, kuid, kgid);
5189+ iap->ia_tag = INOTAG_KTAG(DX_TAG_NFSD, kuid, kgid, GLOBAL_ROOT_TAG);
5190 if ((tmp = ntohl(*p++)) != (u32)-1) {
5191 iap->ia_valid |= ATTR_SIZE;
5192 iap->ia_size = tmp;
5193@@ -154,8 +160,10 @@ encode_fattr(struct svc_rqst *rqstp, __b
5194 *p++ = htonl(nfs_ftypes[type >> 12]);
5195 *p++ = htonl((u32) stat->mode);
5196 *p++ = htonl((u32) stat->nlink);
5197- *p++ = htonl((u32) from_kuid(&init_user_ns, stat->uid));
5198- *p++ = htonl((u32) from_kgid(&init_user_ns, stat->gid));
5199+ *p++ = htonl((u32) from_kuid(&init_user_ns,
5200+ TAGINO_KUID(DX_TAG(dentry->d_inode), stat->uid, stat->tag)));
5201+ *p++ = htonl((u32) from_kgid(&init_user_ns,
5202+ TAGINO_KGID(DX_TAG(dentry->d_inode), stat->gid, stat->tag)));
5203
5204 if (S_ISLNK(type) && stat->size > NFS_MAXPATHLEN) {
5205 *p++ = htonl(NFS_MAXPATHLEN);
5206diff -NurpP --minimal linux-4.4.116/fs/ocfs2/dlmglue.c linux-4.4.116-vs2.3.9.7/fs/ocfs2/dlmglue.c
5207--- linux-4.4.116/fs/ocfs2/dlmglue.c 2018-02-22 21:19:53.000000000 +0000
5208+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/dlmglue.c 2018-01-09 16:36:32.000000000 +0000
5209@@ -2128,6 +2128,7 @@ static void __ocfs2_stuff_meta_lvb(struc
5210 lvb->lvb_iclusters = cpu_to_be32(oi->ip_clusters);
5211 lvb->lvb_iuid = cpu_to_be32(i_uid_read(inode));
5212 lvb->lvb_igid = cpu_to_be32(i_gid_read(inode));
5213+ lvb->lvb_itag = cpu_to_be16(i_tag_read(inode));
5214 lvb->lvb_imode = cpu_to_be16(inode->i_mode);
5215 lvb->lvb_inlink = cpu_to_be16(inode->i_nlink);
5216 lvb->lvb_iatime_packed =
5217@@ -2178,6 +2179,7 @@ static void ocfs2_refresh_inode_from_lvb
5218
5219 i_uid_write(inode, be32_to_cpu(lvb->lvb_iuid));
5220 i_gid_write(inode, be32_to_cpu(lvb->lvb_igid));
5221+ i_tag_write(inode, be16_to_cpu(lvb->lvb_itag));
5222 inode->i_mode = be16_to_cpu(lvb->lvb_imode);
5223 set_nlink(inode, be16_to_cpu(lvb->lvb_inlink));
5224 ocfs2_unpack_timespec(&inode->i_atime,
5225diff -NurpP --minimal linux-4.4.116/fs/ocfs2/dlmglue.h linux-4.4.116-vs2.3.9.7/fs/ocfs2/dlmglue.h
5226--- linux-4.4.116/fs/ocfs2/dlmglue.h 2018-02-22 21:19:53.000000000 +0000
5227+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/dlmglue.h 2018-01-09 16:36:32.000000000 +0000
5228@@ -46,7 +46,8 @@ struct ocfs2_meta_lvb {
5229 __be16 lvb_inlink;
5230 __be32 lvb_iattr;
5231 __be32 lvb_igeneration;
5232- __be32 lvb_reserved2;
5233+ __be16 lvb_itag;
5234+ __be16 lvb_reserved2;
5235 };
5236
5237 #define OCFS2_QINFO_LVB_VERSION 1
5238diff -NurpP --minimal linux-4.4.116/fs/ocfs2/file.c linux-4.4.116-vs2.3.9.7/fs/ocfs2/file.c
5239--- linux-4.4.116/fs/ocfs2/file.c 2018-02-22 21:19:53.000000000 +0000
5240+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/file.c 2018-01-09 16:36:32.000000000 +0000
5241@@ -1151,7 +1151,7 @@ int ocfs2_setattr(struct dentry *dentry,
5242 attr->ia_valid &= ~ATTR_SIZE;
5243
5244 #define OCFS2_VALID_ATTRS (ATTR_ATIME | ATTR_MTIME | ATTR_CTIME | ATTR_SIZE \
5245- | ATTR_GID | ATTR_UID | ATTR_MODE)
5246+ | ATTR_GID | ATTR_UID | ATTR_TAG | ATTR_MODE)
5247 if (!(attr->ia_valid & OCFS2_VALID_ATTRS))
5248 return 0;
5249
5250diff -NurpP --minimal linux-4.4.116/fs/ocfs2/inode.c linux-4.4.116-vs2.3.9.7/fs/ocfs2/inode.c
5251--- linux-4.4.116/fs/ocfs2/inode.c 2016-07-05 04:12:34.000000000 +0000
5252+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/inode.c 2018-01-09 16:36:32.000000000 +0000
5253@@ -28,6 +28,7 @@
5254 #include <linux/highmem.h>
5255 #include <linux/pagemap.h>
5256 #include <linux/quotaops.h>
5257+#include <linux/vs_tag.h>
5258
5259 #include <asm/byteorder.h>
5260
5261@@ -78,11 +79,13 @@ void ocfs2_set_inode_flags(struct inode
5262 {
5263 unsigned int flags = OCFS2_I(inode)->ip_attr;
5264
5265- inode->i_flags &= ~(S_IMMUTABLE |
5266+ inode->i_flags &= ~(S_IMMUTABLE | S_IXUNLINK |
5267 S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
5268
5269 if (flags & OCFS2_IMMUTABLE_FL)
5270 inode->i_flags |= S_IMMUTABLE;
5271+ if (flags & OCFS2_IXUNLINK_FL)
5272+ inode->i_flags |= S_IXUNLINK;
5273
5274 if (flags & OCFS2_SYNC_FL)
5275 inode->i_flags |= S_SYNC;
5276@@ -92,25 +95,44 @@ void ocfs2_set_inode_flags(struct inode
5277 inode->i_flags |= S_NOATIME;
5278 if (flags & OCFS2_DIRSYNC_FL)
5279 inode->i_flags |= S_DIRSYNC;
5280+
5281+ inode->i_vflags &= ~(V_BARRIER | V_COW);
5282+
5283+ if (flags & OCFS2_BARRIER_FL)
5284+ inode->i_vflags |= V_BARRIER;
5285+ if (flags & OCFS2_COW_FL)
5286+ inode->i_vflags |= V_COW;
5287 }
5288
5289 /* Propagate flags from i_flags to OCFS2_I(inode)->ip_attr */
5290 void ocfs2_get_inode_flags(struct ocfs2_inode_info *oi)
5291 {
5292 unsigned int flags = oi->vfs_inode.i_flags;
5293+ unsigned int vflags = oi->vfs_inode.i_vflags;
5294+
5295+ oi->ip_attr &= ~(OCFS2_SYNC_FL | OCFS2_APPEND_FL |
5296+ OCFS2_IMMUTABLE_FL | OCFS2_IXUNLINK_FL |
5297+ OCFS2_NOATIME_FL | OCFS2_DIRSYNC_FL |
5298+ OCFS2_BARRIER_FL | OCFS2_COW_FL);
5299+
5300+ if (flags & S_IMMUTABLE)
5301+ oi->ip_attr |= OCFS2_IMMUTABLE_FL;
5302+ if (flags & S_IXUNLINK)
5303+ oi->ip_attr |= OCFS2_IXUNLINK_FL;
5304
5305- oi->ip_attr &= ~(OCFS2_SYNC_FL|OCFS2_APPEND_FL|
5306- OCFS2_IMMUTABLE_FL|OCFS2_NOATIME_FL|OCFS2_DIRSYNC_FL);
5307 if (flags & S_SYNC)
5308 oi->ip_attr |= OCFS2_SYNC_FL;
5309 if (flags & S_APPEND)
5310 oi->ip_attr |= OCFS2_APPEND_FL;
5311- if (flags & S_IMMUTABLE)
5312- oi->ip_attr |= OCFS2_IMMUTABLE_FL;
5313 if (flags & S_NOATIME)
5314 oi->ip_attr |= OCFS2_NOATIME_FL;
5315 if (flags & S_DIRSYNC)
5316 oi->ip_attr |= OCFS2_DIRSYNC_FL;
5317+
5318+ if (vflags & V_BARRIER)
5319+ oi->ip_attr |= OCFS2_BARRIER_FL;
5320+ if (vflags & V_COW)
5321+ oi->ip_attr |= OCFS2_COW_FL;
5322 }
5323
5324 struct inode *ocfs2_ilookup(struct super_block *sb, u64 blkno)
5325@@ -268,6 +290,8 @@ void ocfs2_populate_inode(struct inode *
5326 struct super_block *sb;
5327 struct ocfs2_super *osb;
5328 int use_plocks = 1;
5329+ uid_t uid;
5330+ gid_t gid;
5331
5332 sb = inode->i_sb;
5333 osb = OCFS2_SB(sb);
5334@@ -296,8 +320,12 @@ void ocfs2_populate_inode(struct inode *
5335 inode->i_generation = le32_to_cpu(fe->i_generation);
5336 inode->i_rdev = huge_decode_dev(le64_to_cpu(fe->id1.dev1.i_rdev));
5337 inode->i_mode = le16_to_cpu(fe->i_mode);
5338- i_uid_write(inode, le32_to_cpu(fe->i_uid));
5339- i_gid_write(inode, le32_to_cpu(fe->i_gid));
5340+ uid = le32_to_cpu(fe->i_uid);
5341+ gid = le32_to_cpu(fe->i_gid);
5342+ i_uid_write(inode, INOTAG_UID(DX_TAG(inode), uid, gid));
5343+ i_gid_write(inode, INOTAG_GID(DX_TAG(inode), uid, gid));
5344+ i_tag_write(inode, INOTAG_TAG(DX_TAG(inode), uid, gid,
5345+ /* le16_to_cpu(raw_inode->i_raw_tag) */ 0));
5346
5347 /* Fast symlinks will have i_size but no allocated clusters. */
5348 if (S_ISLNK(inode->i_mode) && !fe->i_clusters) {
5349diff -NurpP --minimal linux-4.4.116/fs/ocfs2/inode.h linux-4.4.116-vs2.3.9.7/fs/ocfs2/inode.h
5350--- linux-4.4.116/fs/ocfs2/inode.h 2016-07-05 04:15:08.000000000 +0000
5351+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/inode.h 2018-01-09 16:36:32.000000000 +0000
5352@@ -161,6 +161,7 @@ struct buffer_head *ocfs2_bread(struct i
5353
5354 void ocfs2_set_inode_flags(struct inode *inode);
5355 void ocfs2_get_inode_flags(struct ocfs2_inode_info *oi);
5356+int ocfs2_sync_flags(struct inode *inode, int, int);
5357
5358 static inline blkcnt_t ocfs2_inode_sector_count(struct inode *inode)
5359 {
5360diff -NurpP --minimal linux-4.4.116/fs/ocfs2/ioctl.c linux-4.4.116-vs2.3.9.7/fs/ocfs2/ioctl.c
5361--- linux-4.4.116/fs/ocfs2/ioctl.c 2015-10-29 09:21:37.000000000 +0000
5362+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/ioctl.c 2018-01-09 16:36:32.000000000 +0000
5363@@ -76,7 +76,41 @@ static int ocfs2_get_inode_attr(struct i
5364 return status;
5365 }
5366
5367-static int ocfs2_set_inode_attr(struct inode *inode, unsigned flags,
5368+int ocfs2_sync_flags(struct inode *inode, int flags, int vflags)
5369+{
5370+ struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
5371+ struct buffer_head *bh = NULL;
5372+ handle_t *handle = NULL;
5373+ int status;
5374+
5375+ status = ocfs2_inode_lock(inode, &bh, 1);
5376+ if (status < 0) {
5377+ mlog_errno(status);
5378+ return status;
5379+ }
5380+ handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
5381+ if (IS_ERR(handle)) {
5382+ status = PTR_ERR(handle);
5383+ mlog_errno(status);
5384+ goto bail_unlock;
5385+ }
5386+
5387+ inode->i_flags = flags;
5388+ inode->i_vflags = vflags;
5389+ ocfs2_get_inode_flags(OCFS2_I(inode));
5390+
5391+ status = ocfs2_mark_inode_dirty(handle, inode, bh);
5392+ if (status < 0)
5393+ mlog_errno(status);
5394+
5395+ ocfs2_commit_trans(osb, handle);
5396+bail_unlock:
5397+ ocfs2_inode_unlock(inode, 1);
5398+ brelse(bh);
5399+ return status;
5400+}
5401+
5402+int ocfs2_set_inode_attr(struct inode *inode, unsigned flags,
5403 unsigned mask)
5404 {
5405 struct ocfs2_inode_info *ocfs2_inode = OCFS2_I(inode);
5406@@ -116,6 +150,11 @@ static int ocfs2_set_inode_attr(struct i
5407 goto bail_unlock;
5408 }
5409
5410+ if (IS_BARRIER(inode)) {
5411+ vxwprintk_task(1, "messing with the barrier.");
5412+ goto bail_unlock;
5413+ }
5414+
5415 handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
5416 if (IS_ERR(handle)) {
5417 status = PTR_ERR(handle);
5418@@ -841,6 +880,7 @@ bail:
5419 return status;
5420 }
5421
5422+
5423 long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
5424 {
5425 struct inode *inode = file_inode(filp);
5426diff -NurpP --minimal linux-4.4.116/fs/ocfs2/namei.c linux-4.4.116-vs2.3.9.7/fs/ocfs2/namei.c
5427--- linux-4.4.116/fs/ocfs2/namei.c 2018-02-22 21:19:53.000000000 +0000
5428+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/namei.c 2018-01-09 16:36:32.000000000 +0000
5429@@ -41,6 +41,7 @@
5430 #include <linux/slab.h>
5431 #include <linux/highmem.h>
5432 #include <linux/quotaops.h>
5433+#include <linux/vs_tag.h>
5434
5435 #include <cluster/masklog.h>
5436
5437@@ -516,6 +517,7 @@ static int __ocfs2_mknod_locked(struct i
5438 struct ocfs2_extent_list *fel;
5439 u16 feat;
5440 struct ocfs2_inode_info *oi = OCFS2_I(inode);
5441+ ktag_t ktag;
5442
5443 *new_fe_bh = NULL;
5444
5445@@ -553,8 +555,13 @@ static int __ocfs2_mknod_locked(struct i
5446 fe->i_suballoc_loc = cpu_to_le64(suballoc_loc);
5447 fe->i_suballoc_bit = cpu_to_le16(suballoc_bit);
5448 fe->i_suballoc_slot = cpu_to_le16(inode_ac->ac_alloc_slot);
5449- fe->i_uid = cpu_to_le32(i_uid_read(inode));
5450- fe->i_gid = cpu_to_le32(i_gid_read(inode));
5451+
5452+ ktag = make_ktag(&init_user_ns, dx_current_fstag(osb->sb));
5453+ fe->i_uid = cpu_to_le32(from_kuid(&init_user_ns,
5454+ TAGINO_KUID(DX_TAG(inode), inode->i_uid, ktag)));
5455+ fe->i_gid = cpu_to_le32(from_kgid(&init_user_ns,
5456+ TAGINO_KGID(DX_TAG(inode), inode->i_gid, ktag)));
5457+ inode->i_tag = ktag; /* is this correct? */
5458 fe->i_mode = cpu_to_le16(inode->i_mode);
5459 if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode))
5460 fe->id1.dev1.i_rdev = cpu_to_le64(huge_encode_dev(dev));
5461diff -NurpP --minimal linux-4.4.116/fs/ocfs2/ocfs2.h linux-4.4.116-vs2.3.9.7/fs/ocfs2/ocfs2.h
5462--- linux-4.4.116/fs/ocfs2/ocfs2.h 2018-02-22 21:19:53.000000000 +0000
5463+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/ocfs2.h 2018-01-09 17:21:54.000000000 +0000
5464@@ -289,6 +289,7 @@ enum ocfs2_mount_options
5465 OCFS2_MOUNT_JOURNAL_ASYNC_COMMIT = 1 << 15, /* Journal Async Commit */
5466 OCFS2_MOUNT_ERRORS_CONT = 1 << 16, /* Return EIO to the calling process on error */
5467 OCFS2_MOUNT_ERRORS_ROFS = 1 << 17, /* Change filesystem to read-only on error */
5468+ OCFS2_MOUNT_TAGGED = 1 << 18, /* use tagging */
5469 };
5470
5471 #define OCFS2_OSB_SOFT_RO 0x0001
5472diff -NurpP --minimal linux-4.4.116/fs/ocfs2/ocfs2_fs.h linux-4.4.116-vs2.3.9.7/fs/ocfs2/ocfs2_fs.h
5473--- linux-4.4.116/fs/ocfs2/ocfs2_fs.h 2016-07-05 04:12:34.000000000 +0000
5474+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/ocfs2_fs.h 2018-01-09 16:36:32.000000000 +0000
5475@@ -275,6 +275,11 @@
5476 #define OCFS2_TOPDIR_FL FS_TOPDIR_FL /* Top of directory hierarchies*/
5477 #define OCFS2_RESERVED_FL FS_RESERVED_FL /* reserved for ext2 lib */
5478
5479+#define OCFS2_IXUNLINK_FL FS_IXUNLINK_FL /* Immutable invert on unlink */
5480+
5481+#define OCFS2_BARRIER_FL FS_BARRIER_FL /* Barrier for chroot() */
5482+#define OCFS2_COW_FL FS_COW_FL /* Copy on Write marker */
5483+
5484 #define OCFS2_FL_VISIBLE FS_FL_USER_VISIBLE /* User visible flags */
5485 #define OCFS2_FL_MODIFIABLE FS_FL_USER_MODIFIABLE /* User modifiable flags */
5486
5487diff -NurpP --minimal linux-4.4.116/fs/ocfs2/super.c linux-4.4.116-vs2.3.9.7/fs/ocfs2/super.c
5488--- linux-4.4.116/fs/ocfs2/super.c 2016-07-05 04:12:34.000000000 +0000
5489+++ linux-4.4.116-vs2.3.9.7/fs/ocfs2/super.c 2018-01-09 17:22:51.000000000 +0000
5490@@ -193,6 +193,7 @@ enum {
5491 Opt_dir_resv_level,
5492 Opt_journal_async_commit,
5493 Opt_err_cont,
5494+ Opt_tag, Opt_notag, Opt_tagid,
5495 Opt_err,
5496 };
5497
5498@@ -226,6 +227,9 @@ static const match_table_t tokens = {
5499 {Opt_dir_resv_level, "dir_resv_level=%u"},
5500 {Opt_journal_async_commit, "journal_async_commit"},
5501 {Opt_err_cont, "errors=continue"},
5502+ {Opt_tag, "tag"},
5503+ {Opt_notag, "notag"},
5504+ {Opt_tagid, "tagid=%u"},
5505 {Opt_err, NULL}
5506 };
5507
5508@@ -677,6 +681,13 @@ static int ocfs2_remount(struct super_bl
5509 goto out;
5510 }
5511
5512+ if ((osb->s_mount_opt & OCFS2_MOUNT_TAGGED) !=
5513+ (parsed_options.mount_opt & OCFS2_MOUNT_TAGGED)) {
5514+ ret = -EINVAL;
5515+ mlog(ML_ERROR, "Cannot change tagging on remount\n");
5516+ goto out;
5517+ }
5518+
5519 /* We're going to/from readonly mode. */
5520 if ((*flags & MS_RDONLY) != (sb->s_flags & MS_RDONLY)) {
5521 /* Disable quota accounting before remounting RO */
5522@@ -1166,6 +1177,9 @@ static int ocfs2_fill_super(struct super
5523
5524 ocfs2_complete_mount_recovery(osb);
5525
5526+ if (osb->s_mount_opt & OCFS2_MOUNT_TAGGED)
5527+ sb->s_flags |= MS_TAGGED;
5528+
5529 if (ocfs2_mount_local(osb))
5530 snprintf(nodestr, sizeof(nodestr), "local");
5531 else
5532@@ -1486,6 +1500,20 @@ static int ocfs2_parse_options(struct su
5533 case Opt_journal_async_commit:
5534 mopt->mount_opt |= OCFS2_MOUNT_JOURNAL_ASYNC_COMMIT;
5535 break;
5536+#ifndef CONFIG_TAGGING_NONE
5537+ case Opt_tag:
5538+ mopt->mount_opt |= OCFS2_MOUNT_TAGGED;
5539+ break;
5540+ case Opt_notag:
5541+ mopt->mount_opt &= ~OCFS2_MOUNT_TAGGED;
5542+ break;
5543+#endif
5544+#ifdef CONFIG_PROPAGATE
5545+ case Opt_tagid:
5546+ /* use args[0] */
5547+ mopt->mount_opt |= OCFS2_MOUNT_TAGGED;
5548+ break;
5549+#endif
5550 default:
5551 mlog(ML_ERROR,
5552 "Unrecognized mount option \"%s\" "
5553diff -NurpP --minimal linux-4.4.116/fs/open.c linux-4.4.116-vs2.3.9.7/fs/open.c
5554--- linux-4.4.116/fs/open.c 2018-02-22 21:19:53.000000000 +0000
5555+++ linux-4.4.116-vs2.3.9.7/fs/open.c 2018-01-09 16:36:32.000000000 +0000
5556@@ -31,6 +31,11 @@
5557 #include <linux/ima.h>
5558 #include <linux/dnotify.h>
5559 #include <linux/compat.h>
5560+#include <linux/vs_base.h>
5561+#include <linux/vs_limit.h>
5562+#include <linux/vs_tag.h>
5563+#include <linux/vs_cowbl.h>
5564+#include <linux/vserver/dlimit.h>
5565
5566 #include "internal.h"
5567
5568@@ -70,6 +75,11 @@ long vfs_truncate(struct path *path, lof
5569 struct inode *inode;
5570 long error;
5571
5572+#ifdef CONFIG_VSERVER_COWBL
5573+ error = cow_check_and_break(path);
5574+ if (error)
5575+ goto out;
5576+#endif
5577 inode = path->dentry->d_inode;
5578
5579 /* For directories it's -EISDIR, for other non-regulars - -EINVAL */
5580@@ -548,6 +558,13 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
5581 unsigned int lookup_flags = LOOKUP_FOLLOW;
5582 retry:
5583 error = user_path_at(dfd, filename, lookup_flags, &path);
5584+#ifdef CONFIG_VSERVER_COWBL
5585+ if (!error) {
5586+ error = cow_check_and_break(&path);
5587+ if (error)
5588+ path_put(&path);
5589+ }
5590+#endif
5591 if (!error) {
5592 error = chmod_common(&path, mode);
5593 path_put(&path);
5594@@ -582,13 +599,15 @@ retry_deleg:
5595 if (!uid_valid(uid))
5596 return -EINVAL;
5597 newattrs.ia_valid |= ATTR_UID;
5598- newattrs.ia_uid = uid;
5599+ newattrs.ia_uid = make_kuid(&init_user_ns,
5600+ dx_map_uid(user));
5601 }
5602 if (group != (gid_t) -1) {
5603 if (!gid_valid(gid))
5604 return -EINVAL;
5605 newattrs.ia_valid |= ATTR_GID;
5606- newattrs.ia_gid = gid;
5607+ newattrs.ia_gid = make_kgid(&init_user_ns,
5608+ dx_map_gid(group));
5609 }
5610 if (!S_ISDIR(inode->i_mode))
5611 newattrs.ia_valid |=
5612@@ -626,6 +645,10 @@ retry:
5613 error = mnt_want_write(path.mnt);
5614 if (error)
5615 goto out_release;
5616+#ifdef CONFIG_VSERVER_COWBL
5617+ error = cow_check_and_break(&path);
5618+ if (!error)
5619+#endif
5620 error = chown_common(&path, user, group);
5621 mnt_drop_write(path.mnt);
5622 out_release:
5623diff -NurpP --minimal linux-4.4.116/fs/proc/array.c linux-4.4.116-vs2.3.9.7/fs/proc/array.c
5624--- linux-4.4.116/fs/proc/array.c 2018-02-22 21:19:53.000000000 +0000
5625+++ linux-4.4.116-vs2.3.9.7/fs/proc/array.c 2018-01-09 17:30:44.000000000 +0000
5626@@ -83,6 +83,8 @@
5627 #include <linux/tracehook.h>
5628 #include <linux/string_helpers.h>
5629 #include <linux/user_namespace.h>
5630+#include <linux/vs_context.h>
5631+#include <linux/vs_network.h>
5632
5633 #include <asm/pgtable.h>
5634 #include <asm/processor.h>
5635@@ -154,6 +156,9 @@ static inline void task_state(struct seq
5636 ppid = pid_alive(p) ?
5637 task_tgid_nr_ns(rcu_dereference(p->real_parent), ns) : 0;
5638
5639+ if (unlikely(vx_current_initpid(p->pid)))
5640+ ppid = 0;
5641+
5642 tracer = ptrace_parent(p);
5643 if (tracer)
5644 tpid = task_pid_nr_ns(tracer, ns);
5645@@ -292,8 +297,8 @@ static inline void task_sig(struct seq_f
5646 render_sigset_t(m, "SigCgt:\t", &caught);
5647 }
5648
5649-static void render_cap_t(struct seq_file *m, const char *header,
5650- kernel_cap_t *a)
5651+void render_cap_t(struct seq_file *m, const char *header,
5652+ struct vx_info *vxi, kernel_cap_t *a)
5653 {
5654 unsigned __capi;
5655
5656@@ -320,11 +325,12 @@ static inline void task_cap(struct seq_f
5657 cap_ambient = cred->cap_ambient;
5658 rcu_read_unlock();
5659
5660- render_cap_t(m, "CapInh:\t", &cap_inheritable);
5661- render_cap_t(m, "CapPrm:\t", &cap_permitted);
5662- render_cap_t(m, "CapEff:\t", &cap_effective);
5663- render_cap_t(m, "CapBnd:\t", &cap_bset);
5664- render_cap_t(m, "CapAmb:\t", &cap_ambient);
5665+ /* FIXME: maybe move the p->vx_info masking to __task_cred() ? */
5666+ render_cap_t(m, "CapInh:\t", p->vx_info, &cap_inheritable);
5667+ render_cap_t(m, "CapPrm:\t", p->vx_info, &cap_permitted);
5668+ render_cap_t(m, "CapEff:\t", p->vx_info, &cap_effective);
5669+ render_cap_t(m, "CapBnd:\t", p->vx_info, &cap_bset);
5670+ render_cap_t(m, "CapAmb:\t", p->vx_info, &cap_ambient);
5671 }
5672
5673 static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
5674@@ -351,6 +357,43 @@ static void task_cpus_allowed(struct seq
5675 cpumask_pr_args(&task->cpus_allowed));
5676 }
5677
5678+int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
5679+ struct pid *pid, struct task_struct *task)
5680+{
5681+ seq_printf(m, "Proxy:\t%p(%c)\n"
5682+ "Count:\t%u\n"
5683+ "uts:\t%p(%c)\n"
5684+ "ipc:\t%p(%c)\n"
5685+ "mnt:\t%p(%c)\n"
5686+ "pid:\t%p(%c)\n"
5687+ "net:\t%p(%c)\n",
5688+ task->nsproxy,
5689+ (task->nsproxy == init_task.nsproxy ? 'I' : '-'),
5690+ atomic_read(&task->nsproxy->count),
5691+ task->nsproxy->uts_ns,
5692+ (task->nsproxy->uts_ns == init_task.nsproxy->uts_ns ? 'I' : '-'),
5693+ task->nsproxy->ipc_ns,
5694+ (task->nsproxy->ipc_ns == init_task.nsproxy->ipc_ns ? 'I' : '-'),
5695+ task->nsproxy->mnt_ns,
5696+ (task->nsproxy->mnt_ns == init_task.nsproxy->mnt_ns ? 'I' : '-'),
5697+ task->nsproxy->pid_ns_for_children,
5698+ (task->nsproxy->pid_ns_for_children ==
5699+ init_task.nsproxy->pid_ns_for_children ? 'I' : '-'),
5700+ task->nsproxy->net_ns,
5701+ (task->nsproxy->net_ns == init_task.nsproxy->net_ns ? 'I' : '-'));
5702+ return 0;
5703+}
5704+
5705+void task_vs_id(struct seq_file *m, struct task_struct *task)
5706+{
5707+ if (task_vx_flags(task, VXF_HIDE_VINFO, 0))
5708+ return;
5709+
5710+ seq_printf(m, "VxID:\t%d\n", vx_task_xid(task));
5711+ seq_printf(m, "NxID:\t%d\n", nx_task_nid(task));
5712+}
5713+
5714+
5715 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
5716 struct pid *pid, struct task_struct *task)
5717 {
5718@@ -368,6 +411,7 @@ int proc_pid_status(struct seq_file *m,
5719 task_seccomp(m, task);
5720 task_cpus_allowed(m, task);
5721 cpuset_task_status_allowed(m, task);
5722+ task_vs_id(m, task);
5723 task_context_switch_counts(m, task);
5724 return 0;
5725 }
5726@@ -471,6 +515,17 @@ static int do_task_stat(struct seq_file
5727 /* convert nsec -> ticks */
5728 start_time = nsec_to_clock_t(task->real_start_time);
5729
5730+ /* fixup start time for virt uptime */
5731+ if (vx_flags(VXF_VIRT_UPTIME, 0)) {
5732+ unsigned long long bias =
5733+ current->vx_info->cvirt.bias_clock;
5734+
5735+ if (start_time > bias)
5736+ start_time -= bias;
5737+ else
5738+ start_time = 0;
5739+ }
5740+
5741 seq_printf(m, "%d (%s) %c", pid_nr_ns(pid, ns), tcomm, state);
5742 seq_put_decimal_ll(m, ' ', ppid);
5743 seq_put_decimal_ll(m, ' ', pgid);
5744diff -NurpP --minimal linux-4.4.116/fs/proc/base.c linux-4.4.116-vs2.3.9.7/fs/proc/base.c
5745--- linux-4.4.116/fs/proc/base.c 2018-02-22 21:19:53.000000000 +0000
5746+++ linux-4.4.116-vs2.3.9.7/fs/proc/base.c 2018-01-09 16:36:32.000000000 +0000
5747@@ -87,6 +87,8 @@
5748 #include <linux/slab.h>
5749 #include <linux/flex_array.h>
5750 #include <linux/posix-timers.h>
5751+#include <linux/vs_context.h>
5752+#include <linux/vs_network.h>
5753 #ifdef CONFIG_HARDWALL
5754 #include <asm/hardwall.h>
5755 #endif
5756@@ -1097,11 +1099,15 @@ static ssize_t oom_adj_write(struct file
5757 oom_adj = (oom_adj * OOM_SCORE_ADJ_MAX) / -OOM_DISABLE;
5758
5759 if (oom_adj < task->signal->oom_score_adj &&
5760- !capable(CAP_SYS_RESOURCE)) {
5761+ !vx_capable(CAP_SYS_RESOURCE, VXC_OOM_ADJUST)) {
5762 err = -EACCES;
5763 goto err_sighand;
5764 }
5765
5766+ /* prevent guest processes from circumventing the oom killer */
5767+ if (vx_current_xid() && (oom_adj == OOM_DISABLE))
5768+ oom_adj = OOM_ADJUST_MIN;
5769+
5770 /*
5771 * /proc/pid/oom_adj is provided for legacy purposes, ask users to use
5772 * /proc/pid/oom_score_adj instead.
5773@@ -1666,6 +1672,8 @@ struct inode *proc_pid_make_inode(struct
5774 inode->i_gid = cred->egid;
5775 rcu_read_unlock();
5776 }
5777+ /* procfs is xid tagged */
5778+ i_tag_write(inode, (vtag_t)vx_task_xid(task));
5779 security_task_to_inode(task, inode);
5780
5781 out:
5782@@ -1711,6 +1719,8 @@ int pid_getattr(struct vfsmount *mnt, st
5783
5784 /* dentry stuff */
5785
5786+// static unsigned name_to_int(struct dentry *dentry);
5787+
5788 /*
5789 * Exceptional case: normally we are not allowed to unhash a busy
5790 * directory. In this case, however, we can do it - no aliasing problems
5791@@ -1739,6 +1749,19 @@ int pid_revalidate(struct dentry *dentry
5792 task = get_proc_task(inode);
5793
5794 if (task) {
5795+ unsigned pid = name_to_int(&dentry->d_name);
5796+
5797+ if (pid != ~0U && pid != vx_map_pid(task->pid) &&
5798+ pid != __task_pid_nr_ns(task, PIDTYPE_PID,
5799+ task_active_pid_ns(task))) {
5800+ vxdprintk(VXD_CBIT(misc, 10),
5801+ VS_Q("%*s") " dropped by pid_revalidate(%d!=%d)",
5802+ dentry->d_name.len, dentry->d_name.name,
5803+ pid, vx_map_pid(task->pid));
5804+ put_task_struct(task);
5805+ d_drop(dentry);
5806+ return 0;
5807+ }
5808 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
5809 task_dumpable(task)) {
5810 rcu_read_lock();
5811@@ -2283,6 +2306,13 @@ static struct dentry *proc_pident_lookup
5812 if (!task)
5813 goto out_no_task;
5814
5815+ /* TODO: maybe we can come up with a generic approach? */
5816+ if (task_vx_flags(task, VXF_HIDE_VINFO, 0) &&
5817+ (dentry->d_name.len == 5) &&
5818+ (!memcmp(dentry->d_name.name, "vinfo", 5) ||
5819+ !memcmp(dentry->d_name.name, "ninfo", 5)))
5820+ goto out;
5821+
5822 /*
5823 * Yes, it does not scale. And it should not. Don't add
5824 * new entries into /proc/<tgid>/ without very good reasons.
5825@@ -2725,6 +2755,11 @@ static int proc_pid_personality(struct s
5826 static const struct file_operations proc_task_operations;
5827 static const struct inode_operations proc_task_inode_operations;
5828
5829+extern int proc_pid_vx_info(struct seq_file *,
5830+ struct pid_namespace *, struct pid *, struct task_struct *);
5831+extern int proc_pid_nx_info(struct seq_file *,
5832+ struct pid_namespace *, struct pid *, struct task_struct *);
5833+
5834 static const struct pid_entry tgid_base_stuff[] = {
5835 DIR("task", S_IRUGO|S_IXUGO, proc_task_inode_operations, proc_task_operations),
5836 DIR("fd", S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
5837@@ -2789,6 +2824,8 @@ static const struct pid_entry tgid_base_
5838 #ifdef CONFIG_CGROUPS
5839 ONE("cgroup", S_IRUGO, proc_cgroup_show),
5840 #endif
5841+ ONE("vinfo", S_IRUGO, proc_pid_vx_info),
5842+ ONE("ninfo", S_IRUGO, proc_pid_nx_info),
5843 ONE("oom_score", S_IRUGO, proc_oom_score),
5844 REG("oom_adj", S_IRUGO|S_IWUSR, proc_oom_adj_operations),
5845 REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations),
5846@@ -3003,7 +3040,7 @@ retry:
5847 iter.task = NULL;
5848 pid = find_ge_pid(iter.tgid, ns);
5849 if (pid) {
5850- iter.tgid = pid_nr_ns(pid, ns);
5851+ iter.tgid = pid_unmapped_nr_ns(pid, ns);
5852 iter.task = pid_task(pid, PIDTYPE_PID);
5853 /* What we to know is if the pid we have find is the
5854 * pid of a thread_group_leader. Testing for task
5855@@ -3063,8 +3100,10 @@ int proc_pid_readdir(struct file *file,
5856 if (!has_pid_permissions(ns, iter.task, 2))
5857 continue;
5858
5859- len = snprintf(name, sizeof(name), "%d", iter.tgid);
5860+ len = snprintf(name, sizeof(name), "%d", vx_map_tgid(iter.tgid));
5861 ctx->pos = iter.tgid + TGID_OFFSET;
5862+ if (!vx_proc_task_visible(iter.task))
5863+ continue;
5864 if (!proc_fill_cache(file, ctx, name, len,
5865 proc_pid_instantiate, iter.task, NULL)) {
5866 put_task_struct(iter.task);
5867@@ -3161,6 +3200,7 @@ static const struct pid_entry tid_base_s
5868 REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations),
5869 REG("setgroups", S_IRUGO|S_IWUSR, proc_setgroups_operations),
5870 #endif
5871+ ONE("nsproxy", S_IRUGO, proc_pid_nsproxy),
5872 };
5873
5874 static int proc_tid_base_readdir(struct file *file, struct dir_context *ctx)
5875@@ -3227,6 +3267,8 @@ static struct dentry *proc_task_lookup(s
5876 tid = name_to_int(&dentry->d_name);
5877 if (tid == ~0U)
5878 goto out;
5879+ if (vx_current_initpid(tid))
5880+ goto out;
5881
5882 ns = dentry->d_sb->s_fs_info;
5883 rcu_read_lock();
5884diff -NurpP --minimal linux-4.4.116/fs/proc/generic.c linux-4.4.116-vs2.3.9.7/fs/proc/generic.c
5885--- linux-4.4.116/fs/proc/generic.c 2018-02-22 21:19:53.000000000 +0000
5886+++ linux-4.4.116-vs2.3.9.7/fs/proc/generic.c 2018-01-09 17:29:24.000000000 +0000
5887@@ -22,6 +22,7 @@
5888 #include <linux/bitops.h>
5889 #include <linux/spinlock.h>
5890 #include <linux/completion.h>
5891+#include <linux/vserver/inode.h>
5892 #include <asm/uaccess.h>
5893
5894 #include "internal.h"
5895@@ -66,8 +67,16 @@ static struct proc_dir_entry *pde_subdir
5896 node = node->rb_left;
5897 else if (result > 0)
5898 node = node->rb_right;
5899- else
5900+ else {
5901+ if (!vx_hide_check(0, de->vx_flags)) {
5902+ vxdprintk(VXD_CBIT(misc, 9),
5903+ VS_Q("%*s")
5904+ " hidden in pde_subdir_find()",
5905+ de->namelen, de->name);
5906+ return 0;
5907+ }
5908 return de;
5909+ }
5910 }
5911 return NULL;
5912 }
5913@@ -241,6 +250,8 @@ struct dentry *proc_lookup_de(struct pro
5914 return ERR_PTR(-ENOMEM);
5915 d_set_d_op(dentry, &simple_dentry_operations);
5916 d_add(dentry, inode);
5917+ /* generic proc entries belong to the host */
5918+ i_tag_write(inode, 0);
5919 return NULL;
5920 }
5921 read_unlock(&proc_subdir_lock);
5922@@ -287,6 +298,12 @@ int proc_readdir_de(struct proc_dir_entr
5923 do {
5924 struct proc_dir_entry *next;
5925 pde_get(de);
5926+ if (!vx_hide_check(0, de->vx_flags)) {
5927+ vxdprintk(VXD_CBIT(misc, 9),
5928+ VS_Q("%*s") " hidden in proc_readdir_de()",
5929+ de->namelen, de->name);
5930+ goto skip;
5931+ }
5932 read_unlock(&proc_subdir_lock);
5933 if (!dir_emit(ctx, de->name, de->namelen,
5934 de->low_ino, de->mode >> 12)) {
5935@@ -294,6 +311,7 @@ int proc_readdir_de(struct proc_dir_entr
5936 return 0;
5937 }
5938 read_lock(&proc_subdir_lock);
5939+ skip:
5940 ctx->pos++;
5941 next = pde_subdir_next(de);
5942 pde_put(de);
5943@@ -387,6 +405,7 @@ static struct proc_dir_entry *__proc_cre
5944 ent->mode = mode;
5945 ent->nlink = nlink;
5946 ent->subdir = RB_ROOT;
5947+ ent->vx_flags = IATTR_PROC_DEFAULT;
5948 atomic_set(&ent->count, 1);
5949 spin_lock_init(&ent->pde_unload_lock);
5950 INIT_LIST_HEAD(&ent->pde_openers);
5951@@ -411,7 +430,8 @@ struct proc_dir_entry *proc_symlink(cons
5952 kfree(ent->data);
5953 kfree(ent);
5954 ent = NULL;
5955- }
5956+ } else
5957+ ent->vx_flags = IATTR_PROC_SYMLINK;
5958 } else {
5959 kfree(ent);
5960 ent = NULL;
5961diff -NurpP --minimal linux-4.4.116/fs/proc/inode.c linux-4.4.116-vs2.3.9.7/fs/proc/inode.c
5962--- linux-4.4.116/fs/proc/inode.c 2015-10-29 09:21:39.000000000 +0000
5963+++ linux-4.4.116-vs2.3.9.7/fs/proc/inode.c 2018-01-09 16:36:32.000000000 +0000
5964@@ -431,6 +431,8 @@ struct inode *proc_get_inode(struct supe
5965 inode->i_uid = de->uid;
5966 inode->i_gid = de->gid;
5967 }
5968+ if (de->vx_flags)
5969+ PROC_I(inode)->vx_flags = de->vx_flags;
5970 if (de->size)
5971 inode->i_size = de->size;
5972 if (de->nlink)
5973diff -NurpP --minimal linux-4.4.116/fs/proc/internal.h linux-4.4.116-vs2.3.9.7/fs/proc/internal.h
5974--- linux-4.4.116/fs/proc/internal.h 2015-10-29 09:21:39.000000000 +0000
5975+++ linux-4.4.116-vs2.3.9.7/fs/proc/internal.h 2018-01-09 16:36:32.000000000 +0000
5976@@ -14,6 +14,7 @@
5977 #include <linux/spinlock.h>
5978 #include <linux/atomic.h>
5979 #include <linux/binfmts.h>
5980+#include <linux/vs_pid.h>
5981
5982 struct ctl_table_header;
5983 struct mempolicy;
5984@@ -34,6 +35,7 @@ struct proc_dir_entry {
5985 nlink_t nlink;
5986 kuid_t uid;
5987 kgid_t gid;
5988+ int vx_flags;
5989 loff_t size;
5990 const struct inode_operations *proc_iops;
5991 const struct file_operations *proc_fops;
5992@@ -51,15 +53,22 @@ struct proc_dir_entry {
5993 char name[];
5994 };
5995
5996+struct vx_info;
5997+struct nx_info;
5998+
5999 union proc_op {
6000 int (*proc_get_link)(struct dentry *, struct path *);
6001 int (*proc_show)(struct seq_file *m,
6002 struct pid_namespace *ns, struct pid *pid,
6003 struct task_struct *task);
6004+ int (*proc_vs_read)(char *page);
6005+ int (*proc_vxi_read)(struct vx_info *vxi, char *page);
6006+ int (*proc_nxi_read)(struct nx_info *nxi, char *page);
6007 };
6008
6009 struct proc_inode {
6010 struct pid *pid;
6011+ int vx_flags;
6012 int fd;
6013 union proc_op op;
6014 struct proc_dir_entry *pde;
6015@@ -92,11 +101,16 @@ static inline struct pid *proc_pid(struc
6016 return PROC_I(inode)->pid;
6017 }
6018
6019-static inline struct task_struct *get_proc_task(struct inode *inode)
6020+static inline struct task_struct *get_proc_task_real(struct inode *inode)
6021 {
6022 return get_pid_task(proc_pid(inode), PIDTYPE_PID);
6023 }
6024
6025+static inline struct task_struct *get_proc_task(struct inode *inode)
6026+{
6027+ return vx_get_proc_task(inode, proc_pid(inode));
6028+}
6029+
6030 static inline int task_dumpable(struct task_struct *task)
6031 {
6032 int dumpable = 0;
6033@@ -155,6 +169,8 @@ extern int proc_pid_status(struct seq_fi
6034 struct pid *, struct task_struct *);
6035 extern int proc_pid_statm(struct seq_file *, struct pid_namespace *,
6036 struct pid *, struct task_struct *);
6037+extern int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
6038+ struct pid *pid, struct task_struct *task);
6039
6040 /*
6041 * base.c
6042diff -NurpP --minimal linux-4.4.116/fs/proc/loadavg.c linux-4.4.116-vs2.3.9.7/fs/proc/loadavg.c
6043--- linux-4.4.116/fs/proc/loadavg.c 2015-04-12 22:12:50.000000000 +0000
6044+++ linux-4.4.116-vs2.3.9.7/fs/proc/loadavg.c 2018-01-09 16:36:32.000000000 +0000
6045@@ -12,15 +12,27 @@
6046
6047 static int loadavg_proc_show(struct seq_file *m, void *v)
6048 {
6049+ unsigned long running;
6050+ unsigned int threads;
6051 unsigned long avnrun[3];
6052
6053 get_avenrun(avnrun, FIXED_1/200, 0);
6054
6055+ if (vx_flags(VXF_VIRT_LOAD, 0)) {
6056+ struct vx_info *vxi = current_vx_info();
6057+
6058+ running = atomic_read(&vxi->cvirt.nr_running);
6059+ threads = atomic_read(&vxi->cvirt.nr_threads);
6060+ } else {
6061+ running = nr_running();
6062+ threads = nr_threads;
6063+ }
6064+
6065 seq_printf(m, "%lu.%02lu %lu.%02lu %lu.%02lu %ld/%d %d\n",
6066 LOAD_INT(avnrun[0]), LOAD_FRAC(avnrun[0]),
6067 LOAD_INT(avnrun[1]), LOAD_FRAC(avnrun[1]),
6068 LOAD_INT(avnrun[2]), LOAD_FRAC(avnrun[2]),
6069- nr_running(), nr_threads,
6070+ running, threads,
6071 task_active_pid_ns(current)->last_pid);
6072 return 0;
6073 }
6074diff -NurpP --minimal linux-4.4.116/fs/proc/meminfo.c linux-4.4.116-vs2.3.9.7/fs/proc/meminfo.c
6075--- linux-4.4.116/fs/proc/meminfo.c 2016-07-05 04:15:09.000000000 +0000
6076+++ linux-4.4.116-vs2.3.9.7/fs/proc/meminfo.c 2018-01-12 18:43:53.000000000 +0000
6077@@ -43,7 +43,8 @@ static int meminfo_proc_show(struct seq_
6078 si_swapinfo(&i);
6079 committed = percpu_counter_read_positive(&vm_committed_as);
6080
6081- cached = global_page_state(NR_FILE_PAGES) -
6082+ cached = vx_flags(VXF_VIRT_MEM, 0) ?
6083+ vx_vsi_cached(&i) : global_page_state(NR_FILE_PAGES) -
6084 total_swapcache_pages() - i.bufferram;
6085 if (cached < 0)
6086 cached = 0;
6087@@ -70,13 +71,16 @@ static int meminfo_proc_show(struct seq_
6088 */
6089 pagecache = pages[LRU_ACTIVE_FILE] + pages[LRU_INACTIVE_FILE];
6090 pagecache -= min(pagecache / 2, wmark_low);
6091- available += pagecache;
6092+
6093+ if (!vx_flags(VXF_VIRT_MEM, 0))
6094+ available += pagecache;
6095
6096 /*
6097 * Part of the reclaimable slab consists of items that are in use,
6098 * and cannot be freed. Cap this estimate at the low watermark.
6099 */
6100- available += global_page_state(NR_SLAB_RECLAIMABLE) -
6101+ if (!vx_flags(VXF_VIRT_MEM, 0))
6102+ available += global_page_state(NR_SLAB_RECLAIMABLE) -
6103 min(global_page_state(NR_SLAB_RECLAIMABLE) / 2, wmark_low);
6104
6105 if (available < 0)
6106diff -NurpP --minimal linux-4.4.116/fs/proc/root.c linux-4.4.116-vs2.3.9.7/fs/proc/root.c
6107--- linux-4.4.116/fs/proc/root.c 2018-02-22 21:19:53.000000000 +0000
6108+++ linux-4.4.116-vs2.3.9.7/fs/proc/root.c 2018-01-09 16:36:32.000000000 +0000
6109@@ -20,9 +20,14 @@
6110 #include <linux/mount.h>
6111 #include <linux/pid_namespace.h>
6112 #include <linux/parser.h>
6113+#include <linux/vserver/inode.h>
6114
6115 #include "internal.h"
6116
6117+struct proc_dir_entry *proc_virtual;
6118+
6119+extern void proc_vx_init(void);
6120+
6121 static int proc_test_super(struct super_block *sb, void *data)
6122 {
6123 return sb->s_fs_info == data;
6124@@ -113,7 +118,8 @@ static struct dentry *proc_mount(struct
6125 options = data;
6126
6127 /* Does the mounter have privilege over the pid namespace? */
6128- if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
6129+ if (!vx_ns_capable(ns->user_ns,
6130+ CAP_SYS_ADMIN, VXC_SECURE_MOUNT))
6131 return ERR_PTR(-EPERM);
6132 }
6133
6134@@ -196,6 +202,7 @@ void __init proc_root_init(void)
6135 proc_tty_init();
6136 proc_mkdir("bus", NULL);
6137 proc_sys_init();
6138+ proc_vx_init();
6139 }
6140
6141 static int proc_root_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat
6142@@ -257,6 +264,7 @@ struct proc_dir_entry proc_root = {
6143 .proc_iops = &proc_root_inode_operations,
6144 .proc_fops = &proc_root_operations,
6145 .parent = &proc_root,
6146+ .vx_flags = IATTR_ADMIN | IATTR_WATCH,
6147 .subdir = RB_ROOT,
6148 .name = "/proc",
6149 };
6150diff -NurpP --minimal linux-4.4.116/fs/proc/self.c linux-4.4.116-vs2.3.9.7/fs/proc/self.c
6151--- linux-4.4.116/fs/proc/self.c 2015-10-29 09:21:39.000000000 +0000
6152+++ linux-4.4.116-vs2.3.9.7/fs/proc/self.c 2018-01-09 16:36:32.000000000 +0000
6153@@ -1,6 +1,7 @@
6154 #include <linux/sched.h>
6155 #include <linux/slab.h>
6156 #include <linux/pid_namespace.h>
6157+#include <linux/vserver/inode.h>
6158 #include "internal.h"
6159
6160 /*
6161@@ -52,6 +53,8 @@ int proc_setup_self(struct super_block *
6162 self = d_alloc_name(s->s_root, "self");
6163 if (self) {
6164 struct inode *inode = new_inode_pseudo(s);
6165+
6166+ // self->vx_flags = IATTR_PROC_SYMLINK;
6167 if (inode) {
6168 inode->i_ino = self_inum;
6169 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
6170diff -NurpP --minimal linux-4.4.116/fs/proc/stat.c linux-4.4.116-vs2.3.9.7/fs/proc/stat.c
6171--- linux-4.4.116/fs/proc/stat.c 2015-04-12 22:12:50.000000000 +0000
6172+++ linux-4.4.116-vs2.3.9.7/fs/proc/stat.c 2018-01-09 16:36:32.000000000 +0000
6173@@ -9,8 +9,10 @@
6174 #include <linux/slab.h>
6175 #include <linux/time.h>
6176 #include <linux/irqnr.h>
6177+#include <linux/vserver/cvirt.h>
6178 #include <linux/cputime.h>
6179 #include <linux/tick.h>
6180+#include <linux/cpuset.h>
6181
6182 #ifndef arch_irq_stat_cpu
6183 #define arch_irq_stat_cpu(cpu) 0
6184@@ -87,14 +89,26 @@ static int show_stat(struct seq_file *p,
6185 u64 sum_softirq = 0;
6186 unsigned int per_softirq_sums[NR_SOFTIRQS] = {0};
6187 struct timespec boottime;
6188+ cpumask_var_t cpus_allowed;
6189+ bool virt_cpu = vx_flags(VXF_VIRT_CPU, 0);
6190
6191 user = nice = system = idle = iowait =
6192 irq = softirq = steal = 0;
6193 guest = guest_nice = 0;
6194 getboottime(&boottime);
6195+
6196+ if (vx_flags(VXF_VIRT_UPTIME, 0))
6197+ vx_vsi_boottime(&boottime);
6198+
6199+ if (virt_cpu)
6200+ cpuset_cpus_allowed(current, cpus_allowed);
6201+
6202 jif = boottime.tv_sec;
6203
6204 for_each_possible_cpu(i) {
6205+ if (virt_cpu && !cpumask_test_cpu(i, cpus_allowed))
6206+ continue;
6207+
6208 user += kcpustat_cpu(i).cpustat[CPUTIME_USER];
6209 nice += kcpustat_cpu(i).cpustat[CPUTIME_NICE];
6210 system += kcpustat_cpu(i).cpustat[CPUTIME_SYSTEM];
6211@@ -131,6 +145,9 @@ static int show_stat(struct seq_file *p,
6212 seq_putc(p, '\n');
6213
6214 for_each_online_cpu(i) {
6215+ if (virt_cpu && !cpumask_test_cpu(i, cpus_allowed))
6216+ continue;
6217+
6218 /* Copy values here to work around gcc-2.95.3, gcc-2.96 */
6219 user = kcpustat_cpu(i).cpustat[CPUTIME_USER];
6220 nice = kcpustat_cpu(i).cpustat[CPUTIME_NICE];
6221diff -NurpP --minimal linux-4.4.116/fs/proc/uptime.c linux-4.4.116-vs2.3.9.7/fs/proc/uptime.c
6222--- linux-4.4.116/fs/proc/uptime.c 2015-04-12 22:12:50.000000000 +0000
6223+++ linux-4.4.116-vs2.3.9.7/fs/proc/uptime.c 2018-01-09 16:36:32.000000000 +0000
6224@@ -5,6 +5,7 @@
6225 #include <linux/seq_file.h>
6226 #include <linux/time.h>
6227 #include <linux/kernel_stat.h>
6228+#include <linux/vserver/cvirt.h>
6229 #include <linux/cputime.h>
6230
6231 static int uptime_proc_show(struct seq_file *m, void *v)
6232@@ -24,6 +25,10 @@ static int uptime_proc_show(struct seq_f
6233 nsec = cputime64_to_jiffies64(idletime) * TICK_NSEC;
6234 idle.tv_sec = div_u64_rem(nsec, NSEC_PER_SEC, &rem);
6235 idle.tv_nsec = rem;
6236+
6237+ if (vx_flags(VXF_VIRT_UPTIME, 0))
6238+ vx_vsi_uptime(&uptime, &idle);
6239+
6240 seq_printf(m, "%lu.%02lu %lu.%02lu\n",
6241 (unsigned long) uptime.tv_sec,
6242 (uptime.tv_nsec / (NSEC_PER_SEC / 100)),
6243diff -NurpP --minimal linux-4.4.116/fs/proc_namespace.c linux-4.4.116-vs2.3.9.7/fs/proc_namespace.c
6244--- linux-4.4.116/fs/proc_namespace.c 2018-02-22 21:19:53.000000000 +0000
6245+++ linux-4.4.116-vs2.3.9.7/fs/proc_namespace.c 2018-01-09 16:36:32.000000000 +0000
6246@@ -46,6 +46,8 @@ static int show_sb_opts(struct seq_file
6247 { MS_DIRSYNC, ",dirsync" },
6248 { MS_MANDLOCK, ",mand" },
6249 { MS_LAZYTIME, ",lazytime" },
6250+ { MS_TAGGED, ",tag" },
6251+ { MS_NOTAGCHECK, ",notagcheck" },
6252 { 0, NULL }
6253 };
6254 const struct proc_fs_info *fs_infop;
6255@@ -82,6 +84,38 @@ static inline void mangle(struct seq_fil
6256 seq_escape(m, s, " \t\n\\");
6257 }
6258
6259+#ifdef CONFIG_VSERVER_EXTRA_MNT_CHECK
6260+
6261+static int mnt_is_reachable(struct vfsmount *vfsmnt)
6262+{
6263+ struct path root;
6264+ struct dentry *point;
6265+ struct mount *mnt = real_mount(vfsmnt);
6266+ struct mount *root_mnt;
6267+ int ret;
6268+
6269+ if (mnt == mnt->mnt_ns->root)
6270+ return 1;
6271+
6272+ rcu_read_lock();
6273+ root = current->fs->root;
6274+ root_mnt = real_mount(root.mnt);
6275+ point = root.dentry;
6276+
6277+ while ((mnt != mnt->mnt_parent) && (mnt != root_mnt)) {
6278+ point = mnt->mnt_mountpoint;
6279+ mnt = mnt->mnt_parent;
6280+ }
6281+ rcu_read_unlock();
6282+
6283+ ret = (mnt == root_mnt) && is_subdir(point, root.dentry);
6284+ return ret;
6285+}
6286+
6287+#else
6288+#define mnt_is_reachable(v) (1)
6289+#endif
6290+
6291 static void show_type(struct seq_file *m, struct super_block *sb)
6292 {
6293 mangle(m, sb->s_type->name);
6294@@ -99,6 +133,17 @@ static int show_vfsmnt(struct seq_file *
6295 struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
6296 struct super_block *sb = mnt_path.dentry->d_sb;
6297
6298+ if (vx_flags(VXF_HIDE_MOUNT, 0))
6299+ return SEQ_SKIP;
6300+ if (!mnt_is_reachable(mnt) && !vx_check(0, VS_WATCH_P))
6301+ return SEQ_SKIP;
6302+
6303+ if (!vx_check(0, VS_ADMIN|VS_WATCH) &&
6304+ mnt == current->fs->root.mnt) {
6305+ seq_puts(m, "/dev/root / ");
6306+ goto type;
6307+ }
6308+
6309 if (sb->s_op->show_devname) {
6310 err = sb->s_op->show_devname(m, mnt_path.dentry);
6311 if (err)
6312@@ -112,6 +157,7 @@ static int show_vfsmnt(struct seq_file *
6313 if (err)
6314 goto out;
6315 seq_putc(m, ' ');
6316+type:
6317 show_type(m, sb);
6318 seq_puts(m, __mnt_is_readonly(mnt) ? " ro" : " rw");
6319 err = show_sb_opts(m, sb);
6320@@ -133,6 +179,11 @@ static int show_mountinfo(struct seq_fil
6321 struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
6322 int err = 0;
6323
6324+ if (vx_flags(VXF_HIDE_MOUNT, 0))
6325+ return SEQ_SKIP;
6326+ if (!mnt_is_reachable(mnt) && !vx_check(0, VS_WATCH_P))
6327+ return SEQ_SKIP;
6328+
6329 seq_printf(m, "%i %i %u:%u ", r->mnt_id, r->mnt_parent->mnt_id,
6330 MAJOR(sb->s_dev), MINOR(sb->s_dev));
6331 if (sb->s_op->show_path)
6332@@ -193,6 +244,17 @@ static int show_vfsstat(struct seq_file
6333 struct super_block *sb = mnt_path.dentry->d_sb;
6334 int err = 0;
6335
6336+ if (vx_flags(VXF_HIDE_MOUNT, 0))
6337+ return SEQ_SKIP;
6338+ if (!mnt_is_reachable(mnt) && !vx_check(0, VS_WATCH_P))
6339+ return SEQ_SKIP;
6340+
6341+ if (!vx_check(0, VS_ADMIN|VS_WATCH) &&
6342+ mnt == current->fs->root.mnt) {
6343+ seq_puts(m, "device /dev/root mounted on / ");
6344+ goto type;
6345+ }
6346+
6347 /* device */
6348 if (sb->s_op->show_devname) {
6349 seq_puts(m, "device ");
6350@@ -214,7 +276,7 @@ static int show_vfsstat(struct seq_file
6351 if (err)
6352 goto out;
6353 seq_putc(m, ' ');
6354-
6355+type:
6356 /* file system type */
6357 seq_puts(m, "with fstype ");
6358 show_type(m, sb);
6359diff -NurpP --minimal linux-4.4.116/fs/quota/dquot.c linux-4.4.116-vs2.3.9.7/fs/quota/dquot.c
6360--- linux-4.4.116/fs/quota/dquot.c 2018-02-22 21:19:53.000000000 +0000
6361+++ linux-4.4.116-vs2.3.9.7/fs/quota/dquot.c 2018-02-10 15:16:50.000000000 +0000
6362@@ -1643,6 +1643,9 @@ int __dquot_alloc_space(struct inode *in
6363 int reserve = flags & DQUOT_SPACE_RESERVE;
6364 struct dquot **dquots;
6365
6366+ if ((ret = dl_alloc_space(inode, number)))
6367+ return ret;
6368+
6369 if (!dquot_active(inode)) {
6370 inode_incr_space(inode, number, reserve);
6371 goto out;
6372@@ -1695,6 +1698,9 @@ int dquot_alloc_inode(struct inode *inod
6373 struct dquot_warn warn[MAXQUOTAS];
6374 struct dquot * const *dquots;
6375
6376+ if ((ret = dl_alloc_inode(inode)))
6377+ return ret;
6378+
6379 if (!dquot_active(inode))
6380 return 0;
6381 for (cnt = 0; cnt < MAXQUOTAS; cnt++)
6382@@ -1797,6 +1803,8 @@ void __dquot_free_space(struct inode *in
6383 struct dquot **dquots;
6384 int reserve = flags & DQUOT_SPACE_RESERVE, index;
6385
6386+ dl_free_space(inode, number);
6387+
6388 if (!dquot_active(inode)) {
6389 inode_decr_space(inode, number, reserve);
6390 return;
6391@@ -1841,6 +1849,8 @@ void dquot_free_inode(struct inode *inod
6392 struct dquot * const *dquots;
6393 int index;
6394
6395+ dl_free_inode(inode);
6396+
6397 if (!dquot_active(inode))
6398 return;
6399
6400diff -NurpP --minimal linux-4.4.116/fs/quota/quota.c linux-4.4.116-vs2.3.9.7/fs/quota/quota.c
6401--- linux-4.4.116/fs/quota/quota.c 2016-07-05 04:12:34.000000000 +0000
6402+++ linux-4.4.116-vs2.3.9.7/fs/quota/quota.c 2018-01-09 16:36:32.000000000 +0000
6403@@ -8,6 +8,7 @@
6404 #include <linux/fs.h>
6405 #include <linux/namei.h>
6406 #include <linux/slab.h>
6407+#include <linux/vs_context.h>
6408 #include <asm/current.h>
6409 #include <linux/uaccess.h>
6410 #include <linux/kernel.h>
6411@@ -38,7 +39,7 @@ static int check_quotactl_permission(str
6412 break;
6413 /*FALLTHROUGH*/
6414 default:
6415- if (!capable(CAP_SYS_ADMIN))
6416+ if (!vx_capable(CAP_SYS_ADMIN, VXC_QUOTA_CTL))
6417 return -EPERM;
6418 }
6419
6420@@ -702,6 +703,46 @@ static int do_quotactl(struct super_bloc
6421
6422 #ifdef CONFIG_BLOCK
6423
6424+#if defined(CONFIG_BLK_DEV_VROOT) || defined(CONFIG_BLK_DEV_VROOT_MODULE)
6425+
6426+#include <linux/vroot.h>
6427+#include <linux/major.h>
6428+#include <linux/module.h>
6429+#include <linux/kallsyms.h>
6430+#include <linux/vserver/debug.h>
6431+
6432+static vroot_grb_func *vroot_get_real_bdev = NULL;
6433+
6434+static DEFINE_SPINLOCK(vroot_grb_lock);
6435+
6436+int register_vroot_grb(vroot_grb_func *func) {
6437+ int ret = -EBUSY;
6438+
6439+ spin_lock(&vroot_grb_lock);
6440+ if (!vroot_get_real_bdev) {
6441+ vroot_get_real_bdev = func;
6442+ ret = 0;
6443+ }
6444+ spin_unlock(&vroot_grb_lock);
6445+ return ret;
6446+}
6447+EXPORT_SYMBOL(register_vroot_grb);
6448+
6449+int unregister_vroot_grb(vroot_grb_func *func) {
6450+ int ret = -EINVAL;
6451+
6452+ spin_lock(&vroot_grb_lock);
6453+ if (vroot_get_real_bdev) {
6454+ vroot_get_real_bdev = NULL;
6455+ ret = 0;
6456+ }
6457+ spin_unlock(&vroot_grb_lock);
6458+ return ret;
6459+}
6460+EXPORT_SYMBOL(unregister_vroot_grb);
6461+
6462+#endif
6463+
6464 /* Return 1 if 'cmd' will block on frozen filesystem */
6465 static int quotactl_cmd_write(int cmd)
6466 {
6467@@ -737,6 +778,22 @@ static struct super_block *quotactl_bloc
6468 putname(tmp);
6469 if (IS_ERR(bdev))
6470 return ERR_CAST(bdev);
6471+#if defined(CONFIG_BLK_DEV_VROOT) || defined(CONFIG_BLK_DEV_VROOT_MODULE)
6472+ if (bdev && bdev->bd_inode &&
6473+ imajor(bdev->bd_inode) == VROOT_MAJOR) {
6474+ struct block_device *bdnew = (void *)-EINVAL;
6475+
6476+ if (vroot_get_real_bdev)
6477+ bdnew = vroot_get_real_bdev(bdev);
6478+ else
6479+ vxdprintk(VXD_CBIT(misc, 0),
6480+ "vroot_get_real_bdev not set");
6481+ bdput(bdev);
6482+ if (IS_ERR(bdnew))
6483+ return ERR_PTR(PTR_ERR(bdnew));
6484+ bdev = bdnew;
6485+ }
6486+#endif
6487 if (quotactl_cmd_write(cmd))
6488 sb = get_super_thawed(bdev);
6489 else
6490diff -NurpP --minimal linux-4.4.116/fs/stat.c linux-4.4.116-vs2.3.9.7/fs/stat.c
6491--- linux-4.4.116/fs/stat.c 2018-02-22 21:19:54.000000000 +0000
6492+++ linux-4.4.116-vs2.3.9.7/fs/stat.c 2018-01-09 16:36:32.000000000 +0000
6493@@ -26,6 +26,7 @@ void generic_fillattr(struct inode *inod
6494 stat->nlink = inode->i_nlink;
6495 stat->uid = inode->i_uid;
6496 stat->gid = inode->i_gid;
6497+ stat->tag = inode->i_tag;
6498 stat->rdev = inode->i_rdev;
6499 stat->size = i_size_read(inode);
6500 stat->atime = inode->i_atime;
6501diff -NurpP --minimal linux-4.4.116/fs/statfs.c linux-4.4.116-vs2.3.9.7/fs/statfs.c
6502--- linux-4.4.116/fs/statfs.c 2015-04-12 22:12:50.000000000 +0000
6503+++ linux-4.4.116-vs2.3.9.7/fs/statfs.c 2018-01-09 16:36:32.000000000 +0000
6504@@ -7,6 +7,8 @@
6505 #include <linux/statfs.h>
6506 #include <linux/security.h>
6507 #include <linux/uaccess.h>
6508+#include <linux/vs_base.h>
6509+#include <linux/vs_dlimit.h>
6510 #include "internal.h"
6511
6512 static int flags_by_mnt(int mnt_flags)
6513@@ -60,6 +62,8 @@ static int statfs_by_dentry(struct dentr
6514 retval = dentry->d_sb->s_op->statfs(dentry, buf);
6515 if (retval == 0 && buf->f_frsize == 0)
6516 buf->f_frsize = buf->f_bsize;
6517+ if (!vx_check(0, VS_ADMIN|VS_WATCH))
6518+ vx_vsi_statfs(dentry->d_sb, buf);
6519 return retval;
6520 }
6521
6522diff -NurpP --minimal linux-4.4.116/fs/super.c linux-4.4.116-vs2.3.9.7/fs/super.c
6523--- linux-4.4.116/fs/super.c 2018-02-22 21:19:54.000000000 +0000
6524+++ linux-4.4.116-vs2.3.9.7/fs/super.c 2018-01-09 16:36:32.000000000 +0000
6525@@ -33,6 +33,8 @@
6526 #include <linux/cleancache.h>
6527 #include <linux/fsnotify.h>
6528 #include <linux/lockdep.h>
6529+#include <linux/magic.h>
6530+#include <linux/vs_context.h>
6531 #include "internal.h"
6532
6533
6534@@ -1131,6 +1133,13 @@ mount_fs(struct file_system_type *type,
6535 WARN_ON(!sb->s_bdi);
6536 sb->s_flags |= MS_BORN;
6537
6538+ error = -EPERM;
6539+ if (!vx_capable(CAP_SYS_ADMIN, VXC_BINARY_MOUNT) &&
6540+ !sb->s_bdev &&
6541+ (sb->s_magic != PROC_SUPER_MAGIC) &&
6542+ (sb->s_magic != DEVPTS_SUPER_MAGIC))
6543+ goto out_sb;
6544+
6545 error = security_sb_kern_mount(sb, flags, secdata);
6546 if (error)
6547 goto out_sb;
6548diff -NurpP --minimal linux-4.4.116/fs/utimes.c linux-4.4.116-vs2.3.9.7/fs/utimes.c
6549--- linux-4.4.116/fs/utimes.c 2018-02-22 21:19:54.000000000 +0000
6550+++ linux-4.4.116-vs2.3.9.7/fs/utimes.c 2018-01-09 16:36:32.000000000 +0000
6551@@ -8,6 +8,8 @@
6552 #include <linux/stat.h>
6553 #include <linux/utime.h>
6554 #include <linux/syscalls.h>
6555+#include <linux/mount.h>
6556+#include <linux/vs_cowbl.h>
6557 #include <asm/uaccess.h>
6558 #include <asm/unistd.h>
6559
6560@@ -52,13 +54,19 @@ static int utimes_common(struct path *pa
6561 {
6562 int error;
6563 struct iattr newattrs;
6564- struct inode *inode = path->dentry->d_inode;
6565 struct inode *delegated_inode = NULL;
6566+ struct inode *inode;
6567+
6568+ error = cow_check_and_break(path);
6569+ if (error)
6570+ goto out;
6571
6572 error = mnt_want_write(path->mnt);
6573 if (error)
6574 goto out;
6575
6576+ inode = path->dentry->d_inode;
6577+
6578 if (times && times[0].tv_nsec == UTIME_NOW &&
6579 times[1].tv_nsec == UTIME_NOW)
6580 times = NULL;
6581diff -NurpP --minimal linux-4.4.116/fs/xattr.c linux-4.4.116-vs2.3.9.7/fs/xattr.c
6582--- linux-4.4.116/fs/xattr.c 2018-02-22 21:19:54.000000000 +0000
6583+++ linux-4.4.116-vs2.3.9.7/fs/xattr.c 2018-01-09 16:36:32.000000000 +0000
6584@@ -21,6 +21,7 @@
6585 #include <linux/audit.h>
6586 #include <linux/vmalloc.h>
6587 #include <linux/posix_acl_xattr.h>
6588+#include <linux/mount.h>
6589
6590 #include <asm/uaccess.h>
6591
6592@@ -52,7 +53,7 @@ xattr_permission(struct inode *inode, co
6593 * The trusted.* namespace can only be accessed by privileged users.
6594 */
6595 if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) {
6596- if (!capable(CAP_SYS_ADMIN))
6597+ if (!vx_capable(CAP_SYS_ADMIN, VXC_FS_TRUSTED))
6598 return (mask & MAY_WRITE) ? -EPERM : -ENODATA;
6599 return 0;
6600 }
6601diff -NurpP --minimal linux-4.4.116/include/linux/capability.h linux-4.4.116-vs2.3.9.7/include/linux/capability.h
6602--- linux-4.4.116/include/linux/capability.h 2018-02-22 21:19:56.000000000 +0000
6603+++ linux-4.4.116-vs2.3.9.7/include/linux/capability.h 2018-01-09 16:36:32.000000000 +0000
6604@@ -77,7 +77,8 @@ extern const kernel_cap_t __cap_init_eff
6605 #else /* HAND-CODED capability initializers */
6606
6607 #define CAP_LAST_U32 ((_KERNEL_CAPABILITY_U32S) - 1)
6608-#define CAP_LAST_U32_VALID_MASK (CAP_TO_MASK(CAP_LAST_CAP + 1) -1)
6609+#define CAP_LAST_U32_VALID_MASK ((CAP_TO_MASK(CAP_LAST_CAP + 1) -1) \
6610+ | CAP_TO_MASK(CAP_CONTEXT))
6611
6612 # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }})
6613 # define CAP_FULL_SET ((kernel_cap_t){{ ~0, CAP_LAST_U32_VALID_MASK }})
6614diff -NurpP --minimal linux-4.4.116/include/linux/cred.h linux-4.4.116-vs2.3.9.7/include/linux/cred.h
6615--- linux-4.4.116/include/linux/cred.h 2018-02-22 21:19:57.000000000 +0000
6616+++ linux-4.4.116-vs2.3.9.7/include/linux/cred.h 2018-01-11 08:03:00.000000000 +0000
6617@@ -161,6 +161,7 @@ extern void exit_creds(struct task_struc
6618 extern int copy_creds(struct task_struct *, unsigned long);
6619 extern const struct cred *get_task_cred(struct task_struct *);
6620 extern struct cred *cred_alloc_blank(void);
6621+extern struct cred *__prepare_creds(const struct cred *);
6622 extern struct cred *prepare_creds(void);
6623 extern struct cred *prepare_exec_creds(void);
6624 extern int commit_creds(struct cred *);
6625@@ -221,6 +222,31 @@ static inline bool cap_ambient_invariant
6626 cred->cap_inheritable));
6627 }
6628
6629+static inline void set_cred_subscribers(struct cred *cred, int n)
6630+{
6631+#ifdef CONFIG_DEBUG_CREDENTIALS
6632+ atomic_set(&cred->subscribers, n);
6633+#endif
6634+}
6635+
6636+static inline int read_cred_subscribers(const struct cred *cred)
6637+{
6638+#ifdef CONFIG_DEBUG_CREDENTIALS
6639+ return atomic_read(&cred->subscribers);
6640+#else
6641+ return 0;
6642+#endif
6643+}
6644+
6645+static inline void alter_cred_subscribers(const struct cred *_cred, int n)
6646+{
6647+#ifdef CONFIG_DEBUG_CREDENTIALS
6648+ struct cred *cred = (struct cred *) _cred;
6649+
6650+ atomic_add(n, &cred->subscribers);
6651+#endif
6652+}
6653+
6654 /**
6655 * get_new_cred - Get a reference on a new set of credentials
6656 * @cred: The new credentials to reference
6657diff -NurpP --minimal linux-4.4.116/include/linux/dcache.h linux-4.4.116-vs2.3.9.7/include/linux/dcache.h
6658--- linux-4.4.116/include/linux/dcache.h 2018-02-22 21:19:57.000000000 +0000
6659+++ linux-4.4.116-vs2.3.9.7/include/linux/dcache.h 2018-01-09 16:36:32.000000000 +0000
6660@@ -10,6 +10,7 @@
6661 #include <linux/cache.h>
6662 #include <linux/rcupdate.h>
6663 #include <linux/lockref.h>
6664+// #include <linux/vs_limit.h>
6665
6666 struct path;
6667 struct vfsmount;
6668@@ -351,8 +352,10 @@ extern char *dentry_path(struct dentry *
6669 */
6670 static inline struct dentry *dget_dlock(struct dentry *dentry)
6671 {
6672- if (dentry)
6673+ if (dentry) {
6674 dentry->d_lockref.count++;
6675+ // vx_dentry_inc(dentry);
6676+ }
6677 return dentry;
6678 }
6679
6680diff -NurpP --minimal linux-4.4.116/include/linux/devpts_fs.h linux-4.4.116-vs2.3.9.7/include/linux/devpts_fs.h
6681--- linux-4.4.116/include/linux/devpts_fs.h 2018-02-22 21:19:57.000000000 +0000
6682+++ linux-4.4.116-vs2.3.9.7/include/linux/devpts_fs.h 2018-01-09 16:36:32.000000000 +0000
6683@@ -35,5 +35,4 @@ void devpts_pty_kill(struct inode *inode
6684
6685 #endif
6686
6687-
6688 #endif /* _LINUX_DEVPTS_FS_H */
6689diff -NurpP --minimal linux-4.4.116/include/linux/fs.h linux-4.4.116-vs2.3.9.7/include/linux/fs.h
6690--- linux-4.4.116/include/linux/fs.h 2018-02-22 21:19:57.000000000 +0000
6691+++ linux-4.4.116-vs2.3.9.7/include/linux/fs.h 2018-02-22 21:30:19.000000000 +0000
6692@@ -227,6 +227,7 @@ typedef void (dax_iodone_t)(struct buffe
6693 #define ATTR_OPEN (1 << 15) /* Truncating from open(O_TRUNC) */
6694 #define ATTR_TIMES_SET (1 << 16)
6695 #define ATTR_TOUCH (1 << 17)
6696+#define ATTR_TAG (1 << 18)
6697
6698 /*
6699 * Whiteout is represented by a char device. The following constants define the
6700@@ -249,6 +250,7 @@ struct iattr {
6701 umode_t ia_mode;
6702 kuid_t ia_uid;
6703 kgid_t ia_gid;
6704+ ktag_t ia_tag;
6705 loff_t ia_size;
6706 struct timespec ia_atime;
6707 struct timespec ia_mtime;
6708@@ -587,7 +589,9 @@ struct inode {
6709 unsigned short i_opflags;
6710 kuid_t i_uid;
6711 kgid_t i_gid;
6712- unsigned int i_flags;
6713+ ktag_t i_tag;
6714+ unsigned short i_flags;
6715+ unsigned short i_vflags;
6716
6717 #ifdef CONFIG_FS_POSIX_ACL
6718 struct posix_acl *i_acl;
6719@@ -616,6 +620,7 @@ struct inode {
6720 unsigned int __i_nlink;
6721 };
6722 dev_t i_rdev;
6723+ dev_t i_mdev;
6724 loff_t i_size;
6725 struct timespec i_atime;
6726 struct timespec i_mtime;
6727@@ -814,6 +819,11 @@ static inline gid_t i_gid_read(const str
6728 return from_kgid(&init_user_ns, inode->i_gid);
6729 }
6730
6731+static inline vtag_t i_tag_read(const struct inode *inode)
6732+{
6733+ return from_ktag(&init_user_ns, inode->i_tag);
6734+}
6735+
6736 static inline void i_uid_write(struct inode *inode, uid_t uid)
6737 {
6738 inode->i_uid = make_kuid(&init_user_ns, uid);
6739@@ -824,14 +834,19 @@ static inline void i_gid_write(struct in
6740 inode->i_gid = make_kgid(&init_user_ns, gid);
6741 }
6742
6743+static inline void i_tag_write(struct inode *inode, vtag_t tag)
6744+{
6745+ inode->i_tag = make_ktag(&init_user_ns, tag);
6746+}
6747+
6748 static inline unsigned iminor(const struct inode *inode)
6749 {
6750- return MINOR(inode->i_rdev);
6751+ return MINOR(inode->i_mdev);
6752 }
6753
6754 static inline unsigned imajor(const struct inode *inode)
6755 {
6756- return MAJOR(inode->i_rdev);
6757+ return MAJOR(inode->i_mdev);
6758 }
6759
6760 extern struct block_device *I_BDEV(struct inode *inode);
6761@@ -888,6 +903,7 @@ struct file {
6762 loff_t f_pos;
6763 struct fown_struct f_owner;
6764 const struct cred *f_cred;
6765+ vxid_t f_xid;
6766 struct file_ra_state f_ra;
6767
6768 u64 f_version;
6769@@ -1022,6 +1038,7 @@ struct file_lock {
6770 struct file *fl_file;
6771 loff_t fl_start;
6772 loff_t fl_end;
6773+ vxid_t fl_xid;
6774
6775 struct fasync_struct * fl_fasync; /* for lease break notifications */
6776 /* for lease breaks: */
6777@@ -1698,6 +1715,7 @@ struct inode_operations {
6778 ssize_t (*getxattr) (struct dentry *, const char *, void *, size_t);
6779 ssize_t (*listxattr) (struct dentry *, char *, size_t);
6780 int (*removexattr) (struct dentry *, const char *);
6781+ int (*sync_flags) (struct inode *, int, int);
6782 int (*fiemap)(struct inode *, struct fiemap_extent_info *, u64 start,
6783 u64 len);
6784 int (*update_time)(struct inode *, struct timespec *, int);
6785@@ -1712,6 +1730,7 @@ ssize_t rw_copy_check_uvector(int type,
6786 unsigned long nr_segs, unsigned long fast_segs,
6787 struct iovec *fast_pointer,
6788 struct iovec **ret_pointer);
6789+ssize_t vfs_sendfile(struct file *, struct file *, loff_t *, size_t, loff_t);
6790
6791 extern ssize_t __vfs_read(struct file *, char __user *, size_t, loff_t *);
6792 extern ssize_t __vfs_write(struct file *, const char __user *, size_t, loff_t *);
6793@@ -1777,6 +1796,14 @@ struct super_operations {
6794 #else
6795 #define S_DAX 0 /* Make all the DAX code disappear */
6796 #endif
6797+#define S_IXUNLINK 16384 /* Immutable Invert on unlink */
6798+
6799+/* Linux-VServer related Inode flags */
6800+
6801+#define V_VALID 1
6802+#define V_XATTR 2
6803+#define V_BARRIER 4 /* Barrier for chroot() */
6804+#define V_COW 8 /* Copy on Write */
6805
6806 /*
6807 * Note that nosuid etc flags are inode-specific: setting some file-system
6808@@ -1801,10 +1828,13 @@ struct super_operations {
6809 #define IS_MANDLOCK(inode) __IS_FLG(inode, MS_MANDLOCK)
6810 #define IS_NOATIME(inode) __IS_FLG(inode, MS_RDONLY|MS_NOATIME)
6811 #define IS_I_VERSION(inode) __IS_FLG(inode, MS_I_VERSION)
6812+#define IS_TAGGED(inode) __IS_FLG(inode, MS_TAGGED)
6813
6814 #define IS_NOQUOTA(inode) ((inode)->i_flags & S_NOQUOTA)
6815 #define IS_APPEND(inode) ((inode)->i_flags & S_APPEND)
6816 #define IS_IMMUTABLE(inode) ((inode)->i_flags & S_IMMUTABLE)
6817+#define IS_IXUNLINK(inode) ((inode)->i_flags & S_IXUNLINK)
6818+#define IS_IXORUNLINK(inode) ((IS_IXUNLINK(inode) ? S_IMMUTABLE : 0) ^ IS_IMMUTABLE(inode))
6819 #define IS_POSIXACL(inode) __IS_FLG(inode, MS_POSIXACL)
6820
6821 #define IS_DEADDIR(inode) ((inode)->i_flags & S_DEAD)
6822@@ -1819,6 +1849,16 @@ struct super_operations {
6823 #define IS_WHITEOUT(inode) (S_ISCHR(inode->i_mode) && \
6824 (inode)->i_rdev == WHITEOUT_DEV)
6825
6826+#define IS_BARRIER(inode) (S_ISDIR((inode)->i_mode) && ((inode)->i_vflags & V_BARRIER))
6827+
6828+#ifdef CONFIG_VSERVER_COWBL
6829+# define IS_COW(inode) (IS_IXUNLINK(inode) && IS_IMMUTABLE(inode))
6830+# define IS_COW_LINK(inode) (S_ISREG((inode)->i_mode) && ((inode)->i_nlink > 1))
6831+#else
6832+# define IS_COW(inode) (0)
6833+# define IS_COW_LINK(inode) (0)
6834+#endif
6835+
6836 /*
6837 * Inode state bits. Protected by inode->i_lock
6838 *
6839@@ -2075,6 +2115,9 @@ extern struct kobject *fs_kobj;
6840 extern int locks_mandatory_locked(struct file *);
6841 extern int locks_mandatory_area(int, struct inode *, struct file *, loff_t, size_t);
6842
6843+#define ATTR_FLAG_BARRIER 512 /* Barrier for chroot() */
6844+#define ATTR_FLAG_IXUNLINK 1024 /* Immutable invert on unlink */
6845+
6846 /*
6847 * Candidates for mandatory locking have the setgid bit set
6848 * but no group execute bit - an otherwise meaningless combination.
6849@@ -2830,6 +2873,7 @@ extern int dcache_dir_open(struct inode
6850 extern int dcache_dir_close(struct inode *, struct file *);
6851 extern loff_t dcache_dir_lseek(struct file *, loff_t, int);
6852 extern int dcache_readdir(struct file *, struct dir_context *);
6853+extern int dcache_readdir_filter(struct file *, struct dir_context *, int (*)(struct dentry *));
6854 extern int simple_setattr(struct dentry *, struct iattr *);
6855 extern int simple_getattr(struct vfsmount *, struct dentry *, struct kstat *);
6856 extern int simple_statfs(struct dentry *, struct kstatfs *);
6857diff -NurpP --minimal linux-4.4.116/include/linux/init_task.h linux-4.4.116-vs2.3.9.7/include/linux/init_task.h
6858--- linux-4.4.116/include/linux/init_task.h 2016-07-05 04:15:10.000000000 +0000
6859+++ linux-4.4.116-vs2.3.9.7/include/linux/init_task.h 2018-01-09 16:36:32.000000000 +0000
6860@@ -260,6 +260,10 @@ extern struct task_group root_task_group
6861 INIT_VTIME(tsk) \
6862 INIT_NUMA_BALANCING(tsk) \
6863 INIT_KASAN(tsk) \
6864+ .xid = 0, \
6865+ .vx_info = NULL, \
6866+ .nid = 0, \
6867+ .nx_info = NULL, \
6868 }
6869
6870
6871diff -NurpP --minimal linux-4.4.116/include/linux/ipc.h linux-4.4.116-vs2.3.9.7/include/linux/ipc.h
6872--- linux-4.4.116/include/linux/ipc.h 2015-04-12 22:12:50.000000000 +0000
6873+++ linux-4.4.116-vs2.3.9.7/include/linux/ipc.h 2018-01-09 16:36:32.000000000 +0000
6874@@ -16,6 +16,7 @@ struct kern_ipc_perm
6875 key_t key;
6876 kuid_t uid;
6877 kgid_t gid;
6878+ vxid_t xid;
6879 kuid_t cuid;
6880 kgid_t cgid;
6881 umode_t mode;
6882diff -NurpP --minimal linux-4.4.116/include/linux/memcontrol.h linux-4.4.116-vs2.3.9.7/include/linux/memcontrol.h
6883--- linux-4.4.116/include/linux/memcontrol.h 2018-02-22 21:19:57.000000000 +0000
6884+++ linux-4.4.116-vs2.3.9.7/include/linux/memcontrol.h 2018-01-24 22:44:17.000000000 +0000
6885@@ -113,6 +113,7 @@ struct cg_proto {
6886 struct mem_cgroup *memcg;
6887 };
6888
6889+
6890 #ifdef CONFIG_MEMCG
6891 struct mem_cgroup_stat_cpu {
6892 long count[MEM_CGROUP_STAT_NSTATS];
6893@@ -338,6 +339,12 @@ static inline bool mem_cgroup_is_descend
6894 return cgroup_is_descendant(memcg->css.cgroup, root->css.cgroup);
6895 }
6896
6897+extern unsigned long mem_cgroup_mem_usage_pages(struct mem_cgroup *memcg);
6898+extern unsigned long mem_cgroup_mem_limit_pages(struct mem_cgroup *memcg);
6899+extern unsigned long mem_cgroup_memsw_usage_pages(struct mem_cgroup *memcg);
6900+extern unsigned long mem_cgroup_memsw_limit_pages(struct mem_cgroup *memcg);
6901+extern void dump_mem_cgroup(struct mem_cgroup *memcg);
6902+
6903 static inline bool mm_match_cgroup(struct mm_struct *mm,
6904 struct mem_cgroup *memcg)
6905 {
6906diff -NurpP --minimal linux-4.4.116/include/linux/mount.h linux-4.4.116-vs2.3.9.7/include/linux/mount.h
6907--- linux-4.4.116/include/linux/mount.h 2018-02-22 21:19:57.000000000 +0000
6908+++ linux-4.4.116-vs2.3.9.7/include/linux/mount.h 2018-01-09 16:36:32.000000000 +0000
6909@@ -63,6 +63,9 @@ struct mnt_namespace;
6910 #define MNT_MARKED 0x4000000
6911 #define MNT_UMOUNT 0x8000000
6912
6913+#define MNT_TAGID 0x10000
6914+#define MNT_NOTAG 0x20000
6915+
6916 struct vfsmount {
6917 struct dentry *mnt_root; /* root of the mounted tree */
6918 struct super_block *mnt_sb; /* pointer to superblock */
6919diff -NurpP --minimal linux-4.4.116/include/linux/net.h linux-4.4.116-vs2.3.9.7/include/linux/net.h
6920--- linux-4.4.116/include/linux/net.h 2018-02-22 21:19:57.000000000 +0000
6921+++ linux-4.4.116-vs2.3.9.7/include/linux/net.h 2018-01-09 16:42:30.000000000 +0000
6922@@ -43,6 +43,7 @@ struct net;
6923 #define SOCK_NOSPACE 2
6924 #define SOCK_PASSCRED 3
6925 #define SOCK_PASSSEC 4
6926+#define SOCK_USER_SOCKET 5
6927
6928 #ifndef ARCH_HAS_SOCKET_TYPES
6929 /**
6930diff -NurpP --minimal linux-4.4.116/include/linux/netdevice.h linux-4.4.116-vs2.3.9.7/include/linux/netdevice.h
6931--- linux-4.4.116/include/linux/netdevice.h 2018-02-22 21:19:57.000000000 +0000
6932+++ linux-4.4.116-vs2.3.9.7/include/linux/netdevice.h 2018-01-09 16:36:32.000000000 +0000
6933@@ -2296,6 +2296,7 @@ static inline int dev_recursion_level(vo
6934
6935 struct net_device *dev_get_by_index(struct net *net, int ifindex);
6936 struct net_device *__dev_get_by_index(struct net *net, int ifindex);
6937+struct net_device *dev_get_by_index_real_rcu(struct net *net, int ifindex);
6938 struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex);
6939 int netdev_get_name(struct net *net, char *name, int ifindex);
6940 int dev_restart(struct net_device *dev);
6941diff -NurpP --minimal linux-4.4.116/include/linux/nsproxy.h linux-4.4.116-vs2.3.9.7/include/linux/nsproxy.h
6942--- linux-4.4.116/include/linux/nsproxy.h 2015-04-12 22:12:50.000000000 +0000
6943+++ linux-4.4.116-vs2.3.9.7/include/linux/nsproxy.h 2018-01-09 16:36:32.000000000 +0000
6944@@ -3,6 +3,7 @@
6945
6946 #include <linux/spinlock.h>
6947 #include <linux/sched.h>
6948+#include <linux/vserver/debug.h>
6949
6950 struct mnt_namespace;
6951 struct uts_namespace;
6952@@ -63,6 +64,7 @@ extern struct nsproxy init_nsproxy;
6953 */
6954
6955 int copy_namespaces(unsigned long flags, struct task_struct *tsk);
6956+struct nsproxy *copy_nsproxy(struct nsproxy *orig);
6957 void exit_task_namespaces(struct task_struct *tsk);
6958 void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new);
6959 void free_nsproxy(struct nsproxy *ns);
6960@@ -70,16 +72,26 @@ int unshare_nsproxy_namespaces(unsigned
6961 struct cred *, struct fs_struct *);
6962 int __init nsproxy_cache_init(void);
6963
6964-static inline void put_nsproxy(struct nsproxy *ns)
6965+#define get_nsproxy(n) __get_nsproxy(n, __FILE__, __LINE__)
6966+
6967+static inline void __get_nsproxy(struct nsproxy *ns,
6968+ const char *_file, int _line)
6969 {
6970- if (atomic_dec_and_test(&ns->count)) {
6971- free_nsproxy(ns);
6972- }
6973+ vxlprintk(VXD_CBIT(space, 0), "get_nsproxy(%p[%u])",
6974+ ns, atomic_read(&ns->count), _file, _line);
6975+ atomic_inc(&ns->count);
6976 }
6977
6978-static inline void get_nsproxy(struct nsproxy *ns)
6979+#define put_nsproxy(n) __put_nsproxy(n, __FILE__, __LINE__)
6980+
6981+static inline void __put_nsproxy(struct nsproxy *ns,
6982+ const char *_file, int _line)
6983 {
6984- atomic_inc(&ns->count);
6985+ vxlprintk(VXD_CBIT(space, 0), "put_nsproxy(%p[%u])",
6986+ ns, atomic_read(&ns->count), _file, _line);
6987+ if (atomic_dec_and_test(&ns->count)) {
6988+ free_nsproxy(ns);
6989+ }
6990 }
6991
6992 #endif
6993diff -NurpP --minimal linux-4.4.116/include/linux/pid.h linux-4.4.116-vs2.3.9.7/include/linux/pid.h
6994--- linux-4.4.116/include/linux/pid.h 2018-02-22 21:19:57.000000000 +0000
6995+++ linux-4.4.116-vs2.3.9.7/include/linux/pid.h 2018-01-09 16:45:21.000000000 +0000
6996@@ -10,7 +10,8 @@ enum pid_type
6997 PIDTYPE_SID,
6998 PIDTYPE_MAX,
6999 /* only valid to __task_pid_nr_ns() */
7000- __PIDTYPE_TGID
7001+ __PIDTYPE_TGID,
7002+ __PIDTYPE_REALPID
7003 };
7004
7005 /*
7006@@ -172,6 +173,7 @@ static inline pid_t pid_nr(struct pid *p
7007 }
7008
7009 pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns);
7010+pid_t pid_unmapped_nr_ns(struct pid *pid, struct pid_namespace *ns);
7011 pid_t pid_vnr(struct pid *pid);
7012
7013 #define do_each_pid_task(pid, type, task) \
7014diff -NurpP --minimal linux-4.4.116/include/linux/quotaops.h linux-4.4.116-vs2.3.9.7/include/linux/quotaops.h
7015--- linux-4.4.116/include/linux/quotaops.h 2016-07-05 04:12:37.000000000 +0000
7016+++ linux-4.4.116-vs2.3.9.7/include/linux/quotaops.h 2018-01-09 16:36:32.000000000 +0000
7017@@ -8,6 +8,7 @@
7018 #define _LINUX_QUOTAOPS_
7019
7020 #include <linux/fs.h>
7021+#include <linux/vs_dlimit.h>
7022
7023 #define DQUOT_SPACE_WARN 0x1
7024 #define DQUOT_SPACE_RESERVE 0x2
7025@@ -211,11 +212,12 @@ static inline void dquot_drop(struct ino
7026
7027 static inline int dquot_alloc_inode(struct inode *inode)
7028 {
7029- return 0;
7030+ return dl_alloc_inode(inode);
7031 }
7032
7033 static inline void dquot_free_inode(struct inode *inode)
7034 {
7035+ dl_free_inode(inode);
7036 }
7037
7038 static inline int dquot_transfer(struct inode *inode, struct iattr *iattr)
7039@@ -226,6 +228,10 @@ static inline int dquot_transfer(struct
7040 static inline int __dquot_alloc_space(struct inode *inode, qsize_t number,
7041 int flags)
7042 {
7043+ int ret = 0;
7044+
7045+ if ((ret = dl_alloc_space(inode, number)))
7046+ return ret;
7047 if (!(flags & DQUOT_SPACE_RESERVE))
7048 inode_add_bytes(inode, number);
7049 return 0;
7050@@ -236,6 +242,7 @@ static inline void __dquot_free_space(st
7051 {
7052 if (!(flags & DQUOT_SPACE_RESERVE))
7053 inode_sub_bytes(inode, number);
7054+ dl_free_space(inode, number);
7055 }
7056
7057 static inline int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
7058diff -NurpP --minimal linux-4.4.116/include/linux/sched.h linux-4.4.116-vs2.3.9.7/include/linux/sched.h
7059--- linux-4.4.116/include/linux/sched.h 2018-02-22 21:19:57.000000000 +0000
7060+++ linux-4.4.116-vs2.3.9.7/include/linux/sched.h 2018-02-10 15:16:50.000000000 +0000
7061@@ -1601,6 +1601,14 @@ struct task_struct {
7062 #endif
7063 struct seccomp seccomp;
7064
7065+/* vserver context data */
7066+ struct vx_info *vx_info;
7067+ struct nx_info *nx_info;
7068+
7069+ vxid_t xid;
7070+ vnid_t nid;
7071+ vtag_t tag;
7072+
7073 /* Thread group tracking */
7074 u32 parent_exec_id;
7075 u32 self_exec_id;
7076@@ -1928,6 +1936,11 @@ struct pid_namespace;
7077 pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
7078 struct pid_namespace *ns);
7079
7080+#include <linux/vserver/base.h>
7081+#include <linux/vserver/context.h>
7082+#include <linux/vserver/debug.h>
7083+#include <linux/vserver/pid.h>
7084+
7085 static inline pid_t task_pid_nr(struct task_struct *tsk)
7086 {
7087 return tsk->pid;
7088@@ -1941,7 +1954,8 @@ static inline pid_t task_pid_nr_ns(struc
7089
7090 static inline pid_t task_pid_vnr(struct task_struct *tsk)
7091 {
7092- return __task_pid_nr_ns(tsk, PIDTYPE_PID, NULL);
7093+ // return __task_pid_nr_ns(tsk, PIDTYPE_PID, NULL);
7094+ return vx_map_pid(__task_pid_nr_ns(tsk, PIDTYPE_PID, NULL));
7095 }
7096
7097
7098diff -NurpP --minimal linux-4.4.116/include/linux/shmem_fs.h linux-4.4.116-vs2.3.9.7/include/linux/shmem_fs.h
7099--- linux-4.4.116/include/linux/shmem_fs.h 2018-02-22 21:19:57.000000000 +0000
7100+++ linux-4.4.116-vs2.3.9.7/include/linux/shmem_fs.h 2018-01-09 16:36:32.000000000 +0000
7101@@ -10,6 +10,9 @@
7102
7103 /* inode in-kernel data */
7104
7105+#define TMPFS_SUPER_MAGIC 0x01021994
7106+
7107+
7108 struct shmem_inode_info {
7109 spinlock_t lock;
7110 unsigned int seals; /* shmem seals */
7111diff -NurpP --minimal linux-4.4.116/include/linux/stat.h linux-4.4.116-vs2.3.9.7/include/linux/stat.h
7112--- linux-4.4.116/include/linux/stat.h 2015-04-12 22:12:50.000000000 +0000
7113+++ linux-4.4.116-vs2.3.9.7/include/linux/stat.h 2018-01-09 16:36:32.000000000 +0000
7114@@ -25,6 +25,7 @@ struct kstat {
7115 unsigned int nlink;
7116 kuid_t uid;
7117 kgid_t gid;
7118+ ktag_t tag;
7119 dev_t rdev;
7120 loff_t size;
7121 struct timespec atime;
7122diff -NurpP --minimal linux-4.4.116/include/linux/sunrpc/auth.h linux-4.4.116-vs2.3.9.7/include/linux/sunrpc/auth.h
7123--- linux-4.4.116/include/linux/sunrpc/auth.h 2016-07-05 04:12:37.000000000 +0000
7124+++ linux-4.4.116-vs2.3.9.7/include/linux/sunrpc/auth.h 2018-01-09 16:36:32.000000000 +0000
7125@@ -40,6 +40,7 @@ enum {
7126 struct auth_cred {
7127 kuid_t uid;
7128 kgid_t gid;
7129+ ktag_t tag;
7130 struct group_info *group_info;
7131 const char *principal;
7132 unsigned long ac_flags;
7133diff -NurpP --minimal linux-4.4.116/include/linux/sunrpc/clnt.h linux-4.4.116-vs2.3.9.7/include/linux/sunrpc/clnt.h
7134--- linux-4.4.116/include/linux/sunrpc/clnt.h 2018-02-22 21:19:58.000000000 +0000
7135+++ linux-4.4.116-vs2.3.9.7/include/linux/sunrpc/clnt.h 2018-01-09 16:36:32.000000000 +0000
7136@@ -51,7 +51,8 @@ struct rpc_clnt {
7137 cl_discrtry : 1,/* disconnect before retry */
7138 cl_noretranstimeo: 1,/* No retransmit timeouts */
7139 cl_autobind : 1,/* use getport() */
7140- cl_chatty : 1;/* be verbose */
7141+ cl_chatty : 1,/* be verbose */
7142+ cl_tag : 1;/* context tagging */
7143
7144 struct rpc_rtt * cl_rtt; /* RTO estimator data */
7145 const struct rpc_timeout *cl_timeout; /* Timeout strategy */
7146diff -NurpP --minimal linux-4.4.116/include/linux/types.h linux-4.4.116-vs2.3.9.7/include/linux/types.h
7147--- linux-4.4.116/include/linux/types.h 2016-07-05 04:15:11.000000000 +0000
7148+++ linux-4.4.116-vs2.3.9.7/include/linux/types.h 2018-01-09 16:36:32.000000000 +0000
7149@@ -32,6 +32,9 @@ typedef __kernel_uid32_t uid_t;
7150 typedef __kernel_gid32_t gid_t;
7151 typedef __kernel_uid16_t uid16_t;
7152 typedef __kernel_gid16_t gid16_t;
7153+typedef unsigned int vxid_t;
7154+typedef unsigned int vnid_t;
7155+typedef unsigned int vtag_t;
7156
7157 typedef unsigned long uintptr_t;
7158
7159diff -NurpP --minimal linux-4.4.116/include/linux/uidgid.h linux-4.4.116-vs2.3.9.7/include/linux/uidgid.h
7160--- linux-4.4.116/include/linux/uidgid.h 2015-07-06 20:41:43.000000000 +0000
7161+++ linux-4.4.116-vs2.3.9.7/include/linux/uidgid.h 2018-01-09 16:36:32.000000000 +0000
7162@@ -21,13 +21,17 @@ typedef struct {
7163 uid_t val;
7164 } kuid_t;
7165
7166-
7167 typedef struct {
7168 gid_t val;
7169 } kgid_t;
7170
7171+typedef struct {
7172+ vtag_t val;
7173+} ktag_t;
7174+
7175 #define KUIDT_INIT(value) (kuid_t){ value }
7176 #define KGIDT_INIT(value) (kgid_t){ value }
7177+#define KTAGT_INIT(value) (ktag_t){ value }
7178
7179 #ifdef CONFIG_MULTIUSER
7180 static inline uid_t __kuid_val(kuid_t uid)
7181@@ -51,11 +55,18 @@ static inline gid_t __kgid_val(kgid_t gi
7182 }
7183 #endif
7184
7185+static inline vtag_t __ktag_val(ktag_t tag)
7186+{
7187+ return tag.val;
7188+}
7189+
7190 #define GLOBAL_ROOT_UID KUIDT_INIT(0)
7191 #define GLOBAL_ROOT_GID KGIDT_INIT(0)
7192+#define GLOBAL_ROOT_TAG KTAGT_INIT(0)
7193
7194 #define INVALID_UID KUIDT_INIT(-1)
7195 #define INVALID_GID KGIDT_INIT(-1)
7196+#define INVALID_TAG KTAGT_INIT(-1)
7197
7198 static inline bool uid_eq(kuid_t left, kuid_t right)
7199 {
7200@@ -67,6 +78,11 @@ static inline bool gid_eq(kgid_t left, k
7201 return __kgid_val(left) == __kgid_val(right);
7202 }
7203
7204+static inline bool tag_eq(ktag_t left, ktag_t right)
7205+{
7206+ return __ktag_val(left) == __ktag_val(right);
7207+}
7208+
7209 static inline bool uid_gt(kuid_t left, kuid_t right)
7210 {
7211 return __kuid_val(left) > __kuid_val(right);
7212@@ -117,13 +133,21 @@ static inline bool gid_valid(kgid_t gid)
7213 return __kgid_val(gid) != (gid_t) -1;
7214 }
7215
7216+static inline bool tag_valid(ktag_t tag)
7217+{
7218+ return !tag_eq(tag, INVALID_TAG);
7219+}
7220+
7221 #ifdef CONFIG_USER_NS
7222
7223 extern kuid_t make_kuid(struct user_namespace *from, uid_t uid);
7224 extern kgid_t make_kgid(struct user_namespace *from, gid_t gid);
7225+extern ktag_t make_ktag(struct user_namespace *from, gid_t gid);
7226
7227 extern uid_t from_kuid(struct user_namespace *to, kuid_t uid);
7228 extern gid_t from_kgid(struct user_namespace *to, kgid_t gid);
7229+extern vtag_t from_ktag(struct user_namespace *to, ktag_t tag);
7230+
7231 extern uid_t from_kuid_munged(struct user_namespace *to, kuid_t uid);
7232 extern gid_t from_kgid_munged(struct user_namespace *to, kgid_t gid);
7233
7234@@ -149,6 +173,11 @@ static inline kgid_t make_kgid(struct us
7235 return KGIDT_INIT(gid);
7236 }
7237
7238+static inline ktag_t make_ktag(struct user_namespace *from, vtag_t tag)
7239+{
7240+ return KTAGT_INIT(tag);
7241+}
7242+
7243 static inline uid_t from_kuid(struct user_namespace *to, kuid_t kuid)
7244 {
7245 return __kuid_val(kuid);
7246@@ -159,6 +188,11 @@ static inline gid_t from_kgid(struct use
7247 return __kgid_val(kgid);
7248 }
7249
7250+static inline vtag_t from_ktag(struct user_namespace *to, ktag_t ktag)
7251+{
7252+ return __ktag_val(ktag);
7253+}
7254+
7255 static inline uid_t from_kuid_munged(struct user_namespace *to, kuid_t kuid)
7256 {
7257 uid_t uid = from_kuid(to, kuid);
7258diff -NurpP --minimal linux-4.4.116/include/linux/vroot.h linux-4.4.116-vs2.3.9.7/include/linux/vroot.h
7259--- linux-4.4.116/include/linux/vroot.h 1970-01-01 00:00:00.000000000 +0000
7260+++ linux-4.4.116-vs2.3.9.7/include/linux/vroot.h 2018-01-09 16:36:32.000000000 +0000
7261@@ -0,0 +1,51 @@
7262+
7263+/*
7264+ * include/linux/vroot.h
7265+ *
7266+ * written by Herbert P?tzl, 9/11/2002
7267+ * ported to 2.6 by Herbert P?tzl, 30/12/2004
7268+ *
7269+ * Copyright (C) 2002-2007 by Herbert P?tzl.
7270+ * Redistribution of this file is permitted under the
7271+ * GNU General Public License.
7272+ */
7273+
7274+#ifndef _LINUX_VROOT_H
7275+#define _LINUX_VROOT_H
7276+
7277+
7278+#ifdef __KERNEL__
7279+
7280+/* Possible states of device */
7281+enum {
7282+ Vr_unbound,
7283+ Vr_bound,
7284+};
7285+
7286+struct vroot_device {
7287+ int vr_number;
7288+ int vr_refcnt;
7289+
7290+ struct semaphore vr_ctl_mutex;
7291+ struct block_device *vr_device;
7292+ int vr_state;
7293+};
7294+
7295+
7296+typedef struct block_device *(vroot_grb_func)(struct block_device *);
7297+
7298+extern int register_vroot_grb(vroot_grb_func *);
7299+extern int unregister_vroot_grb(vroot_grb_func *);
7300+
7301+#endif /* __KERNEL__ */
7302+
7303+#define MAX_VROOT_DEFAULT 8
7304+
7305+/*
7306+ * IOCTL commands --- we will commandeer 0x56 ('V')
7307+ */
7308+
7309+#define VROOT_SET_DEV 0x5600
7310+#define VROOT_CLR_DEV 0x5601
7311+
7312+#endif /* _LINUX_VROOT_H */
7313diff -NurpP --minimal linux-4.4.116/include/linux/vs_base.h linux-4.4.116-vs2.3.9.7/include/linux/vs_base.h
7314--- linux-4.4.116/include/linux/vs_base.h 1970-01-01 00:00:00.000000000 +0000
7315+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_base.h 2018-01-09 16:36:32.000000000 +0000
7316@@ -0,0 +1,10 @@
7317+#ifndef _VS_BASE_H
7318+#define _VS_BASE_H
7319+
7320+#include "vserver/base.h"
7321+#include "vserver/check.h"
7322+#include "vserver/debug.h"
7323+
7324+#else
7325+#warning duplicate inclusion
7326+#endif
7327diff -NurpP --minimal linux-4.4.116/include/linux/vs_context.h linux-4.4.116-vs2.3.9.7/include/linux/vs_context.h
7328--- linux-4.4.116/include/linux/vs_context.h 1970-01-01 00:00:00.000000000 +0000
7329+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_context.h 2018-01-09 16:36:32.000000000 +0000
7330@@ -0,0 +1,242 @@
7331+#ifndef _VS_CONTEXT_H
7332+#define _VS_CONTEXT_H
7333+
7334+#include "vserver/base.h"
7335+#include "vserver/check.h"
7336+#include "vserver/context.h"
7337+#include "vserver/history.h"
7338+#include "vserver/debug.h"
7339+
7340+#include <linux/sched.h>
7341+
7342+
7343+#define get_vx_info(i) __get_vx_info(i, __FILE__, __LINE__, __HERE__)
7344+
7345+static inline struct vx_info *__get_vx_info(struct vx_info *vxi,
7346+ const char *_file, int _line, void *_here)
7347+{
7348+ if (!vxi)
7349+ return NULL;
7350+
7351+ vxlprintk(VXD_CBIT(xid, 2), "get_vx_info(%p[#%d.%d])",
7352+ vxi, vxi ? vxi->vx_id : 0,
7353+ vxi ? atomic_read(&vxi->vx_usecnt) : 0,
7354+ _file, _line);
7355+ __vxh_get_vx_info(vxi, _here);
7356+
7357+ atomic_inc(&vxi->vx_usecnt);
7358+ return vxi;
7359+}
7360+
7361+
7362+extern void free_vx_info(struct vx_info *);
7363+
7364+#define put_vx_info(i) __put_vx_info(i, __FILE__, __LINE__, __HERE__)
7365+
7366+static inline void __put_vx_info(struct vx_info *vxi,
7367+ const char *_file, int _line, void *_here)
7368+{
7369+ if (!vxi)
7370+ return;
7371+
7372+ vxlprintk(VXD_CBIT(xid, 2), "put_vx_info(%p[#%d.%d])",
7373+ vxi, vxi ? vxi->vx_id : 0,
7374+ vxi ? atomic_read(&vxi->vx_usecnt) : 0,
7375+ _file, _line);
7376+ __vxh_put_vx_info(vxi, _here);
7377+
7378+ if (atomic_dec_and_test(&vxi->vx_usecnt))
7379+ free_vx_info(vxi);
7380+}
7381+
7382+
7383+#define init_vx_info(p, i) \
7384+ __init_vx_info(p, i, __FILE__, __LINE__, __HERE__)
7385+
7386+static inline void __init_vx_info(struct vx_info **vxp, struct vx_info *vxi,
7387+ const char *_file, int _line, void *_here)
7388+{
7389+ if (vxi) {
7390+ vxlprintk(VXD_CBIT(xid, 3),
7391+ "init_vx_info(%p[#%d.%d])",
7392+ vxi, vxi ? vxi->vx_id : 0,
7393+ vxi ? atomic_read(&vxi->vx_usecnt) : 0,
7394+ _file, _line);
7395+ __vxh_init_vx_info(vxi, vxp, _here);
7396+
7397+ atomic_inc(&vxi->vx_usecnt);
7398+ }
7399+ *vxp = vxi;
7400+}
7401+
7402+
7403+#define set_vx_info(p, i) \
7404+ __set_vx_info(p, i, __FILE__, __LINE__, __HERE__)
7405+
7406+static inline void __set_vx_info(struct vx_info **vxp, struct vx_info *vxi,
7407+ const char *_file, int _line, void *_here)
7408+{
7409+ struct vx_info *vxo;
7410+
7411+ if (!vxi)
7412+ return;
7413+
7414+ vxlprintk(VXD_CBIT(xid, 3), "set_vx_info(%p[#%d.%d])",
7415+ vxi, vxi ? vxi->vx_id : 0,
7416+ vxi ? atomic_read(&vxi->vx_usecnt) : 0,
7417+ _file, _line);
7418+ __vxh_set_vx_info(vxi, vxp, _here);
7419+
7420+ atomic_inc(&vxi->vx_usecnt);
7421+ vxo = xchg(vxp, vxi);
7422+ BUG_ON(vxo);
7423+}
7424+
7425+
7426+#define clr_vx_info(p) __clr_vx_info(p, __FILE__, __LINE__, __HERE__)
7427+
7428+static inline void __clr_vx_info(struct vx_info **vxp,
7429+ const char *_file, int _line, void *_here)
7430+{
7431+ struct vx_info *vxo;
7432+
7433+ vxo = xchg(vxp, NULL);
7434+ if (!vxo)
7435+ return;
7436+
7437+ vxlprintk(VXD_CBIT(xid, 3), "clr_vx_info(%p[#%d.%d])",
7438+ vxo, vxo ? vxo->vx_id : 0,
7439+ vxo ? atomic_read(&vxo->vx_usecnt) : 0,
7440+ _file, _line);
7441+ __vxh_clr_vx_info(vxo, vxp, _here);
7442+
7443+ if (atomic_dec_and_test(&vxo->vx_usecnt))
7444+ free_vx_info(vxo);
7445+}
7446+
7447+
7448+#define claim_vx_info(v, p) \
7449+ __claim_vx_info(v, p, __FILE__, __LINE__, __HERE__)
7450+
7451+static inline void __claim_vx_info(struct vx_info *vxi,
7452+ struct task_struct *task,
7453+ const char *_file, int _line, void *_here)
7454+{
7455+ vxlprintk(VXD_CBIT(xid, 3), "claim_vx_info(%p[#%d.%d.%d]) %p",
7456+ vxi, vxi ? vxi->vx_id : 0,
7457+ vxi ? atomic_read(&vxi->vx_usecnt) : 0,
7458+ vxi ? atomic_read(&vxi->vx_tasks) : 0,
7459+ task, _file, _line);
7460+ __vxh_claim_vx_info(vxi, task, _here);
7461+
7462+ atomic_inc(&vxi->vx_tasks);
7463+}
7464+
7465+
7466+extern void unhash_vx_info(struct vx_info *);
7467+
7468+#define release_vx_info(v, p) \
7469+ __release_vx_info(v, p, __FILE__, __LINE__, __HERE__)
7470+
7471+static inline void __release_vx_info(struct vx_info *vxi,
7472+ struct task_struct *task,
7473+ const char *_file, int _line, void *_here)
7474+{
7475+ vxlprintk(VXD_CBIT(xid, 3), "release_vx_info(%p[#%d.%d.%d]) %p",
7476+ vxi, vxi ? vxi->vx_id : 0,
7477+ vxi ? atomic_read(&vxi->vx_usecnt) : 0,
7478+ vxi ? atomic_read(&vxi->vx_tasks) : 0,
7479+ task, _file, _line);
7480+ __vxh_release_vx_info(vxi, task, _here);
7481+
7482+ might_sleep();
7483+
7484+ if (atomic_dec_and_test(&vxi->vx_tasks))
7485+ unhash_vx_info(vxi);
7486+}
7487+
7488+
7489+#define task_get_vx_info(p) \
7490+ __task_get_vx_info(p, __FILE__, __LINE__, __HERE__)
7491+
7492+static inline struct vx_info *__task_get_vx_info(struct task_struct *p,
7493+ const char *_file, int _line, void *_here)
7494+{
7495+ struct vx_info *vxi;
7496+
7497+ task_lock(p);
7498+ vxlprintk(VXD_CBIT(xid, 5), "task_get_vx_info(%p)",
7499+ p, _file, _line);
7500+ vxi = __get_vx_info(p->vx_info, _file, _line, _here);
7501+ task_unlock(p);
7502+ return vxi;
7503+}
7504+
7505+
7506+static inline void __wakeup_vx_info(struct vx_info *vxi)
7507+{
7508+ if (waitqueue_active(&vxi->vx_wait))
7509+ wake_up_interruptible(&vxi->vx_wait);
7510+}
7511+
7512+
7513+#define enter_vx_info(v, s) __enter_vx_info(v, s, __FILE__, __LINE__)
7514+
7515+static inline void __enter_vx_info(struct vx_info *vxi,
7516+ struct vx_info_save *vxis, const char *_file, int _line)
7517+{
7518+ vxlprintk(VXD_CBIT(xid, 5), "enter_vx_info(%p[#%d],%p) %p[#%d,%p]",
7519+ vxi, vxi ? vxi->vx_id : 0, vxis, current,
7520+ current->xid, current->vx_info, _file, _line);
7521+ vxis->vxi = xchg(&current->vx_info, vxi);
7522+ vxis->xid = current->xid;
7523+ current->xid = vxi ? vxi->vx_id : 0;
7524+}
7525+
7526+#define leave_vx_info(s) __leave_vx_info(s, __FILE__, __LINE__)
7527+
7528+static inline void __leave_vx_info(struct vx_info_save *vxis,
7529+ const char *_file, int _line)
7530+{
7531+ vxlprintk(VXD_CBIT(xid, 5), "leave_vx_info(%p[#%d,%p]) %p[#%d,%p]",
7532+ vxis, vxis->xid, vxis->vxi, current,
7533+ current->xid, current->vx_info, _file, _line);
7534+ (void)xchg(&current->vx_info, vxis->vxi);
7535+ current->xid = vxis->xid;
7536+}
7537+
7538+
7539+static inline void __enter_vx_admin(struct vx_info_save *vxis)
7540+{
7541+ vxis->vxi = xchg(&current->vx_info, NULL);
7542+ vxis->xid = xchg(&current->xid, (vxid_t)0);
7543+}
7544+
7545+static inline void __leave_vx_admin(struct vx_info_save *vxis)
7546+{
7547+ (void)xchg(&current->xid, vxis->xid);
7548+ (void)xchg(&current->vx_info, vxis->vxi);
7549+}
7550+
7551+#define task_is_init(p) \
7552+ __task_is_init(p, __FILE__, __LINE__, __HERE__)
7553+
7554+static inline int __task_is_init(struct task_struct *p,
7555+ const char *_file, int _line, void *_here)
7556+{
7557+ int is_init = is_global_init(p);
7558+
7559+ task_lock(p);
7560+ if (p->vx_info)
7561+ is_init = p->vx_info->vx_initpid == p->pid;
7562+ task_unlock(p);
7563+ return is_init;
7564+}
7565+
7566+extern void exit_vx_info(struct task_struct *, int);
7567+extern void exit_vx_info_early(struct task_struct *, int);
7568+
7569+
7570+#else
7571+#warning duplicate inclusion
7572+#endif
7573diff -NurpP --minimal linux-4.4.116/include/linux/vs_cowbl.h linux-4.4.116-vs2.3.9.7/include/linux/vs_cowbl.h
7574--- linux-4.4.116/include/linux/vs_cowbl.h 1970-01-01 00:00:00.000000000 +0000
7575+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_cowbl.h 2018-01-09 16:36:32.000000000 +0000
7576@@ -0,0 +1,48 @@
7577+#ifndef _VS_COWBL_H
7578+#define _VS_COWBL_H
7579+
7580+#include <linux/fs.h>
7581+#include <linux/dcache.h>
7582+#include <linux/namei.h>
7583+#include <linux/slab.h>
7584+
7585+extern struct dentry *cow_break_link(const char *pathname);
7586+
7587+static inline int cow_check_and_break(struct path *path)
7588+{
7589+ struct inode *inode = path->dentry->d_inode;
7590+ int error = 0;
7591+
7592+ /* do we need this check? */
7593+ if (IS_RDONLY(inode))
7594+ return -EROFS;
7595+
7596+ if (IS_COW(inode)) {
7597+ if (IS_COW_LINK(inode)) {
7598+ struct dentry *new_dentry, *old_dentry = path->dentry;
7599+ char *pp, *buf;
7600+
7601+ buf = kmalloc(PATH_MAX, GFP_KERNEL);
7602+ if (!buf) {
7603+ return -ENOMEM;
7604+ }
7605+ pp = d_path(path, buf, PATH_MAX);
7606+ new_dentry = cow_break_link(pp);
7607+ kfree(buf);
7608+ if (!IS_ERR(new_dentry)) {
7609+ path->dentry = new_dentry;
7610+ dput(old_dentry);
7611+ } else
7612+ error = PTR_ERR(new_dentry);
7613+ } else {
7614+ inode->i_flags &= ~(S_IXUNLINK | S_IMMUTABLE);
7615+ inode->i_ctime = CURRENT_TIME;
7616+ mark_inode_dirty(inode);
7617+ }
7618+ }
7619+ return error;
7620+}
7621+
7622+#else
7623+#warning duplicate inclusion
7624+#endif
7625diff -NurpP --minimal linux-4.4.116/include/linux/vs_cvirt.h linux-4.4.116-vs2.3.9.7/include/linux/vs_cvirt.h
7626--- linux-4.4.116/include/linux/vs_cvirt.h 1970-01-01 00:00:00.000000000 +0000
7627+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_cvirt.h 2018-01-09 16:36:32.000000000 +0000
7628@@ -0,0 +1,50 @@
7629+#ifndef _VS_CVIRT_H
7630+#define _VS_CVIRT_H
7631+
7632+#include "vserver/cvirt.h"
7633+#include "vserver/context.h"
7634+#include "vserver/base.h"
7635+#include "vserver/check.h"
7636+#include "vserver/debug.h"
7637+
7638+
7639+static inline void vx_activate_task(struct task_struct *p)
7640+{
7641+ struct vx_info *vxi;
7642+
7643+ if ((vxi = p->vx_info)) {
7644+ vx_update_load(vxi);
7645+ atomic_inc(&vxi->cvirt.nr_running);
7646+ }
7647+}
7648+
7649+static inline void vx_deactivate_task(struct task_struct *p)
7650+{
7651+ struct vx_info *vxi;
7652+
7653+ if ((vxi = p->vx_info)) {
7654+ vx_update_load(vxi);
7655+ atomic_dec(&vxi->cvirt.nr_running);
7656+ }
7657+}
7658+
7659+static inline void vx_uninterruptible_inc(struct task_struct *p)
7660+{
7661+ struct vx_info *vxi;
7662+
7663+ if ((vxi = p->vx_info))
7664+ atomic_inc(&vxi->cvirt.nr_uninterruptible);
7665+}
7666+
7667+static inline void vx_uninterruptible_dec(struct task_struct *p)
7668+{
7669+ struct vx_info *vxi;
7670+
7671+ if ((vxi = p->vx_info))
7672+ atomic_dec(&vxi->cvirt.nr_uninterruptible);
7673+}
7674+
7675+
7676+#else
7677+#warning duplicate inclusion
7678+#endif
7679diff -NurpP --minimal linux-4.4.116/include/linux/vs_device.h linux-4.4.116-vs2.3.9.7/include/linux/vs_device.h
7680--- linux-4.4.116/include/linux/vs_device.h 1970-01-01 00:00:00.000000000 +0000
7681+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_device.h 2018-01-09 16:36:32.000000000 +0000
7682@@ -0,0 +1,45 @@
7683+#ifndef _VS_DEVICE_H
7684+#define _VS_DEVICE_H
7685+
7686+#include "vserver/base.h"
7687+#include "vserver/device.h"
7688+#include "vserver/debug.h"
7689+
7690+
7691+#ifdef CONFIG_VSERVER_DEVICE
7692+
7693+int vs_map_device(struct vx_info *, dev_t, dev_t *, umode_t);
7694+
7695+#define vs_device_perm(v, d, m, p) \
7696+ ((vs_map_device(current_vx_info(), d, NULL, m) & (p)) == (p))
7697+
7698+#else
7699+
7700+static inline
7701+int vs_map_device(struct vx_info *vxi,
7702+ dev_t device, dev_t *target, umode_t mode)
7703+{
7704+ if (target)
7705+ *target = device;
7706+ return ~0;
7707+}
7708+
7709+#define vs_device_perm(v, d, m, p) ((p) == (p))
7710+
7711+#endif
7712+
7713+
7714+#define vs_map_chrdev(d, t, p) \
7715+ ((vs_map_device(current_vx_info(), d, t, S_IFCHR) & (p)) == (p))
7716+#define vs_map_blkdev(d, t, p) \
7717+ ((vs_map_device(current_vx_info(), d, t, S_IFBLK) & (p)) == (p))
7718+
7719+#define vs_chrdev_perm(d, p) \
7720+ vs_device_perm(current_vx_info(), d, S_IFCHR, p)
7721+#define vs_blkdev_perm(d, p) \
7722+ vs_device_perm(current_vx_info(), d, S_IFBLK, p)
7723+
7724+
7725+#else
7726+#warning duplicate inclusion
7727+#endif
7728diff -NurpP --minimal linux-4.4.116/include/linux/vs_dlimit.h linux-4.4.116-vs2.3.9.7/include/linux/vs_dlimit.h
7729--- linux-4.4.116/include/linux/vs_dlimit.h 1970-01-01 00:00:00.000000000 +0000
7730+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_dlimit.h 2018-01-09 16:36:32.000000000 +0000
7731@@ -0,0 +1,215 @@
7732+#ifndef _VS_DLIMIT_H
7733+#define _VS_DLIMIT_H
7734+
7735+#include <linux/fs.h>
7736+
7737+#include "vserver/dlimit.h"
7738+#include "vserver/base.h"
7739+#include "vserver/debug.h"
7740+
7741+
7742+#define get_dl_info(i) __get_dl_info(i, __FILE__, __LINE__)
7743+
7744+static inline struct dl_info *__get_dl_info(struct dl_info *dli,
7745+ const char *_file, int _line)
7746+{
7747+ if (!dli)
7748+ return NULL;
7749+ vxlprintk(VXD_CBIT(dlim, 4), "get_dl_info(%p[#%d.%d])",
7750+ dli, dli ? dli->dl_tag : 0,
7751+ dli ? atomic_read(&dli->dl_usecnt) : 0,
7752+ _file, _line);
7753+ atomic_inc(&dli->dl_usecnt);
7754+ return dli;
7755+}
7756+
7757+
7758+#define free_dl_info(i) \
7759+ call_rcu(&(i)->dl_rcu, rcu_free_dl_info)
7760+
7761+#define put_dl_info(i) __put_dl_info(i, __FILE__, __LINE__)
7762+
7763+static inline void __put_dl_info(struct dl_info *dli,
7764+ const char *_file, int _line)
7765+{
7766+ if (!dli)
7767+ return;
7768+ vxlprintk(VXD_CBIT(dlim, 4), "put_dl_info(%p[#%d.%d])",
7769+ dli, dli ? dli->dl_tag : 0,
7770+ dli ? atomic_read(&dli->dl_usecnt) : 0,
7771+ _file, _line);
7772+ if (atomic_dec_and_test(&dli->dl_usecnt))
7773+ free_dl_info(dli);
7774+}
7775+
7776+
7777+#define __dlimit_char(d) ((d) ? '*' : ' ')
7778+
7779+static inline int __dl_alloc_space(struct super_block *sb,
7780+ vtag_t tag, dlsize_t nr, const char *file, int line)
7781+{
7782+ struct dl_info *dli = NULL;
7783+ int ret = 0;
7784+
7785+ if (nr == 0)
7786+ goto out;
7787+ dli = locate_dl_info(sb, tag);
7788+ if (!dli)
7789+ goto out;
7790+
7791+ spin_lock(&dli->dl_lock);
7792+ ret = (dli->dl_space_used + nr > dli->dl_space_total);
7793+ if (!ret)
7794+ dli->dl_space_used += nr;
7795+ spin_unlock(&dli->dl_lock);
7796+ put_dl_info(dli);
7797+out:
7798+ vxlprintk(VXD_CBIT(dlim, 1),
7799+ "ALLOC (%p,#%d)%c %lld bytes (%d)",
7800+ sb, tag, __dlimit_char(dli), (long long)nr,
7801+ ret, file, line);
7802+ return ret ? -ENOSPC : 0;
7803+}
7804+
7805+static inline void __dl_free_space(struct super_block *sb,
7806+ vtag_t tag, dlsize_t nr, const char *_file, int _line)
7807+{
7808+ struct dl_info *dli = NULL;
7809+
7810+ if (nr == 0)
7811+ goto out;
7812+ dli = locate_dl_info(sb, tag);
7813+ if (!dli)
7814+ goto out;
7815+
7816+ spin_lock(&dli->dl_lock);
7817+ if (dli->dl_space_used > nr)
7818+ dli->dl_space_used -= nr;
7819+ else
7820+ dli->dl_space_used = 0;
7821+ spin_unlock(&dli->dl_lock);
7822+ put_dl_info(dli);
7823+out:
7824+ vxlprintk(VXD_CBIT(dlim, 1),
7825+ "FREE (%p,#%d)%c %lld bytes",
7826+ sb, tag, __dlimit_char(dli), (long long)nr,
7827+ _file, _line);
7828+}
7829+
7830+static inline int __dl_alloc_inode(struct super_block *sb,
7831+ vtag_t tag, const char *_file, int _line)
7832+{
7833+ struct dl_info *dli;
7834+ int ret = 0;
7835+
7836+ dli = locate_dl_info(sb, tag);
7837+ if (!dli)
7838+ goto out;
7839+
7840+ spin_lock(&dli->dl_lock);
7841+ dli->dl_inodes_used++;
7842+ ret = (dli->dl_inodes_used > dli->dl_inodes_total);
7843+ spin_unlock(&dli->dl_lock);
7844+ put_dl_info(dli);
7845+out:
7846+ vxlprintk(VXD_CBIT(dlim, 0),
7847+ "ALLOC (%p,#%d)%c inode (%d)",
7848+ sb, tag, __dlimit_char(dli), ret, _file, _line);
7849+ return ret ? -ENOSPC : 0;
7850+}
7851+
7852+static inline void __dl_free_inode(struct super_block *sb,
7853+ vtag_t tag, const char *_file, int _line)
7854+{
7855+ struct dl_info *dli;
7856+
7857+ dli = locate_dl_info(sb, tag);
7858+ if (!dli)
7859+ goto out;
7860+
7861+ spin_lock(&dli->dl_lock);
7862+ if (dli->dl_inodes_used > 1)
7863+ dli->dl_inodes_used--;
7864+ else
7865+ dli->dl_inodes_used = 0;
7866+ spin_unlock(&dli->dl_lock);
7867+ put_dl_info(dli);
7868+out:
7869+ vxlprintk(VXD_CBIT(dlim, 0),
7870+ "FREE (%p,#%d)%c inode",
7871+ sb, tag, __dlimit_char(dli), _file, _line);
7872+}
7873+
7874+static inline void __dl_adjust_block(struct super_block *sb, vtag_t tag,
7875+ unsigned long long *free_blocks, unsigned long long *root_blocks,
7876+ const char *_file, int _line)
7877+{
7878+ struct dl_info *dli;
7879+ uint64_t broot, bfree;
7880+
7881+ dli = locate_dl_info(sb, tag);
7882+ if (!dli)
7883+ return;
7884+
7885+ spin_lock(&dli->dl_lock);
7886+ broot = (dli->dl_space_total -
7887+ (dli->dl_space_total >> 10) * dli->dl_nrlmult)
7888+ >> sb->s_blocksize_bits;
7889+ bfree = (dli->dl_space_total - dli->dl_space_used)
7890+ >> sb->s_blocksize_bits;
7891+ spin_unlock(&dli->dl_lock);
7892+
7893+ vxlprintk(VXD_CBIT(dlim, 2),
7894+ "ADJUST: %lld,%lld on %lld,%lld [mult=%d]",
7895+ (long long)bfree, (long long)broot,
7896+ *free_blocks, *root_blocks, dli->dl_nrlmult,
7897+ _file, _line);
7898+ if (free_blocks) {
7899+ if (*free_blocks > bfree)
7900+ *free_blocks = bfree;
7901+ }
7902+ if (root_blocks) {
7903+ if (*root_blocks > broot)
7904+ *root_blocks = broot;
7905+ }
7906+ put_dl_info(dli);
7907+}
7908+
7909+#define dl_prealloc_space(in, bytes) \
7910+ __dl_alloc_space((in)->i_sb, i_tag_read(in), (dlsize_t)(bytes), \
7911+ __FILE__, __LINE__ )
7912+
7913+#define dl_alloc_space(in, bytes) \
7914+ __dl_alloc_space((in)->i_sb, i_tag_read(in), (dlsize_t)(bytes), \
7915+ __FILE__, __LINE__ )
7916+
7917+#define dl_reserve_space(in, bytes) \
7918+ __dl_alloc_space((in)->i_sb, i_tag_read(in), (dlsize_t)(bytes), \
7919+ __FILE__, __LINE__ )
7920+
7921+#define dl_claim_space(in, bytes) (0)
7922+
7923+#define dl_release_space(in, bytes) \
7924+ __dl_free_space((in)->i_sb, i_tag_read(in), (dlsize_t)(bytes), \
7925+ __FILE__, __LINE__ )
7926+
7927+#define dl_free_space(in, bytes) \
7928+ __dl_free_space((in)->i_sb, i_tag_read(in), (dlsize_t)(bytes), \
7929+ __FILE__, __LINE__ )
7930+
7931+
7932+
7933+#define dl_alloc_inode(in) \
7934+ __dl_alloc_inode((in)->i_sb, i_tag_read(in), __FILE__, __LINE__ )
7935+
7936+#define dl_free_inode(in) \
7937+ __dl_free_inode((in)->i_sb, i_tag_read(in), __FILE__, __LINE__ )
7938+
7939+
7940+#define dl_adjust_block(sb, tag, fb, rb) \
7941+ __dl_adjust_block(sb, tag, fb, rb, __FILE__, __LINE__ )
7942+
7943+
7944+#else
7945+#warning duplicate inclusion
7946+#endif
7947diff -NurpP --minimal linux-4.4.116/include/linux/vs_inet.h linux-4.4.116-vs2.3.9.7/include/linux/vs_inet.h
7948--- linux-4.4.116/include/linux/vs_inet.h 1970-01-01 00:00:00.000000000 +0000
7949+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_inet.h 2018-01-09 16:36:32.000000000 +0000
7950@@ -0,0 +1,364 @@
7951+#ifndef _VS_INET_H
7952+#define _VS_INET_H
7953+
7954+#include "vserver/base.h"
7955+#include "vserver/network.h"
7956+#include "vserver/debug.h"
7957+
7958+#define IPI_LOOPBACK htonl(INADDR_LOOPBACK)
7959+
7960+#define NXAV4(a) NIPQUAD((a)->ip[0]), NIPQUAD((a)->ip[1]), \
7961+ NIPQUAD((a)->mask), (a)->type
7962+#define NXAV4_FMT "[" NIPQUAD_FMT "-" NIPQUAD_FMT "/" NIPQUAD_FMT ":%04x]"
7963+
7964+#define NIPQUAD(addr) \
7965+ ((unsigned char *)&addr)[0], \
7966+ ((unsigned char *)&addr)[1], \
7967+ ((unsigned char *)&addr)[2], \
7968+ ((unsigned char *)&addr)[3]
7969+
7970+#define NIPQUAD_FMT "%u.%u.%u.%u"
7971+
7972+
7973+static inline
7974+int v4_addr_match(struct nx_addr_v4 *nxa, __be32 addr, uint16_t tmask)
7975+{
7976+ __be32 ip = nxa->ip[0].s_addr;
7977+ __be32 mask = nxa->mask.s_addr;
7978+ __be32 bcast = ip | ~mask;
7979+ int ret = 0;
7980+
7981+ switch (nxa->type & tmask) {
7982+ case NXA_TYPE_MASK:
7983+ ret = (ip == (addr & mask));
7984+ break;
7985+ case NXA_TYPE_ADDR:
7986+ ret = 3;
7987+ if (addr == ip)
7988+ break;
7989+ /* fall through to broadcast */
7990+ case NXA_MOD_BCAST:
7991+ ret = ((tmask & NXA_MOD_BCAST) && (addr == bcast));
7992+ break;
7993+ case NXA_TYPE_RANGE:
7994+ ret = ((nxa->ip[0].s_addr <= addr) &&
7995+ (nxa->ip[1].s_addr > addr));
7996+ break;
7997+ case NXA_TYPE_ANY:
7998+ ret = 2;
7999+ break;
8000+ }
8001+
8002+ vxdprintk(VXD_CBIT(net, 0),
8003+ "v4_addr_match(%p" NXAV4_FMT "," NIPQUAD_FMT ",%04x) = %d",
8004+ nxa, NXAV4(nxa), NIPQUAD(addr), tmask, ret);
8005+ return ret;
8006+}
8007+
8008+static inline
8009+int v4_addr_in_nx_info(struct nx_info *nxi, __be32 addr, uint16_t tmask)
8010+{
8011+ struct nx_addr_v4 *nxa;
8012+ unsigned long irqflags;
8013+ int ret = 1;
8014+
8015+ if (!nxi)
8016+ goto out;
8017+
8018+ ret = 2;
8019+ /* allow 127.0.0.1 when remapping lback */
8020+ if ((tmask & NXA_LOOPBACK) &&
8021+ (addr == IPI_LOOPBACK) &&
8022+ nx_info_flags(nxi, NXF_LBACK_REMAP, 0))
8023+ goto out;
8024+ ret = 3;
8025+ /* check for lback address */
8026+ if ((tmask & NXA_MOD_LBACK) &&
8027+ (nxi->v4_lback.s_addr == addr))
8028+ goto out;
8029+ ret = 4;
8030+ /* check for broadcast address */
8031+ if ((tmask & NXA_MOD_BCAST) &&
8032+ (nxi->v4_bcast.s_addr == addr))
8033+ goto out;
8034+ ret = 5;
8035+
8036+ /* check for v4 addresses */
8037+ spin_lock_irqsave(&nxi->addr_lock, irqflags);
8038+ for (nxa = &nxi->v4; nxa; nxa = nxa->next)
8039+ if (v4_addr_match(nxa, addr, tmask))
8040+ goto out_unlock;
8041+ ret = 0;
8042+out_unlock:
8043+ spin_unlock_irqrestore(&nxi->addr_lock, irqflags);
8044+out:
8045+ vxdprintk(VXD_CBIT(net, 0),
8046+ "v4_addr_in_nx_info(%p[#%u]," NIPQUAD_FMT ",%04x) = %d",
8047+ nxi, nxi ? nxi->nx_id : 0, NIPQUAD(addr), tmask, ret);
8048+ return ret;
8049+}
8050+
8051+static inline
8052+int v4_nx_addr_match(struct nx_addr_v4 *nxa, struct nx_addr_v4 *addr, uint16_t mask)
8053+{
8054+ /* FIXME: needs full range checks */
8055+ return v4_addr_match(nxa, addr->ip[0].s_addr, mask);
8056+}
8057+
8058+static inline
8059+int v4_nx_addr_in_nx_info(struct nx_info *nxi, struct nx_addr_v4 *nxa, uint16_t mask)
8060+{
8061+ struct nx_addr_v4 *ptr;
8062+ unsigned long irqflags;
8063+ int ret = 1;
8064+
8065+ spin_lock_irqsave(&nxi->addr_lock, irqflags);
8066+ for (ptr = &nxi->v4; ptr; ptr = ptr->next)
8067+ if (v4_nx_addr_match(ptr, nxa, mask))
8068+ goto out_unlock;
8069+ ret = 0;
8070+out_unlock:
8071+ spin_unlock_irqrestore(&nxi->addr_lock, irqflags);
8072+ return ret;
8073+}
8074+
8075+#include <net/inet_sock.h>
8076+
8077+/*
8078+ * Check if a given address matches for a socket
8079+ *
8080+ * nxi: the socket's nx_info if any
8081+ * addr: to be verified address
8082+ */
8083+static inline
8084+int v4_sock_addr_match (
8085+ struct nx_info *nxi,
8086+ struct inet_sock *inet,
8087+ __be32 addr)
8088+{
8089+ __be32 saddr = inet->inet_rcv_saddr;
8090+ __be32 bcast = nxi ? nxi->v4_bcast.s_addr : INADDR_BROADCAST;
8091+
8092+ if (addr && (saddr == addr || bcast == addr))
8093+ return 1;
8094+ if (!saddr)
8095+ return v4_addr_in_nx_info(nxi, addr, NXA_MASK_BIND);
8096+ return 0;
8097+}
8098+
8099+
8100+/* inet related checks and helpers */
8101+
8102+
8103+struct in_ifaddr;
8104+struct net_device;
8105+struct sock;
8106+
8107+#ifdef CONFIG_INET
8108+
8109+#include <linux/netdevice.h>
8110+#include <linux/inetdevice.h>
8111+#include <net/inet_sock.h>
8112+#include <net/inet_timewait_sock.h>
8113+
8114+
8115+int dev_in_nx_info(struct net_device *, struct nx_info *);
8116+int v4_dev_in_nx_info(struct net_device *, struct nx_info *);
8117+int nx_v4_addr_conflict(struct nx_info *, struct nx_info *);
8118+
8119+
8120+/*
8121+ * check if address is covered by socket
8122+ *
8123+ * sk: the socket to check against
8124+ * addr: the address in question (must be != 0)
8125+ */
8126+
8127+static inline
8128+int __v4_addr_match_socket(const struct sock *sk, struct nx_addr_v4 *nxa)
8129+{
8130+ struct nx_info *nxi = sk->sk_nx_info;
8131+ __be32 saddr = sk->sk_rcv_saddr;
8132+
8133+ vxdprintk(VXD_CBIT(net, 5),
8134+ "__v4_addr_in_socket(%p," NXAV4_FMT ") %p:" NIPQUAD_FMT " %p;%lx",
8135+ sk, NXAV4(nxa), nxi, NIPQUAD(saddr), sk->sk_socket,
8136+ (sk->sk_socket?sk->sk_socket->flags:0));
8137+
8138+ if (saddr) { /* direct address match */
8139+ return v4_addr_match(nxa, saddr, -1);
8140+ } else if (nxi) { /* match against nx_info */
8141+ return v4_nx_addr_in_nx_info(nxi, nxa, -1);
8142+ } else { /* unrestricted any socket */
8143+ return 1;
8144+ }
8145+}
8146+
8147+
8148+
8149+static inline
8150+int nx_dev_visible(struct nx_info *nxi, struct net_device *dev)
8151+{
8152+ vxdprintk(VXD_CBIT(net, 1),
8153+ "nx_dev_visible(%p[#%u],%p " VS_Q("%s") ") %d",
8154+ nxi, nxi ? nxi->nx_id : 0, dev, dev->name,
8155+ nxi ? dev_in_nx_info(dev, nxi) : 0);
8156+
8157+ if (!nx_info_flags(nxi, NXF_HIDE_NETIF, 0))
8158+ return 1;
8159+ if (dev_in_nx_info(dev, nxi))
8160+ return 1;
8161+ return 0;
8162+}
8163+
8164+
8165+static inline
8166+int v4_ifa_in_nx_info(struct in_ifaddr *ifa, struct nx_info *nxi)
8167+{
8168+ if (!nxi)
8169+ return 1;
8170+ if (!ifa)
8171+ return 0;
8172+ return v4_addr_in_nx_info(nxi, ifa->ifa_local, NXA_MASK_SHOW);
8173+}
8174+
8175+static inline
8176+int nx_v4_ifa_visible(struct nx_info *nxi, struct in_ifaddr *ifa)
8177+{
8178+ vxdprintk(VXD_CBIT(net, 1), "nx_v4_ifa_visible(%p[#%u],%p) %d",
8179+ nxi, nxi ? nxi->nx_id : 0, ifa,
8180+ nxi ? v4_ifa_in_nx_info(ifa, nxi) : 0);
8181+
8182+ if (!nx_info_flags(nxi, NXF_HIDE_NETIF, 0))
8183+ return 1;
8184+ if (v4_ifa_in_nx_info(ifa, nxi))
8185+ return 1;
8186+ return 0;
8187+}
8188+
8189+
8190+struct nx_v4_sock_addr {
8191+ __be32 saddr; /* Address used for validation */
8192+ __be32 baddr; /* Address used for socket bind */
8193+};
8194+
8195+static inline
8196+int v4_map_sock_addr(struct inet_sock *inet, struct sockaddr_in *addr,
8197+ struct nx_v4_sock_addr *nsa)
8198+{
8199+ struct sock *sk = &inet->sk;
8200+ struct nx_info *nxi = sk->sk_nx_info;
8201+ __be32 saddr = addr->sin_addr.s_addr;
8202+ __be32 baddr = saddr;
8203+
8204+ vxdprintk(VXD_CBIT(net, 3),
8205+ "inet_bind(%p)* %p,%p;%lx " NIPQUAD_FMT,
8206+ sk, sk->sk_nx_info, sk->sk_socket,
8207+ (sk->sk_socket ? sk->sk_socket->flags : 0),
8208+ NIPQUAD(saddr));
8209+
8210+ if (nxi) {
8211+ if (saddr == INADDR_ANY) {
8212+ if (nx_info_flags(nxi, NXF_SINGLE_IP, 0))
8213+ baddr = nxi->v4.ip[0].s_addr;
8214+ } else if (saddr == IPI_LOOPBACK) {
8215+ if (nx_info_flags(nxi, NXF_LBACK_REMAP, 0))
8216+ baddr = nxi->v4_lback.s_addr;
8217+ } else if (!ipv4_is_multicast(saddr) ||
8218+ !nx_info_ncaps(nxi, NXC_MULTICAST)) {
8219+ /* normal address bind */
8220+ if (!v4_addr_in_nx_info(nxi, saddr, NXA_MASK_BIND))
8221+ return -EADDRNOTAVAIL;
8222+ }
8223+ }
8224+
8225+ vxdprintk(VXD_CBIT(net, 3),
8226+ "inet_bind(%p) " NIPQUAD_FMT ", " NIPQUAD_FMT,
8227+ sk, NIPQUAD(saddr), NIPQUAD(baddr));
8228+
8229+ nsa->saddr = saddr;
8230+ nsa->baddr = baddr;
8231+ return 0;
8232+}
8233+
8234+static inline
8235+void v4_set_sock_addr(struct inet_sock *inet, struct nx_v4_sock_addr *nsa)
8236+{
8237+ inet->inet_saddr = nsa->baddr;
8238+ inet->inet_rcv_saddr = nsa->baddr;
8239+}
8240+
8241+
8242+/*
8243+ * helper to simplify inet_lookup_listener
8244+ *
8245+ * nxi: the socket's nx_info if any
8246+ * addr: to be verified address
8247+ * saddr: socket address
8248+ */
8249+static inline int v4_inet_addr_match (
8250+ struct nx_info *nxi,
8251+ __be32 addr,
8252+ __be32 saddr)
8253+{
8254+ if (addr && (saddr == addr))
8255+ return 1;
8256+ if (!saddr)
8257+ return nxi ? v4_addr_in_nx_info(nxi, addr, NXA_MASK_BIND) : 1;
8258+ return 0;
8259+}
8260+
8261+static inline __be32 nx_map_sock_lback(struct nx_info *nxi, __be32 addr)
8262+{
8263+ if (nx_info_flags(nxi, NXF_HIDE_LBACK, 0) &&
8264+ (addr == nxi->v4_lback.s_addr))
8265+ return IPI_LOOPBACK;
8266+ return addr;
8267+}
8268+
8269+static inline
8270+int nx_info_has_v4(struct nx_info *nxi)
8271+{
8272+ if (!nxi)
8273+ return 1;
8274+ if (NX_IPV4(nxi))
8275+ return 1;
8276+ if (nx_info_flags(nxi, NXF_LBACK_REMAP, 0))
8277+ return 1;
8278+ return 0;
8279+}
8280+
8281+#else /* CONFIG_INET */
8282+
8283+static inline
8284+int nx_dev_visible(struct nx_info *n, struct net_device *d)
8285+{
8286+ return 1;
8287+}
8288+
8289+static inline
8290+int nx_v4_addr_conflict(struct nx_info *n, uint32_t a, const struct sock *s)
8291+{
8292+ return 1;
8293+}
8294+
8295+static inline
8296+int v4_ifa_in_nx_info(struct in_ifaddr *a, struct nx_info *n)
8297+{
8298+ return 1;
8299+}
8300+
8301+static inline
8302+int nx_info_has_v4(struct nx_info *nxi)
8303+{
8304+ return 0;
8305+}
8306+
8307+#endif /* CONFIG_INET */
8308+
8309+#define current_nx_info_has_v4() \
8310+ nx_info_has_v4(current_nx_info())
8311+
8312+#else
8313+// #warning duplicate inclusion
8314+#endif
8315diff -NurpP --minimal linux-4.4.116/include/linux/vs_inet6.h linux-4.4.116-vs2.3.9.7/include/linux/vs_inet6.h
8316--- linux-4.4.116/include/linux/vs_inet6.h 1970-01-01 00:00:00.000000000 +0000
8317+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_inet6.h 2018-01-09 16:36:32.000000000 +0000
8318@@ -0,0 +1,257 @@
8319+#ifndef _VS_INET6_H
8320+#define _VS_INET6_H
8321+
8322+#include "vserver/base.h"
8323+#include "vserver/network.h"
8324+#include "vserver/debug.h"
8325+
8326+#include <net/ipv6.h>
8327+
8328+#define NXAV6(a) &(a)->ip, &(a)->mask, (a)->prefix, (a)->type
8329+#define NXAV6_FMT "[%pI6/%pI6/%d:%04x]"
8330+
8331+
8332+#ifdef CONFIG_IPV6
8333+
8334+static inline
8335+int v6_addr_match(struct nx_addr_v6 *nxa,
8336+ const struct in6_addr *addr, uint16_t mask)
8337+{
8338+ int ret = 0;
8339+
8340+ switch (nxa->type & mask) {
8341+ case NXA_TYPE_MASK:
8342+ ret = ipv6_masked_addr_cmp(&nxa->ip, &nxa->mask, addr);
8343+ break;
8344+ case NXA_TYPE_ADDR:
8345+ ret = ipv6_addr_equal(&nxa->ip, addr);
8346+ break;
8347+ case NXA_TYPE_ANY:
8348+ ret = 1;
8349+ break;
8350+ }
8351+ vxdprintk(VXD_CBIT(net, 0),
8352+ "v6_addr_match(%p" NXAV6_FMT ",%pI6,%04x) = %d",
8353+ nxa, NXAV6(nxa), addr, mask, ret);
8354+ return ret;
8355+}
8356+
8357+static inline
8358+int v6_addr_in_nx_info(struct nx_info *nxi,
8359+ const struct in6_addr *addr, uint16_t mask)
8360+{
8361+ struct nx_addr_v6 *nxa;
8362+ unsigned long irqflags;
8363+ int ret = 1;
8364+
8365+ if (!nxi)
8366+ goto out;
8367+
8368+ spin_lock_irqsave(&nxi->addr_lock, irqflags);
8369+ for (nxa = &nxi->v6; nxa; nxa = nxa->next)
8370+ if (v6_addr_match(nxa, addr, mask))
8371+ goto out_unlock;
8372+ ret = 0;
8373+out_unlock:
8374+ spin_unlock_irqrestore(&nxi->addr_lock, irqflags);
8375+out:
8376+ vxdprintk(VXD_CBIT(net, 0),
8377+ "v6_addr_in_nx_info(%p[#%u],%pI6,%04x) = %d",
8378+ nxi, nxi ? nxi->nx_id : 0, addr, mask, ret);
8379+ return ret;
8380+}
8381+
8382+static inline
8383+int v6_nx_addr_match(struct nx_addr_v6 *nxa, struct nx_addr_v6 *addr, uint16_t mask)
8384+{
8385+ /* FIXME: needs full range checks */
8386+ return v6_addr_match(nxa, &addr->ip, mask);
8387+}
8388+
8389+static inline
8390+int v6_nx_addr_in_nx_info(struct nx_info *nxi, struct nx_addr_v6 *nxa, uint16_t mask)
8391+{
8392+ struct nx_addr_v6 *ptr;
8393+ unsigned long irqflags;
8394+ int ret = 1;
8395+
8396+ spin_lock_irqsave(&nxi->addr_lock, irqflags);
8397+ for (ptr = &nxi->v6; ptr; ptr = ptr->next)
8398+ if (v6_nx_addr_match(ptr, nxa, mask))
8399+ goto out_unlock;
8400+ ret = 0;
8401+out_unlock:
8402+ spin_unlock_irqrestore(&nxi->addr_lock, irqflags);
8403+ return ret;
8404+}
8405+
8406+
8407+/*
8408+ * Check if a given address matches for a socket
8409+ *
8410+ * nxi: the socket's nx_info if any
8411+ * addr: to be verified address
8412+ */
8413+static inline
8414+int v6_sock_addr_match (
8415+ struct nx_info *nxi,
8416+ struct inet_sock *inet,
8417+ struct in6_addr *addr)
8418+{
8419+ struct sock *sk = &inet->sk;
8420+ const struct in6_addr *saddr = inet6_rcv_saddr(sk);
8421+
8422+ if (!ipv6_addr_any(addr) &&
8423+ ipv6_addr_equal(saddr, addr))
8424+ return 1;
8425+ if (ipv6_addr_any(saddr))
8426+ return v6_addr_in_nx_info(nxi, addr, -1);
8427+ return 0;
8428+}
8429+
8430+/*
8431+ * check if address is covered by socket
8432+ *
8433+ * sk: the socket to check against
8434+ * addr: the address in question (must be != 0)
8435+ */
8436+
8437+static inline
8438+int __v6_addr_match_socket(const struct sock *sk, struct nx_addr_v6 *nxa)
8439+{
8440+ struct nx_info *nxi = sk->sk_nx_info;
8441+ const struct in6_addr *saddr = inet6_rcv_saddr(sk);
8442+
8443+ vxdprintk(VXD_CBIT(net, 5),
8444+ "__v6_addr_in_socket(%p," NXAV6_FMT ") %p:%pI6 %p;%lx",
8445+ sk, NXAV6(nxa), nxi, saddr, sk->sk_socket,
8446+ (sk->sk_socket?sk->sk_socket->flags:0));
8447+
8448+ if (!ipv6_addr_any(saddr)) { /* direct address match */
8449+ return v6_addr_match(nxa, saddr, -1);
8450+ } else if (nxi) { /* match against nx_info */
8451+ return v6_nx_addr_in_nx_info(nxi, nxa, -1);
8452+ } else { /* unrestricted any socket */
8453+ return 1;
8454+ }
8455+}
8456+
8457+
8458+/* inet related checks and helpers */
8459+
8460+
8461+struct in_ifaddr;
8462+struct net_device;
8463+struct sock;
8464+
8465+
8466+#include <linux/netdevice.h>
8467+#include <linux/inetdevice.h>
8468+#include <net/inet_timewait_sock.h>
8469+
8470+
8471+int dev_in_nx_info(struct net_device *, struct nx_info *);
8472+int v6_dev_in_nx_info(struct net_device *, struct nx_info *);
8473+int nx_v6_addr_conflict(struct nx_info *, struct nx_info *);
8474+
8475+
8476+
8477+static inline
8478+int v6_ifa_in_nx_info(struct inet6_ifaddr *ifa, struct nx_info *nxi)
8479+{
8480+ if (!nxi)
8481+ return 1;
8482+ if (!ifa)
8483+ return 0;
8484+ return v6_addr_in_nx_info(nxi, &ifa->addr, -1);
8485+}
8486+
8487+static inline
8488+int nx_v6_ifa_visible(struct nx_info *nxi, struct inet6_ifaddr *ifa)
8489+{
8490+ vxdprintk(VXD_CBIT(net, 1), "nx_v6_ifa_visible(%p[#%u],%p) %d",
8491+ nxi, nxi ? nxi->nx_id : 0, ifa,
8492+ nxi ? v6_ifa_in_nx_info(ifa, nxi) : 0);
8493+
8494+ if (!nx_info_flags(nxi, NXF_HIDE_NETIF, 0))
8495+ return 1;
8496+ if (v6_ifa_in_nx_info(ifa, nxi))
8497+ return 1;
8498+ return 0;
8499+}
8500+
8501+
8502+struct nx_v6_sock_addr {
8503+ struct in6_addr saddr; /* Address used for validation */
8504+ struct in6_addr baddr; /* Address used for socket bind */
8505+};
8506+
8507+static inline
8508+int v6_map_sock_addr(struct inet_sock *inet, struct sockaddr_in6 *addr,
8509+ struct nx_v6_sock_addr *nsa)
8510+{
8511+ // struct sock *sk = &inet->sk;
8512+ // struct nx_info *nxi = sk->sk_nx_info;
8513+ struct in6_addr saddr = addr->sin6_addr;
8514+ struct in6_addr baddr = saddr;
8515+
8516+ nsa->saddr = saddr;
8517+ nsa->baddr = baddr;
8518+ return 0;
8519+}
8520+
8521+static inline
8522+void v6_set_sock_addr(struct inet_sock *inet, struct nx_v6_sock_addr *nsa)
8523+{
8524+ // struct sock *sk = &inet->sk;
8525+ // struct in6_addr *saddr = inet6_rcv_saddr(sk);
8526+
8527+ // *saddr = nsa->baddr;
8528+ // inet->inet_saddr = nsa->baddr;
8529+}
8530+
8531+static inline
8532+int nx_info_has_v6(struct nx_info *nxi)
8533+{
8534+ if (!nxi)
8535+ return 1;
8536+ if (NX_IPV6(nxi))
8537+ return 1;
8538+ return 0;
8539+}
8540+
8541+#else /* CONFIG_IPV6 */
8542+
8543+static inline
8544+int nx_v6_dev_visible(struct nx_info *n, struct net_device *d)
8545+{
8546+ return 1;
8547+}
8548+
8549+
8550+static inline
8551+int nx_v6_addr_conflict(struct nx_info *n, uint32_t a, const struct sock *s)
8552+{
8553+ return 1;
8554+}
8555+
8556+static inline
8557+int v6_ifa_in_nx_info(struct in_ifaddr *a, struct nx_info *n)
8558+{
8559+ return 1;
8560+}
8561+
8562+static inline
8563+int nx_info_has_v6(struct nx_info *nxi)
8564+{
8565+ return 0;
8566+}
8567+
8568+#endif /* CONFIG_IPV6 */
8569+
8570+#define current_nx_info_has_v6() \
8571+ nx_info_has_v6(current_nx_info())
8572+
8573+#else
8574+#warning duplicate inclusion
8575+#endif
8576diff -NurpP --minimal linux-4.4.116/include/linux/vs_limit.h linux-4.4.116-vs2.3.9.7/include/linux/vs_limit.h
8577--- linux-4.4.116/include/linux/vs_limit.h 1970-01-01 00:00:00.000000000 +0000
8578+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_limit.h 2018-01-09 16:36:32.000000000 +0000
8579@@ -0,0 +1,140 @@
8580+#ifndef _VS_LIMIT_H
8581+#define _VS_LIMIT_H
8582+
8583+#include "vserver/limit.h"
8584+#include "vserver/base.h"
8585+#include "vserver/context.h"
8586+#include "vserver/debug.h"
8587+#include "vserver/context.h"
8588+#include "vserver/limit_int.h"
8589+
8590+
8591+#define vx_acc_cres(v, d, p, r) \
8592+ __vx_acc_cres(v, r, d, p, __FILE__, __LINE__)
8593+
8594+#define vx_acc_cres_cond(x, d, p, r) \
8595+ __vx_acc_cres(((x) == vx_current_xid()) ? current_vx_info() : 0, \
8596+ r, d, p, __FILE__, __LINE__)
8597+
8598+
8599+#define vx_add_cres(v, a, p, r) \
8600+ __vx_add_cres(v, r, a, p, __FILE__, __LINE__)
8601+#define vx_sub_cres(v, a, p, r) vx_add_cres(v, -(a), p, r)
8602+
8603+#define vx_add_cres_cond(x, a, p, r) \
8604+ __vx_add_cres(((x) == vx_current_xid()) ? current_vx_info() : 0, \
8605+ r, a, p, __FILE__, __LINE__)
8606+#define vx_sub_cres_cond(x, a, p, r) vx_add_cres_cond(x, -(a), p, r)
8607+
8608+
8609+/* process and file limits */
8610+
8611+#define vx_nproc_inc(p) \
8612+ vx_acc_cres((p)->vx_info, 1, p, RLIMIT_NPROC)
8613+
8614+#define vx_nproc_dec(p) \
8615+ vx_acc_cres((p)->vx_info,-1, p, RLIMIT_NPROC)
8616+
8617+#define vx_files_inc(f) \
8618+ vx_acc_cres_cond((f)->f_xid, 1, f, RLIMIT_NOFILE)
8619+
8620+#define vx_files_dec(f) \
8621+ vx_acc_cres_cond((f)->f_xid,-1, f, RLIMIT_NOFILE)
8622+
8623+#define vx_locks_inc(l) \
8624+ vx_acc_cres_cond((l)->fl_xid, 1, l, RLIMIT_LOCKS)
8625+
8626+#define vx_locks_dec(l) \
8627+ vx_acc_cres_cond((l)->fl_xid,-1, l, RLIMIT_LOCKS)
8628+
8629+#define vx_openfd_inc(f) \
8630+ vx_acc_cres(current_vx_info(), 1, (void *)(long)(f), VLIMIT_OPENFD)
8631+
8632+#define vx_openfd_dec(f) \
8633+ vx_acc_cres(current_vx_info(),-1, (void *)(long)(f), VLIMIT_OPENFD)
8634+
8635+
8636+#define vx_cres_avail(v, n, r) \
8637+ __vx_cres_avail(v, r, n, __FILE__, __LINE__)
8638+
8639+
8640+#define vx_nproc_avail(n) \
8641+ vx_cres_avail(current_vx_info(), n, RLIMIT_NPROC)
8642+
8643+#define vx_files_avail(n) \
8644+ vx_cres_avail(current_vx_info(), n, RLIMIT_NOFILE)
8645+
8646+#define vx_locks_avail(n) \
8647+ vx_cres_avail(current_vx_info(), n, RLIMIT_LOCKS)
8648+
8649+#define vx_openfd_avail(n) \
8650+ vx_cres_avail(current_vx_info(), n, VLIMIT_OPENFD)
8651+
8652+
8653+/* dentry limits */
8654+
8655+#define vx_dentry_inc(d) do { \
8656+ if (d_count(d) == 1) \
8657+ vx_acc_cres(current_vx_info(), 1, d, VLIMIT_DENTRY); \
8658+ } while (0)
8659+
8660+#define vx_dentry_dec(d) do { \
8661+ if (d_count(d) == 0) \
8662+ vx_acc_cres(current_vx_info(),-1, d, VLIMIT_DENTRY); \
8663+ } while (0)
8664+
8665+#define vx_dentry_avail(n) \
8666+ vx_cres_avail(current_vx_info(), n, VLIMIT_DENTRY)
8667+
8668+
8669+/* socket limits */
8670+
8671+#define vx_sock_inc(s) \
8672+ vx_acc_cres((s)->sk_vx_info, 1, s, VLIMIT_NSOCK)
8673+
8674+#define vx_sock_dec(s) \
8675+ vx_acc_cres((s)->sk_vx_info,-1, s, VLIMIT_NSOCK)
8676+
8677+#define vx_sock_avail(n) \
8678+ vx_cres_avail(current_vx_info(), n, VLIMIT_NSOCK)
8679+
8680+
8681+/* ipc resource limits */
8682+
8683+#define vx_ipcmsg_add(v, u, a) \
8684+ vx_add_cres(v, a, u, RLIMIT_MSGQUEUE)
8685+
8686+#define vx_ipcmsg_sub(v, u, a) \
8687+ vx_sub_cres(v, a, u, RLIMIT_MSGQUEUE)
8688+
8689+#define vx_ipcmsg_avail(v, a) \
8690+ vx_cres_avail(v, a, RLIMIT_MSGQUEUE)
8691+
8692+
8693+#define vx_ipcshm_add(v, k, a) \
8694+ vx_add_cres(v, a, (void *)(long)(k), VLIMIT_SHMEM)
8695+
8696+#define vx_ipcshm_sub(v, k, a) \
8697+ vx_sub_cres(v, a, (void *)(long)(k), VLIMIT_SHMEM)
8698+
8699+#define vx_ipcshm_avail(v, a) \
8700+ vx_cres_avail(v, a, VLIMIT_SHMEM)
8701+
8702+
8703+#define vx_semary_inc(a) \
8704+ vx_acc_cres(current_vx_info(), 1, a, VLIMIT_SEMARY)
8705+
8706+#define vx_semary_dec(a) \
8707+ vx_acc_cres(current_vx_info(), -1, a, VLIMIT_SEMARY)
8708+
8709+
8710+#define vx_nsems_add(a,n) \
8711+ vx_add_cres(current_vx_info(), n, a, VLIMIT_NSEMS)
8712+
8713+#define vx_nsems_sub(a,n) \
8714+ vx_sub_cres(current_vx_info(), n, a, VLIMIT_NSEMS)
8715+
8716+
8717+#else
8718+#warning duplicate inclusion
8719+#endif
8720diff -NurpP --minimal linux-4.4.116/include/linux/vs_network.h linux-4.4.116-vs2.3.9.7/include/linux/vs_network.h
8721--- linux-4.4.116/include/linux/vs_network.h 1970-01-01 00:00:00.000000000 +0000
8722+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_network.h 2018-01-09 16:36:32.000000000 +0000
8723@@ -0,0 +1,169 @@
8724+#ifndef _NX_VS_NETWORK_H
8725+#define _NX_VS_NETWORK_H
8726+
8727+#include "vserver/context.h"
8728+#include "vserver/network.h"
8729+#include "vserver/base.h"
8730+#include "vserver/check.h"
8731+#include "vserver/debug.h"
8732+
8733+#include <linux/sched.h>
8734+
8735+
8736+#define get_nx_info(i) __get_nx_info(i, __FILE__, __LINE__)
8737+
8738+static inline struct nx_info *__get_nx_info(struct nx_info *nxi,
8739+ const char *_file, int _line)
8740+{
8741+ if (!nxi)
8742+ return NULL;
8743+
8744+ vxlprintk(VXD_CBIT(nid, 2), "get_nx_info(%p[#%d.%d])",
8745+ nxi, nxi ? nxi->nx_id : 0,
8746+ nxi ? atomic_read(&nxi->nx_usecnt) : 0,
8747+ _file, _line);
8748+
8749+ atomic_inc(&nxi->nx_usecnt);
8750+ return nxi;
8751+}
8752+
8753+
8754+extern void free_nx_info(struct nx_info *);
8755+
8756+#define put_nx_info(i) __put_nx_info(i, __FILE__, __LINE__)
8757+
8758+static inline void __put_nx_info(struct nx_info *nxi, const char *_file, int _line)
8759+{
8760+ if (!nxi)
8761+ return;
8762+
8763+ vxlprintk(VXD_CBIT(nid, 2), "put_nx_info(%p[#%d.%d])",
8764+ nxi, nxi ? nxi->nx_id : 0,
8765+ nxi ? atomic_read(&nxi->nx_usecnt) : 0,
8766+ _file, _line);
8767+
8768+ if (atomic_dec_and_test(&nxi->nx_usecnt))
8769+ free_nx_info(nxi);
8770+}
8771+
8772+
8773+#define init_nx_info(p, i) __init_nx_info(p, i, __FILE__, __LINE__)
8774+
8775+static inline void __init_nx_info(struct nx_info **nxp, struct nx_info *nxi,
8776+ const char *_file, int _line)
8777+{
8778+ if (nxi) {
8779+ vxlprintk(VXD_CBIT(nid, 3),
8780+ "init_nx_info(%p[#%d.%d])",
8781+ nxi, nxi ? nxi->nx_id : 0,
8782+ nxi ? atomic_read(&nxi->nx_usecnt) : 0,
8783+ _file, _line);
8784+
8785+ atomic_inc(&nxi->nx_usecnt);
8786+ }
8787+ *nxp = nxi;
8788+}
8789+
8790+
8791+#define set_nx_info(p, i) __set_nx_info(p, i, __FILE__, __LINE__)
8792+
8793+static inline void __set_nx_info(struct nx_info **nxp, struct nx_info *nxi,
8794+ const char *_file, int _line)
8795+{
8796+ struct nx_info *nxo;
8797+
8798+ if (!nxi)
8799+ return;
8800+
8801+ vxlprintk(VXD_CBIT(nid, 3), "set_nx_info(%p[#%d.%d])",
8802+ nxi, nxi ? nxi->nx_id : 0,
8803+ nxi ? atomic_read(&nxi->nx_usecnt) : 0,
8804+ _file, _line);
8805+
8806+ atomic_inc(&nxi->nx_usecnt);
8807+ nxo = xchg(nxp, nxi);
8808+ BUG_ON(nxo);
8809+}
8810+
8811+#define clr_nx_info(p) __clr_nx_info(p, __FILE__, __LINE__)
8812+
8813+static inline void __clr_nx_info(struct nx_info **nxp,
8814+ const char *_file, int _line)
8815+{
8816+ struct nx_info *nxo;
8817+
8818+ nxo = xchg(nxp, NULL);
8819+ if (!nxo)
8820+ return;
8821+
8822+ vxlprintk(VXD_CBIT(nid, 3), "clr_nx_info(%p[#%d.%d])",
8823+ nxo, nxo ? nxo->nx_id : 0,
8824+ nxo ? atomic_read(&nxo->nx_usecnt) : 0,
8825+ _file, _line);
8826+
8827+ if (atomic_dec_and_test(&nxo->nx_usecnt))
8828+ free_nx_info(nxo);
8829+}
8830+
8831+
8832+#define claim_nx_info(v, p) __claim_nx_info(v, p, __FILE__, __LINE__)
8833+
8834+static inline void __claim_nx_info(struct nx_info *nxi,
8835+ struct task_struct *task, const char *_file, int _line)
8836+{
8837+ vxlprintk(VXD_CBIT(nid, 3), "claim_nx_info(%p[#%d.%d.%d]) %p",
8838+ nxi, nxi ? nxi->nx_id : 0,
8839+ nxi?atomic_read(&nxi->nx_usecnt):0,
8840+ nxi?atomic_read(&nxi->nx_tasks):0,
8841+ task, _file, _line);
8842+
8843+ atomic_inc(&nxi->nx_tasks);
8844+}
8845+
8846+
8847+extern void unhash_nx_info(struct nx_info *);
8848+
8849+#define release_nx_info(v, p) __release_nx_info(v, p, __FILE__, __LINE__)
8850+
8851+static inline void __release_nx_info(struct nx_info *nxi,
8852+ struct task_struct *task, const char *_file, int _line)
8853+{
8854+ vxlprintk(VXD_CBIT(nid, 3), "release_nx_info(%p[#%d.%d.%d]) %p",
8855+ nxi, nxi ? nxi->nx_id : 0,
8856+ nxi ? atomic_read(&nxi->nx_usecnt) : 0,
8857+ nxi ? atomic_read(&nxi->nx_tasks) : 0,
8858+ task, _file, _line);
8859+
8860+ might_sleep();
8861+
8862+ if (atomic_dec_and_test(&nxi->nx_tasks))
8863+ unhash_nx_info(nxi);
8864+}
8865+
8866+
8867+#define task_get_nx_info(i) __task_get_nx_info(i, __FILE__, __LINE__)
8868+
8869+static __inline__ struct nx_info *__task_get_nx_info(struct task_struct *p,
8870+ const char *_file, int _line)
8871+{
8872+ struct nx_info *nxi;
8873+
8874+ task_lock(p);
8875+ vxlprintk(VXD_CBIT(nid, 5), "task_get_nx_info(%p)",
8876+ p, _file, _line);
8877+ nxi = __get_nx_info(p->nx_info, _file, _line);
8878+ task_unlock(p);
8879+ return nxi;
8880+}
8881+
8882+
8883+static inline void exit_nx_info(struct task_struct *p)
8884+{
8885+ if (p->nx_info)
8886+ release_nx_info(p->nx_info, p);
8887+}
8888+
8889+
8890+#else
8891+#warning duplicate inclusion
8892+#endif
8893diff -NurpP --minimal linux-4.4.116/include/linux/vs_pid.h linux-4.4.116-vs2.3.9.7/include/linux/vs_pid.h
8894--- linux-4.4.116/include/linux/vs_pid.h 1970-01-01 00:00:00.000000000 +0000
8895+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_pid.h 2018-01-09 16:36:32.000000000 +0000
8896@@ -0,0 +1,50 @@
8897+#ifndef _VS_PID_H
8898+#define _VS_PID_H
8899+
8900+#include "vserver/base.h"
8901+#include "vserver/check.h"
8902+#include "vserver/context.h"
8903+#include "vserver/debug.h"
8904+#include "vserver/pid.h"
8905+#include <linux/pid_namespace.h>
8906+
8907+
8908+#define VXF_FAKE_INIT (VXF_INFO_INIT | VXF_STATE_INIT)
8909+
8910+static inline
8911+int vx_proc_task_visible(struct task_struct *task)
8912+{
8913+ if ((task->pid == 1) &&
8914+ !vx_flags(VXF_FAKE_INIT, VXF_FAKE_INIT))
8915+ /* show a blend through init */
8916+ goto visible;
8917+ if (vx_check(vx_task_xid(task), VS_WATCH | VS_IDENT))
8918+ goto visible;
8919+ return 0;
8920+visible:
8921+ return 1;
8922+}
8923+
8924+#define find_task_by_real_pid(pid) find_task_by_pid_ns(pid, &init_pid_ns)
8925+
8926+
8927+static inline
8928+struct task_struct *vx_get_proc_task(struct inode *inode, struct pid *pid)
8929+{
8930+ struct task_struct *task = get_pid_task(pid, PIDTYPE_PID);
8931+
8932+ if (task && !vx_proc_task_visible(task)) {
8933+ vxdprintk(VXD_CBIT(misc, 6),
8934+ "dropping task (get) %p[#%u,%u] for %p[#%u,%u]",
8935+ task, task->xid, task->pid,
8936+ current, current->xid, current->pid);
8937+ put_task_struct(task);
8938+ task = NULL;
8939+ }
8940+ return task;
8941+}
8942+
8943+
8944+#else
8945+#warning duplicate inclusion
8946+#endif
8947diff -NurpP --minimal linux-4.4.116/include/linux/vs_sched.h linux-4.4.116-vs2.3.9.7/include/linux/vs_sched.h
8948--- linux-4.4.116/include/linux/vs_sched.h 1970-01-01 00:00:00.000000000 +0000
8949+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_sched.h 2018-01-09 16:36:32.000000000 +0000
8950@@ -0,0 +1,40 @@
8951+#ifndef _VS_SCHED_H
8952+#define _VS_SCHED_H
8953+
8954+#include "vserver/base.h"
8955+#include "vserver/context.h"
8956+#include "vserver/sched.h"
8957+
8958+
8959+#define MAX_PRIO_BIAS 20
8960+#define MIN_PRIO_BIAS -20
8961+
8962+static inline
8963+int vx_adjust_prio(struct task_struct *p, int prio, int max_user)
8964+{
8965+ struct vx_info *vxi = p->vx_info;
8966+
8967+ if (vxi)
8968+ prio += vx_cpu(vxi, sched_pc).prio_bias;
8969+ return prio;
8970+}
8971+
8972+static inline void vx_account_user(struct vx_info *vxi,
8973+ cputime_t cputime, int nice)
8974+{
8975+ if (!vxi)
8976+ return;
8977+ vx_cpu(vxi, sched_pc).user_ticks += cputime;
8978+}
8979+
8980+static inline void vx_account_system(struct vx_info *vxi,
8981+ cputime_t cputime, int idle)
8982+{
8983+ if (!vxi)
8984+ return;
8985+ vx_cpu(vxi, sched_pc).sys_ticks += cputime;
8986+}
8987+
8988+#else
8989+#warning duplicate inclusion
8990+#endif
8991diff -NurpP --minimal linux-4.4.116/include/linux/vs_socket.h linux-4.4.116-vs2.3.9.7/include/linux/vs_socket.h
8992--- linux-4.4.116/include/linux/vs_socket.h 1970-01-01 00:00:00.000000000 +0000
8993+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_socket.h 2018-01-09 16:36:32.000000000 +0000
8994@@ -0,0 +1,67 @@
8995+#ifndef _VS_SOCKET_H
8996+#define _VS_SOCKET_H
8997+
8998+#include "vserver/debug.h"
8999+#include "vserver/base.h"
9000+#include "vserver/cacct.h"
9001+#include "vserver/context.h"
9002+#include "vserver/tag.h"
9003+
9004+
9005+/* socket accounting */
9006+
9007+#include <linux/socket.h>
9008+
9009+static inline int vx_sock_type(int family)
9010+{
9011+ switch (family) {
9012+ case PF_UNSPEC:
9013+ return VXA_SOCK_UNSPEC;
9014+ case PF_UNIX:
9015+ return VXA_SOCK_UNIX;
9016+ case PF_INET:
9017+ return VXA_SOCK_INET;
9018+ case PF_INET6:
9019+ return VXA_SOCK_INET6;
9020+ case PF_PACKET:
9021+ return VXA_SOCK_PACKET;
9022+ default:
9023+ return VXA_SOCK_OTHER;
9024+ }
9025+}
9026+
9027+#define vx_acc_sock(v, f, p, s) \
9028+ __vx_acc_sock(v, f, p, s, __FILE__, __LINE__)
9029+
9030+static inline void __vx_acc_sock(struct vx_info *vxi,
9031+ int family, int pos, int size, char *file, int line)
9032+{
9033+ if (vxi) {
9034+ int type = vx_sock_type(family);
9035+
9036+ atomic_long_inc(&vxi->cacct.sock[type][pos].count);
9037+ atomic_long_add(size, &vxi->cacct.sock[type][pos].total);
9038+ }
9039+}
9040+
9041+#define vx_sock_recv(sk, s) \
9042+ vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 0, s)
9043+#define vx_sock_send(sk, s) \
9044+ vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 1, s)
9045+#define vx_sock_fail(sk, s) \
9046+ vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 2, s)
9047+
9048+
9049+#define sock_vx_init(s) do { \
9050+ (s)->sk_xid = 0; \
9051+ (s)->sk_vx_info = NULL; \
9052+ } while (0)
9053+
9054+#define sock_nx_init(s) do { \
9055+ (s)->sk_nid = 0; \
9056+ (s)->sk_nx_info = NULL; \
9057+ } while (0)
9058+
9059+#else
9060+#warning duplicate inclusion
9061+#endif
9062diff -NurpP --minimal linux-4.4.116/include/linux/vs_tag.h linux-4.4.116-vs2.3.9.7/include/linux/vs_tag.h
9063--- linux-4.4.116/include/linux/vs_tag.h 1970-01-01 00:00:00.000000000 +0000
9064+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_tag.h 2018-01-09 16:36:32.000000000 +0000
9065@@ -0,0 +1,47 @@
9066+#ifndef _VS_TAG_H
9067+#define _VS_TAG_H
9068+
9069+#include <linux/vserver/tag.h>
9070+
9071+/* check conditions */
9072+
9073+#define DX_ADMIN 0x0001
9074+#define DX_WATCH 0x0002
9075+#define DX_HOSTID 0x0008
9076+
9077+#define DX_IDENT 0x0010
9078+
9079+#define DX_ARG_MASK 0x0010
9080+
9081+
9082+#define dx_task_tag(t) ((t)->tag)
9083+
9084+#define dx_current_tag() dx_task_tag(current)
9085+
9086+#define dx_check(c, m) __dx_check(dx_current_tag(), c, m)
9087+
9088+#define dx_weak_check(c, m) ((m) ? dx_check(c, m) : 1)
9089+
9090+
9091+/*
9092+ * check current context for ADMIN/WATCH and
9093+ * optionally against supplied argument
9094+ */
9095+static inline int __dx_check(vtag_t cid, vtag_t id, unsigned int mode)
9096+{
9097+ if (mode & DX_ARG_MASK) {
9098+ if ((mode & DX_IDENT) && (id == cid))
9099+ return 1;
9100+ }
9101+ return (((mode & DX_ADMIN) && (cid == 0)) ||
9102+ ((mode & DX_WATCH) && (cid == 1)) ||
9103+ ((mode & DX_HOSTID) && (id == 0)));
9104+}
9105+
9106+struct inode;
9107+int dx_permission(const struct inode *inode, int mask);
9108+
9109+
9110+#else
9111+#warning duplicate inclusion
9112+#endif
9113diff -NurpP --minimal linux-4.4.116/include/linux/vs_time.h linux-4.4.116-vs2.3.9.7/include/linux/vs_time.h
9114--- linux-4.4.116/include/linux/vs_time.h 1970-01-01 00:00:00.000000000 +0000
9115+++ linux-4.4.116-vs2.3.9.7/include/linux/vs_time.h 2018-01-09 16:36:32.000000000 +0000
9116@@ -0,0 +1,19 @@
9117+#ifndef _VS_TIME_H
9118+#define _VS_TIME_H
9119+
9120+
9121+/* time faking stuff */
9122+
9123+#ifdef CONFIG_VSERVER_VTIME
9124+
9125+extern void vx_adjust_timespec(struct timespec *ts);
9126+extern int vx_settimeofday(const struct timespec *ts);
9127+
9128+#else
9129+#define vx_adjust_timespec(t) do { } while (0)
9130+#define vx_settimeofday(t) do_settimeofday(t)
9131+#endif
9132+
9133+#else
9134+#warning duplicate inclusion
9135+#endif
9136diff -NurpP --minimal linux-4.4.116/include/linux/vserver/base.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/base.h
9137--- linux-4.4.116/include/linux/vserver/base.h 1970-01-01 00:00:00.000000000 +0000
9138+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/base.h 2018-01-09 16:36:32.000000000 +0000
9139@@ -0,0 +1,184 @@
9140+#ifndef _VSERVER_BASE_H
9141+#define _VSERVER_BASE_H
9142+
9143+
9144+/* context state changes */
9145+
9146+enum {
9147+ VSC_STARTUP = 1,
9148+ VSC_SHUTDOWN,
9149+
9150+ VSC_NETUP,
9151+ VSC_NETDOWN,
9152+};
9153+
9154+
9155+
9156+#define vx_task_xid(t) ((t)->xid)
9157+
9158+#define vx_current_xid() vx_task_xid(current)
9159+
9160+#define current_vx_info() (current->vx_info)
9161+
9162+
9163+#define nx_task_nid(t) ((t)->nid)
9164+
9165+#define nx_current_nid() nx_task_nid(current)
9166+
9167+#define current_nx_info() (current->nx_info)
9168+
9169+
9170+/* generic flag merging */
9171+
9172+#define vs_check_flags(v, m, f) (((v) & (m)) ^ (f))
9173+
9174+#define vs_mask_flags(v, f, m) (((v) & ~(m)) | ((f) & (m)))
9175+
9176+#define vs_mask_mask(v, f, m) (((v) & ~(m)) | ((v) & (f) & (m)))
9177+
9178+#define vs_check_bit(v, n) ((v) & (1LL << (n)))
9179+
9180+
9181+/* context flags */
9182+
9183+#define __vx_flags(v) ((v) ? (v)->vx_flags : 0)
9184+
9185+#define vx_current_flags() __vx_flags(current_vx_info())
9186+
9187+#define vx_info_flags(v, m, f) \
9188+ vs_check_flags(__vx_flags(v), m, f)
9189+
9190+#define task_vx_flags(t, m, f) \
9191+ ((t) && vx_info_flags((t)->vx_info, m, f))
9192+
9193+#define vx_flags(m, f) vx_info_flags(current_vx_info(), m, f)
9194+
9195+
9196+/* context caps */
9197+
9198+#define __vx_ccaps(v) ((v) ? (v)->vx_ccaps : 0)
9199+
9200+#define vx_current_ccaps() __vx_ccaps(current_vx_info())
9201+
9202+#define vx_info_ccaps(v, c) (__vx_ccaps(v) & (c))
9203+
9204+#define vx_ccaps(c) vx_info_ccaps(current_vx_info(), (c))
9205+
9206+
9207+
9208+/* network flags */
9209+
9210+#define __nx_flags(n) ((n) ? (n)->nx_flags : 0)
9211+
9212+#define nx_current_flags() __nx_flags(current_nx_info())
9213+
9214+#define nx_info_flags(n, m, f) \
9215+ vs_check_flags(__nx_flags(n), m, f)
9216+
9217+#define task_nx_flags(t, m, f) \
9218+ ((t) && nx_info_flags((t)->nx_info, m, f))
9219+
9220+#define nx_flags(m, f) nx_info_flags(current_nx_info(), m, f)
9221+
9222+
9223+/* network caps */
9224+
9225+#define __nx_ncaps(n) ((n) ? (n)->nx_ncaps : 0)
9226+
9227+#define nx_current_ncaps() __nx_ncaps(current_nx_info())
9228+
9229+#define nx_info_ncaps(n, c) (__nx_ncaps(n) & (c))
9230+
9231+#define nx_ncaps(c) nx_info_ncaps(current_nx_info(), c)
9232+
9233+
9234+/* context mask capabilities */
9235+
9236+#define __vx_mcaps(v) ((v) ? (v)->vx_ccaps >> 32UL : ~0 )
9237+
9238+#define vx_info_mcaps(v, c) (__vx_mcaps(v) & (c))
9239+
9240+#define vx_mcaps(c) vx_info_mcaps(current_vx_info(), c)
9241+
9242+
9243+/* context bcap mask */
9244+
9245+#define __vx_bcaps(v) ((v)->vx_bcaps)
9246+
9247+#define vx_current_bcaps() __vx_bcaps(current_vx_info())
9248+
9249+
9250+/* mask given bcaps */
9251+
9252+#define vx_info_mbcaps(v, c) ((v) ? cap_intersect(__vx_bcaps(v), c) : c)
9253+
9254+#define vx_mbcaps(c) vx_info_mbcaps(current_vx_info(), c)
9255+
9256+
9257+/* masked cap_bset */
9258+
9259+#define vx_info_cap_bset(v) vx_info_mbcaps(v, current->cap_bset)
9260+
9261+#define vx_current_cap_bset() vx_info_cap_bset(current_vx_info())
9262+
9263+#if 0
9264+#define vx_info_mbcap(v, b) \
9265+ (!vx_info_flags(v, VXF_STATE_SETUP, 0) ? \
9266+ vx_info_bcaps(v, b) : (b))
9267+
9268+#define task_vx_mbcap(t, b) \
9269+ vx_info_mbcap((t)->vx_info, (t)->b)
9270+
9271+#define vx_mbcap(b) task_vx_mbcap(current, b)
9272+#endif
9273+
9274+#define vx_cap_raised(v, c, f) cap_raised(vx_info_mbcaps(v, c), f)
9275+
9276+#define vx_capable(b, c) (capable(b) || \
9277+ (cap_raised(current_cap(), b) && vx_ccaps(c)))
9278+
9279+#define vx_ns_capable(n, b, c) (ns_capable(n, b) || \
9280+ (cap_raised(current_cap(), b) && vx_ccaps(c)))
9281+
9282+#define nx_capable(b, c) (capable(b) || \
9283+ (cap_raised(current_cap(), b) && nx_ncaps(c)))
9284+
9285+#define nx_ns_capable(n, b, c) (ns_capable(n, b) || \
9286+ (cap_raised(current_cap(), b) && nx_ncaps(c)))
9287+
9288+#define vx_task_initpid(t, n) \
9289+ ((t)->vx_info && \
9290+ ((t)->vx_info->vx_initpid == (n)))
9291+
9292+#define vx_current_initpid(n) vx_task_initpid(current, n)
9293+
9294+
9295+/* context unshare mask */
9296+
9297+#define __vx_umask(v) ((v)->vx_umask)
9298+
9299+#define vx_current_umask() __vx_umask(current_vx_info())
9300+
9301+#define vx_can_unshare(b, f) (capable(b) || \
9302+ (cap_raised(current_cap(), b) && \
9303+ !((f) & ~vx_current_umask())))
9304+
9305+#define vx_ns_can_unshare(n, b, f) (ns_capable(n, b) || \
9306+ (cap_raised(current_cap(), b) && \
9307+ !((f) & ~vx_current_umask())))
9308+
9309+#define __vx_wmask(v) ((v)->vx_wmask)
9310+
9311+#define vx_current_wmask() __vx_wmask(current_vx_info())
9312+
9313+
9314+#define __vx_state(v) ((v) ? ((v)->vx_state) : 0)
9315+
9316+#define vx_info_state(v, m) (__vx_state(v) & (m))
9317+
9318+
9319+#define __nx_state(n) ((n) ? ((n)->nx_state) : 0)
9320+
9321+#define nx_info_state(n, m) (__nx_state(n) & (m))
9322+
9323+#endif
9324diff -NurpP --minimal linux-4.4.116/include/linux/vserver/cacct.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/cacct.h
9325--- linux-4.4.116/include/linux/vserver/cacct.h 1970-01-01 00:00:00.000000000 +0000
9326+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/cacct.h 2018-01-09 16:36:32.000000000 +0000
9327@@ -0,0 +1,15 @@
9328+#ifndef _VSERVER_CACCT_H
9329+#define _VSERVER_CACCT_H
9330+
9331+
9332+enum sock_acc_field {
9333+ VXA_SOCK_UNSPEC = 0,
9334+ VXA_SOCK_UNIX,
9335+ VXA_SOCK_INET,
9336+ VXA_SOCK_INET6,
9337+ VXA_SOCK_PACKET,
9338+ VXA_SOCK_OTHER,
9339+ VXA_SOCK_SIZE /* array size */
9340+};
9341+
9342+#endif /* _VSERVER_CACCT_H */
9343diff -NurpP --minimal linux-4.4.116/include/linux/vserver/cacct_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/cacct_cmd.h
9344--- linux-4.4.116/include/linux/vserver/cacct_cmd.h 1970-01-01 00:00:00.000000000 +0000
9345+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/cacct_cmd.h 2018-01-09 16:36:32.000000000 +0000
9346@@ -0,0 +1,10 @@
9347+#ifndef _VSERVER_CACCT_CMD_H
9348+#define _VSERVER_CACCT_CMD_H
9349+
9350+
9351+#include <linux/compiler.h>
9352+#include <uapi/vserver/cacct_cmd.h>
9353+
9354+extern int vc_sock_stat(struct vx_info *, void __user *);
9355+
9356+#endif /* _VSERVER_CACCT_CMD_H */
9357diff -NurpP --minimal linux-4.4.116/include/linux/vserver/cacct_def.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/cacct_def.h
9358--- linux-4.4.116/include/linux/vserver/cacct_def.h 1970-01-01 00:00:00.000000000 +0000
9359+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/cacct_def.h 2018-01-09 16:36:32.000000000 +0000
9360@@ -0,0 +1,43 @@
9361+#ifndef _VSERVER_CACCT_DEF_H
9362+#define _VSERVER_CACCT_DEF_H
9363+
9364+#include <asm/atomic.h>
9365+#include <linux/vserver/cacct.h>
9366+
9367+
9368+struct _vx_sock_acc {
9369+ atomic_long_t count;
9370+ atomic_long_t total;
9371+};
9372+
9373+/* context sub struct */
9374+
9375+struct _vx_cacct {
9376+ struct _vx_sock_acc sock[VXA_SOCK_SIZE][3];
9377+ atomic_t slab[8];
9378+ atomic_t page[6][8];
9379+};
9380+
9381+#ifdef CONFIG_VSERVER_DEBUG
9382+
9383+static inline void __dump_vx_cacct(struct _vx_cacct *cacct)
9384+{
9385+ int i, j;
9386+
9387+ printk("\t_vx_cacct:");
9388+ for (i = 0; i < 6; i++) {
9389+ struct _vx_sock_acc *ptr = cacct->sock[i];
9390+
9391+ printk("\t [%d] =", i);
9392+ for (j = 0; j < 3; j++) {
9393+ printk(" [%d] = %8lu, %8lu", j,
9394+ atomic_long_read(&ptr[j].count),
9395+ atomic_long_read(&ptr[j].total));
9396+ }
9397+ printk("\n");
9398+ }
9399+}
9400+
9401+#endif
9402+
9403+#endif /* _VSERVER_CACCT_DEF_H */
9404diff -NurpP --minimal linux-4.4.116/include/linux/vserver/cacct_int.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/cacct_int.h
9405--- linux-4.4.116/include/linux/vserver/cacct_int.h 1970-01-01 00:00:00.000000000 +0000
9406+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/cacct_int.h 2018-01-09 16:36:32.000000000 +0000
9407@@ -0,0 +1,17 @@
9408+#ifndef _VSERVER_CACCT_INT_H
9409+#define _VSERVER_CACCT_INT_H
9410+
9411+static inline
9412+unsigned long vx_sock_count(struct _vx_cacct *cacct, int type, int pos)
9413+{
9414+ return atomic_long_read(&cacct->sock[type][pos].count);
9415+}
9416+
9417+
9418+static inline
9419+unsigned long vx_sock_total(struct _vx_cacct *cacct, int type, int pos)
9420+{
9421+ return atomic_long_read(&cacct->sock[type][pos].total);
9422+}
9423+
9424+#endif /* _VSERVER_CACCT_INT_H */
9425diff -NurpP --minimal linux-4.4.116/include/linux/vserver/check.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/check.h
9426--- linux-4.4.116/include/linux/vserver/check.h 1970-01-01 00:00:00.000000000 +0000
9427+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/check.h 2018-01-09 16:36:32.000000000 +0000
9428@@ -0,0 +1,89 @@
9429+#ifndef _VSERVER_CHECK_H
9430+#define _VSERVER_CHECK_H
9431+
9432+
9433+#define MAX_S_CONTEXT 65535 /* Arbitrary limit */
9434+
9435+#ifdef CONFIG_VSERVER_DYNAMIC_IDS
9436+#define MIN_D_CONTEXT 49152 /* dynamic contexts start here */
9437+#else
9438+#define MIN_D_CONTEXT 65536
9439+#endif
9440+
9441+/* check conditions */
9442+
9443+#define VS_ADMIN 0x0001
9444+#define VS_WATCH 0x0002
9445+#define VS_HIDE 0x0004
9446+#define VS_HOSTID 0x0008
9447+
9448+#define VS_IDENT 0x0010
9449+#define VS_EQUIV 0x0020
9450+#define VS_PARENT 0x0040
9451+#define VS_CHILD 0x0080
9452+
9453+#define VS_ARG_MASK 0x00F0
9454+
9455+#define VS_DYNAMIC 0x0100
9456+#define VS_STATIC 0x0200
9457+
9458+#define VS_ATR_MASK 0x0F00
9459+
9460+#ifdef CONFIG_VSERVER_PRIVACY
9461+#define VS_ADMIN_P (0)
9462+#define VS_WATCH_P (0)
9463+#else
9464+#define VS_ADMIN_P VS_ADMIN
9465+#define VS_WATCH_P VS_WATCH
9466+#endif
9467+
9468+#define VS_HARDIRQ 0x1000
9469+#define VS_SOFTIRQ 0x2000
9470+#define VS_IRQ 0x4000
9471+
9472+#define VS_IRQ_MASK 0xF000
9473+
9474+#include <linux/hardirq.h>
9475+
9476+/*
9477+ * check current context for ADMIN/WATCH and
9478+ * optionally against supplied argument
9479+ */
9480+static inline int __vs_check(int cid, int id, unsigned int mode)
9481+{
9482+ if (mode & VS_ARG_MASK) {
9483+ if ((mode & VS_IDENT) && (id == cid))
9484+ return 1;
9485+ }
9486+ if (mode & VS_ATR_MASK) {
9487+ if ((mode & VS_DYNAMIC) &&
9488+ (id >= MIN_D_CONTEXT) &&
9489+ (id <= MAX_S_CONTEXT))
9490+ return 1;
9491+ if ((mode & VS_STATIC) &&
9492+ (id > 1) && (id < MIN_D_CONTEXT))
9493+ return 1;
9494+ }
9495+ if (mode & VS_IRQ_MASK) {
9496+ if ((mode & VS_IRQ) && unlikely(in_interrupt()))
9497+ return 1;
9498+ if ((mode & VS_HARDIRQ) && unlikely(in_irq()))
9499+ return 1;
9500+ if ((mode & VS_SOFTIRQ) && unlikely(in_softirq()))
9501+ return 1;
9502+ }
9503+ return (((mode & VS_ADMIN) && (cid == 0)) ||
9504+ ((mode & VS_WATCH) && (cid == 1)) ||
9505+ ((mode & VS_HOSTID) && (id == 0)));
9506+}
9507+
9508+#define vx_check(c, m) __vs_check(vx_current_xid(), c, (m) | VS_IRQ)
9509+
9510+#define vx_weak_check(c, m) ((m) ? vx_check(c, m) : 1)
9511+
9512+
9513+#define nx_check(c, m) __vs_check(nx_current_nid(), c, m)
9514+
9515+#define nx_weak_check(c, m) ((m) ? nx_check(c, m) : 1)
9516+
9517+#endif
9518diff -NurpP --minimal linux-4.4.116/include/linux/vserver/context.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/context.h
9519--- linux-4.4.116/include/linux/vserver/context.h 1970-01-01 00:00:00.000000000 +0000
9520+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/context.h 2018-01-09 16:36:32.000000000 +0000
9521@@ -0,0 +1,110 @@
9522+#ifndef _VSERVER_CONTEXT_H
9523+#define _VSERVER_CONTEXT_H
9524+
9525+
9526+#include <linux/list.h>
9527+#include <linux/spinlock.h>
9528+#include <linux/rcupdate.h>
9529+#include <uapi/vserver/context.h>
9530+
9531+#include "limit_def.h"
9532+#include "sched_def.h"
9533+#include "cvirt_def.h"
9534+#include "cacct_def.h"
9535+#include "device_def.h"
9536+
9537+#define VX_SPACES 2
9538+
9539+struct _vx_info_pc {
9540+ struct _vx_sched_pc sched_pc;
9541+ struct _vx_cvirt_pc cvirt_pc;
9542+};
9543+
9544+struct _vx_space {
9545+ unsigned long vx_nsmask; /* assignment mask */
9546+ struct nsproxy *vx_nsproxy; /* private namespaces */
9547+ struct fs_struct *vx_fs; /* private namespace fs */
9548+ const struct cred *vx_cred; /* task credentials */
9549+};
9550+
9551+struct vx_info {
9552+ struct hlist_node vx_hlist; /* linked list of contexts */
9553+ vxid_t vx_id; /* context id */
9554+ atomic_t vx_usecnt; /* usage count */
9555+ atomic_t vx_tasks; /* tasks count */
9556+ struct vx_info *vx_parent; /* parent context */
9557+ int vx_state; /* context state */
9558+
9559+ struct _vx_space space[VX_SPACES]; /* namespace store */
9560+
9561+ uint64_t vx_flags; /* context flags */
9562+ uint64_t vx_ccaps; /* context caps (vserver) */
9563+ uint64_t vx_umask; /* unshare mask (guest) */
9564+ uint64_t vx_wmask; /* warn mask (guest) */
9565+ kernel_cap_t vx_bcaps; /* bounding caps (system) */
9566+
9567+ struct task_struct *vx_reaper; /* guest reaper process */
9568+ pid_t vx_initpid; /* PID of guest init */
9569+ int64_t vx_badness_bias; /* OOM points bias */
9570+
9571+ struct _vx_limit limit; /* vserver limits */
9572+ struct _vx_sched sched; /* vserver scheduler */
9573+ struct _vx_cvirt cvirt; /* virtual/bias stuff */
9574+ struct _vx_cacct cacct; /* context accounting */
9575+
9576+ struct _vx_device dmap; /* default device map targets */
9577+
9578+#ifndef CONFIG_SMP
9579+ struct _vx_info_pc info_pc; /* per cpu data */
9580+#else
9581+ struct _vx_info_pc *ptr_pc; /* per cpu array */
9582+#endif
9583+
9584+ wait_queue_head_t vx_wait; /* context exit waitqueue */
9585+ int reboot_cmd; /* last sys_reboot() cmd */
9586+ int exit_code; /* last process exit code */
9587+
9588+ char vx_name[65]; /* vserver name */
9589+};
9590+
9591+#ifndef CONFIG_SMP
9592+#define vx_ptr_pc(vxi) (&(vxi)->info_pc)
9593+#define vx_per_cpu(vxi, v, id) vx_ptr_pc(vxi)->v
9594+#else
9595+#define vx_ptr_pc(vxi) ((vxi)->ptr_pc)
9596+#define vx_per_cpu(vxi, v, id) per_cpu_ptr(vx_ptr_pc(vxi), id)->v
9597+#endif
9598+
9599+#define vx_cpu(vxi, v) vx_per_cpu(vxi, v, smp_processor_id())
9600+
9601+
9602+struct vx_info_save {
9603+ struct vx_info *vxi;
9604+ vxid_t xid;
9605+};
9606+
9607+
9608+/* status flags */
9609+
9610+#define VXS_HASHED 0x0001
9611+#define VXS_PAUSED 0x0010
9612+#define VXS_SHUTDOWN 0x0100
9613+#define VXS_HELPER 0x1000
9614+#define VXS_RELEASED 0x8000
9615+
9616+
9617+extern void claim_vx_info(struct vx_info *, struct task_struct *);
9618+extern void release_vx_info(struct vx_info *, struct task_struct *);
9619+
9620+extern struct vx_info *lookup_vx_info(int);
9621+extern struct vx_info *lookup_or_create_vx_info(int);
9622+
9623+extern int get_xid_list(int, unsigned int *, int);
9624+extern int xid_is_hashed(vxid_t);
9625+
9626+extern int vx_migrate_task(struct task_struct *, struct vx_info *, int);
9627+
9628+extern long vs_state_change(struct vx_info *, unsigned int);
9629+
9630+
9631+#endif /* _VSERVER_CONTEXT_H */
9632diff -NurpP --minimal linux-4.4.116/include/linux/vserver/context_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/context_cmd.h
9633--- linux-4.4.116/include/linux/vserver/context_cmd.h 1970-01-01 00:00:00.000000000 +0000
9634+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/context_cmd.h 2018-01-09 16:36:32.000000000 +0000
9635@@ -0,0 +1,33 @@
9636+#ifndef _VSERVER_CONTEXT_CMD_H
9637+#define _VSERVER_CONTEXT_CMD_H
9638+
9639+#include <uapi/vserver/context_cmd.h>
9640+
9641+extern int vc_task_xid(uint32_t);
9642+
9643+extern int vc_vx_info(struct vx_info *, void __user *);
9644+
9645+extern int vc_ctx_stat(struct vx_info *, void __user *);
9646+
9647+extern int vc_ctx_create(uint32_t, void __user *);
9648+extern int vc_ctx_migrate(struct vx_info *, void __user *);
9649+
9650+extern int vc_get_cflags(struct vx_info *, void __user *);
9651+extern int vc_set_cflags(struct vx_info *, void __user *);
9652+
9653+extern int vc_get_ccaps(struct vx_info *, void __user *);
9654+extern int vc_set_ccaps(struct vx_info *, void __user *);
9655+
9656+extern int vc_get_bcaps(struct vx_info *, void __user *);
9657+extern int vc_set_bcaps(struct vx_info *, void __user *);
9658+
9659+extern int vc_get_umask(struct vx_info *, void __user *);
9660+extern int vc_set_umask(struct vx_info *, void __user *);
9661+
9662+extern int vc_get_wmask(struct vx_info *, void __user *);
9663+extern int vc_set_wmask(struct vx_info *, void __user *);
9664+
9665+extern int vc_get_badness(struct vx_info *, void __user *);
9666+extern int vc_set_badness(struct vx_info *, void __user *);
9667+
9668+#endif /* _VSERVER_CONTEXT_CMD_H */
9669diff -NurpP --minimal linux-4.4.116/include/linux/vserver/cvirt.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/cvirt.h
9670--- linux-4.4.116/include/linux/vserver/cvirt.h 1970-01-01 00:00:00.000000000 +0000
9671+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/cvirt.h 2018-01-09 16:36:32.000000000 +0000
9672@@ -0,0 +1,18 @@
9673+#ifndef _VSERVER_CVIRT_H
9674+#define _VSERVER_CVIRT_H
9675+
9676+struct timespec;
9677+
9678+void vx_vsi_boottime(struct timespec *);
9679+
9680+void vx_vsi_uptime(struct timespec *, struct timespec *);
9681+
9682+
9683+struct vx_info;
9684+
9685+void vx_update_load(struct vx_info *);
9686+
9687+
9688+int vx_do_syslog(int, char __user *, int);
9689+
9690+#endif /* _VSERVER_CVIRT_H */
9691diff -NurpP --minimal linux-4.4.116/include/linux/vserver/cvirt_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/cvirt_cmd.h
9692--- linux-4.4.116/include/linux/vserver/cvirt_cmd.h 1970-01-01 00:00:00.000000000 +0000
9693+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/cvirt_cmd.h 2018-01-09 16:36:32.000000000 +0000
9694@@ -0,0 +1,13 @@
9695+#ifndef _VSERVER_CVIRT_CMD_H
9696+#define _VSERVER_CVIRT_CMD_H
9697+
9698+
9699+#include <linux/compiler.h>
9700+#include <uapi/vserver/cvirt_cmd.h>
9701+
9702+extern int vc_set_vhi_name(struct vx_info *, void __user *);
9703+extern int vc_get_vhi_name(struct vx_info *, void __user *);
9704+
9705+extern int vc_virt_stat(struct vx_info *, void __user *);
9706+
9707+#endif /* _VSERVER_CVIRT_CMD_H */
9708diff -NurpP --minimal linux-4.4.116/include/linux/vserver/cvirt_def.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/cvirt_def.h
9709--- linux-4.4.116/include/linux/vserver/cvirt_def.h 1970-01-01 00:00:00.000000000 +0000
9710+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/cvirt_def.h 2018-01-09 16:36:32.000000000 +0000
9711@@ -0,0 +1,80 @@
9712+#ifndef _VSERVER_CVIRT_DEF_H
9713+#define _VSERVER_CVIRT_DEF_H
9714+
9715+#include <linux/jiffies.h>
9716+#include <linux/spinlock.h>
9717+#include <linux/wait.h>
9718+#include <linux/time.h>
9719+#include <asm/atomic.h>
9720+
9721+
9722+struct _vx_usage_stat {
9723+ uint64_t user;
9724+ uint64_t nice;
9725+ uint64_t system;
9726+ uint64_t softirq;
9727+ uint64_t irq;
9728+ uint64_t idle;
9729+ uint64_t iowait;
9730+};
9731+
9732+struct _vx_syslog {
9733+ wait_queue_head_t log_wait;
9734+ spinlock_t logbuf_lock; /* lock for the log buffer */
9735+
9736+ unsigned long log_start; /* next char to be read by syslog() */
9737+ unsigned long con_start; /* next char to be sent to consoles */
9738+ unsigned long log_end; /* most-recently-written-char + 1 */
9739+ unsigned long logged_chars; /* #chars since last read+clear operation */
9740+
9741+ char log_buf[1024];
9742+};
9743+
9744+
9745+/* context sub struct */
9746+
9747+struct _vx_cvirt {
9748+ atomic_t nr_threads; /* number of current threads */
9749+ atomic_t nr_running; /* number of running threads */
9750+ atomic_t nr_uninterruptible; /* number of uninterruptible threads */
9751+
9752+ atomic_t nr_onhold; /* processes on hold */
9753+ uint32_t onhold_last; /* jiffies when put on hold */
9754+
9755+ struct timespec bias_ts; /* time offset to the host */
9756+ struct timespec bias_idle;
9757+ struct timespec bias_uptime; /* context creation point */
9758+ uint64_t bias_clock; /* offset in clock_t */
9759+
9760+ spinlock_t load_lock; /* lock for the load averages */
9761+ atomic_t load_updates; /* nr of load updates done so far */
9762+ uint32_t load_last; /* last time load was calculated */
9763+ uint32_t load[3]; /* load averages 1,5,15 */
9764+
9765+ atomic_t total_forks; /* number of forks so far */
9766+
9767+ struct _vx_syslog syslog;
9768+};
9769+
9770+struct _vx_cvirt_pc {
9771+ struct _vx_usage_stat cpustat;
9772+};
9773+
9774+
9775+#ifdef CONFIG_VSERVER_DEBUG
9776+
9777+static inline void __dump_vx_cvirt(struct _vx_cvirt *cvirt)
9778+{
9779+ printk("\t_vx_cvirt:\n");
9780+ printk("\t threads: %4d, %4d, %4d, %4d\n",
9781+ atomic_read(&cvirt->nr_threads),
9782+ atomic_read(&cvirt->nr_running),
9783+ atomic_read(&cvirt->nr_uninterruptible),
9784+ atomic_read(&cvirt->nr_onhold));
9785+ /* add rest here */
9786+ printk("\t total_forks = %d\n", atomic_read(&cvirt->total_forks));
9787+}
9788+
9789+#endif
9790+
9791+#endif /* _VSERVER_CVIRT_DEF_H */
9792diff -NurpP --minimal linux-4.4.116/include/linux/vserver/debug.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/debug.h
9793--- linux-4.4.116/include/linux/vserver/debug.h 1970-01-01 00:00:00.000000000 +0000
9794+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/debug.h 2018-01-09 16:36:32.000000000 +0000
9795@@ -0,0 +1,146 @@
9796+#ifndef _VSERVER_DEBUG_H
9797+#define _VSERVER_DEBUG_H
9798+
9799+
9800+#define VXD_CBIT(n, m) (vs_debug_ ## n & (1 << (m)))
9801+#define VXD_CMIN(n, m) (vs_debug_ ## n > (m))
9802+#define VXD_MASK(n, m) (vs_debug_ ## n & (m))
9803+
9804+#define VXD_DEV(d) (d), (d)->bd_inode->i_ino, \
9805+ imajor((d)->bd_inode), iminor((d)->bd_inode)
9806+#define VXF_DEV "%p[%lu,%d:%d]"
9807+
9808+#if defined(CONFIG_QUOTES_UTF8)
9809+#define VS_Q_LQM "\xc2\xbb"
9810+#define VS_Q_RQM "\xc2\xab"
9811+#elif defined(CONFIG_QUOTES_ASCII)
9812+#define VS_Q_LQM "\x27"
9813+#define VS_Q_RQM "\x27"
9814+#else
9815+#define VS_Q_LQM "\xbb"
9816+#define VS_Q_RQM "\xab"
9817+#endif
9818+
9819+#define VS_Q(f) VS_Q_LQM f VS_Q_RQM
9820+
9821+
9822+#define vxd_path(p) \
9823+ ({ static char _buffer[PATH_MAX]; \
9824+ d_path(p, _buffer, sizeof(_buffer)); })
9825+
9826+#define vxd_cond_path(n) \
9827+ ((n) ? vxd_path(&(n)->path) : "<null>" )
9828+
9829+
9830+#ifdef CONFIG_VSERVER_DEBUG
9831+
9832+extern unsigned int vs_debug_switch;
9833+extern unsigned int vs_debug_xid;
9834+extern unsigned int vs_debug_nid;
9835+extern unsigned int vs_debug_tag;
9836+extern unsigned int vs_debug_net;
9837+extern unsigned int vs_debug_limit;
9838+extern unsigned int vs_debug_cres;
9839+extern unsigned int vs_debug_dlim;
9840+extern unsigned int vs_debug_quota;
9841+extern unsigned int vs_debug_cvirt;
9842+extern unsigned int vs_debug_space;
9843+extern unsigned int vs_debug_perm;
9844+extern unsigned int vs_debug_misc;
9845+
9846+
9847+#define VX_LOGLEVEL "vxD: "
9848+#define VX_PROC_FMT "%p: "
9849+#define VX_PROCESS current
9850+
9851+#define vxdprintk(c, f, x...) \
9852+ do { \
9853+ if (c) \
9854+ printk(VX_LOGLEVEL VX_PROC_FMT f "\n", \
9855+ VX_PROCESS , ##x); \
9856+ } while (0)
9857+
9858+#define vxlprintk(c, f, x...) \
9859+ do { \
9860+ if (c) \
9861+ printk(VX_LOGLEVEL f " @%s:%d\n", x); \
9862+ } while (0)
9863+
9864+#define vxfprintk(c, f, x...) \
9865+ do { \
9866+ if (c) \
9867+ printk(VX_LOGLEVEL f " %s@%s:%d\n", x); \
9868+ } while (0)
9869+
9870+
9871+struct vx_info;
9872+
9873+void dump_vx_info(struct vx_info *, int);
9874+void dump_vx_info_inactive(int);
9875+
9876+#else /* CONFIG_VSERVER_DEBUG */
9877+
9878+#define vs_debug_switch 0
9879+#define vs_debug_xid 0
9880+#define vs_debug_nid 0
9881+#define vs_debug_tag 0
9882+#define vs_debug_net 0
9883+#define vs_debug_limit 0
9884+#define vs_debug_cres 0
9885+#define vs_debug_dlim 0
9886+#define vs_debug_quota 0
9887+#define vs_debug_cvirt 0
9888+#define vs_debug_space 0
9889+#define vs_debug_perm 0
9890+#define vs_debug_misc 0
9891+
9892+#define vxdprintk(x...) do { } while (0)
9893+#define vxlprintk(x...) do { } while (0)
9894+#define vxfprintk(x...) do { } while (0)
9895+
9896+#endif /* CONFIG_VSERVER_DEBUG */
9897+
9898+
9899+#ifdef CONFIG_VSERVER_WARN
9900+
9901+#define VX_WARNLEVEL KERN_WARNING "vxW: "
9902+#define VX_WARN_TASK "[" VS_Q("%s") ",%u:#%u|%u|%u] "
9903+#define VX_WARN_XID "[xid #%u] "
9904+#define VX_WARN_NID "[nid #%u] "
9905+#define VX_WARN_TAG "[tag #%u] "
9906+
9907+#define vxwprintk(c, f, x...) \
9908+ do { \
9909+ if (c) \
9910+ printk(VX_WARNLEVEL f "\n", ##x); \
9911+ } while (0)
9912+
9913+#else /* CONFIG_VSERVER_WARN */
9914+
9915+#define vxwprintk(x...) do { } while (0)
9916+
9917+#endif /* CONFIG_VSERVER_WARN */
9918+
9919+#define vxwprintk_task(c, f, x...) \
9920+ vxwprintk(c, VX_WARN_TASK f, \
9921+ current->comm, current->pid, \
9922+ current->xid, current->nid, \
9923+ current->tag, ##x)
9924+#define vxwprintk_xid(c, f, x...) \
9925+ vxwprintk(c, VX_WARN_XID f, current->xid, x)
9926+#define vxwprintk_nid(c, f, x...) \
9927+ vxwprintk(c, VX_WARN_NID f, current->nid, x)
9928+#define vxwprintk_tag(c, f, x...) \
9929+ vxwprintk(c, VX_WARN_TAG f, current->tag, x)
9930+
9931+#ifdef CONFIG_VSERVER_DEBUG
9932+#define vxd_assert_lock(l) assert_spin_locked(l)
9933+#define vxd_assert(c, f, x...) vxlprintk(!(c), \
9934+ "assertion [" f "] failed.", ##x, __FILE__, __LINE__)
9935+#else
9936+#define vxd_assert_lock(l) do { } while (0)
9937+#define vxd_assert(c, f, x...) do { } while (0)
9938+#endif
9939+
9940+
9941+#endif /* _VSERVER_DEBUG_H */
9942diff -NurpP --minimal linux-4.4.116/include/linux/vserver/debug_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/debug_cmd.h
9943--- linux-4.4.116/include/linux/vserver/debug_cmd.h 1970-01-01 00:00:00.000000000 +0000
9944+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/debug_cmd.h 2018-01-09 16:36:32.000000000 +0000
9945@@ -0,0 +1,37 @@
9946+#ifndef _VSERVER_DEBUG_CMD_H
9947+#define _VSERVER_DEBUG_CMD_H
9948+
9949+#include <uapi/vserver/debug_cmd.h>
9950+
9951+
9952+#ifdef CONFIG_COMPAT
9953+
9954+#include <asm/compat.h>
9955+
9956+struct vcmd_read_history_v0_x32 {
9957+ uint32_t index;
9958+ uint32_t count;
9959+ compat_uptr_t data_ptr;
9960+};
9961+
9962+struct vcmd_read_monitor_v0_x32 {
9963+ uint32_t index;
9964+ uint32_t count;
9965+ compat_uptr_t data_ptr;
9966+};
9967+
9968+#endif /* CONFIG_COMPAT */
9969+
9970+extern int vc_dump_history(uint32_t);
9971+
9972+extern int vc_read_history(uint32_t, void __user *);
9973+extern int vc_read_monitor(uint32_t, void __user *);
9974+
9975+#ifdef CONFIG_COMPAT
9976+
9977+extern int vc_read_history_x32(uint32_t, void __user *);
9978+extern int vc_read_monitor_x32(uint32_t, void __user *);
9979+
9980+#endif /* CONFIG_COMPAT */
9981+
9982+#endif /* _VSERVER_DEBUG_CMD_H */
9983diff -NurpP --minimal linux-4.4.116/include/linux/vserver/device.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/device.h
9984--- linux-4.4.116/include/linux/vserver/device.h 1970-01-01 00:00:00.000000000 +0000
9985+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/device.h 2018-01-09 16:36:32.000000000 +0000
9986@@ -0,0 +1,9 @@
9987+#ifndef _VSERVER_DEVICE_H
9988+#define _VSERVER_DEVICE_H
9989+
9990+
9991+#include <uapi/vserver/device.h>
9992+
9993+#else /* _VSERVER_DEVICE_H */
9994+#warning duplicate inclusion
9995+#endif /* _VSERVER_DEVICE_H */
9996diff -NurpP --minimal linux-4.4.116/include/linux/vserver/device_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/device_cmd.h
9997--- linux-4.4.116/include/linux/vserver/device_cmd.h 1970-01-01 00:00:00.000000000 +0000
9998+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/device_cmd.h 2018-01-09 16:36:32.000000000 +0000
9999@@ -0,0 +1,31 @@
10000+#ifndef _VSERVER_DEVICE_CMD_H
10001+#define _VSERVER_DEVICE_CMD_H
10002+
10003+#include <uapi/vserver/device_cmd.h>
10004+
10005+
10006+#ifdef CONFIG_COMPAT
10007+
10008+#include <asm/compat.h>
10009+
10010+struct vcmd_set_mapping_v0_x32 {
10011+ compat_uptr_t device_ptr;
10012+ compat_uptr_t target_ptr;
10013+ uint32_t flags;
10014+};
10015+
10016+#endif /* CONFIG_COMPAT */
10017+
10018+#include <linux/compiler.h>
10019+
10020+extern int vc_set_mapping(struct vx_info *, void __user *);
10021+extern int vc_unset_mapping(struct vx_info *, void __user *);
10022+
10023+#ifdef CONFIG_COMPAT
10024+
10025+extern int vc_set_mapping_x32(struct vx_info *, void __user *);
10026+extern int vc_unset_mapping_x32(struct vx_info *, void __user *);
10027+
10028+#endif /* CONFIG_COMPAT */
10029+
10030+#endif /* _VSERVER_DEVICE_CMD_H */
10031diff -NurpP --minimal linux-4.4.116/include/linux/vserver/device_def.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/device_def.h
10032--- linux-4.4.116/include/linux/vserver/device_def.h 1970-01-01 00:00:00.000000000 +0000
10033+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/device_def.h 2018-01-09 16:36:32.000000000 +0000
10034@@ -0,0 +1,17 @@
10035+#ifndef _VSERVER_DEVICE_DEF_H
10036+#define _VSERVER_DEVICE_DEF_H
10037+
10038+#include <linux/types.h>
10039+
10040+struct vx_dmap_target {
10041+ dev_t target;
10042+ uint32_t flags;
10043+};
10044+
10045+struct _vx_device {
10046+#ifdef CONFIG_VSERVER_DEVICE
10047+ struct vx_dmap_target targets[2];
10048+#endif
10049+};
10050+
10051+#endif /* _VSERVER_DEVICE_DEF_H */
10052diff -NurpP --minimal linux-4.4.116/include/linux/vserver/dlimit.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/dlimit.h
10053--- linux-4.4.116/include/linux/vserver/dlimit.h 1970-01-01 00:00:00.000000000 +0000
10054+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/dlimit.h 2018-01-09 16:36:32.000000000 +0000
10055@@ -0,0 +1,54 @@
10056+#ifndef _VSERVER_DLIMIT_H
10057+#define _VSERVER_DLIMIT_H
10058+
10059+#include "switch.h"
10060+
10061+
10062+#ifdef __KERNEL__
10063+
10064+/* keep in sync with CDLIM_INFINITY */
10065+
10066+#define DLIM_INFINITY (~0ULL)
10067+
10068+#include <linux/spinlock.h>
10069+#include <linux/rcupdate.h>
10070+
10071+struct super_block;
10072+
10073+struct dl_info {
10074+ struct hlist_node dl_hlist; /* linked list of contexts */
10075+ struct rcu_head dl_rcu; /* the rcu head */
10076+ vtag_t dl_tag; /* context tag */
10077+ atomic_t dl_usecnt; /* usage count */
10078+ atomic_t dl_refcnt; /* reference count */
10079+
10080+ struct super_block *dl_sb; /* associated superblock */
10081+
10082+ spinlock_t dl_lock; /* protect the values */
10083+
10084+ unsigned long long dl_space_used; /* used space in bytes */
10085+ unsigned long long dl_space_total; /* maximum space in bytes */
10086+ unsigned long dl_inodes_used; /* used inodes */
10087+ unsigned long dl_inodes_total; /* maximum inodes */
10088+
10089+ unsigned int dl_nrlmult; /* non root limit mult */
10090+};
10091+
10092+struct rcu_head;
10093+
10094+extern void rcu_free_dl_info(struct rcu_head *);
10095+extern void unhash_dl_info(struct dl_info *);
10096+
10097+extern struct dl_info *locate_dl_info(struct super_block *, vtag_t);
10098+
10099+
10100+struct kstatfs;
10101+
10102+extern void vx_vsi_statfs(struct super_block *, struct kstatfs *);
10103+
10104+typedef uint64_t dlsize_t;
10105+
10106+#endif /* __KERNEL__ */
10107+#else /* _VSERVER_DLIMIT_H */
10108+#warning duplicate inclusion
10109+#endif /* _VSERVER_DLIMIT_H */
10110diff -NurpP --minimal linux-4.4.116/include/linux/vserver/dlimit_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/dlimit_cmd.h
10111--- linux-4.4.116/include/linux/vserver/dlimit_cmd.h 1970-01-01 00:00:00.000000000 +0000
10112+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/dlimit_cmd.h 2018-01-09 16:36:32.000000000 +0000
10113@@ -0,0 +1,46 @@
10114+#ifndef _VSERVER_DLIMIT_CMD_H
10115+#define _VSERVER_DLIMIT_CMD_H
10116+
10117+#include <uapi/vserver/dlimit_cmd.h>
10118+
10119+
10120+#ifdef CONFIG_COMPAT
10121+
10122+#include <asm/compat.h>
10123+
10124+struct vcmd_ctx_dlimit_base_v0_x32 {
10125+ compat_uptr_t name_ptr;
10126+ uint32_t flags;
10127+};
10128+
10129+struct vcmd_ctx_dlimit_v0_x32 {
10130+ compat_uptr_t name_ptr;
10131+ uint32_t space_used; /* used space in kbytes */
10132+ uint32_t space_total; /* maximum space in kbytes */
10133+ uint32_t inodes_used; /* used inodes */
10134+ uint32_t inodes_total; /* maximum inodes */
10135+ uint32_t reserved; /* reserved for root in % */
10136+ uint32_t flags;
10137+};
10138+
10139+#endif /* CONFIG_COMPAT */
10140+
10141+#include <linux/compiler.h>
10142+
10143+extern int vc_add_dlimit(uint32_t, void __user *);
10144+extern int vc_rem_dlimit(uint32_t, void __user *);
10145+
10146+extern int vc_set_dlimit(uint32_t, void __user *);
10147+extern int vc_get_dlimit(uint32_t, void __user *);
10148+
10149+#ifdef CONFIG_COMPAT
10150+
10151+extern int vc_add_dlimit_x32(uint32_t, void __user *);
10152+extern int vc_rem_dlimit_x32(uint32_t, void __user *);
10153+
10154+extern int vc_set_dlimit_x32(uint32_t, void __user *);
10155+extern int vc_get_dlimit_x32(uint32_t, void __user *);
10156+
10157+#endif /* CONFIG_COMPAT */
10158+
10159+#endif /* _VSERVER_DLIMIT_CMD_H */
10160diff -NurpP --minimal linux-4.4.116/include/linux/vserver/global.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/global.h
10161--- linux-4.4.116/include/linux/vserver/global.h 1970-01-01 00:00:00.000000000 +0000
10162+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/global.h 2018-01-09 16:36:32.000000000 +0000
10163@@ -0,0 +1,19 @@
10164+#ifndef _VSERVER_GLOBAL_H
10165+#define _VSERVER_GLOBAL_H
10166+
10167+
10168+extern atomic_t vx_global_ctotal;
10169+extern atomic_t vx_global_cactive;
10170+
10171+extern atomic_t nx_global_ctotal;
10172+extern atomic_t nx_global_cactive;
10173+
10174+extern atomic_t vs_global_nsproxy;
10175+extern atomic_t vs_global_fs;
10176+extern atomic_t vs_global_mnt_ns;
10177+extern atomic_t vs_global_uts_ns;
10178+extern atomic_t vs_global_user_ns;
10179+extern atomic_t vs_global_pid_ns;
10180+
10181+
10182+#endif /* _VSERVER_GLOBAL_H */
10183diff -NurpP --minimal linux-4.4.116/include/linux/vserver/history.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/history.h
10184--- linux-4.4.116/include/linux/vserver/history.h 1970-01-01 00:00:00.000000000 +0000
10185+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/history.h 2018-01-09 16:36:32.000000000 +0000
10186@@ -0,0 +1,197 @@
10187+#ifndef _VSERVER_HISTORY_H
10188+#define _VSERVER_HISTORY_H
10189+
10190+
10191+enum {
10192+ VXH_UNUSED = 0,
10193+ VXH_THROW_OOPS = 1,
10194+
10195+ VXH_GET_VX_INFO,
10196+ VXH_PUT_VX_INFO,
10197+ VXH_INIT_VX_INFO,
10198+ VXH_SET_VX_INFO,
10199+ VXH_CLR_VX_INFO,
10200+ VXH_CLAIM_VX_INFO,
10201+ VXH_RELEASE_VX_INFO,
10202+ VXH_ALLOC_VX_INFO,
10203+ VXH_DEALLOC_VX_INFO,
10204+ VXH_HASH_VX_INFO,
10205+ VXH_UNHASH_VX_INFO,
10206+ VXH_LOC_VX_INFO,
10207+ VXH_LOOKUP_VX_INFO,
10208+ VXH_CREATE_VX_INFO,
10209+};
10210+
10211+struct _vxhe_vxi {
10212+ struct vx_info *ptr;
10213+ unsigned xid;
10214+ unsigned usecnt;
10215+ unsigned tasks;
10216+};
10217+
10218+struct _vxhe_set_clr {
10219+ void *data;
10220+};
10221+
10222+struct _vxhe_loc_lookup {
10223+ unsigned arg;
10224+};
10225+
10226+struct _vx_hist_entry {
10227+ void *loc;
10228+ unsigned short seq;
10229+ unsigned short type;
10230+ struct _vxhe_vxi vxi;
10231+ union {
10232+ struct _vxhe_set_clr sc;
10233+ struct _vxhe_loc_lookup ll;
10234+ };
10235+};
10236+
10237+#ifdef CONFIG_VSERVER_HISTORY
10238+
10239+extern unsigned volatile int vxh_active;
10240+
10241+struct _vx_hist_entry *vxh_advance(void *loc);
10242+
10243+
10244+static inline
10245+void __vxh_copy_vxi(struct _vx_hist_entry *entry, struct vx_info *vxi)
10246+{
10247+ entry->vxi.ptr = vxi;
10248+ if (vxi) {
10249+ entry->vxi.usecnt = atomic_read(&vxi->vx_usecnt);
10250+ entry->vxi.tasks = atomic_read(&vxi->vx_tasks);
10251+ entry->vxi.xid = vxi->vx_id;
10252+ }
10253+}
10254+
10255+
10256+#define __HERE__ current_text_addr()
10257+
10258+#define __VXH_BODY(__type, __data, __here) \
10259+ struct _vx_hist_entry *entry; \
10260+ \
10261+ preempt_disable(); \
10262+ entry = vxh_advance(__here); \
10263+ __data; \
10264+ entry->type = __type; \
10265+ preempt_enable();
10266+
10267+
10268+ /* pass vxi only */
10269+
10270+#define __VXH_SMPL \
10271+ __vxh_copy_vxi(entry, vxi)
10272+
10273+static inline
10274+void __vxh_smpl(struct vx_info *vxi, int __type, void *__here)
10275+{
10276+ __VXH_BODY(__type, __VXH_SMPL, __here)
10277+}
10278+
10279+ /* pass vxi and data (void *) */
10280+
10281+#define __VXH_DATA \
10282+ __vxh_copy_vxi(entry, vxi); \
10283+ entry->sc.data = data
10284+
10285+static inline
10286+void __vxh_data(struct vx_info *vxi, void *data,
10287+ int __type, void *__here)
10288+{
10289+ __VXH_BODY(__type, __VXH_DATA, __here)
10290+}
10291+
10292+ /* pass vxi and arg (long) */
10293+
10294+#define __VXH_LONG \
10295+ __vxh_copy_vxi(entry, vxi); \
10296+ entry->ll.arg = arg
10297+
10298+static inline
10299+void __vxh_long(struct vx_info *vxi, long arg,
10300+ int __type, void *__here)
10301+{
10302+ __VXH_BODY(__type, __VXH_LONG, __here)
10303+}
10304+
10305+
10306+static inline
10307+void __vxh_throw_oops(void *__here)
10308+{
10309+ __VXH_BODY(VXH_THROW_OOPS, {}, __here);
10310+ /* prevent further acquisition */
10311+ vxh_active = 0;
10312+}
10313+
10314+
10315+#define vxh_throw_oops() __vxh_throw_oops(__HERE__);
10316+
10317+#define __vxh_get_vx_info(v, h) __vxh_smpl(v, VXH_GET_VX_INFO, h);
10318+#define __vxh_put_vx_info(v, h) __vxh_smpl(v, VXH_PUT_VX_INFO, h);
10319+
10320+#define __vxh_init_vx_info(v, d, h) \
10321+ __vxh_data(v, d, VXH_INIT_VX_INFO, h);
10322+#define __vxh_set_vx_info(v, d, h) \
10323+ __vxh_data(v, d, VXH_SET_VX_INFO, h);
10324+#define __vxh_clr_vx_info(v, d, h) \
10325+ __vxh_data(v, d, VXH_CLR_VX_INFO, h);
10326+
10327+#define __vxh_claim_vx_info(v, d, h) \
10328+ __vxh_data(v, d, VXH_CLAIM_VX_INFO, h);
10329+#define __vxh_release_vx_info(v, d, h) \
10330+ __vxh_data(v, d, VXH_RELEASE_VX_INFO, h);
10331+
10332+#define vxh_alloc_vx_info(v) \
10333+ __vxh_smpl(v, VXH_ALLOC_VX_INFO, __HERE__);
10334+#define vxh_dealloc_vx_info(v) \
10335+ __vxh_smpl(v, VXH_DEALLOC_VX_INFO, __HERE__);
10336+
10337+#define vxh_hash_vx_info(v) \
10338+ __vxh_smpl(v, VXH_HASH_VX_INFO, __HERE__);
10339+#define vxh_unhash_vx_info(v) \
10340+ __vxh_smpl(v, VXH_UNHASH_VX_INFO, __HERE__);
10341+
10342+#define vxh_loc_vx_info(v, l) \
10343+ __vxh_long(v, l, VXH_LOC_VX_INFO, __HERE__);
10344+#define vxh_lookup_vx_info(v, l) \
10345+ __vxh_long(v, l, VXH_LOOKUP_VX_INFO, __HERE__);
10346+#define vxh_create_vx_info(v, l) \
10347+ __vxh_long(v, l, VXH_CREATE_VX_INFO, __HERE__);
10348+
10349+extern void vxh_dump_history(void);
10350+
10351+
10352+#else /* CONFIG_VSERVER_HISTORY */
10353+
10354+#define __HERE__ 0
10355+
10356+#define vxh_throw_oops() do { } while (0)
10357+
10358+#define __vxh_get_vx_info(v, h) do { } while (0)
10359+#define __vxh_put_vx_info(v, h) do { } while (0)
10360+
10361+#define __vxh_init_vx_info(v, d, h) do { } while (0)
10362+#define __vxh_set_vx_info(v, d, h) do { } while (0)
10363+#define __vxh_clr_vx_info(v, d, h) do { } while (0)
10364+
10365+#define __vxh_claim_vx_info(v, d, h) do { } while (0)
10366+#define __vxh_release_vx_info(v, d, h) do { } while (0)
10367+
10368+#define vxh_alloc_vx_info(v) do { } while (0)
10369+#define vxh_dealloc_vx_info(v) do { } while (0)
10370+
10371+#define vxh_hash_vx_info(v) do { } while (0)
10372+#define vxh_unhash_vx_info(v) do { } while (0)
10373+
10374+#define vxh_loc_vx_info(v, l) do { } while (0)
10375+#define vxh_lookup_vx_info(v, l) do { } while (0)
10376+#define vxh_create_vx_info(v, l) do { } while (0)
10377+
10378+#define vxh_dump_history() do { } while (0)
10379+
10380+
10381+#endif /* CONFIG_VSERVER_HISTORY */
10382+
10383+#endif /* _VSERVER_HISTORY_H */
10384diff -NurpP --minimal linux-4.4.116/include/linux/vserver/inode.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/inode.h
10385--- linux-4.4.116/include/linux/vserver/inode.h 1970-01-01 00:00:00.000000000 +0000
10386+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/inode.h 2018-01-09 16:36:32.000000000 +0000
10387@@ -0,0 +1,19 @@
10388+#ifndef _VSERVER_INODE_H
10389+#define _VSERVER_INODE_H
10390+
10391+#include <uapi/vserver/inode.h>
10392+
10393+
10394+#ifdef CONFIG_VSERVER_PROC_SECURE
10395+#define IATTR_PROC_DEFAULT ( IATTR_ADMIN | IATTR_HIDE )
10396+#define IATTR_PROC_SYMLINK ( IATTR_ADMIN )
10397+#else
10398+#define IATTR_PROC_DEFAULT ( IATTR_ADMIN )
10399+#define IATTR_PROC_SYMLINK ( IATTR_ADMIN )
10400+#endif
10401+
10402+#define vx_hide_check(c, m) (((m) & IATTR_HIDE) ? vx_check(c, m) : 1)
10403+
10404+#else /* _VSERVER_INODE_H */
10405+#warning duplicate inclusion
10406+#endif /* _VSERVER_INODE_H */
10407diff -NurpP --minimal linux-4.4.116/include/linux/vserver/inode_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/inode_cmd.h
10408--- linux-4.4.116/include/linux/vserver/inode_cmd.h 1970-01-01 00:00:00.000000000 +0000
10409+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/inode_cmd.h 2018-01-09 16:36:32.000000000 +0000
10410@@ -0,0 +1,36 @@
10411+#ifndef _VSERVER_INODE_CMD_H
10412+#define _VSERVER_INODE_CMD_H
10413+
10414+#include <uapi/vserver/inode_cmd.h>
10415+
10416+
10417+
10418+#ifdef CONFIG_COMPAT
10419+
10420+#include <asm/compat.h>
10421+
10422+struct vcmd_ctx_iattr_v1_x32 {
10423+ compat_uptr_t name_ptr;
10424+ uint32_t tag;
10425+ uint32_t flags;
10426+ uint32_t mask;
10427+};
10428+
10429+#endif /* CONFIG_COMPAT */
10430+
10431+#include <linux/compiler.h>
10432+
10433+extern int vc_get_iattr(void __user *);
10434+extern int vc_set_iattr(void __user *);
10435+
10436+extern int vc_fget_iattr(uint32_t, void __user *);
10437+extern int vc_fset_iattr(uint32_t, void __user *);
10438+
10439+#ifdef CONFIG_COMPAT
10440+
10441+extern int vc_get_iattr_x32(void __user *);
10442+extern int vc_set_iattr_x32(void __user *);
10443+
10444+#endif /* CONFIG_COMPAT */
10445+
10446+#endif /* _VSERVER_INODE_CMD_H */
10447diff -NurpP --minimal linux-4.4.116/include/linux/vserver/limit.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/limit.h
10448--- linux-4.4.116/include/linux/vserver/limit.h 1970-01-01 00:00:00.000000000 +0000
10449+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/limit.h 2018-01-09 16:36:32.000000000 +0000
10450@@ -0,0 +1,67 @@
10451+#ifndef _VSERVER_LIMIT_H
10452+#define _VSERVER_LIMIT_H
10453+
10454+#include <uapi/vserver/limit.h>
10455+
10456+
10457+#define VLIM_NOCHECK ((1L << VLIMIT_DENTRY) | (1L << RLIMIT_RSS))
10458+
10459+/* keep in sync with CRLIM_INFINITY */
10460+
10461+#define VLIM_INFINITY (~0ULL)
10462+
10463+#include <asm/atomic.h>
10464+#include <asm/resource.h>
10465+
10466+#ifndef RLIM_INFINITY
10467+#warning RLIM_INFINITY is undefined
10468+#endif
10469+
10470+#define __rlim_val(l, r, v) ((l)->res[r].v)
10471+
10472+#define __rlim_soft(l, r) __rlim_val(l, r, soft)
10473+#define __rlim_hard(l, r) __rlim_val(l, r, hard)
10474+
10475+#define __rlim_rcur(l, r) __rlim_val(l, r, rcur)
10476+#define __rlim_rmin(l, r) __rlim_val(l, r, rmin)
10477+#define __rlim_rmax(l, r) __rlim_val(l, r, rmax)
10478+
10479+#define __rlim_lhit(l, r) __rlim_val(l, r, lhit)
10480+#define __rlim_hit(l, r) atomic_inc(&__rlim_lhit(l, r))
10481+
10482+typedef atomic_long_t rlim_atomic_t;
10483+typedef unsigned long rlim_t;
10484+
10485+#define __rlim_get(l, r) atomic_long_read(&__rlim_rcur(l, r))
10486+#define __rlim_set(l, r, v) atomic_long_set(&__rlim_rcur(l, r), v)
10487+#define __rlim_inc(l, r) atomic_long_inc(&__rlim_rcur(l, r))
10488+#define __rlim_dec(l, r) atomic_long_dec(&__rlim_rcur(l, r))
10489+#define __rlim_add(l, r, v) atomic_long_add(v, &__rlim_rcur(l, r))
10490+#define __rlim_sub(l, r, v) atomic_long_sub(v, &__rlim_rcur(l, r))
10491+
10492+
10493+#if (RLIM_INFINITY == VLIM_INFINITY)
10494+#define VX_VLIM(r) ((long long)(long)(r))
10495+#define VX_RLIM(v) ((rlim_t)(v))
10496+#else
10497+#define VX_VLIM(r) (((r) == RLIM_INFINITY) \
10498+ ? VLIM_INFINITY : (long long)(r))
10499+#define VX_RLIM(v) (((v) == VLIM_INFINITY) \
10500+ ? RLIM_INFINITY : (rlim_t)(v))
10501+#endif
10502+
10503+struct sysinfo;
10504+
10505+#ifdef CONFIG_MEMCG
10506+void vx_vsi_meminfo(struct sysinfo *);
10507+void vx_vsi_swapinfo(struct sysinfo *);
10508+long vx_vsi_cached(struct sysinfo *);
10509+#else /* !CONFIG_MEMCG */
10510+#define vx_vsi_meminfo(s) do { } while (0)
10511+#define vx_vsi_swapinfo(s) do { } while (0)
10512+#define vx_vsi_cached(s) (0L)
10513+#endif /* !CONFIG_MEMCG */
10514+
10515+#define NUM_LIMITS 24
10516+
10517+#endif /* _VSERVER_LIMIT_H */
10518diff -NurpP --minimal linux-4.4.116/include/linux/vserver/limit_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/limit_cmd.h
10519--- linux-4.4.116/include/linux/vserver/limit_cmd.h 1970-01-01 00:00:00.000000000 +0000
10520+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/limit_cmd.h 2018-01-09 16:36:32.000000000 +0000
10521@@ -0,0 +1,35 @@
10522+#ifndef _VSERVER_LIMIT_CMD_H
10523+#define _VSERVER_LIMIT_CMD_H
10524+
10525+#include <uapi/vserver/limit_cmd.h>
10526+
10527+
10528+#ifdef CONFIG_IA32_EMULATION
10529+
10530+struct vcmd_ctx_rlimit_v0_x32 {
10531+ uint32_t id;
10532+ uint64_t minimum;
10533+ uint64_t softlimit;
10534+ uint64_t maximum;
10535+} __attribute__ ((packed));
10536+
10537+#endif /* CONFIG_IA32_EMULATION */
10538+
10539+#include <linux/compiler.h>
10540+
10541+extern int vc_get_rlimit_mask(uint32_t, void __user *);
10542+extern int vc_get_rlimit(struct vx_info *, void __user *);
10543+extern int vc_set_rlimit(struct vx_info *, void __user *);
10544+extern int vc_reset_hits(struct vx_info *, void __user *);
10545+extern int vc_reset_minmax(struct vx_info *, void __user *);
10546+
10547+extern int vc_rlimit_stat(struct vx_info *, void __user *);
10548+
10549+#ifdef CONFIG_IA32_EMULATION
10550+
10551+extern int vc_get_rlimit_x32(struct vx_info *, void __user *);
10552+extern int vc_set_rlimit_x32(struct vx_info *, void __user *);
10553+
10554+#endif /* CONFIG_IA32_EMULATION */
10555+
10556+#endif /* _VSERVER_LIMIT_CMD_H */
10557diff -NurpP --minimal linux-4.4.116/include/linux/vserver/limit_def.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/limit_def.h
10558--- linux-4.4.116/include/linux/vserver/limit_def.h 1970-01-01 00:00:00.000000000 +0000
10559+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/limit_def.h 2018-01-09 16:36:32.000000000 +0000
10560@@ -0,0 +1,47 @@
10561+#ifndef _VSERVER_LIMIT_DEF_H
10562+#define _VSERVER_LIMIT_DEF_H
10563+
10564+#include <asm/atomic.h>
10565+#include <asm/resource.h>
10566+
10567+#include "limit.h"
10568+
10569+
10570+struct _vx_res_limit {
10571+ rlim_t soft; /* Context soft limit */
10572+ rlim_t hard; /* Context hard limit */
10573+
10574+ rlim_atomic_t rcur; /* Current value */
10575+ rlim_t rmin; /* Context minimum */
10576+ rlim_t rmax; /* Context maximum */
10577+
10578+ atomic_t lhit; /* Limit hits */
10579+};
10580+
10581+/* context sub struct */
10582+
10583+struct _vx_limit {
10584+ struct _vx_res_limit res[NUM_LIMITS];
10585+};
10586+
10587+#ifdef CONFIG_VSERVER_DEBUG
10588+
10589+static inline void __dump_vx_limit(struct _vx_limit *limit)
10590+{
10591+ int i;
10592+
10593+ printk("\t_vx_limit:");
10594+ for (i = 0; i < NUM_LIMITS; i++) {
10595+ printk("\t [%2d] = %8lu %8lu/%8lu, %8ld/%8ld, %8d\n",
10596+ i, (unsigned long)__rlim_get(limit, i),
10597+ (unsigned long)__rlim_rmin(limit, i),
10598+ (unsigned long)__rlim_rmax(limit, i),
10599+ (long)__rlim_soft(limit, i),
10600+ (long)__rlim_hard(limit, i),
10601+ atomic_read(&__rlim_lhit(limit, i)));
10602+ }
10603+}
10604+
10605+#endif
10606+
10607+#endif /* _VSERVER_LIMIT_DEF_H */
10608diff -NurpP --minimal linux-4.4.116/include/linux/vserver/limit_int.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/limit_int.h
10609--- linux-4.4.116/include/linux/vserver/limit_int.h 1970-01-01 00:00:00.000000000 +0000
10610+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/limit_int.h 2018-01-09 16:36:32.000000000 +0000
10611@@ -0,0 +1,193 @@
10612+#ifndef _VSERVER_LIMIT_INT_H
10613+#define _VSERVER_LIMIT_INT_H
10614+
10615+#define VXD_RCRES_COND(r) VXD_CBIT(cres, r)
10616+#define VXD_RLIMIT_COND(r) VXD_CBIT(limit, r)
10617+
10618+extern const char *vlimit_name[NUM_LIMITS];
10619+
10620+static inline void __vx_acc_cres(struct vx_info *vxi,
10621+ int res, int dir, void *_data, char *_file, int _line)
10622+{
10623+ if (VXD_RCRES_COND(res))
10624+ vxlprintk(1, "vx_acc_cres[%5d,%s,%2d]: %5ld%s (%p)",
10625+ (vxi ? vxi->vx_id : -1), vlimit_name[res], res,
10626+ (vxi ? (long)__rlim_get(&vxi->limit, res) : 0),
10627+ (dir > 0) ? "++" : "--", _data, _file, _line);
10628+ if (!vxi)
10629+ return;
10630+
10631+ if (dir > 0)
10632+ __rlim_inc(&vxi->limit, res);
10633+ else
10634+ __rlim_dec(&vxi->limit, res);
10635+}
10636+
10637+static inline void __vx_add_cres(struct vx_info *vxi,
10638+ int res, int amount, void *_data, char *_file, int _line)
10639+{
10640+ if (VXD_RCRES_COND(res))
10641+ vxlprintk(1, "vx_add_cres[%5d,%s,%2d]: %5ld += %5d (%p)",
10642+ (vxi ? vxi->vx_id : -1), vlimit_name[res], res,
10643+ (vxi ? (long)__rlim_get(&vxi->limit, res) : 0),
10644+ amount, _data, _file, _line);
10645+ if (amount == 0)
10646+ return;
10647+ if (!vxi)
10648+ return;
10649+ __rlim_add(&vxi->limit, res, amount);
10650+}
10651+
10652+static inline
10653+int __vx_cres_adjust_max(struct _vx_limit *limit, int res, rlim_t value)
10654+{
10655+ int cond = (value > __rlim_rmax(limit, res));
10656+
10657+ if (cond)
10658+ __rlim_rmax(limit, res) = value;
10659+ return cond;
10660+}
10661+
10662+static inline
10663+int __vx_cres_adjust_min(struct _vx_limit *limit, int res, rlim_t value)
10664+{
10665+ int cond = (value < __rlim_rmin(limit, res));
10666+
10667+ if (cond)
10668+ __rlim_rmin(limit, res) = value;
10669+ return cond;
10670+}
10671+
10672+static inline
10673+void __vx_cres_fixup(struct _vx_limit *limit, int res, rlim_t value)
10674+{
10675+ if (!__vx_cres_adjust_max(limit, res, value))
10676+ __vx_cres_adjust_min(limit, res, value);
10677+}
10678+
10679+
10680+/* return values:
10681+ +1 ... no limit hit
10682+ -1 ... over soft limit
10683+ 0 ... over hard limit */
10684+
10685+static inline int __vx_cres_avail(struct vx_info *vxi,
10686+ int res, int num, char *_file, int _line)
10687+{
10688+ struct _vx_limit *limit;
10689+ rlim_t value;
10690+
10691+ if (VXD_RLIMIT_COND(res))
10692+ vxlprintk(1, "vx_cres_avail[%5d,%s,%2d]: %5ld/%5ld > %5ld + %5d",
10693+ (vxi ? vxi->vx_id : -1), vlimit_name[res], res,
10694+ (vxi ? (long)__rlim_soft(&vxi->limit, res) : -1),
10695+ (vxi ? (long)__rlim_hard(&vxi->limit, res) : -1),
10696+ (vxi ? (long)__rlim_get(&vxi->limit, res) : 0),
10697+ num, _file, _line);
10698+ if (!vxi)
10699+ return 1;
10700+
10701+ limit = &vxi->limit;
10702+ value = __rlim_get(limit, res);
10703+
10704+ if (!__vx_cres_adjust_max(limit, res, value))
10705+ __vx_cres_adjust_min(limit, res, value);
10706+
10707+ if (num == 0)
10708+ return 1;
10709+
10710+ if (__rlim_soft(limit, res) == RLIM_INFINITY)
10711+ return -1;
10712+ if (value + num <= __rlim_soft(limit, res))
10713+ return -1;
10714+
10715+ if (__rlim_hard(limit, res) == RLIM_INFINITY)
10716+ return 1;
10717+ if (value + num <= __rlim_hard(limit, res))
10718+ return 1;
10719+
10720+ __rlim_hit(limit, res);
10721+ return 0;
10722+}
10723+
10724+
10725+static const int VLA_RSS[] = { RLIMIT_RSS, VLIMIT_ANON, VLIMIT_MAPPED, 0 };
10726+
10727+static inline
10728+rlim_t __vx_cres_array_sum(struct _vx_limit *limit, const int *array)
10729+{
10730+ rlim_t value, sum = 0;
10731+ int res;
10732+
10733+ while ((res = *array++)) {
10734+ value = __rlim_get(limit, res);
10735+ __vx_cres_fixup(limit, res, value);
10736+ sum += value;
10737+ }
10738+ return sum;
10739+}
10740+
10741+static inline
10742+rlim_t __vx_cres_array_fixup(struct _vx_limit *limit, const int *array)
10743+{
10744+ rlim_t value = __vx_cres_array_sum(limit, array + 1);
10745+ int res = *array;
10746+
10747+ if (value == __rlim_get(limit, res))
10748+ return value;
10749+
10750+ __rlim_set(limit, res, value);
10751+ /* now adjust min/max */
10752+ if (!__vx_cres_adjust_max(limit, res, value))
10753+ __vx_cres_adjust_min(limit, res, value);
10754+
10755+ return value;
10756+}
10757+
10758+static inline int __vx_cres_array_avail(struct vx_info *vxi,
10759+ const int *array, int num, char *_file, int _line)
10760+{
10761+ struct _vx_limit *limit;
10762+ rlim_t value = 0;
10763+ int res;
10764+
10765+ if (num == 0)
10766+ return 1;
10767+ if (!vxi)
10768+ return 1;
10769+
10770+ limit = &vxi->limit;
10771+ res = *array;
10772+ value = __vx_cres_array_sum(limit, array + 1);
10773+
10774+ __rlim_set(limit, res, value);
10775+ __vx_cres_fixup(limit, res, value);
10776+
10777+ return __vx_cres_avail(vxi, res, num, _file, _line);
10778+}
10779+
10780+
10781+static inline void vx_limit_fixup(struct _vx_limit *limit, int id)
10782+{
10783+ rlim_t value;
10784+ int res;
10785+
10786+ /* complex resources first */
10787+ if ((id < 0) || (id == RLIMIT_RSS))
10788+ __vx_cres_array_fixup(limit, VLA_RSS);
10789+
10790+ for (res = 0; res < NUM_LIMITS; res++) {
10791+ if ((id > 0) && (res != id))
10792+ continue;
10793+
10794+ value = __rlim_get(limit, res);
10795+ __vx_cres_fixup(limit, res, value);
10796+
10797+ /* not supposed to happen, maybe warn? */
10798+ if (__rlim_rmax(limit, res) > __rlim_hard(limit, res))
10799+ __rlim_rmax(limit, res) = __rlim_hard(limit, res);
10800+ }
10801+}
10802+
10803+
10804+#endif /* _VSERVER_LIMIT_INT_H */
10805diff -NurpP --minimal linux-4.4.116/include/linux/vserver/monitor.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/monitor.h
10806--- linux-4.4.116/include/linux/vserver/monitor.h 1970-01-01 00:00:00.000000000 +0000
10807+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/monitor.h 2018-01-09 16:36:32.000000000 +0000
10808@@ -0,0 +1,6 @@
10809+#ifndef _VSERVER_MONITOR_H
10810+#define _VSERVER_MONITOR_H
10811+
10812+#include <uapi/vserver/monitor.h>
10813+
10814+#endif /* _VSERVER_MONITOR_H */
10815diff -NurpP --minimal linux-4.4.116/include/linux/vserver/network.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/network.h
10816--- linux-4.4.116/include/linux/vserver/network.h 1970-01-01 00:00:00.000000000 +0000
10817+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/network.h 2018-01-09 16:36:32.000000000 +0000
10818@@ -0,0 +1,76 @@
10819+#ifndef _VSERVER_NETWORK_H
10820+#define _VSERVER_NETWORK_H
10821+
10822+
10823+#include <linux/list.h>
10824+#include <linux/spinlock.h>
10825+#include <linux/rcupdate.h>
10826+#include <linux/in.h>
10827+#include <linux/in6.h>
10828+#include <asm/atomic.h>
10829+#include <uapi/vserver/network.h>
10830+
10831+struct nx_addr_v4 {
10832+ struct nx_addr_v4 *next;
10833+ struct in_addr ip[2];
10834+ struct in_addr mask;
10835+ uint16_t type;
10836+ uint16_t flags;
10837+};
10838+
10839+struct nx_addr_v6 {
10840+ struct nx_addr_v6 *next;
10841+ struct in6_addr ip;
10842+ struct in6_addr mask;
10843+ uint32_t prefix;
10844+ uint16_t type;
10845+ uint16_t flags;
10846+};
10847+
10848+struct nx_info {
10849+ struct hlist_node nx_hlist; /* linked list of nxinfos */
10850+ vnid_t nx_id; /* vnet id */
10851+ atomic_t nx_usecnt; /* usage count */
10852+ atomic_t nx_tasks; /* tasks count */
10853+ int nx_state; /* context state */
10854+
10855+ uint64_t nx_flags; /* network flag word */
10856+ uint64_t nx_ncaps; /* network capabilities */
10857+
10858+ spinlock_t addr_lock; /* protect address changes */
10859+ struct in_addr v4_lback; /* Loopback address */
10860+ struct in_addr v4_bcast; /* Broadcast address */
10861+ struct nx_addr_v4 v4; /* First/Single ipv4 address */
10862+#ifdef CONFIG_IPV6
10863+ struct nx_addr_v6 v6; /* First/Single ipv6 address */
10864+#endif
10865+ char nx_name[65]; /* network context name */
10866+};
10867+
10868+
10869+/* status flags */
10870+
10871+#define NXS_HASHED 0x0001
10872+#define NXS_SHUTDOWN 0x0100
10873+#define NXS_RELEASED 0x8000
10874+
10875+extern struct nx_info *lookup_nx_info(int);
10876+
10877+extern int get_nid_list(int, unsigned int *, int);
10878+extern int nid_is_hashed(vnid_t);
10879+
10880+extern int nx_migrate_task(struct task_struct *, struct nx_info *);
10881+
10882+extern long vs_net_change(struct nx_info *, unsigned int);
10883+
10884+struct sock;
10885+
10886+
10887+#define NX_IPV4(n) ((n)->v4.type != NXA_TYPE_NONE)
10888+#ifdef CONFIG_IPV6
10889+#define NX_IPV6(n) ((n)->v6.type != NXA_TYPE_NONE)
10890+#else
10891+#define NX_IPV6(n) (0)
10892+#endif
10893+
10894+#endif /* _VSERVER_NETWORK_H */
10895diff -NurpP --minimal linux-4.4.116/include/linux/vserver/network_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/network_cmd.h
10896--- linux-4.4.116/include/linux/vserver/network_cmd.h 1970-01-01 00:00:00.000000000 +0000
10897+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/network_cmd.h 2018-01-09 16:36:32.000000000 +0000
10898@@ -0,0 +1,37 @@
10899+#ifndef _VSERVER_NETWORK_CMD_H
10900+#define _VSERVER_NETWORK_CMD_H
10901+
10902+#include <uapi/vserver/network_cmd.h>
10903+
10904+extern int vc_task_nid(uint32_t);
10905+
10906+extern int vc_nx_info(struct nx_info *, void __user *);
10907+
10908+extern int vc_net_create(uint32_t, void __user *);
10909+extern int vc_net_migrate(struct nx_info *, void __user *);
10910+
10911+extern int vc_net_add(struct nx_info *, void __user *);
10912+extern int vc_net_remove(struct nx_info *, void __user *);
10913+
10914+extern int vc_net_add_ipv4_v1(struct nx_info *, void __user *);
10915+extern int vc_net_add_ipv4(struct nx_info *, void __user *);
10916+
10917+extern int vc_net_rem_ipv4_v1(struct nx_info *, void __user *);
10918+extern int vc_net_rem_ipv4(struct nx_info *, void __user *);
10919+
10920+extern int vc_net_add_ipv6(struct nx_info *, void __user *);
10921+extern int vc_net_remove_ipv6(struct nx_info *, void __user *);
10922+
10923+extern int vc_add_match_ipv4(struct nx_info *, void __user *);
10924+extern int vc_get_match_ipv4(struct nx_info *, void __user *);
10925+
10926+extern int vc_add_match_ipv6(struct nx_info *, void __user *);
10927+extern int vc_get_match_ipv6(struct nx_info *, void __user *);
10928+
10929+extern int vc_get_nflags(struct nx_info *, void __user *);
10930+extern int vc_set_nflags(struct nx_info *, void __user *);
10931+
10932+extern int vc_get_ncaps(struct nx_info *, void __user *);
10933+extern int vc_set_ncaps(struct nx_info *, void __user *);
10934+
10935+#endif /* _VSERVER_CONTEXT_CMD_H */
10936diff -NurpP --minimal linux-4.4.116/include/linux/vserver/percpu.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/percpu.h
10937--- linux-4.4.116/include/linux/vserver/percpu.h 1970-01-01 00:00:00.000000000 +0000
10938+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/percpu.h 2018-01-09 16:36:32.000000000 +0000
10939@@ -0,0 +1,14 @@
10940+#ifndef _VSERVER_PERCPU_H
10941+#define _VSERVER_PERCPU_H
10942+
10943+#include "cvirt_def.h"
10944+#include "sched_def.h"
10945+
10946+struct _vx_percpu {
10947+ struct _vx_cvirt_pc cvirt;
10948+ struct _vx_sched_pc sched;
10949+};
10950+
10951+#define PERCPU_PERCTX (sizeof(struct _vx_percpu))
10952+
10953+#endif /* _VSERVER_PERCPU_H */
10954diff -NurpP --minimal linux-4.4.116/include/linux/vserver/pid.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/pid.h
10955--- linux-4.4.116/include/linux/vserver/pid.h 1970-01-01 00:00:00.000000000 +0000
10956+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/pid.h 2018-01-09 16:36:32.000000000 +0000
10957@@ -0,0 +1,51 @@
10958+#ifndef _VSERVER_PID_H
10959+#define _VSERVER_PID_H
10960+
10961+/* pid faking stuff */
10962+
10963+#define vx_info_map_pid(v, p) \
10964+ __vx_info_map_pid((v), (p), __func__, __FILE__, __LINE__)
10965+#define vx_info_map_tgid(v,p) vx_info_map_pid(v,p)
10966+#define vx_map_pid(p) vx_info_map_pid(current_vx_info(), p)
10967+#define vx_map_tgid(p) vx_map_pid(p)
10968+
10969+static inline int __vx_info_map_pid(struct vx_info *vxi, int pid,
10970+ const char *func, const char *file, int line)
10971+{
10972+ if (vx_info_flags(vxi, VXF_INFO_INIT, 0)) {
10973+ vxfprintk(VXD_CBIT(cvirt, 2),
10974+ "vx_map_tgid: %p/%llx: %d -> %d",
10975+ vxi, (long long)vxi->vx_flags, pid,
10976+ (pid && pid == vxi->vx_initpid) ? 1 : pid,
10977+ func, file, line);
10978+ if (pid == 0)
10979+ return 0;
10980+ if (pid == vxi->vx_initpid)
10981+ return 1;
10982+ }
10983+ return pid;
10984+}
10985+
10986+#define vx_info_rmap_pid(v, p) \
10987+ __vx_info_rmap_pid((v), (p), __func__, __FILE__, __LINE__)
10988+#define vx_rmap_pid(p) vx_info_rmap_pid(current_vx_info(), p)
10989+#define vx_rmap_tgid(p) vx_rmap_pid(p)
10990+
10991+static inline int __vx_info_rmap_pid(struct vx_info *vxi, int pid,
10992+ const char *func, const char *file, int line)
10993+{
10994+ if (vx_info_flags(vxi, VXF_INFO_INIT, 0)) {
10995+ vxfprintk(VXD_CBIT(cvirt, 2),
10996+ "vx_rmap_tgid: %p/%llx: %d -> %d",
10997+ vxi, (long long)vxi->vx_flags, pid,
10998+ (pid == 1) ? vxi->vx_initpid : pid,
10999+ func, file, line);
11000+ if ((pid == 1) && vxi->vx_initpid)
11001+ return vxi->vx_initpid;
11002+ if (pid == vxi->vx_initpid)
11003+ return ~0U;
11004+ }
11005+ return pid;
11006+}
11007+
11008+#endif
11009diff -NurpP --minimal linux-4.4.116/include/linux/vserver/sched.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/sched.h
11010--- linux-4.4.116/include/linux/vserver/sched.h 1970-01-01 00:00:00.000000000 +0000
11011+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/sched.h 2018-01-09 16:36:32.000000000 +0000
11012@@ -0,0 +1,23 @@
11013+#ifndef _VSERVER_SCHED_H
11014+#define _VSERVER_SCHED_H
11015+
11016+
11017+#ifdef __KERNEL__
11018+
11019+struct timespec;
11020+
11021+void vx_vsi_uptime(struct timespec *, struct timespec *);
11022+
11023+
11024+struct vx_info;
11025+
11026+void vx_update_load(struct vx_info *);
11027+
11028+
11029+void vx_update_sched_param(struct _vx_sched *sched,
11030+ struct _vx_sched_pc *sched_pc);
11031+
11032+#endif /* __KERNEL__ */
11033+#else /* _VSERVER_SCHED_H */
11034+#warning duplicate inclusion
11035+#endif /* _VSERVER_SCHED_H */
11036diff -NurpP --minimal linux-4.4.116/include/linux/vserver/sched_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/sched_cmd.h
11037--- linux-4.4.116/include/linux/vserver/sched_cmd.h 1970-01-01 00:00:00.000000000 +0000
11038+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/sched_cmd.h 2018-01-09 16:36:32.000000000 +0000
11039@@ -0,0 +1,11 @@
11040+#ifndef _VSERVER_SCHED_CMD_H
11041+#define _VSERVER_SCHED_CMD_H
11042+
11043+
11044+#include <linux/compiler.h>
11045+#include <uapi/vserver/sched_cmd.h>
11046+
11047+extern int vc_set_prio_bias(struct vx_info *, void __user *);
11048+extern int vc_get_prio_bias(struct vx_info *, void __user *);
11049+
11050+#endif /* _VSERVER_SCHED_CMD_H */
11051diff -NurpP --minimal linux-4.4.116/include/linux/vserver/sched_def.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/sched_def.h
11052--- linux-4.4.116/include/linux/vserver/sched_def.h 1970-01-01 00:00:00.000000000 +0000
11053+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/sched_def.h 2018-01-09 16:36:32.000000000 +0000
11054@@ -0,0 +1,38 @@
11055+#ifndef _VSERVER_SCHED_DEF_H
11056+#define _VSERVER_SCHED_DEF_H
11057+
11058+#include <linux/spinlock.h>
11059+#include <linux/jiffies.h>
11060+#include <linux/cpumask.h>
11061+#include <asm/atomic.h>
11062+#include <asm/param.h>
11063+
11064+
11065+/* context sub struct */
11066+
11067+struct _vx_sched {
11068+ int prio_bias; /* bias offset for priority */
11069+
11070+ cpumask_t update; /* CPUs which should update */
11071+};
11072+
11073+struct _vx_sched_pc {
11074+ int prio_bias; /* bias offset for priority */
11075+
11076+ uint64_t user_ticks; /* token tick events */
11077+ uint64_t sys_ticks; /* token tick events */
11078+ uint64_t hold_ticks; /* token ticks paused */
11079+};
11080+
11081+
11082+#ifdef CONFIG_VSERVER_DEBUG
11083+
11084+static inline void __dump_vx_sched(struct _vx_sched *sched)
11085+{
11086+ printk("\t_vx_sched:\n");
11087+ printk("\t priority = %4d\n", sched->prio_bias);
11088+}
11089+
11090+#endif
11091+
11092+#endif /* _VSERVER_SCHED_DEF_H */
11093diff -NurpP --minimal linux-4.4.116/include/linux/vserver/signal.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/signal.h
11094--- linux-4.4.116/include/linux/vserver/signal.h 1970-01-01 00:00:00.000000000 +0000
11095+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/signal.h 2018-01-09 16:36:32.000000000 +0000
11096@@ -0,0 +1,14 @@
11097+#ifndef _VSERVER_SIGNAL_H
11098+#define _VSERVER_SIGNAL_H
11099+
11100+
11101+#ifdef __KERNEL__
11102+
11103+struct vx_info;
11104+
11105+int vx_info_kill(struct vx_info *, int, int);
11106+
11107+#endif /* __KERNEL__ */
11108+#else /* _VSERVER_SIGNAL_H */
11109+#warning duplicate inclusion
11110+#endif /* _VSERVER_SIGNAL_H */
11111diff -NurpP --minimal linux-4.4.116/include/linux/vserver/signal_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/signal_cmd.h
11112--- linux-4.4.116/include/linux/vserver/signal_cmd.h 1970-01-01 00:00:00.000000000 +0000
11113+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/signal_cmd.h 2018-01-09 16:36:32.000000000 +0000
11114@@ -0,0 +1,14 @@
11115+#ifndef _VSERVER_SIGNAL_CMD_H
11116+#define _VSERVER_SIGNAL_CMD_H
11117+
11118+#include <uapi/vserver/signal_cmd.h>
11119+
11120+
11121+extern int vc_ctx_kill(struct vx_info *, void __user *);
11122+extern int vc_wait_exit(struct vx_info *, void __user *);
11123+
11124+
11125+extern int vc_get_pflags(uint32_t pid, void __user *);
11126+extern int vc_set_pflags(uint32_t pid, void __user *);
11127+
11128+#endif /* _VSERVER_SIGNAL_CMD_H */
11129diff -NurpP --minimal linux-4.4.116/include/linux/vserver/space.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/space.h
11130--- linux-4.4.116/include/linux/vserver/space.h 1970-01-01 00:00:00.000000000 +0000
11131+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/space.h 2018-01-09 16:36:32.000000000 +0000
11132@@ -0,0 +1,12 @@
11133+#ifndef _VSERVER_SPACE_H
11134+#define _VSERVER_SPACE_H
11135+
11136+#include <linux/types.h>
11137+
11138+struct vx_info;
11139+
11140+int vx_set_space(struct vx_info *vxi, unsigned long mask, unsigned index);
11141+
11142+#else /* _VSERVER_SPACE_H */
11143+#warning duplicate inclusion
11144+#endif /* _VSERVER_SPACE_H */
11145diff -NurpP --minimal linux-4.4.116/include/linux/vserver/space_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/space_cmd.h
11146--- linux-4.4.116/include/linux/vserver/space_cmd.h 1970-01-01 00:00:00.000000000 +0000
11147+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/space_cmd.h 2018-01-09 16:36:32.000000000 +0000
11148@@ -0,0 +1,13 @@
11149+#ifndef _VSERVER_SPACE_CMD_H
11150+#define _VSERVER_SPACE_CMD_H
11151+
11152+#include <uapi/vserver/space_cmd.h>
11153+
11154+
11155+extern int vc_enter_space_v1(struct vx_info *, void __user *);
11156+extern int vc_set_space_v1(struct vx_info *, void __user *);
11157+extern int vc_enter_space(struct vx_info *, void __user *);
11158+extern int vc_set_space(struct vx_info *, void __user *);
11159+extern int vc_get_space_mask(void __user *, int);
11160+
11161+#endif /* _VSERVER_SPACE_CMD_H */
11162diff -NurpP --minimal linux-4.4.116/include/linux/vserver/switch.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/switch.h
11163--- linux-4.4.116/include/linux/vserver/switch.h 1970-01-01 00:00:00.000000000 +0000
11164+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/switch.h 2018-01-09 16:36:32.000000000 +0000
11165@@ -0,0 +1,8 @@
11166+#ifndef _VSERVER_SWITCH_H
11167+#define _VSERVER_SWITCH_H
11168+
11169+
11170+#include <linux/errno.h>
11171+#include <uapi/vserver/switch.h>
11172+
11173+#endif /* _VSERVER_SWITCH_H */
11174diff -NurpP --minimal linux-4.4.116/include/linux/vserver/tag.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/tag.h
11175--- linux-4.4.116/include/linux/vserver/tag.h 1970-01-01 00:00:00.000000000 +0000
11176+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/tag.h 2018-01-09 16:36:32.000000000 +0000
11177@@ -0,0 +1,160 @@
11178+#ifndef _DX_TAG_H
11179+#define _DX_TAG_H
11180+
11181+#include <linux/types.h>
11182+#include <linux/uidgid.h>
11183+
11184+
11185+#define DX_TAG(in) (IS_TAGGED(in))
11186+
11187+
11188+#ifdef CONFIG_TAG_NFSD
11189+#define DX_TAG_NFSD 1
11190+#else
11191+#define DX_TAG_NFSD 0
11192+#endif
11193+
11194+
11195+#ifdef CONFIG_TAGGING_NONE
11196+
11197+#define MAX_UID 0xFFFFFFFF
11198+#define MAX_GID 0xFFFFFFFF
11199+
11200+#define INOTAG_TAG(cond, uid, gid, tag) (0)
11201+
11202+#define TAGINO_UID(cond, uid, tag) (uid)
11203+#define TAGINO_GID(cond, gid, tag) (gid)
11204+
11205+#endif
11206+
11207+
11208+#ifdef CONFIG_TAGGING_GID16
11209+
11210+#define MAX_UID 0xFFFFFFFF
11211+#define MAX_GID 0x0000FFFF
11212+
11213+#define INOTAG_TAG(cond, uid, gid, tag) \
11214+ ((cond) ? (((gid) >> 16) & 0xFFFF) : 0)
11215+
11216+#define TAGINO_UID(cond, uid, tag) (uid)
11217+#define TAGINO_GID(cond, gid, tag) \
11218+ ((cond) ? (((gid) & 0xFFFF) | ((tag) << 16)) : (gid))
11219+
11220+#endif
11221+
11222+
11223+#ifdef CONFIG_TAGGING_ID24
11224+
11225+#define MAX_UID 0x00FFFFFF
11226+#define MAX_GID 0x00FFFFFF
11227+
11228+#define INOTAG_TAG(cond, uid, gid, tag) \
11229+ ((cond) ? ((((uid) >> 16) & 0xFF00) | (((gid) >> 24) & 0xFF)) : 0)
11230+
11231+#define TAGINO_UID(cond, uid, tag) \
11232+ ((cond) ? (((uid) & 0xFFFFFF) | (((tag) & 0xFF00) << 16)) : (uid))
11233+#define TAGINO_GID(cond, gid, tag) \
11234+ ((cond) ? (((gid) & 0xFFFFFF) | (((tag) & 0x00FF) << 24)) : (gid))
11235+
11236+#endif
11237+
11238+
11239+#ifdef CONFIG_TAGGING_UID16
11240+
11241+#define MAX_UID 0x0000FFFF
11242+#define MAX_GID 0xFFFFFFFF
11243+
11244+#define INOTAG_TAG(cond, uid, gid, tag) \
11245+ ((cond) ? (((uid) >> 16) & 0xFFFF) : 0)
11246+
11247+#define TAGINO_UID(cond, uid, tag) \
11248+ ((cond) ? (((uid) & 0xFFFF) | ((tag) << 16)) : (uid))
11249+#define TAGINO_GID(cond, gid, tag) (gid)
11250+
11251+#endif
11252+
11253+
11254+#ifdef CONFIG_TAGGING_INTERN
11255+
11256+#define MAX_UID 0xFFFFFFFF
11257+#define MAX_GID 0xFFFFFFFF
11258+
11259+#define INOTAG_TAG(cond, uid, gid, tag) \
11260+ ((cond) ? (tag) : 0)
11261+
11262+#define TAGINO_UID(cond, uid, tag) (uid)
11263+#define TAGINO_GID(cond, gid, tag) (gid)
11264+
11265+#endif
11266+
11267+
11268+#ifndef CONFIG_TAGGING_NONE
11269+#define dx_current_fstag(sb) \
11270+ ((sb)->s_flags & MS_TAGGED ? dx_current_tag() : 0)
11271+#else
11272+#define dx_current_fstag(sb) (0)
11273+#endif
11274+
11275+#ifndef CONFIG_TAGGING_INTERN
11276+#define TAGINO_TAG(cond, tag) (0)
11277+#else
11278+#define TAGINO_TAG(cond, tag) ((cond) ? (tag) : 0)
11279+#endif
11280+
11281+#define TAGINO_KUID(cond, kuid, ktag) \
11282+ KUIDT_INIT(TAGINO_UID(cond, __kuid_val(kuid), __ktag_val(ktag)))
11283+#define TAGINO_KGID(cond, kgid, ktag) \
11284+ KGIDT_INIT(TAGINO_GID(cond, __kgid_val(kgid), __ktag_val(ktag)))
11285+#define TAGINO_KTAG(cond, ktag) \
11286+ KTAGT_INIT(TAGINO_TAG(cond, __ktag_val(ktag)))
11287+
11288+
11289+#define INOTAG_UID(cond, uid, gid) \
11290+ ((cond) ? ((uid) & MAX_UID) : (uid))
11291+#define INOTAG_GID(cond, uid, gid) \
11292+ ((cond) ? ((gid) & MAX_GID) : (gid))
11293+
11294+#define INOTAG_KUID(cond, kuid, kgid) \
11295+ KUIDT_INIT(INOTAG_UID(cond, __kuid_val(kuid), __kgid_val(kgid)))
11296+#define INOTAG_KGID(cond, kuid, kgid) \
11297+ KGIDT_INIT(INOTAG_GID(cond, __kuid_val(kuid), __kgid_val(kgid)))
11298+#define INOTAG_KTAG(cond, kuid, kgid, ktag) \
11299+ KTAGT_INIT(INOTAG_TAG(cond, \
11300+ __kuid_val(kuid), __kgid_val(kgid), __ktag_val(ktag)))
11301+
11302+
11303+static inline uid_t dx_map_uid(uid_t uid)
11304+{
11305+ if ((uid > MAX_UID) && (uid != -1))
11306+ uid = -2;
11307+ return (uid & MAX_UID);
11308+}
11309+
11310+static inline gid_t dx_map_gid(gid_t gid)
11311+{
11312+ if ((gid > MAX_GID) && (gid != -1))
11313+ gid = -2;
11314+ return (gid & MAX_GID);
11315+}
11316+
11317+struct peer_tag {
11318+ int32_t xid;
11319+ int32_t nid;
11320+};
11321+
11322+#define dx_notagcheck(sb) ((sb) && ((sb)->s_flags & MS_NOTAGCHECK))
11323+
11324+int dx_parse_tag(char *string, vtag_t *tag, int remove, int *mnt_flags,
11325+ unsigned long *flags);
11326+
11327+#ifdef CONFIG_PROPAGATE
11328+
11329+void __dx_propagate_tag(struct nameidata *nd, struct inode *inode);
11330+
11331+#define dx_propagate_tag(n, i) __dx_propagate_tag(n, i)
11332+
11333+#else
11334+#define dx_propagate_tag(n, i) do { } while (0)
11335+#endif
11336+
11337+#endif /* _DX_TAG_H */
11338diff -NurpP --minimal linux-4.4.116/include/linux/vserver/tag_cmd.h linux-4.4.116-vs2.3.9.7/include/linux/vserver/tag_cmd.h
11339--- linux-4.4.116/include/linux/vserver/tag_cmd.h 1970-01-01 00:00:00.000000000 +0000
11340+++ linux-4.4.116-vs2.3.9.7/include/linux/vserver/tag_cmd.h 2018-01-09 16:36:32.000000000 +0000
11341@@ -0,0 +1,10 @@
11342+#ifndef _VSERVER_TAG_CMD_H
11343+#define _VSERVER_TAG_CMD_H
11344+
11345+#include <uapi/vserver/tag_cmd.h>
11346+
11347+extern int vc_task_tag(uint32_t);
11348+
11349+extern int vc_tag_migrate(uint32_t);
11350+
11351+#endif /* _VSERVER_TAG_CMD_H */
11352diff -NurpP --minimal linux-4.4.116/include/net/addrconf.h linux-4.4.116-vs2.3.9.7/include/net/addrconf.h
11353--- linux-4.4.116/include/net/addrconf.h 2018-02-22 21:19:58.000000000 +0000
11354+++ linux-4.4.116-vs2.3.9.7/include/net/addrconf.h 2018-01-09 16:36:32.000000000 +0000
11355@@ -84,7 +84,7 @@ struct inet6_ifaddr *ipv6_get_ifaddr(str
11356
11357 int ipv6_dev_get_saddr(struct net *net, const struct net_device *dev,
11358 const struct in6_addr *daddr, unsigned int srcprefs,
11359- struct in6_addr *saddr);
11360+ struct in6_addr *saddr, struct nx_info *nxi);
11361 int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
11362 u32 banned_flags);
11363 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
11364diff -NurpP --minimal linux-4.4.116/include/net/af_unix.h linux-4.4.116-vs2.3.9.7/include/net/af_unix.h
11365--- linux-4.4.116/include/net/af_unix.h 2018-02-22 21:19:58.000000000 +0000
11366+++ linux-4.4.116-vs2.3.9.7/include/net/af_unix.h 2018-01-09 16:36:32.000000000 +0000
11367@@ -4,6 +4,7 @@
11368 #include <linux/socket.h>
11369 #include <linux/un.h>
11370 #include <linux/mutex.h>
11371+// #include <linux/vs_base.h>
11372 #include <net/sock.h>
11373
11374 void unix_inflight(struct user_struct *user, struct file *fp);
11375diff -NurpP --minimal linux-4.4.116/include/net/inet_timewait_sock.h linux-4.4.116-vs2.3.9.7/include/net/inet_timewait_sock.h
11376--- linux-4.4.116/include/net/inet_timewait_sock.h 2016-07-05 04:15:11.000000000 +0000
11377+++ linux-4.4.116-vs2.3.9.7/include/net/inet_timewait_sock.h 2018-01-09 16:40:17.000000000 +0000
11378@@ -71,6 +71,10 @@ struct inet_timewait_sock {
11379 #define tw_num __tw_common.skc_num
11380 #define tw_cookie __tw_common.skc_cookie
11381 #define tw_dr __tw_common.skc_tw_dr
11382+#define tw_xid __tw_common.skc_xid
11383+#define tw_vx_info __tw_common.skc_vx_info
11384+#define tw_nid __tw_common.skc_nid
11385+#define tw_nx_info __tw_common.skc_nx_info
11386
11387 int tw_timeout;
11388 volatile unsigned char tw_substate;
11389diff -NurpP --minimal linux-4.4.116/include/net/ip6_route.h linux-4.4.116-vs2.3.9.7/include/net/ip6_route.h
11390--- linux-4.4.116/include/net/ip6_route.h 2018-02-22 21:19:58.000000000 +0000
11391+++ linux-4.4.116-vs2.3.9.7/include/net/ip6_route.h 2018-01-09 16:36:32.000000000 +0000
11392@@ -90,7 +90,7 @@ int ip6_del_rt(struct rt6_info *);
11393
11394 int ip6_route_get_saddr(struct net *net, struct rt6_info *rt,
11395 const struct in6_addr *daddr, unsigned int prefs,
11396- struct in6_addr *saddr);
11397+ struct in6_addr *saddr, struct nx_info *nxi);
11398
11399 struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
11400 const struct in6_addr *saddr, int oif, int flags);
11401diff -NurpP --minimal linux-4.4.116/include/net/route.h linux-4.4.116-vs2.3.9.7/include/net/route.h
11402--- linux-4.4.116/include/net/route.h 2016-07-05 04:15:11.000000000 +0000
11403+++ linux-4.4.116-vs2.3.9.7/include/net/route.h 2018-01-09 16:39:47.000000000 +0000
11404@@ -223,6 +223,9 @@ static inline void ip_rt_put(struct rtab
11405 dst_release(&rt->dst);
11406 }
11407
11408+#include <linux/vs_base.h>
11409+#include <linux/vs_inet.h>
11410+
11411 #define IPTOS_RT_MASK (IPTOS_TOS_MASK & ~3)
11412
11413 extern const __u8 ip_tos2prio[16];
11414@@ -270,6 +273,9 @@ static inline void ip_route_connect_init
11415 protocol, flow_flags, dst, src, dport, sport);
11416 }
11417
11418+extern struct rtable *ip_v4_find_src(struct net *net, struct nx_info *,
11419+ struct flowi4 *);
11420+
11421 static inline struct rtable *ip_route_connect(struct flowi4 *fl4,
11422 __be32 dst, __be32 src, u32 tos,
11423 int oif, u8 protocol,
11424@@ -278,6 +284,7 @@ static inline struct rtable *ip_route_co
11425 {
11426 struct net *net = sock_net(sk);
11427 struct rtable *rt;
11428+ struct nx_info *nx_info = current_nx_info();
11429
11430 ip_route_connect_init(fl4, dst, src, tos, oif, protocol,
11431 sport, dport, sk);
11432@@ -291,7 +298,21 @@ static inline struct rtable *ip_route_co
11433
11434 src = fl4->saddr;
11435 }
11436- if (!dst || !src) {
11437+
11438+ if (sk)
11439+ nx_info = sk->sk_nx_info;
11440+
11441+ vxdprintk(VXD_CBIT(net, 4),
11442+ "ip_route_connect(%p) %p,%p;%lx",
11443+ sk, nx_info, sk->sk_socket,
11444+ (sk->sk_socket?sk->sk_socket->flags:0));
11445+
11446+ rt = ip_v4_find_src(net, nx_info, fl4);
11447+ if (IS_ERR(rt))
11448+ return rt;
11449+ ip_rt_put(rt);
11450+
11451+ if (!fl4->daddr || !fl4->saddr) {
11452 rt = __ip_route_output_key(net, fl4);
11453 if (IS_ERR(rt))
11454 return rt;
11455diff -NurpP --minimal linux-4.4.116/include/net/sock.h linux-4.4.116-vs2.3.9.7/include/net/sock.h
11456--- linux-4.4.116/include/net/sock.h 2018-02-22 21:19:58.000000000 +0000
11457+++ linux-4.4.116-vs2.3.9.7/include/net/sock.h 2018-01-09 16:41:40.000000000 +0000
11458@@ -201,6 +201,10 @@ struct sock_common {
11459 struct in6_addr skc_v6_daddr;
11460 struct in6_addr skc_v6_rcv_saddr;
11461 #endif
11462+ vxid_t skc_xid;
11463+ struct vx_info *skc_vx_info;
11464+ vnid_t skc_nid;
11465+ struct nx_info *skc_nx_info;
11466
11467 atomic64_t skc_cookie;
11468
11469@@ -349,8 +353,12 @@ struct sock {
11470 #define sk_prot __sk_common.skc_prot
11471 #define sk_net __sk_common.skc_net
11472 #define sk_v6_daddr __sk_common.skc_v6_daddr
11473-#define sk_v6_rcv_saddr __sk_common.skc_v6_rcv_saddr
11474+#define sk_v6_rcv_saddr __sk_common.skc_v6_rcv_saddr
11475 #define sk_cookie __sk_common.skc_cookie
11476+#define sk_xid __sk_common.skc_xid
11477+#define sk_vx_info __sk_common.skc_vx_info
11478+#define sk_nid __sk_common.skc_nid
11479+#define sk_nx_info __sk_common.skc_nx_info
11480 #define sk_incoming_cpu __sk_common.skc_incoming_cpu
11481 #define sk_flags __sk_common.skc_flags
11482 #define sk_rxhash __sk_common.skc_rxhash
11483diff -NurpP --minimal linux-4.4.116/include/uapi/Kbuild linux-4.4.116-vs2.3.9.7/include/uapi/Kbuild
11484--- linux-4.4.116/include/uapi/Kbuild 2015-04-12 22:12:50.000000000 +0000
11485+++ linux-4.4.116-vs2.3.9.7/include/uapi/Kbuild 2018-01-09 16:36:32.000000000 +0000
11486@@ -13,3 +13,4 @@ header-y += drm/
11487 header-y += xen/
11488 header-y += scsi/
11489 header-y += misc/
11490+header-y += vserver/
11491diff -NurpP --minimal linux-4.4.116/include/uapi/linux/capability.h linux-4.4.116-vs2.3.9.7/include/uapi/linux/capability.h
11492--- linux-4.4.116/include/uapi/linux/capability.h 2015-04-12 22:12:50.000000000 +0000
11493+++ linux-4.4.116-vs2.3.9.7/include/uapi/linux/capability.h 2018-01-09 16:36:32.000000000 +0000
11494@@ -259,6 +259,7 @@ struct vfs_cap_data {
11495 arbitrary SCSI commands */
11496 /* Allow setting encryption key on loopback filesystem */
11497 /* Allow setting zone reclaim policy */
11498+/* Allow the selection of a security context */
11499
11500 #define CAP_SYS_ADMIN 21
11501
11502@@ -354,7 +355,12 @@ struct vfs_cap_data {
11503
11504 #define CAP_LAST_CAP CAP_AUDIT_READ
11505
11506-#define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
11507+/* Allow context manipulations */
11508+/* Allow changing context info on files */
11509+
11510+#define CAP_CONTEXT 63
11511+
11512+#define cap_valid(x) ((x) >= 0 && ((x) <= CAP_LAST_CAP || (x) == CAP_CONTEXT))
11513
11514 /*
11515 * Bit location of each capability (used by user-space library and kernel)
11516diff -NurpP --minimal linux-4.4.116/include/uapi/linux/fs.h linux-4.4.116-vs2.3.9.7/include/uapi/linux/fs.h
11517--- linux-4.4.116/include/uapi/linux/fs.h 2016-07-05 04:15:11.000000000 +0000
11518+++ linux-4.4.116-vs2.3.9.7/include/uapi/linux/fs.h 2018-01-09 16:47:48.000000000 +0000
11519@@ -91,6 +91,9 @@ struct inodes_stat_t {
11520 #define MS_I_VERSION (1<<23) /* Update inode I_version field */
11521 #define MS_STRICTATIME (1<<24) /* Always perform atime updates */
11522 #define MS_LAZYTIME (1<<25) /* Update the on-disk [acm]times lazily */
11523+#define MS_TAGGED (1<<8) /* use generic inode tagging */
11524+#define MS_NOTAGCHECK (1<<9) /* don't check tags */
11525+#define MS_TAGID (1<<26) /* use specific tag for this mount */
11526
11527 /* These sb flags are internal to the kernel */
11528 #define MS_NOSEC (1<<28)
11529@@ -197,12 +200,15 @@ struct inodes_stat_t {
11530 #define FS_EXTENT_FL 0x00080000 /* Extents */
11531 #define FS_DIRECTIO_FL 0x00100000 /* Use direct i/o */
11532 #define FS_NOCOW_FL 0x00800000 /* Do not cow file */
11533+#define FS_IXUNLINK_FL 0x08000000 /* Immutable invert on unlink */
11534 #define FS_PROJINHERIT_FL 0x20000000 /* Create with parents projid */
11535 #define FS_RESERVED_FL 0x80000000 /* reserved for ext2 lib */
11536
11537-#define FS_FL_USER_VISIBLE 0x0003DFFF /* User visible flags */
11538-#define FS_FL_USER_MODIFIABLE 0x000380FF /* User modifiable flags */
11539-
11540+#define FS_BARRIER_FL 0x04000000 /* Barrier for chroot() */
11541+#define FS_COW_FL 0x20000000 /* Copy on Write marker */
11542+
11543+#define FS_FL_USER_VISIBLE 0x0103DFFF /* User visible flags */
11544+#define FS_FL_USER_MODIFIABLE 0x010380FF /* User modifiable flags */
11545
11546 #define SYNC_FILE_RANGE_WAIT_BEFORE 1
11547 #define SYNC_FILE_RANGE_WRITE 2
11548diff -NurpP --minimal linux-4.4.116/include/uapi/linux/gfs2_ondisk.h linux-4.4.116-vs2.3.9.7/include/uapi/linux/gfs2_ondisk.h
11549--- linux-4.4.116/include/uapi/linux/gfs2_ondisk.h 2015-04-12 22:12:50.000000000 +0000
11550+++ linux-4.4.116-vs2.3.9.7/include/uapi/linux/gfs2_ondisk.h 2018-01-09 16:36:32.000000000 +0000
11551@@ -225,6 +225,9 @@ enum {
11552 gfs2fl_Sync = 8,
11553 gfs2fl_System = 9,
11554 gfs2fl_TopLevel = 10,
11555+ gfs2fl_IXUnlink = 16,
11556+ gfs2fl_Barrier = 17,
11557+ gfs2fl_Cow = 18,
11558 gfs2fl_TruncInProg = 29,
11559 gfs2fl_InheritDirectio = 30,
11560 gfs2fl_InheritJdata = 31,
11561@@ -242,6 +245,9 @@ enum {
11562 #define GFS2_DIF_SYNC 0x00000100
11563 #define GFS2_DIF_SYSTEM 0x00000200 /* New in gfs2 */
11564 #define GFS2_DIF_TOPDIR 0x00000400 /* New in gfs2 */
11565+#define GFS2_DIF_IXUNLINK 0x00010000
11566+#define GFS2_DIF_BARRIER 0x00020000
11567+#define GFS2_DIF_COW 0x00040000
11568 #define GFS2_DIF_TRUNC_IN_PROG 0x20000000 /* New in gfs2 */
11569 #define GFS2_DIF_INHERIT_DIRECTIO 0x40000000 /* only in gfs1 */
11570 #define GFS2_DIF_INHERIT_JDATA 0x80000000
11571diff -NurpP --minimal linux-4.4.116/include/uapi/linux/if_tun.h linux-4.4.116-vs2.3.9.7/include/uapi/linux/if_tun.h
11572--- linux-4.4.116/include/uapi/linux/if_tun.h 2015-10-29 09:21:42.000000000 +0000
11573+++ linux-4.4.116-vs2.3.9.7/include/uapi/linux/if_tun.h 2018-01-09 16:46:34.000000000 +0000
11574@@ -56,6 +56,7 @@
11575 */
11576 #define TUNSETVNETBE _IOW('T', 222, int)
11577 #define TUNGETVNETBE _IOR('T', 223, int)
11578+#define TUNSETNID _IOW('T', 224, int)
11579
11580 /* TUNSETIFF ifr flags */
11581 #define IFF_TUN 0x0001
11582diff -NurpP --minimal linux-4.4.116/include/uapi/linux/major.h linux-4.4.116-vs2.3.9.7/include/uapi/linux/major.h
11583--- linux-4.4.116/include/uapi/linux/major.h 2015-04-12 22:12:50.000000000 +0000
11584+++ linux-4.4.116-vs2.3.9.7/include/uapi/linux/major.h 2018-01-09 16:36:33.000000000 +0000
11585@@ -15,6 +15,7 @@
11586 #define HD_MAJOR IDE0_MAJOR
11587 #define PTY_SLAVE_MAJOR 3
11588 #define TTY_MAJOR 4
11589+#define VROOT_MAJOR 4
11590 #define TTYAUX_MAJOR 5
11591 #define LP_MAJOR 6
11592 #define VCS_MAJOR 7
11593diff -NurpP --minimal linux-4.4.116/include/uapi/linux/nfs_mount.h linux-4.4.116-vs2.3.9.7/include/uapi/linux/nfs_mount.h
11594--- linux-4.4.116/include/uapi/linux/nfs_mount.h 2015-04-12 22:12:50.000000000 +0000
11595+++ linux-4.4.116-vs2.3.9.7/include/uapi/linux/nfs_mount.h 2018-01-09 16:36:33.000000000 +0000
11596@@ -63,7 +63,8 @@ struct nfs_mount_data {
11597 #define NFS_MOUNT_SECFLAVOUR 0x2000 /* 5 non-text parsed mount data only */
11598 #define NFS_MOUNT_NORDIRPLUS 0x4000 /* 5 */
11599 #define NFS_MOUNT_UNSHARED 0x8000 /* 5 */
11600-#define NFS_MOUNT_FLAGMASK 0xFFFF
11601+#define NFS_MOUNT_TAGGED 0x10000 /* context tagging */
11602+#define NFS_MOUNT_FLAGMASK 0x1FFFF
11603
11604 /* The following are for internal use only */
11605 #define NFS_MOUNT_LOOKUP_CACHE_NONEG 0x10000
11606diff -NurpP --minimal linux-4.4.116/include/uapi/linux/reboot.h linux-4.4.116-vs2.3.9.7/include/uapi/linux/reboot.h
11607--- linux-4.4.116/include/uapi/linux/reboot.h 2015-04-12 22:12:50.000000000 +0000
11608+++ linux-4.4.116-vs2.3.9.7/include/uapi/linux/reboot.h 2018-01-09 16:36:33.000000000 +0000
11609@@ -33,7 +33,7 @@
11610 #define LINUX_REBOOT_CMD_RESTART2 0xA1B2C3D4
11611 #define LINUX_REBOOT_CMD_SW_SUSPEND 0xD000FCE2
11612 #define LINUX_REBOOT_CMD_KEXEC 0x45584543
11613-
11614+#define LINUX_REBOOT_CMD_OOM 0xDEADBEEF
11615
11616
11617 #endif /* _UAPI_LINUX_REBOOT_H */
11618diff -NurpP --minimal linux-4.4.116/include/uapi/linux/sysctl.h linux-4.4.116-vs2.3.9.7/include/uapi/linux/sysctl.h
11619--- linux-4.4.116/include/uapi/linux/sysctl.h 2015-04-12 22:12:50.000000000 +0000
11620+++ linux-4.4.116-vs2.3.9.7/include/uapi/linux/sysctl.h 2018-01-09 16:36:33.000000000 +0000
11621@@ -60,6 +60,7 @@ enum
11622 CTL_ABI=9, /* Binary emulation */
11623 CTL_CPU=10, /* CPU stuff (speed scaling, etc) */
11624 CTL_ARLAN=254, /* arlan wireless driver */
11625+ CTL_VSERVER=4242, /* Linux-VServer debug */
11626 CTL_S390DBF=5677, /* s390 debug */
11627 CTL_SUNRPC=7249, /* sunrpc debug */
11628 CTL_PM=9899, /* frv power management */
11629@@ -94,6 +95,7 @@ enum
11630
11631 KERN_PANIC=15, /* int: panic timeout */
11632 KERN_REALROOTDEV=16, /* real root device to mount after initrd */
11633+ KERN_VSHELPER=17, /* string: path to vshelper policy agent */
11634
11635 KERN_SPARC_REBOOT=21, /* reboot command on Sparc */
11636 KERN_CTLALTDEL=22, /* int: allow ctl-alt-del to reboot */
11637diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/Kbuild linux-4.4.116-vs2.3.9.7/include/uapi/vserver/Kbuild
11638--- linux-4.4.116/include/uapi/vserver/Kbuild 1970-01-01 00:00:00.000000000 +0000
11639+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/Kbuild 2018-01-09 16:36:33.000000000 +0000
11640@@ -0,0 +1,9 @@
11641+
11642+header-y += context_cmd.h network_cmd.h space_cmd.h \
11643+ cacct_cmd.h cvirt_cmd.h limit_cmd.h dlimit_cmd.h \
11644+ inode_cmd.h tag_cmd.h sched_cmd.h signal_cmd.h \
11645+ debug_cmd.h device_cmd.h
11646+
11647+header-y += switch.h context.h network.h monitor.h \
11648+ limit.h inode.h device.h
11649+
11650diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/cacct_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/cacct_cmd.h
11651--- linux-4.4.116/include/uapi/vserver/cacct_cmd.h 1970-01-01 00:00:00.000000000 +0000
11652+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/cacct_cmd.h 2018-01-09 16:36:33.000000000 +0000
11653@@ -0,0 +1,15 @@
11654+#ifndef _UAPI_VS_CACCT_CMD_H
11655+#define _UAPI_VS_CACCT_CMD_H
11656+
11657+
11658+/* virtual host info name commands */
11659+
11660+#define VCMD_sock_stat VC_CMD(VSTAT, 5, 0)
11661+
11662+struct vcmd_sock_stat_v0 {
11663+ uint32_t field;
11664+ uint32_t count[3];
11665+ uint64_t total[3];
11666+};
11667+
11668+#endif /* _UAPI_VS_CACCT_CMD_H */
11669diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/context.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/context.h
11670--- linux-4.4.116/include/uapi/vserver/context.h 1970-01-01 00:00:00.000000000 +0000
11671+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/context.h 2018-01-09 16:36:33.000000000 +0000
11672@@ -0,0 +1,81 @@
11673+#ifndef _UAPI_VS_CONTEXT_H
11674+#define _UAPI_VS_CONTEXT_H
11675+
11676+#include <linux/types.h>
11677+#include <linux/capability.h>
11678+
11679+
11680+/* context flags */
11681+
11682+#define VXF_INFO_SCHED 0x00000002
11683+#define VXF_INFO_NPROC 0x00000004
11684+#define VXF_INFO_PRIVATE 0x00000008
11685+
11686+#define VXF_INFO_INIT 0x00000010
11687+#define VXF_INFO_HIDE 0x00000020
11688+#define VXF_INFO_ULIMIT 0x00000040
11689+#define VXF_INFO_NSPACE 0x00000080
11690+
11691+#define VXF_SCHED_HARD 0x00000100
11692+#define VXF_SCHED_PRIO 0x00000200
11693+#define VXF_SCHED_PAUSE 0x00000400
11694+
11695+#define VXF_VIRT_MEM 0x00010000
11696+#define VXF_VIRT_UPTIME 0x00020000
11697+#define VXF_VIRT_CPU 0x00040000
11698+#define VXF_VIRT_LOAD 0x00080000
11699+#define VXF_VIRT_TIME 0x00100000
11700+
11701+#define VXF_HIDE_MOUNT 0x01000000
11702+/* was VXF_HIDE_NETIF 0x02000000 */
11703+#define VXF_HIDE_VINFO 0x04000000
11704+
11705+#define VXF_STATE_SETUP (1ULL << 32)
11706+#define VXF_STATE_INIT (1ULL << 33)
11707+#define VXF_STATE_ADMIN (1ULL << 34)
11708+
11709+#define VXF_SC_HELPER (1ULL << 36)
11710+#define VXF_REBOOT_KILL (1ULL << 37)
11711+#define VXF_PERSISTENT (1ULL << 38)
11712+
11713+#define VXF_FORK_RSS (1ULL << 48)
11714+#define VXF_PROLIFIC (1ULL << 49)
11715+
11716+#define VXF_IGNEG_NICE (1ULL << 52)
11717+
11718+#define VXF_ONE_TIME (0x0007ULL << 32)
11719+
11720+#define VXF_INIT_SET (VXF_STATE_SETUP | VXF_STATE_INIT | VXF_STATE_ADMIN)
11721+
11722+
11723+/* context migration */
11724+
11725+#define VXM_SET_INIT 0x00000001
11726+#define VXM_SET_REAPER 0x00000002
11727+
11728+/* context caps */
11729+
11730+#define VXC_SET_UTSNAME 0x00000001
11731+#define VXC_SET_RLIMIT 0x00000002
11732+#define VXC_FS_SECURITY 0x00000004
11733+#define VXC_FS_TRUSTED 0x00000008
11734+#define VXC_TIOCSTI 0x00000010
11735+
11736+/* was VXC_RAW_ICMP 0x00000100 */
11737+#define VXC_SYSLOG 0x00001000
11738+#define VXC_OOM_ADJUST 0x00002000
11739+#define VXC_AUDIT_CONTROL 0x00004000
11740+
11741+#define VXC_SECURE_MOUNT 0x00010000
11742+/* #define VXC_SECURE_REMOUNT 0x00020000 */
11743+#define VXC_BINARY_MOUNT 0x00040000
11744+#define VXC_DEV_MOUNT 0x00080000
11745+
11746+#define VXC_QUOTA_CTL 0x00100000
11747+#define VXC_ADMIN_MAPPER 0x00200000
11748+#define VXC_ADMIN_CLOOP 0x00400000
11749+
11750+#define VXC_KTHREAD 0x01000000
11751+#define VXC_NAMESPACE 0x02000000
11752+
11753+#endif /* _UAPI_VS_CONTEXT_H */
11754diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/context_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/context_cmd.h
11755--- linux-4.4.116/include/uapi/vserver/context_cmd.h 1970-01-01 00:00:00.000000000 +0000
11756+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/context_cmd.h 2018-01-09 16:36:33.000000000 +0000
11757@@ -0,0 +1,115 @@
11758+#ifndef _UAPI_VS_CONTEXT_CMD_H
11759+#define _UAPI_VS_CONTEXT_CMD_H
11760+
11761+
11762+/* vinfo commands */
11763+
11764+#define VCMD_task_xid VC_CMD(VINFO, 1, 0)
11765+
11766+
11767+#define VCMD_vx_info VC_CMD(VINFO, 5, 0)
11768+
11769+struct vcmd_vx_info_v0 {
11770+ uint32_t xid;
11771+ uint32_t initpid;
11772+ /* more to come */
11773+};
11774+
11775+
11776+#define VCMD_ctx_stat VC_CMD(VSTAT, 0, 0)
11777+
11778+struct vcmd_ctx_stat_v0 {
11779+ uint32_t usecnt;
11780+ uint32_t tasks;
11781+ /* more to come */
11782+};
11783+
11784+
11785+/* context commands */
11786+
11787+#define VCMD_ctx_create_v0 VC_CMD(VPROC, 1, 0)
11788+#define VCMD_ctx_create VC_CMD(VPROC, 1, 1)
11789+
11790+struct vcmd_ctx_create {
11791+ uint64_t flagword;
11792+};
11793+
11794+#define VCMD_ctx_migrate_v0 VC_CMD(PROCMIG, 1, 0)
11795+#define VCMD_ctx_migrate VC_CMD(PROCMIG, 1, 1)
11796+
11797+struct vcmd_ctx_migrate {
11798+ uint64_t flagword;
11799+};
11800+
11801+
11802+
11803+/* flag commands */
11804+
11805+#define VCMD_get_cflags VC_CMD(FLAGS, 1, 0)
11806+#define VCMD_set_cflags VC_CMD(FLAGS, 2, 0)
11807+
11808+struct vcmd_ctx_flags_v0 {
11809+ uint64_t flagword;
11810+ uint64_t mask;
11811+};
11812+
11813+
11814+
11815+/* context caps commands */
11816+
11817+#define VCMD_get_ccaps VC_CMD(FLAGS, 3, 1)
11818+#define VCMD_set_ccaps VC_CMD(FLAGS, 4, 1)
11819+
11820+struct vcmd_ctx_caps_v1 {
11821+ uint64_t ccaps;
11822+ uint64_t cmask;
11823+};
11824+
11825+
11826+
11827+/* bcaps commands */
11828+
11829+#define VCMD_get_bcaps VC_CMD(FLAGS, 9, 0)
11830+#define VCMD_set_bcaps VC_CMD(FLAGS, 10, 0)
11831+
11832+struct vcmd_bcaps {
11833+ uint64_t bcaps;
11834+ uint64_t bmask;
11835+};
11836+
11837+
11838+
11839+/* umask commands */
11840+
11841+#define VCMD_get_umask VC_CMD(FLAGS, 13, 0)
11842+#define VCMD_set_umask VC_CMD(FLAGS, 14, 0)
11843+
11844+struct vcmd_umask {
11845+ uint64_t umask;
11846+ uint64_t mask;
11847+};
11848+
11849+
11850+
11851+/* wmask commands */
11852+
11853+#define VCMD_get_wmask VC_CMD(FLAGS, 15, 0)
11854+#define VCMD_set_wmask VC_CMD(FLAGS, 16, 0)
11855+
11856+struct vcmd_wmask {
11857+ uint64_t wmask;
11858+ uint64_t mask;
11859+};
11860+
11861+
11862+
11863+/* OOM badness */
11864+
11865+#define VCMD_get_badness VC_CMD(MEMCTRL, 5, 0)
11866+#define VCMD_set_badness VC_CMD(MEMCTRL, 6, 0)
11867+
11868+struct vcmd_badness_v0 {
11869+ int64_t bias;
11870+};
11871+
11872+#endif /* _UAPI_VS_CONTEXT_CMD_H */
11873diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/cvirt_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/cvirt_cmd.h
11874--- linux-4.4.116/include/uapi/vserver/cvirt_cmd.h 1970-01-01 00:00:00.000000000 +0000
11875+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/cvirt_cmd.h 2018-01-09 16:36:33.000000000 +0000
11876@@ -0,0 +1,41 @@
11877+#ifndef _UAPI_VS_CVIRT_CMD_H
11878+#define _UAPI_VS_CVIRT_CMD_H
11879+
11880+
11881+/* virtual host info name commands */
11882+
11883+#define VCMD_set_vhi_name VC_CMD(VHOST, 1, 0)
11884+#define VCMD_get_vhi_name VC_CMD(VHOST, 2, 0)
11885+
11886+struct vcmd_vhi_name_v0 {
11887+ uint32_t field;
11888+ char name[65];
11889+};
11890+
11891+
11892+enum vhi_name_field {
11893+ VHIN_CONTEXT = 0,
11894+ VHIN_SYSNAME,
11895+ VHIN_NODENAME,
11896+ VHIN_RELEASE,
11897+ VHIN_VERSION,
11898+ VHIN_MACHINE,
11899+ VHIN_DOMAINNAME,
11900+};
11901+
11902+
11903+
11904+#define VCMD_virt_stat VC_CMD(VSTAT, 3, 0)
11905+
11906+struct vcmd_virt_stat_v0 {
11907+ uint64_t offset;
11908+ uint64_t uptime;
11909+ uint32_t nr_threads;
11910+ uint32_t nr_running;
11911+ uint32_t nr_uninterruptible;
11912+ uint32_t nr_onhold;
11913+ uint32_t nr_forks;
11914+ uint32_t load[3];
11915+};
11916+
11917+#endif /* _UAPI_VS_CVIRT_CMD_H */
11918diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/debug_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/debug_cmd.h
11919--- linux-4.4.116/include/uapi/vserver/debug_cmd.h 1970-01-01 00:00:00.000000000 +0000
11920+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/debug_cmd.h 2018-01-09 16:36:33.000000000 +0000
11921@@ -0,0 +1,24 @@
11922+#ifndef _UAPI_VS_DEBUG_CMD_H
11923+#define _UAPI_VS_DEBUG_CMD_H
11924+
11925+
11926+/* debug commands */
11927+
11928+#define VCMD_dump_history VC_CMD(DEBUG, 1, 0)
11929+
11930+#define VCMD_read_history VC_CMD(DEBUG, 5, 0)
11931+#define VCMD_read_monitor VC_CMD(DEBUG, 6, 0)
11932+
11933+struct vcmd_read_history_v0 {
11934+ uint32_t index;
11935+ uint32_t count;
11936+ char __user *data;
11937+};
11938+
11939+struct vcmd_read_monitor_v0 {
11940+ uint32_t index;
11941+ uint32_t count;
11942+ char __user *data;
11943+};
11944+
11945+#endif /* _UAPI_VS_DEBUG_CMD_H */
11946diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/device.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/device.h
11947--- linux-4.4.116/include/uapi/vserver/device.h 1970-01-01 00:00:00.000000000 +0000
11948+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/device.h 2018-01-09 16:36:33.000000000 +0000
11949@@ -0,0 +1,12 @@
11950+#ifndef _UAPI_VS_DEVICE_H
11951+#define _UAPI_VS_DEVICE_H
11952+
11953+
11954+#define DATTR_CREATE 0x00000001
11955+#define DATTR_OPEN 0x00000002
11956+
11957+#define DATTR_REMAP 0x00000010
11958+
11959+#define DATTR_MASK 0x00000013
11960+
11961+#endif /* _UAPI_VS_DEVICE_H */
11962diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/device_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/device_cmd.h
11963--- linux-4.4.116/include/uapi/vserver/device_cmd.h 1970-01-01 00:00:00.000000000 +0000
11964+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/device_cmd.h 2018-01-09 16:36:33.000000000 +0000
11965@@ -0,0 +1,16 @@
11966+#ifndef _UAPI_VS_DEVICE_CMD_H
11967+#define _UAPI_VS_DEVICE_CMD_H
11968+
11969+
11970+/* device vserver commands */
11971+
11972+#define VCMD_set_mapping VC_CMD(DEVICE, 1, 0)
11973+#define VCMD_unset_mapping VC_CMD(DEVICE, 2, 0)
11974+
11975+struct vcmd_set_mapping_v0 {
11976+ const char __user *device;
11977+ const char __user *target;
11978+ uint32_t flags;
11979+};
11980+
11981+#endif /* _UAPI_VS_DEVICE_CMD_H */
11982diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/dlimit_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/dlimit_cmd.h
11983--- linux-4.4.116/include/uapi/vserver/dlimit_cmd.h 1970-01-01 00:00:00.000000000 +0000
11984+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/dlimit_cmd.h 2018-01-09 16:36:33.000000000 +0000
11985@@ -0,0 +1,67 @@
11986+#ifndef _UAPI_VS_DLIMIT_CMD_H
11987+#define _UAPI_VS_DLIMIT_CMD_H
11988+
11989+
11990+/* dlimit vserver commands */
11991+
11992+#define VCMD_add_dlimit VC_CMD(DLIMIT, 1, 0)
11993+#define VCMD_rem_dlimit VC_CMD(DLIMIT, 2, 0)
11994+
11995+#define VCMD_set_dlimit VC_CMD(DLIMIT, 5, 0)
11996+#define VCMD_get_dlimit VC_CMD(DLIMIT, 6, 0)
11997+
11998+struct vcmd_ctx_dlimit_base_v0 {
11999+ const char __user *name;
12000+ uint32_t flags;
12001+};
12002+
12003+struct vcmd_ctx_dlimit_v0 {
12004+ const char __user *name;
12005+ uint32_t space_used; /* used space in kbytes */
12006+ uint32_t space_total; /* maximum space in kbytes */
12007+ uint32_t inodes_used; /* used inodes */
12008+ uint32_t inodes_total; /* maximum inodes */
12009+ uint32_t reserved; /* reserved for root in % */
12010+ uint32_t flags;
12011+};
12012+
12013+#define CDLIM_UNSET ((uint32_t)0UL)
12014+#define CDLIM_INFINITY ((uint32_t)~0UL)
12015+#define CDLIM_KEEP ((uint32_t)~1UL)
12016+
12017+#define DLIME_UNIT 0
12018+#define DLIME_KILO 1
12019+#define DLIME_MEGA 2
12020+#define DLIME_GIGA 3
12021+
12022+#define DLIMF_SHIFT 0x10
12023+
12024+#define DLIMS_USED 0
12025+#define DLIMS_TOTAL 2
12026+
12027+static inline
12028+uint64_t dlimit_space_32to64(uint32_t val, uint32_t flags, int shift)
12029+{
12030+ int exp = (flags & DLIMF_SHIFT) ?
12031+ (flags >> shift) & DLIME_GIGA : DLIME_KILO;
12032+ return ((uint64_t)val) << (10 * exp);
12033+}
12034+
12035+static inline
12036+uint32_t dlimit_space_64to32(uint64_t val, uint32_t *flags, int shift)
12037+{
12038+ int exp = 0;
12039+
12040+ if (*flags & DLIMF_SHIFT) {
12041+ while (val > (1LL << 32) && (exp < 3)) {
12042+ val >>= 10;
12043+ exp++;
12044+ }
12045+ *flags &= ~(DLIME_GIGA << shift);
12046+ *flags |= exp << shift;
12047+ } else
12048+ val >>= 10;
12049+ return val;
12050+}
12051+
12052+#endif /* _UAPI_VS_DLIMIT_CMD_H */
12053diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/inode.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/inode.h
12054--- linux-4.4.116/include/uapi/vserver/inode.h 1970-01-01 00:00:00.000000000 +0000
12055+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/inode.h 2018-01-09 16:36:33.000000000 +0000
12056@@ -0,0 +1,23 @@
12057+#ifndef _UAPI_VS_INODE_H
12058+#define _UAPI_VS_INODE_H
12059+
12060+
12061+#define IATTR_TAG 0x01000000
12062+
12063+#define IATTR_ADMIN 0x00000001
12064+#define IATTR_WATCH 0x00000002
12065+#define IATTR_HIDE 0x00000004
12066+#define IATTR_FLAGS 0x00000007
12067+
12068+#define IATTR_BARRIER 0x00010000
12069+#define IATTR_IXUNLINK 0x00020000
12070+#define IATTR_IMMUTABLE 0x00040000
12071+#define IATTR_COW 0x00080000
12072+
12073+
12074+/* inode ioctls */
12075+
12076+#define FIOC_GETXFLG _IOR('x', 5, long)
12077+#define FIOC_SETXFLG _IOW('x', 6, long)
12078+
12079+#endif /* _UAPI_VS_INODE_H */
12080diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/inode_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/inode_cmd.h
12081--- linux-4.4.116/include/uapi/vserver/inode_cmd.h 1970-01-01 00:00:00.000000000 +0000
12082+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/inode_cmd.h 2018-01-09 16:36:33.000000000 +0000
12083@@ -0,0 +1,26 @@
12084+#ifndef _UAPI_VS_INODE_CMD_H
12085+#define _UAPI_VS_INODE_CMD_H
12086+
12087+
12088+/* inode vserver commands */
12089+
12090+#define VCMD_get_iattr VC_CMD(INODE, 1, 1)
12091+#define VCMD_set_iattr VC_CMD(INODE, 2, 1)
12092+
12093+#define VCMD_fget_iattr VC_CMD(INODE, 3, 0)
12094+#define VCMD_fset_iattr VC_CMD(INODE, 4, 0)
12095+
12096+struct vcmd_ctx_iattr_v1 {
12097+ const char __user *name;
12098+ uint32_t tag;
12099+ uint32_t flags;
12100+ uint32_t mask;
12101+};
12102+
12103+struct vcmd_ctx_fiattr_v0 {
12104+ uint32_t tag;
12105+ uint32_t flags;
12106+ uint32_t mask;
12107+};
12108+
12109+#endif /* _UAPI_VS_INODE_CMD_H */
12110diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/limit.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/limit.h
12111--- linux-4.4.116/include/uapi/vserver/limit.h 1970-01-01 00:00:00.000000000 +0000
12112+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/limit.h 2018-01-09 16:36:33.000000000 +0000
12113@@ -0,0 +1,14 @@
12114+#ifndef _UAPI_VS_LIMIT_H
12115+#define _UAPI_VS_LIMIT_H
12116+
12117+
12118+#define VLIMIT_NSOCK 16
12119+#define VLIMIT_OPENFD 17
12120+#define VLIMIT_ANON 18
12121+#define VLIMIT_SHMEM 19
12122+#define VLIMIT_SEMARY 20
12123+#define VLIMIT_NSEMS 21
12124+#define VLIMIT_DENTRY 22
12125+#define VLIMIT_MAPPED 23
12126+
12127+#endif /* _UAPI_VS_LIMIT_H */
12128diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/limit_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/limit_cmd.h
12129--- linux-4.4.116/include/uapi/vserver/limit_cmd.h 1970-01-01 00:00:00.000000000 +0000
12130+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/limit_cmd.h 2018-01-09 16:36:33.000000000 +0000
12131@@ -0,0 +1,40 @@
12132+#ifndef _UAPI_VS_LIMIT_CMD_H
12133+#define _UAPI_VS_LIMIT_CMD_H
12134+
12135+
12136+/* rlimit vserver commands */
12137+
12138+#define VCMD_get_rlimit VC_CMD(RLIMIT, 1, 0)
12139+#define VCMD_set_rlimit VC_CMD(RLIMIT, 2, 0)
12140+#define VCMD_get_rlimit_mask VC_CMD(RLIMIT, 3, 0)
12141+#define VCMD_reset_hits VC_CMD(RLIMIT, 7, 0)
12142+#define VCMD_reset_minmax VC_CMD(RLIMIT, 9, 0)
12143+
12144+struct vcmd_ctx_rlimit_v0 {
12145+ uint32_t id;
12146+ uint64_t minimum;
12147+ uint64_t softlimit;
12148+ uint64_t maximum;
12149+};
12150+
12151+struct vcmd_ctx_rlimit_mask_v0 {
12152+ uint32_t minimum;
12153+ uint32_t softlimit;
12154+ uint32_t maximum;
12155+};
12156+
12157+#define VCMD_rlimit_stat VC_CMD(VSTAT, 1, 0)
12158+
12159+struct vcmd_rlimit_stat_v0 {
12160+ uint32_t id;
12161+ uint32_t hits;
12162+ uint64_t value;
12163+ uint64_t minimum;
12164+ uint64_t maximum;
12165+};
12166+
12167+#define CRLIM_UNSET (0ULL)
12168+#define CRLIM_INFINITY (~0ULL)
12169+#define CRLIM_KEEP (~1ULL)
12170+
12171+#endif /* _UAPI_VS_LIMIT_CMD_H */
12172diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/monitor.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/monitor.h
12173--- linux-4.4.116/include/uapi/vserver/monitor.h 1970-01-01 00:00:00.000000000 +0000
12174+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/monitor.h 2018-01-09 16:36:33.000000000 +0000
12175@@ -0,0 +1,96 @@
12176+#ifndef _UAPI_VS_MONITOR_H
12177+#define _UAPI_VS_MONITOR_H
12178+
12179+#include <linux/types.h>
12180+
12181+
12182+enum {
12183+ VXM_UNUSED = 0,
12184+
12185+ VXM_SYNC = 0x10,
12186+
12187+ VXM_UPDATE = 0x20,
12188+ VXM_UPDATE_1,
12189+ VXM_UPDATE_2,
12190+
12191+ VXM_RQINFO_1 = 0x24,
12192+ VXM_RQINFO_2,
12193+
12194+ VXM_ACTIVATE = 0x40,
12195+ VXM_DEACTIVATE,
12196+ VXM_IDLE,
12197+
12198+ VXM_HOLD = 0x44,
12199+ VXM_UNHOLD,
12200+
12201+ VXM_MIGRATE = 0x48,
12202+ VXM_RESCHED,
12203+
12204+ /* all other bits are flags */
12205+ VXM_SCHED = 0x80,
12206+};
12207+
12208+struct _vxm_update_1 {
12209+ uint32_t tokens_max;
12210+ uint32_t fill_rate;
12211+ uint32_t interval;
12212+};
12213+
12214+struct _vxm_update_2 {
12215+ uint32_t tokens_min;
12216+ uint32_t fill_rate;
12217+ uint32_t interval;
12218+};
12219+
12220+struct _vxm_rqinfo_1 {
12221+ uint16_t running;
12222+ uint16_t onhold;
12223+ uint16_t iowait;
12224+ uint16_t uintr;
12225+ uint32_t idle_tokens;
12226+};
12227+
12228+struct _vxm_rqinfo_2 {
12229+ uint32_t norm_time;
12230+ uint32_t idle_time;
12231+ uint32_t idle_skip;
12232+};
12233+
12234+struct _vxm_sched {
12235+ uint32_t tokens;
12236+ uint32_t norm_time;
12237+ uint32_t idle_time;
12238+};
12239+
12240+struct _vxm_task {
12241+ uint16_t pid;
12242+ uint16_t state;
12243+};
12244+
12245+struct _vxm_event {
12246+ uint32_t jif;
12247+ union {
12248+ uint32_t seq;
12249+ uint32_t sec;
12250+ };
12251+ union {
12252+ uint32_t tokens;
12253+ uint32_t nsec;
12254+ struct _vxm_task tsk;
12255+ };
12256+};
12257+
12258+struct _vx_mon_entry {
12259+ uint16_t type;
12260+ uint16_t xid;
12261+ union {
12262+ struct _vxm_event ev;
12263+ struct _vxm_sched sd;
12264+ struct _vxm_update_1 u1;
12265+ struct _vxm_update_2 u2;
12266+ struct _vxm_rqinfo_1 q1;
12267+ struct _vxm_rqinfo_2 q2;
12268+ };
12269+};
12270+
12271+#endif /* _UAPI_VS_MONITOR_H */
12272diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/network.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/network.h
12273--- linux-4.4.116/include/uapi/vserver/network.h 1970-01-01 00:00:00.000000000 +0000
12274+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/network.h 2018-01-09 16:36:33.000000000 +0000
12275@@ -0,0 +1,76 @@
12276+#ifndef _UAPI_VS_NETWORK_H
12277+#define _UAPI_VS_NETWORK_H
12278+
12279+#include <linux/types.h>
12280+
12281+
12282+#define MAX_N_CONTEXT 65535 /* Arbitrary limit */
12283+
12284+
12285+/* network flags */
12286+
12287+#define NXF_INFO_PRIVATE 0x00000008
12288+
12289+#define NXF_SINGLE_IP 0x00000100
12290+#define NXF_LBACK_REMAP 0x00000200
12291+#define NXF_LBACK_ALLOW 0x00000400
12292+
12293+#define NXF_HIDE_NETIF 0x02000000
12294+#define NXF_HIDE_LBACK 0x04000000
12295+
12296+#define NXF_STATE_SETUP (1ULL << 32)
12297+#define NXF_STATE_ADMIN (1ULL << 34)
12298+
12299+#define NXF_SC_HELPER (1ULL << 36)
12300+#define NXF_PERSISTENT (1ULL << 38)
12301+
12302+#define NXF_ONE_TIME (0x0005ULL << 32)
12303+
12304+
12305+#define NXF_INIT_SET (__nxf_init_set())
12306+
12307+static inline uint64_t __nxf_init_set(void) {
12308+ return NXF_STATE_ADMIN
12309+#ifdef CONFIG_VSERVER_AUTO_LBACK
12310+ | NXF_LBACK_REMAP
12311+ | NXF_HIDE_LBACK
12312+#endif
12313+#ifdef CONFIG_VSERVER_AUTO_SINGLE
12314+ | NXF_SINGLE_IP
12315+#endif
12316+ | NXF_HIDE_NETIF;
12317+}
12318+
12319+
12320+/* network caps */
12321+
12322+#define NXC_TUN_CREATE 0x00000001
12323+
12324+#define NXC_RAW_ICMP 0x00000100
12325+
12326+#define NXC_MULTICAST 0x00001000
12327+
12328+
12329+/* address types */
12330+
12331+#define NXA_TYPE_IPV4 0x0001
12332+#define NXA_TYPE_IPV6 0x0002
12333+
12334+#define NXA_TYPE_NONE 0x0000
12335+#define NXA_TYPE_ANY 0x00FF
12336+
12337+#define NXA_TYPE_ADDR 0x0010
12338+#define NXA_TYPE_MASK 0x0020
12339+#define NXA_TYPE_RANGE 0x0040
12340+
12341+#define NXA_MASK_ALL (NXA_TYPE_ADDR | NXA_TYPE_MASK | NXA_TYPE_RANGE)
12342+
12343+#define NXA_MOD_BCAST 0x0100
12344+#define NXA_MOD_LBACK 0x0200
12345+
12346+#define NXA_LOOPBACK 0x1000
12347+
12348+#define NXA_MASK_BIND (NXA_MASK_ALL | NXA_MOD_BCAST | NXA_MOD_LBACK)
12349+#define NXA_MASK_SHOW (NXA_MASK_ALL | NXA_LOOPBACK)
12350+
12351+#endif /* _UAPI_VS_NETWORK_H */
12352diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/network_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/network_cmd.h
12353--- linux-4.4.116/include/uapi/vserver/network_cmd.h 1970-01-01 00:00:00.000000000 +0000
12354+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/network_cmd.h 2018-01-09 16:36:33.000000000 +0000
12355@@ -0,0 +1,123 @@
12356+#ifndef _UAPI_VS_NETWORK_CMD_H
12357+#define _UAPI_VS_NETWORK_CMD_H
12358+
12359+
12360+/* vinfo commands */
12361+
12362+#define VCMD_task_nid VC_CMD(VINFO, 2, 0)
12363+
12364+
12365+#define VCMD_nx_info VC_CMD(VINFO, 6, 0)
12366+
12367+struct vcmd_nx_info_v0 {
12368+ uint32_t nid;
12369+ /* more to come */
12370+};
12371+
12372+
12373+#include <linux/in.h>
12374+#include <linux/in6.h>
12375+
12376+#define VCMD_net_create_v0 VC_CMD(VNET, 1, 0)
12377+#define VCMD_net_create VC_CMD(VNET, 1, 1)
12378+
12379+struct vcmd_net_create {
12380+ uint64_t flagword;
12381+};
12382+
12383+#define VCMD_net_migrate VC_CMD(NETMIG, 1, 0)
12384+
12385+#define VCMD_net_add VC_CMD(NETALT, 1, 0)
12386+#define VCMD_net_remove VC_CMD(NETALT, 2, 0)
12387+
12388+struct vcmd_net_addr_v0 {
12389+ uint16_t type;
12390+ uint16_t count;
12391+ struct in_addr ip[4];
12392+ struct in_addr mask[4];
12393+};
12394+
12395+#define VCMD_net_add_ipv4_v1 VC_CMD(NETALT, 1, 1)
12396+#define VCMD_net_rem_ipv4_v1 VC_CMD(NETALT, 2, 1)
12397+
12398+struct vcmd_net_addr_ipv4_v1 {
12399+ uint16_t type;
12400+ uint16_t flags;
12401+ struct in_addr ip;
12402+ struct in_addr mask;
12403+};
12404+
12405+#define VCMD_net_add_ipv4 VC_CMD(NETALT, 1, 2)
12406+#define VCMD_net_rem_ipv4 VC_CMD(NETALT, 2, 2)
12407+
12408+struct vcmd_net_addr_ipv4_v2 {
12409+ uint16_t type;
12410+ uint16_t flags;
12411+ struct in_addr ip;
12412+ struct in_addr ip2;
12413+ struct in_addr mask;
12414+};
12415+
12416+#define VCMD_net_add_ipv6 VC_CMD(NETALT, 3, 1)
12417+#define VCMD_net_remove_ipv6 VC_CMD(NETALT, 4, 1)
12418+
12419+struct vcmd_net_addr_ipv6_v1 {
12420+ uint16_t type;
12421+ uint16_t flags;
12422+ uint32_t prefix;
12423+ struct in6_addr ip;
12424+ struct in6_addr mask;
12425+};
12426+
12427+#define VCMD_add_match_ipv4 VC_CMD(NETALT, 5, 0)
12428+#define VCMD_get_match_ipv4 VC_CMD(NETALT, 6, 0)
12429+
12430+struct vcmd_match_ipv4_v0 {
12431+ uint16_t type;
12432+ uint16_t flags;
12433+ uint16_t parent;
12434+ uint16_t prefix;
12435+ struct in_addr ip;
12436+ struct in_addr ip2;
12437+ struct in_addr mask;
12438+};
12439+
12440+#define VCMD_add_match_ipv6 VC_CMD(NETALT, 7, 0)
12441+#define VCMD_get_match_ipv6 VC_CMD(NETALT, 8, 0)
12442+
12443+struct vcmd_match_ipv6_v0 {
12444+ uint16_t type;
12445+ uint16_t flags;
12446+ uint16_t parent;
12447+ uint16_t prefix;
12448+ struct in6_addr ip;
12449+ struct in6_addr ip2;
12450+ struct in6_addr mask;
12451+};
12452+
12453+
12454+
12455+
12456+/* flag commands */
12457+
12458+#define VCMD_get_nflags VC_CMD(FLAGS, 5, 0)
12459+#define VCMD_set_nflags VC_CMD(FLAGS, 6, 0)
12460+
12461+struct vcmd_net_flags_v0 {
12462+ uint64_t flagword;
12463+ uint64_t mask;
12464+};
12465+
12466+
12467+
12468+/* network caps commands */
12469+
12470+#define VCMD_get_ncaps VC_CMD(FLAGS, 7, 0)
12471+#define VCMD_set_ncaps VC_CMD(FLAGS, 8, 0)
12472+
12473+struct vcmd_net_caps_v0 {
12474+ uint64_t ncaps;
12475+ uint64_t cmask;
12476+};
12477+
12478+#endif /* _UAPI_VS_NETWORK_CMD_H */
12479diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/sched_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/sched_cmd.h
12480--- linux-4.4.116/include/uapi/vserver/sched_cmd.h 1970-01-01 00:00:00.000000000 +0000
12481+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/sched_cmd.h 2018-01-09 16:36:33.000000000 +0000
12482@@ -0,0 +1,13 @@
12483+#ifndef _UAPI_VS_SCHED_CMD_H
12484+#define _UAPI_VS_SCHED_CMD_H
12485+
12486+
12487+struct vcmd_prio_bias {
12488+ int32_t cpu_id;
12489+ int32_t prio_bias;
12490+};
12491+
12492+#define VCMD_set_prio_bias VC_CMD(SCHED, 4, 0)
12493+#define VCMD_get_prio_bias VC_CMD(SCHED, 5, 0)
12494+
12495+#endif /* _UAPI_VS_SCHED_CMD_H */
12496diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/signal_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/signal_cmd.h
12497--- linux-4.4.116/include/uapi/vserver/signal_cmd.h 1970-01-01 00:00:00.000000000 +0000
12498+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/signal_cmd.h 2018-01-09 16:36:33.000000000 +0000
12499@@ -0,0 +1,31 @@
12500+#ifndef _UAPI_VS_SIGNAL_CMD_H
12501+#define _UAPI_VS_SIGNAL_CMD_H
12502+
12503+
12504+/* signalling vserver commands */
12505+
12506+#define VCMD_ctx_kill VC_CMD(PROCTRL, 1, 0)
12507+#define VCMD_wait_exit VC_CMD(EVENT, 99, 0)
12508+
12509+struct vcmd_ctx_kill_v0 {
12510+ int32_t pid;
12511+ int32_t sig;
12512+};
12513+
12514+struct vcmd_wait_exit_v0 {
12515+ int32_t reboot_cmd;
12516+ int32_t exit_code;
12517+};
12518+
12519+
12520+/* process alteration commands */
12521+
12522+#define VCMD_get_pflags VC_CMD(PROCALT, 5, 0)
12523+#define VCMD_set_pflags VC_CMD(PROCALT, 6, 0)
12524+
12525+struct vcmd_pflags_v0 {
12526+ uint32_t flagword;
12527+ uint32_t mask;
12528+};
12529+
12530+#endif /* _UAPI_VS_SIGNAL_CMD_H */
12531diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/space_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/space_cmd.h
12532--- linux-4.4.116/include/uapi/vserver/space_cmd.h 1970-01-01 00:00:00.000000000 +0000
12533+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/space_cmd.h 2018-01-09 16:36:33.000000000 +0000
12534@@ -0,0 +1,28 @@
12535+#ifndef _UAPI_VS_SPACE_CMD_H
12536+#define _UAPI_VS_SPACE_CMD_H
12537+
12538+
12539+#define VCMD_enter_space_v0 VC_CMD(PROCALT, 1, 0)
12540+#define VCMD_enter_space_v1 VC_CMD(PROCALT, 1, 1)
12541+#define VCMD_enter_space VC_CMD(PROCALT, 1, 2)
12542+
12543+#define VCMD_set_space_v0 VC_CMD(PROCALT, 3, 0)
12544+#define VCMD_set_space_v1 VC_CMD(PROCALT, 3, 1)
12545+#define VCMD_set_space VC_CMD(PROCALT, 3, 2)
12546+
12547+#define VCMD_get_space_mask_v0 VC_CMD(PROCALT, 4, 0)
12548+
12549+#define VCMD_get_space_mask VC_CMD(VSPACE, 0, 1)
12550+#define VCMD_get_space_default VC_CMD(VSPACE, 1, 0)
12551+
12552+
12553+struct vcmd_space_mask_v1 {
12554+ uint64_t mask;
12555+};
12556+
12557+struct vcmd_space_mask_v2 {
12558+ uint64_t mask;
12559+ uint32_t index;
12560+};
12561+
12562+#endif /* _UAPI_VS_SPACE_CMD_H */
12563diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/switch.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/switch.h
12564--- linux-4.4.116/include/uapi/vserver/switch.h 1970-01-01 00:00:00.000000000 +0000
12565+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/switch.h 2018-01-09 16:36:33.000000000 +0000
12566@@ -0,0 +1,90 @@
12567+#ifndef _UAPI_VS_SWITCH_H
12568+#define _UAPI_VS_SWITCH_H
12569+
12570+#include <linux/types.h>
12571+
12572+
12573+#define VC_CATEGORY(c) (((c) >> 24) & 0x3F)
12574+#define VC_COMMAND(c) (((c) >> 16) & 0xFF)
12575+#define VC_VERSION(c) ((c) & 0xFFF)
12576+
12577+#define VC_CMD(c, i, v) ((((VC_CAT_ ## c) & 0x3F) << 24) \
12578+ | (((i) & 0xFF) << 16) | ((v) & 0xFFF))
12579+
12580+/*
12581+
12582+ Syscall Matrix V2.8
12583+
12584+ |VERSION|CREATE |MODIFY |MIGRATE|CONTROL|EXPERIM| |SPECIAL|SPECIAL|
12585+ |STATS |DESTROY|ALTER |CHANGE |LIMIT |TEST | | | |
12586+ |INFO |SETUP | |MOVE | | | | | |
12587+ -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
12588+ SYSTEM |VERSION|VSETUP |VHOST | | | | |DEVICE | |
12589+ HOST | 00| 01| 02| 03| 04| 05| | 06| 07|
12590+ -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
12591+ CPU | |VPROC |PROCALT|PROCMIG|PROCTRL| | |SCHED. | |
12592+ PROCESS| 08| 09| 10| 11| 12| 13| | 14| 15|
12593+ -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
12594+ MEMORY | | | | |MEMCTRL| | |SWAP | |
12595+ | 16| 17| 18| 19| 20| 21| | 22| 23|
12596+ -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
12597+ NETWORK| |VNET |NETALT |NETMIG |NETCTL | | |SERIAL | |
12598+ | 24| 25| 26| 27| 28| 29| | 30| 31|
12599+ -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
12600+ DISK | | | |TAGMIG |DLIMIT | | |INODE | |
12601+ VFS | 32| 33| 34| 35| 36| 37| | 38| 39|
12602+ -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
12603+ OTHER |VSTAT | | | | | | |VINFO | |
12604+ | 40| 41| 42| 43| 44| 45| | 46| 47|
12605+ =======+=======+=======+=======+=======+=======+=======+ +=======+=======+
12606+ SPECIAL|EVENT | | | |FLAGS | | |VSPACE | |
12607+ | 48| 49| 50| 51| 52| 53| | 54| 55|
12608+ -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
12609+ SPECIAL|DEBUG | | | |RLIMIT |SYSCALL| | |COMPAT |
12610+ | 56| 57| 58| 59| 60|TEST 61| | 62| 63|
12611+ -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
12612+
12613+*/
12614+
12615+#define VC_CAT_VERSION 0
12616+
12617+#define VC_CAT_VSETUP 1
12618+#define VC_CAT_VHOST 2
12619+
12620+#define VC_CAT_DEVICE 6
12621+
12622+#define VC_CAT_VPROC 9
12623+#define VC_CAT_PROCALT 10
12624+#define VC_CAT_PROCMIG 11
12625+#define VC_CAT_PROCTRL 12
12626+
12627+#define VC_CAT_SCHED 14
12628+#define VC_CAT_MEMCTRL 20
12629+
12630+#define VC_CAT_VNET 25
12631+#define VC_CAT_NETALT 26
12632+#define VC_CAT_NETMIG 27
12633+#define VC_CAT_NETCTRL 28
12634+
12635+#define VC_CAT_TAGMIG 35
12636+#define VC_CAT_DLIMIT 36
12637+#define VC_CAT_INODE 38
12638+
12639+#define VC_CAT_VSTAT 40
12640+#define VC_CAT_VINFO 46
12641+#define VC_CAT_EVENT 48
12642+
12643+#define VC_CAT_FLAGS 52
12644+#define VC_CAT_VSPACE 54
12645+#define VC_CAT_DEBUG 56
12646+#define VC_CAT_RLIMIT 60
12647+
12648+#define VC_CAT_SYSTEST 61
12649+#define VC_CAT_COMPAT 63
12650+
12651+/* query version */
12652+
12653+#define VCMD_get_version VC_CMD(VERSION, 0, 0)
12654+#define VCMD_get_vci VC_CMD(VERSION, 1, 0)
12655+
12656+#endif /* _UAPI_VS_SWITCH_H */
12657diff -NurpP --minimal linux-4.4.116/include/uapi/vserver/tag_cmd.h linux-4.4.116-vs2.3.9.7/include/uapi/vserver/tag_cmd.h
12658--- linux-4.4.116/include/uapi/vserver/tag_cmd.h 1970-01-01 00:00:00.000000000 +0000
12659+++ linux-4.4.116-vs2.3.9.7/include/uapi/vserver/tag_cmd.h 2018-01-09 16:36:33.000000000 +0000
12660@@ -0,0 +1,14 @@
12661+#ifndef _UAPI_VS_TAG_CMD_H
12662+#define _UAPI_VS_TAG_CMD_H
12663+
12664+
12665+/* vinfo commands */
12666+
12667+#define VCMD_task_tag VC_CMD(VINFO, 3, 0)
12668+
12669+
12670+/* context commands */
12671+
12672+#define VCMD_tag_migrate VC_CMD(TAGMIG, 1, 0)
12673+
12674+#endif /* _UAPI_VS_TAG_CMD_H */
12675diff -NurpP --minimal linux-4.4.116/init/Kconfig linux-4.4.116-vs2.3.9.7/init/Kconfig
12676--- linux-4.4.116/init/Kconfig 2018-02-22 21:19:59.000000000 +0000
12677+++ linux-4.4.116-vs2.3.9.7/init/Kconfig 2018-02-10 15:16:50.000000000 +0000
12678@@ -927,6 +927,7 @@ config NUMA_BALANCING_DEFAULT_ENABLED
12679 menuconfig CGROUPS
12680 bool "Control Group support"
12681 select KERNFS
12682+ default y
12683 help
12684 This option adds support for grouping sets of processes together, for
12685 use with process control subsystems such as Cpusets, CFS, memory
12686diff -NurpP --minimal linux-4.4.116/init/main.c linux-4.4.116-vs2.3.9.7/init/main.c
12687--- linux-4.4.116/init/main.c 2018-02-22 21:19:59.000000000 +0000
12688+++ linux-4.4.116-vs2.3.9.7/init/main.c 2018-01-09 16:58:21.000000000 +0000
12689@@ -82,6 +82,7 @@
12690 #include <linux/proc_ns.h>
12691 #include <linux/io.h>
12692 #include <linux/kaiser.h>
12693+#include <linux/vserver/percpu.h>
12694
12695 #include <asm/io.h>
12696 #include <asm/bugs.h>
12697diff -NurpP --minimal linux-4.4.116/ipc/mqueue.c linux-4.4.116-vs2.3.9.7/ipc/mqueue.c
12698--- linux-4.4.116/ipc/mqueue.c 2018-02-22 21:19:59.000000000 +0000
12699+++ linux-4.4.116-vs2.3.9.7/ipc/mqueue.c 2018-01-09 16:36:33.000000000 +0000
12700@@ -35,6 +35,8 @@
12701 #include <linux/ipc_namespace.h>
12702 #include <linux/user_namespace.h>
12703 #include <linux/slab.h>
12704+#include <linux/vs_context.h>
12705+#include <linux/vs_limit.h>
12706
12707 #include <net/sock.h>
12708 #include "util.h"
12709@@ -75,6 +77,7 @@ struct mqueue_inode_info {
12710 struct pid *notify_owner;
12711 struct user_namespace *notify_user_ns;
12712 struct user_struct *user; /* user who created, for accounting */
12713+ struct vx_info *vxi;
12714 struct sock *notify_sock;
12715 struct sk_buff *notify_cookie;
12716
12717@@ -230,6 +233,7 @@ static struct inode *mqueue_get_inode(st
12718 if (S_ISREG(mode)) {
12719 struct mqueue_inode_info *info;
12720 unsigned long mq_bytes, mq_treesize;
12721+ struct vx_info *vxi = current_vx_info();
12722
12723 inode->i_fop = &mqueue_file_operations;
12724 inode->i_size = FILENT_SIZE;
12725@@ -243,6 +247,7 @@ static struct inode *mqueue_get_inode(st
12726 info->notify_user_ns = NULL;
12727 info->qsize = 0;
12728 info->user = NULL; /* set when all is ok */
12729+ info->vxi = NULL;
12730 info->msg_tree = RB_ROOT;
12731 info->node_cache = NULL;
12732 memset(&info->attr, 0, sizeof(info->attr));
12733@@ -276,17 +281,20 @@ static struct inode *mqueue_get_inode(st
12734
12735 spin_lock(&mq_lock);
12736 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
12737- u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE)) {
12738+ u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE) ||
12739+ !vx_ipcmsg_avail(vxi, mq_bytes)) {
12740 spin_unlock(&mq_lock);
12741 /* mqueue_evict_inode() releases info->messages */
12742 ret = -EMFILE;
12743 goto out_inode;
12744 }
12745 u->mq_bytes += mq_bytes;
12746+ vx_ipcmsg_add(vxi, u, mq_bytes);
12747 spin_unlock(&mq_lock);
12748
12749 /* all is ok */
12750 info->user = get_uid(u);
12751+ info->vxi = get_vx_info(vxi);
12752 } else if (S_ISDIR(mode)) {
12753 inc_nlink(inode);
12754 /* Some things misbehave if size == 0 on a directory */
12755@@ -398,8 +406,11 @@ static void mqueue_evict_inode(struct in
12756
12757 user = info->user;
12758 if (user) {
12759+ struct vx_info *vxi = info->vxi;
12760+
12761 spin_lock(&mq_lock);
12762 user->mq_bytes -= mq_bytes;
12763+ vx_ipcmsg_sub(vxi, user, mq_bytes);
12764 /*
12765 * get_ns_from_inode() ensures that the
12766 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
12767@@ -409,6 +420,7 @@ static void mqueue_evict_inode(struct in
12768 if (ipc_ns)
12769 ipc_ns->mq_queues_count--;
12770 spin_unlock(&mq_lock);
12771+ put_vx_info(vxi);
12772 free_uid(user);
12773 }
12774 if (ipc_ns)
12775diff -NurpP --minimal linux-4.4.116/ipc/msg.c linux-4.4.116-vs2.3.9.7/ipc/msg.c
12776--- linux-4.4.116/ipc/msg.c 2018-02-22 21:19:59.000000000 +0000
12777+++ linux-4.4.116-vs2.3.9.7/ipc/msg.c 2018-02-10 15:16:50.000000000 +0000
12778@@ -37,6 +37,7 @@
12779 #include <linux/rwsem.h>
12780 #include <linux/nsproxy.h>
12781 #include <linux/ipc_namespace.h>
12782+#include <linux/vs_base.h>
12783
12784 #include <asm/current.h>
12785 #include <linux/uaccess.h>
12786@@ -129,6 +130,7 @@ static int newque(struct ipc_namespace *
12787
12788 msq->q_perm.mode = msgflg & S_IRWXUGO;
12789 msq->q_perm.key = key;
12790+ msq->q_perm.xid = vx_current_xid();
12791
12792 msq->q_perm.security = NULL;
12793 retval = security_msg_queue_alloc(msq);
12794diff -NurpP --minimal linux-4.4.116/ipc/sem.c linux-4.4.116-vs2.3.9.7/ipc/sem.c
12795--- linux-4.4.116/ipc/sem.c 2018-02-22 21:19:59.000000000 +0000
12796+++ linux-4.4.116-vs2.3.9.7/ipc/sem.c 2018-01-09 16:36:33.000000000 +0000
12797@@ -85,6 +85,8 @@
12798 #include <linux/rwsem.h>
12799 #include <linux/nsproxy.h>
12800 #include <linux/ipc_namespace.h>
12801+#include <linux/vs_base.h>
12802+#include <linux/vs_limit.h>
12803
12804 #include <linux/uaccess.h>
12805 #include "util.h"
12806@@ -533,6 +535,7 @@ static int newary(struct ipc_namespace *
12807
12808 sma->sem_perm.mode = (semflg & S_IRWXUGO);
12809 sma->sem_perm.key = key;
12810+ sma->sem_perm.xid = vx_current_xid();
12811
12812 sma->sem_perm.security = NULL;
12813 retval = security_sem_alloc(sma);
12814@@ -563,6 +566,9 @@ static int newary(struct ipc_namespace *
12815 return id;
12816 }
12817 ns->used_sems += nsems;
12818+ /* FIXME: obsoleted? */
12819+ vx_semary_inc(sma);
12820+ vx_nsems_add(sma, nsems);
12821
12822 sem_unlock(sma, -1);
12823 rcu_read_unlock();
12824@@ -1151,6 +1157,9 @@ static void freeary(struct ipc_namespace
12825
12826 wake_up_sem_queue_do(&tasks);
12827 ns->used_sems -= sma->sem_nsems;
12828+ /* FIXME: obsoleted? */
12829+ vx_nsems_sub(sma, sma->sem_nsems);
12830+ vx_semary_dec(sma);
12831 ipc_rcu_putref(sma, sem_rcu_free);
12832 }
12833
12834diff -NurpP --minimal linux-4.4.116/ipc/shm.c linux-4.4.116-vs2.3.9.7/ipc/shm.c
12835--- linux-4.4.116/ipc/shm.c 2018-02-22 21:19:59.000000000 +0000
12836+++ linux-4.4.116-vs2.3.9.7/ipc/shm.c 2018-01-09 16:36:33.000000000 +0000
12837@@ -42,6 +42,8 @@
12838 #include <linux/nsproxy.h>
12839 #include <linux/mount.h>
12840 #include <linux/ipc_namespace.h>
12841+#include <linux/vs_context.h>
12842+#include <linux/vs_limit.h>
12843
12844 #include <linux/uaccess.h>
12845
12846@@ -228,10 +230,14 @@ static void shm_open(struct vm_area_stru
12847 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
12848 {
12849 struct file *shm_file;
12850+ struct vx_info *vxi = lookup_vx_info(shp->shm_perm.xid);
12851+ int numpages = (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
12852
12853 shm_file = shp->shm_file;
12854 shp->shm_file = NULL;
12855- ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
12856+ vx_ipcshm_sub(vxi, shp, numpages);
12857+ ns->shm_tot -= numpages;
12858+
12859 shm_rmid(ns, shp);
12860 shm_unlock(shp);
12861 if (!is_file_hugepages(shm_file))
12862@@ -240,6 +246,7 @@ static void shm_destroy(struct ipc_names
12863 user_shm_unlock(i_size_read(file_inode(shm_file)),
12864 shp->mlock_user);
12865 fput(shm_file);
12866+ put_vx_info(vxi);
12867 ipc_rcu_putref(shp, shm_rcu_free);
12868 }
12869
12870@@ -537,11 +544,15 @@ static int newseg(struct ipc_namespace *
12871 ns->shm_tot + numpages > ns->shm_ctlall)
12872 return -ENOSPC;
12873
12874+ if (!vx_ipcshm_avail(current_vx_info(), numpages))
12875+ return -ENOSPC;
12876+
12877 shp = ipc_rcu_alloc(sizeof(*shp));
12878 if (!shp)
12879 return -ENOMEM;
12880
12881 shp->shm_perm.key = key;
12882+ shp->shm_perm.xid = vx_current_xid();
12883 shp->shm_perm.mode = (shmflg & S_IRWXUGO);
12884 shp->mlock_user = NULL;
12885
12886@@ -612,6 +623,7 @@ static int newseg(struct ipc_namespace *
12887
12888 ipc_unlock_object(&shp->shm_perm);
12889 rcu_read_unlock();
12890+ vx_ipcshm_add(current_vx_info(), key, numpages);
12891 return error;
12892
12893 no_id:
12894diff -NurpP --minimal linux-4.4.116/kernel/Makefile linux-4.4.116-vs2.3.9.7/kernel/Makefile
12895--- linux-4.4.116/kernel/Makefile 2016-07-05 04:12:38.000000000 +0000
12896+++ linux-4.4.116-vs2.3.9.7/kernel/Makefile 2018-01-09 16:36:33.000000000 +0000
12897@@ -29,6 +29,7 @@ obj-y += printk/
12898 obj-y += irq/
12899 obj-y += rcu/
12900 obj-y += livepatch/
12901+obj-y += vserver/
12902
12903 obj-$(CONFIG_CHECKPOINT_RESTORE) += kcmp.o
12904 obj-$(CONFIG_FREEZER) += freezer.o
12905diff -NurpP --minimal linux-4.4.116/kernel/auditsc.c linux-4.4.116-vs2.3.9.7/kernel/auditsc.c
12906--- linux-4.4.116/kernel/auditsc.c 2018-02-22 21:19:59.000000000 +0000
12907+++ linux-4.4.116-vs2.3.9.7/kernel/auditsc.c 2018-01-09 16:36:33.000000000 +0000
12908@@ -1962,7 +1962,7 @@ static int audit_set_loginuid_perm(kuid_
12909 if (is_audit_feature_set(AUDIT_FEATURE_LOGINUID_IMMUTABLE))
12910 return -EPERM;
12911 /* it is set, you need permission */
12912- if (!capable(CAP_AUDIT_CONTROL))
12913+ if (!vx_capable(CAP_AUDIT_CONTROL, VXC_AUDIT_CONTROL))
12914 return -EPERM;
12915 /* reject if this is not an unset and we don't allow that */
12916 if (is_audit_feature_set(AUDIT_FEATURE_ONLY_UNSET_LOGINUID) && uid_valid(loginuid))
12917diff -NurpP --minimal linux-4.4.116/kernel/capability.c linux-4.4.116-vs2.3.9.7/kernel/capability.c
12918--- linux-4.4.116/kernel/capability.c 2018-02-22 21:19:59.000000000 +0000
12919+++ linux-4.4.116-vs2.3.9.7/kernel/capability.c 2018-01-09 16:36:33.000000000 +0000
12920@@ -17,6 +17,7 @@
12921 #include <linux/syscalls.h>
12922 #include <linux/pid_namespace.h>
12923 #include <linux/user_namespace.h>
12924+#include <linux/vs_context.h>
12925 #include <asm/uaccess.h>
12926
12927 /*
12928@@ -107,6 +108,7 @@ static int cap_validate_magic(cap_user_h
12929 return 0;
12930 }
12931
12932+
12933 /*
12934 * The only thing that can change the capabilities of the current
12935 * process is the current process. As such, we can't be in this code
12936@@ -344,6 +346,8 @@ bool has_ns_capability_noaudit(struct ta
12937 return (ret == 0);
12938 }
12939
12940+#include <linux/vserver/base.h>
12941+
12942 /**
12943 * has_capability_noaudit - Does a task have a capability (unaudited) in the
12944 * initial user ns
12945diff -NurpP --minimal linux-4.4.116/kernel/compat.c linux-4.4.116-vs2.3.9.7/kernel/compat.c
12946--- linux-4.4.116/kernel/compat.c 2015-07-06 20:41:43.000000000 +0000
12947+++ linux-4.4.116-vs2.3.9.7/kernel/compat.c 2018-01-09 16:36:33.000000000 +0000
12948@@ -27,6 +27,7 @@
12949 #include <linux/times.h>
12950 #include <linux/ptrace.h>
12951 #include <linux/gfp.h>
12952+#include <linux/vs_time.h>
12953
12954 #include <asm/uaccess.h>
12955
12956@@ -1059,7 +1060,7 @@ COMPAT_SYSCALL_DEFINE1(stime, compat_tim
12957 if (err)
12958 return err;
12959
12960- do_settimeofday(&tv);
12961+ vx_settimeofday(&tv);
12962 return 0;
12963 }
12964
12965diff -NurpP --minimal linux-4.4.116/kernel/cred.c linux-4.4.116-vs2.3.9.7/kernel/cred.c
12966--- linux-4.4.116/kernel/cred.c 2018-02-22 21:19:59.000000000 +0000
12967+++ linux-4.4.116-vs2.3.9.7/kernel/cred.c 2018-01-09 16:36:33.000000000 +0000
12968@@ -64,31 +64,6 @@ struct cred init_cred = {
12969 .group_info = &init_groups,
12970 };
12971
12972-static inline void set_cred_subscribers(struct cred *cred, int n)
12973-{
12974-#ifdef CONFIG_DEBUG_CREDENTIALS
12975- atomic_set(&cred->subscribers, n);
12976-#endif
12977-}
12978-
12979-static inline int read_cred_subscribers(const struct cred *cred)
12980-{
12981-#ifdef CONFIG_DEBUG_CREDENTIALS
12982- return atomic_read(&cred->subscribers);
12983-#else
12984- return 0;
12985-#endif
12986-}
12987-
12988-static inline void alter_cred_subscribers(const struct cred *_cred, int n)
12989-{
12990-#ifdef CONFIG_DEBUG_CREDENTIALS
12991- struct cred *cred = (struct cred *) _cred;
12992-
12993- atomic_add(n, &cred->subscribers);
12994-#endif
12995-}
12996-
12997 /*
12998 * The RCU callback to actually dispose of a set of credentials
12999 */
13000@@ -240,21 +215,16 @@ error:
13001 *
13002 * Call commit_creds() or abort_creds() to clean up.
13003 */
13004-struct cred *prepare_creds(void)
13005+struct cred *__prepare_creds(const struct cred *old)
13006 {
13007- struct task_struct *task = current;
13008- const struct cred *old;
13009 struct cred *new;
13010
13011- validate_process_creds();
13012-
13013 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
13014 if (!new)
13015 return NULL;
13016
13017 kdebug("prepare_creds() alloc %p", new);
13018
13019- old = task->cred;
13020 memcpy(new, old, sizeof(struct cred));
13021
13022 atomic_set(&new->usage, 1);
13023@@ -283,6 +253,13 @@ error:
13024 abort_creds(new);
13025 return NULL;
13026 }
13027+
13028+struct cred *prepare_creds(void)
13029+{
13030+ validate_process_creds();
13031+
13032+ return __prepare_creds(current->cred);
13033+}
13034 EXPORT_SYMBOL(prepare_creds);
13035
13036 /*
13037diff -NurpP --minimal linux-4.4.116/kernel/exit.c linux-4.4.116-vs2.3.9.7/kernel/exit.c
13038--- linux-4.4.116/kernel/exit.c 2018-02-22 21:20:00.000000000 +0000
13039+++ linux-4.4.116-vs2.3.9.7/kernel/exit.c 2018-02-06 17:16:09.000000000 +0000
13040@@ -48,6 +48,10 @@
13041 #include <linux/fs_struct.h>
13042 #include <linux/init_task.h>
13043 #include <linux/perf_event.h>
13044+#include <linux/vs_limit.h>
13045+#include <linux/vs_context.h>
13046+#include <linux/vs_network.h>
13047+#include <linux/vs_pid.h>
13048 #include <trace/events/sched.h>
13049 #include <linux/hw_breakpoint.h>
13050 #include <linux/oom.h>
13051@@ -456,14 +460,24 @@ static struct task_struct *find_child_re
13052 {
13053 struct pid_namespace *pid_ns = task_active_pid_ns(father);
13054 struct task_struct *reaper = pid_ns->child_reaper;
13055+ struct vx_info *vxi = task_get_vx_info(father);
13056+
13057+ if (vxi) {
13058+ BUG_ON(!vxi->vx_reaper);
13059+ if (vxi->vx_reaper != init_pid_ns.child_reaper &&
13060+ vxi->vx_reaper != father) {
13061+ reaper = vxi->vx_reaper;
13062+ goto out_put;
13063+ }
13064+ }
13065
13066 if (likely(reaper != father))
13067- return reaper;
13068+ goto out_put;
13069
13070 reaper = find_alive_thread(father);
13071 if (reaper) {
13072 pid_ns->child_reaper = reaper;
13073- return reaper;
13074+ goto out_put;
13075 }
13076
13077 write_unlock_irq(&tasklist_lock);
13078@@ -474,7 +488,10 @@ static struct task_struct *find_child_re
13079 zap_pid_ns_processes(pid_ns);
13080 write_lock_irq(&tasklist_lock);
13081
13082- return father;
13083+ reaper = father;
13084+out_put:
13085+ put_vx_info(vxi);
13086+ return reaper;
13087 }
13088
13089 /*
13090@@ -562,9 +579,13 @@ static void forget_original_parent(struc
13091 return;
13092
13093 reaper = find_new_reaper(father, reaper);
13094- list_for_each_entry(p, &father->children, sibling) {
13095+ for (p = list_first_entry(&father->children, struct task_struct, sibling);
13096+ &p->sibling != &father->children; ) {
13097+ struct task_struct *next, *this_reaper = reaper;
13098+ if (p == reaper)
13099+ this_reaper = task_active_pid_ns(reaper)->child_reaper;
13100 for_each_thread(p, t) {
13101- t->real_parent = reaper;
13102+ t->real_parent = this_reaper;
13103 BUG_ON((!t->ptrace) != (t->parent == father));
13104 if (likely(!t->ptrace))
13105 t->parent = t->real_parent;
13106@@ -576,10 +597,13 @@ static void forget_original_parent(struc
13107 * If this is a threaded reparent there is no need to
13108 * notify anyone anything has happened.
13109 */
13110- if (!same_thread_group(reaper, father))
13111+ if (!same_thread_group(this_reaper, father))
13112 reparent_leader(father, p, dead);
13113+ next = list_next_entry(p, sibling);
13114+ list_add(&p->sibling, &this_reaper->children);
13115+ p = next;
13116 }
13117- list_splice_tail_init(&father->children, &reaper->children);
13118+ INIT_LIST_HEAD(&father->children);
13119 }
13120
13121 /*
13122@@ -763,6 +787,9 @@ void do_exit(long code)
13123 */
13124 flush_ptrace_hw_breakpoint(tsk);
13125
13126+ /* needs to stay before exit_notify() */
13127+ exit_vx_info_early(tsk, code);
13128+
13129 TASKS_RCU(preempt_disable());
13130 TASKS_RCU(tasks_rcu_i = __srcu_read_lock(&tasks_rcu_exit_srcu));
13131 TASKS_RCU(preempt_enable());
13132@@ -800,6 +827,10 @@ void do_exit(long code)
13133
13134 validate_creds_for_do_exit(tsk);
13135
13136+ /* needs to stay after exit_notify() and before preempt_disable() */
13137+ exit_vx_info(tsk, code);
13138+ exit_nx_info(tsk);
13139+
13140 check_stack_usage();
13141 preempt_disable();
13142 if (tsk->nr_dirtied)
13143@@ -826,6 +857,7 @@ void do_exit(long code)
13144 tsk->state = TASK_DEAD;
13145 tsk->flags |= PF_NOFREEZE; /* tell freezer to ignore us */
13146 schedule();
13147+ printk("bad task: %p [%lx]\n", current, current->state);
13148 BUG();
13149 /* Avoid "noreturn function does return". */
13150 for (;;)
13151diff -NurpP --minimal linux-4.4.116/kernel/fork.c linux-4.4.116-vs2.3.9.7/kernel/fork.c
13152--- linux-4.4.116/kernel/fork.c 2018-02-22 21:20:00.000000000 +0000
13153+++ linux-4.4.116-vs2.3.9.7/kernel/fork.c 2018-01-09 17:00:00.000000000 +0000
13154@@ -76,6 +76,9 @@
13155 #include <linux/aio.h>
13156 #include <linux/compiler.h>
13157 #include <linux/sysctl.h>
13158+#include <linux/vs_context.h>
13159+#include <linux/vs_network.h>
13160+#include <linux/vs_limit.h>
13161
13162 #include <asm/pgtable.h>
13163 #include <asm/pgalloc.h>
13164@@ -227,6 +230,8 @@ void free_task(struct task_struct *tsk)
13165 arch_release_thread_info(tsk->stack);
13166 free_thread_info(tsk->stack);
13167 rt_mutex_debug_task_free(tsk);
13168+ clr_vx_info(&tsk->vx_info);
13169+ clr_nx_info(&tsk->nx_info);
13170 ftrace_graph_exit_task(tsk);
13171 put_seccomp_filter(tsk);
13172 arch_release_task_struct(tsk);
13173@@ -1282,6 +1287,8 @@ static struct task_struct *copy_process(
13174 {
13175 int retval;
13176 struct task_struct *p;
13177+ struct vx_info *vxi;
13178+ struct nx_info *nxi;
13179 void *cgrp_ss_priv[CGROUP_CANFORK_COUNT] = {};
13180
13181 if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
13182@@ -1343,7 +1350,12 @@ static struct task_struct *copy_process(
13183 DEBUG_LOCKS_WARN_ON(!p->hardirqs_enabled);
13184 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
13185 #endif
13186+ init_vx_info(&p->vx_info, current_vx_info());
13187+ init_nx_info(&p->nx_info, current_nx_info());
13188+
13189 retval = -EAGAIN;
13190+ if (!vx_nproc_avail(1))
13191+ goto bad_fork_free;
13192 if (atomic_read(&p->real_cred->user->processes) >=
13193 task_rlimit(p, RLIMIT_NPROC)) {
13194 if (p->real_cred->user != INIT_USER &&
13195@@ -1640,6 +1652,18 @@ static struct task_struct *copy_process(
13196 total_forks++;
13197 spin_unlock(&current->sighand->siglock);
13198 syscall_tracepoint_update(p);
13199+
13200+ /* p is copy of current */
13201+ vxi = p->vx_info;
13202+ if (vxi) {
13203+ claim_vx_info(vxi, p);
13204+ atomic_inc(&vxi->cvirt.nr_threads);
13205+ atomic_inc(&vxi->cvirt.total_forks);
13206+ vx_nproc_inc(p);
13207+ }
13208+ nxi = p->nx_info;
13209+ if (nxi)
13210+ claim_nx_info(nxi, p);
13211 write_unlock_irq(&tasklist_lock);
13212
13213 proc_fork_connector(p);
13214diff -NurpP --minimal linux-4.4.116/kernel/kthread.c linux-4.4.116-vs2.3.9.7/kernel/kthread.c
13215--- linux-4.4.116/kernel/kthread.c 2018-02-22 21:20:00.000000000 +0000
13216+++ linux-4.4.116-vs2.3.9.7/kernel/kthread.c 2018-01-09 17:01:06.000000000 +0000
13217@@ -19,6 +19,7 @@
13218 #include <linux/ptrace.h>
13219 #include <linux/uaccess.h>
13220 #include <linux/cgroup.h>
13221+#include <linux/vs_pid.h>
13222 #include <trace/events/sched.h>
13223
13224 static DEFINE_SPINLOCK(kthread_create_lock);
13225diff -NurpP --minimal linux-4.4.116/kernel/nsproxy.c linux-4.4.116-vs2.3.9.7/kernel/nsproxy.c
13226--- linux-4.4.116/kernel/nsproxy.c 2015-04-12 22:12:50.000000000 +0000
13227+++ linux-4.4.116-vs2.3.9.7/kernel/nsproxy.c 2018-01-09 16:36:33.000000000 +0000
13228@@ -20,11 +20,14 @@
13229 #include <linux/mnt_namespace.h>
13230 #include <linux/utsname.h>
13231 #include <linux/pid_namespace.h>
13232+#include <linux/vserver/global.h>
13233+#include <linux/vserver/debug.h>
13234 #include <net/net_namespace.h>
13235 #include <linux/ipc_namespace.h>
13236 #include <linux/proc_ns.h>
13237 #include <linux/file.h>
13238 #include <linux/syscalls.h>
13239+#include "../fs/mount.h"
13240
13241 static struct kmem_cache *nsproxy_cachep;
13242
13243@@ -46,8 +49,11 @@ static inline struct nsproxy *create_nsp
13244 struct nsproxy *nsproxy;
13245
13246 nsproxy = kmem_cache_alloc(nsproxy_cachep, GFP_KERNEL);
13247- if (nsproxy)
13248+ if (nsproxy) {
13249 atomic_set(&nsproxy->count, 1);
13250+ atomic_inc(&vs_global_nsproxy);
13251+ }
13252+ vxdprintk(VXD_CBIT(space, 2), "create_nsproxy = %p[1]", nsproxy);
13253 return nsproxy;
13254 }
13255
13256@@ -56,9 +62,12 @@ static inline struct nsproxy *create_nsp
13257 * Return the newly created nsproxy. Do not attach this to the task,
13258 * leave it to the caller to do proper locking and attach it to task.
13259 */
13260-static struct nsproxy *create_new_namespaces(unsigned long flags,
13261- struct task_struct *tsk, struct user_namespace *user_ns,
13262- struct fs_struct *new_fs)
13263+static struct nsproxy *unshare_namespaces(
13264+ unsigned long flags,
13265+ struct nsproxy *orig,
13266+ struct fs_struct *new_fs,
13267+ struct user_namespace *new_user,
13268+ struct pid_namespace *new_pid)
13269 {
13270 struct nsproxy *new_nsp;
13271 int err;
13272@@ -67,32 +76,31 @@ static struct nsproxy *create_new_namesp
13273 if (!new_nsp)
13274 return ERR_PTR(-ENOMEM);
13275
13276- new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, user_ns, new_fs);
13277+ new_nsp->mnt_ns = copy_mnt_ns(flags, orig->mnt_ns, new_user, new_fs);
13278 if (IS_ERR(new_nsp->mnt_ns)) {
13279 err = PTR_ERR(new_nsp->mnt_ns);
13280 goto out_ns;
13281 }
13282
13283- new_nsp->uts_ns = copy_utsname(flags, user_ns, tsk->nsproxy->uts_ns);
13284+ new_nsp->uts_ns = copy_utsname(flags, new_user, orig->uts_ns);
13285 if (IS_ERR(new_nsp->uts_ns)) {
13286 err = PTR_ERR(new_nsp->uts_ns);
13287 goto out_uts;
13288 }
13289
13290- new_nsp->ipc_ns = copy_ipcs(flags, user_ns, tsk->nsproxy->ipc_ns);
13291+ new_nsp->ipc_ns = copy_ipcs(flags, new_user, orig->ipc_ns);
13292 if (IS_ERR(new_nsp->ipc_ns)) {
13293 err = PTR_ERR(new_nsp->ipc_ns);
13294 goto out_ipc;
13295 }
13296
13297- new_nsp->pid_ns_for_children =
13298- copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children);
13299+ new_nsp->pid_ns_for_children = copy_pid_ns(flags, new_user, new_pid);
13300 if (IS_ERR(new_nsp->pid_ns_for_children)) {
13301 err = PTR_ERR(new_nsp->pid_ns_for_children);
13302 goto out_pid;
13303 }
13304
13305- new_nsp->net_ns = copy_net_ns(flags, user_ns, tsk->nsproxy->net_ns);
13306+ new_nsp->net_ns = copy_net_ns(flags, new_user, orig->net_ns);
13307 if (IS_ERR(new_nsp->net_ns)) {
13308 err = PTR_ERR(new_nsp->net_ns);
13309 goto out_net;
13310@@ -117,6 +125,41 @@ out_ns:
13311 return ERR_PTR(err);
13312 }
13313
13314+static struct nsproxy *create_new_namespaces(unsigned long flags,
13315+ struct task_struct *tsk, struct user_namespace *user_ns,
13316+ struct fs_struct *new_fs)
13317+
13318+{
13319+ return unshare_namespaces(flags, tsk->nsproxy,
13320+ new_fs, user_ns, task_active_pid_ns(tsk));
13321+}
13322+
13323+/*
13324+ * copies the nsproxy, setting refcount to 1, and grabbing a
13325+ * reference to all contained namespaces.
13326+ */
13327+struct nsproxy *copy_nsproxy(struct nsproxy *orig)
13328+{
13329+ struct nsproxy *ns = create_nsproxy();
13330+
13331+ if (ns) {
13332+ memcpy(ns, orig, sizeof(struct nsproxy));
13333+ atomic_set(&ns->count, 1);
13334+
13335+ if (ns->mnt_ns)
13336+ get_mnt_ns(ns->mnt_ns);
13337+ if (ns->uts_ns)
13338+ get_uts_ns(ns->uts_ns);
13339+ if (ns->ipc_ns)
13340+ get_ipc_ns(ns->ipc_ns);
13341+ if (ns->pid_ns_for_children)
13342+ get_pid_ns(ns->pid_ns_for_children);
13343+ if (ns->net_ns)
13344+ get_net(ns->net_ns);
13345+ }
13346+ return ns;
13347+}
13348+
13349 /*
13350 * called from clone. This now handles copy for nsproxy and all
13351 * namespaces therein.
13352@@ -125,7 +168,10 @@ int copy_namespaces(unsigned long flags,
13353 {
13354 struct nsproxy *old_ns = tsk->nsproxy;
13355 struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns);
13356- struct nsproxy *new_ns;
13357+ struct nsproxy *new_ns = NULL;
13358+
13359+ vxdprintk(VXD_CBIT(space, 7), "copy_namespaces(0x%08lx,%p[%p])",
13360+ flags, tsk, old_ns);
13361
13362 if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
13363 CLONE_NEWPID | CLONE_NEWNET)))) {
13364@@ -133,7 +179,7 @@ int copy_namespaces(unsigned long flags,
13365 return 0;
13366 }
13367
13368- if (!ns_capable(user_ns, CAP_SYS_ADMIN))
13369+ if (!vx_ns_can_unshare(user_ns, CAP_SYS_ADMIN, flags))
13370 return -EPERM;
13371
13372 /*
13373@@ -152,6 +198,9 @@ int copy_namespaces(unsigned long flags,
13374 return PTR_ERR(new_ns);
13375
13376 tsk->nsproxy = new_ns;
13377+ vxdprintk(VXD_CBIT(space, 3),
13378+ "copy_namespaces(0x%08lx,%p[%p]) = [%p]",
13379+ flags, tsk, old_ns, new_ns);
13380 return 0;
13381 }
13382
13383@@ -165,7 +214,9 @@ void free_nsproxy(struct nsproxy *ns)
13384 put_ipc_ns(ns->ipc_ns);
13385 if (ns->pid_ns_for_children)
13386 put_pid_ns(ns->pid_ns_for_children);
13387- put_net(ns->net_ns);
13388+ if (ns->net_ns)
13389+ put_net(ns->net_ns);
13390+ atomic_dec(&vs_global_nsproxy);
13391 kmem_cache_free(nsproxy_cachep, ns);
13392 }
13393
13394@@ -179,12 +230,16 @@ int unshare_nsproxy_namespaces(unsigned
13395 struct user_namespace *user_ns;
13396 int err = 0;
13397
13398+ vxdprintk(VXD_CBIT(space, 4),
13399+ "unshare_nsproxy_namespaces(0x%08lx,[%p])",
13400+ unshare_flags, current->nsproxy);
13401+
13402 if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
13403 CLONE_NEWNET | CLONE_NEWPID)))
13404 return 0;
13405
13406 user_ns = new_cred ? new_cred->user_ns : current_user_ns();
13407- if (!ns_capable(user_ns, CAP_SYS_ADMIN))
13408+ if (!vx_ns_can_unshare(user_ns, CAP_SYS_ADMIN, unshare_flags))
13409 return -EPERM;
13410
13411 *new_nsp = create_new_namespaces(unshare_flags, current, user_ns,
13412diff -NurpP --minimal linux-4.4.116/kernel/pid.c linux-4.4.116-vs2.3.9.7/kernel/pid.c
13413--- linux-4.4.116/kernel/pid.c 2018-02-22 21:20:00.000000000 +0000
13414+++ linux-4.4.116-vs2.3.9.7/kernel/pid.c 2018-01-09 21:54:23.000000000 +0000
13415@@ -38,6 +38,7 @@
13416 #include <linux/syscalls.h>
13417 #include <linux/proc_ns.h>
13418 #include <linux/proc_fs.h>
13419+#include <linux/vs_pid.h>
13420
13421 #define pid_hashfn(nr, ns) \
13422 hash_long((unsigned long)nr + (unsigned long)ns, pidhash_shift)
13423@@ -379,7 +380,7 @@ EXPORT_SYMBOL_GPL(find_pid_ns);
13424
13425 struct pid *find_vpid(int nr)
13426 {
13427- return find_pid_ns(nr, task_active_pid_ns(current));
13428+ return find_pid_ns(vx_rmap_pid(nr), task_active_pid_ns(current));
13429 }
13430 EXPORT_SYMBOL_GPL(find_vpid);
13431
13432@@ -435,6 +436,9 @@ void transfer_pid(struct task_struct *ol
13433 struct task_struct *pid_task(struct pid *pid, enum pid_type type)
13434 {
13435 struct task_struct *result = NULL;
13436+
13437+ if (type == __PIDTYPE_REALPID)
13438+ type = PIDTYPE_PID;
13439 if (pid) {
13440 struct hlist_node *first;
13441 first = rcu_dereference_check(hlist_first_rcu(&pid->tasks[type]),
13442@@ -453,7 +457,7 @@ struct task_struct *find_task_by_pid_ns(
13443 {
13444 RCU_LOCKDEP_WARN(!rcu_read_lock_held(),
13445 "find_task_by_pid_ns() needs rcu_read_lock() protection");
13446- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
13447+ return pid_task(find_pid_ns(vx_rmap_pid(nr), ns), PIDTYPE_PID);
13448 }
13449
13450 struct task_struct *find_task_by_vpid(pid_t vnr)
13451@@ -497,7 +501,7 @@ struct pid *find_get_pid(pid_t nr)
13452 }
13453 EXPORT_SYMBOL_GPL(find_get_pid);
13454
13455-pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns)
13456+pid_t pid_unmapped_nr_ns(struct pid *pid, struct pid_namespace *ns)
13457 {
13458 struct upid *upid;
13459 pid_t nr = 0;
13460@@ -511,6 +515,11 @@ pid_t pid_nr_ns(struct pid *pid, struct
13461 }
13462 EXPORT_SYMBOL_GPL(pid_nr_ns);
13463
13464+pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns)
13465+{
13466+ return vx_map_pid(pid_unmapped_nr_ns(pid, ns));
13467+}
13468+
13469 pid_t pid_vnr(struct pid *pid)
13470 {
13471 return pid_nr_ns(pid, task_active_pid_ns(current));
13472diff -NurpP --minimal linux-4.4.116/kernel/pid_namespace.c linux-4.4.116-vs2.3.9.7/kernel/pid_namespace.c
13473--- linux-4.4.116/kernel/pid_namespace.c 2018-02-22 21:20:00.000000000 +0000
13474+++ linux-4.4.116-vs2.3.9.7/kernel/pid_namespace.c 2018-01-09 16:36:33.000000000 +0000
13475@@ -18,6 +18,7 @@
13476 #include <linux/proc_ns.h>
13477 #include <linux/reboot.h>
13478 #include <linux/export.h>
13479+#include <linux/vserver/global.h>
13480
13481 struct pid_cache {
13482 int nr_ids;
13483@@ -111,6 +112,7 @@ static struct pid_namespace *create_pid_
13484 ns->ns.ops = &pidns_operations;
13485
13486 kref_init(&ns->kref);
13487+ atomic_inc(&vs_global_pid_ns);
13488 ns->level = level;
13489 ns->parent = get_pid_ns(parent_pid_ns);
13490 ns->user_ns = get_user_ns(user_ns);
13491@@ -128,6 +130,7 @@ static struct pid_namespace *create_pid_
13492 out_free_map:
13493 kfree(ns->pidmap[0].page);
13494 out_free:
13495+ atomic_dec(&vs_global_pid_ns);
13496 kmem_cache_free(pid_ns_cachep, ns);
13497 out:
13498 return ERR_PTR(err);
13499diff -NurpP --minimal linux-4.4.116/kernel/printk/printk.c linux-4.4.116-vs2.3.9.7/kernel/printk/printk.c
13500--- linux-4.4.116/kernel/printk/printk.c 2018-02-22 21:20:00.000000000 +0000
13501+++ linux-4.4.116-vs2.3.9.7/kernel/printk/printk.c 2018-01-09 16:36:33.000000000 +0000
13502@@ -46,6 +46,7 @@
13503 #include <linux/utsname.h>
13504 #include <linux/ctype.h>
13505 #include <linux/uio.h>
13506+#include <linux/vs_cvirt.h>
13507
13508 #include <asm/uaccess.h>
13509
13510@@ -502,7 +503,7 @@ int check_syslog_permissions(int type, i
13511 goto ok;
13512
13513 if (syslog_action_restricted(type)) {
13514- if (capable(CAP_SYSLOG))
13515+ if (vx_capable(CAP_SYSLOG, VXC_SYSLOG))
13516 goto ok;
13517 /*
13518 * For historical reasons, accept CAP_SYS_ADMIN too, with
13519@@ -1304,12 +1305,9 @@ int do_syslog(int type, char __user *buf
13520 if (error)
13521 goto out;
13522
13523- switch (type) {
13524- case SYSLOG_ACTION_CLOSE: /* Close log */
13525- break;
13526- case SYSLOG_ACTION_OPEN: /* Open log */
13527- break;
13528- case SYSLOG_ACTION_READ: /* Read from log */
13529+ if ((type == SYSLOG_ACTION_READ) ||
13530+ (type == SYSLOG_ACTION_READ_ALL) ||
13531+ (type == SYSLOG_ACTION_READ_CLEAR)) {
13532 error = -EINVAL;
13533 if (!buf || len < 0)
13534 goto out;
13535@@ -1320,6 +1318,16 @@ int do_syslog(int type, char __user *buf
13536 error = -EFAULT;
13537 goto out;
13538 }
13539+ }
13540+ if (!vx_check(0, VS_ADMIN|VS_WATCH))
13541+ return vx_do_syslog(type, buf, len);
13542+
13543+ switch (type) {
13544+ case SYSLOG_ACTION_CLOSE: /* Close log */
13545+ break;
13546+ case SYSLOG_ACTION_OPEN: /* Open log */
13547+ break;
13548+ case SYSLOG_ACTION_READ: /* Read from log */
13549 error = wait_event_interruptible(log_wait,
13550 syslog_seq != log_next_seq);
13551 if (error)
13552@@ -1332,16 +1340,6 @@ int do_syslog(int type, char __user *buf
13553 /* FALL THRU */
13554 /* Read last kernel messages */
13555 case SYSLOG_ACTION_READ_ALL:
13556- error = -EINVAL;
13557- if (!buf || len < 0)
13558- goto out;
13559- error = 0;
13560- if (!len)
13561- goto out;
13562- if (!access_ok(VERIFY_WRITE, buf, len)) {
13563- error = -EFAULT;
13564- goto out;
13565- }
13566 error = syslog_print_all(buf, len, clear);
13567 break;
13568 /* Clear ring buffer */
13569diff -NurpP --minimal linux-4.4.116/kernel/ptrace.c linux-4.4.116-vs2.3.9.7/kernel/ptrace.c
13570--- linux-4.4.116/kernel/ptrace.c 2018-02-22 21:20:00.000000000 +0000
13571+++ linux-4.4.116-vs2.3.9.7/kernel/ptrace.c 2018-01-09 16:36:33.000000000 +0000
13572@@ -23,6 +23,7 @@
13573 #include <linux/syscalls.h>
13574 #include <linux/uaccess.h>
13575 #include <linux/regset.h>
13576+#include <linux/vs_context.h>
13577 #include <linux/hw_breakpoint.h>
13578 #include <linux/cn_proc.h>
13579 #include <linux/compat.h>
13580@@ -295,6 +296,11 @@ ok:
13581 !ptrace_has_cap(mm->user_ns, mode)))
13582 return -EPERM;
13583
13584+ if (!vx_check(task->xid, VS_ADMIN_P|VS_WATCH_P|VS_IDENT))
13585+ return -EPERM;
13586+ if (!vx_check(task->xid, VS_IDENT) &&
13587+ !task_vx_flags(task, VXF_STATE_ADMIN, 0))
13588+ return -EACCES;
13589 return security_ptrace_access_check(task, mode);
13590 }
13591
13592diff -NurpP --minimal linux-4.4.116/kernel/reboot.c linux-4.4.116-vs2.3.9.7/kernel/reboot.c
13593--- linux-4.4.116/kernel/reboot.c 2016-07-05 04:12:39.000000000 +0000
13594+++ linux-4.4.116-vs2.3.9.7/kernel/reboot.c 2018-01-09 16:36:33.000000000 +0000
13595@@ -16,6 +16,7 @@
13596 #include <linux/syscalls.h>
13597 #include <linux/syscore_ops.h>
13598 #include <linux/uaccess.h>
13599+#include <linux/vs_pid.h>
13600
13601 /*
13602 * this indicates whether you can reboot with ctrl-alt-del: the default is yes
13603@@ -269,6 +270,8 @@ EXPORT_SYMBOL_GPL(kernel_power_off);
13604
13605 static DEFINE_MUTEX(reboot_mutex);
13606
13607+long vs_reboot(unsigned int, void __user *);
13608+
13609 /*
13610 * Reboot system call: for obvious reasons only root may call it,
13611 * and even root needs to set up some magic numbers in the registers
13612@@ -311,6 +314,9 @@ SYSCALL_DEFINE4(reboot, int, magic1, int
13613 if ((cmd == LINUX_REBOOT_CMD_POWER_OFF) && !pm_power_off)
13614 cmd = LINUX_REBOOT_CMD_HALT;
13615
13616+ if (!vx_check(0, VS_ADMIN|VS_WATCH))
13617+ return vs_reboot(cmd, arg);
13618+
13619 mutex_lock(&reboot_mutex);
13620 switch (cmd) {
13621 case LINUX_REBOOT_CMD_RESTART:
13622diff -NurpP --minimal linux-4.4.116/kernel/sched/core.c linux-4.4.116-vs2.3.9.7/kernel/sched/core.c
13623--- linux-4.4.116/kernel/sched/core.c 2018-02-22 21:20:00.000000000 +0000
13624+++ linux-4.4.116-vs2.3.9.7/kernel/sched/core.c 2018-02-22 21:30:19.000000000 +0000
13625@@ -74,6 +74,8 @@
13626 #include <linux/binfmts.h>
13627 #include <linux/context_tracking.h>
13628 #include <linux/compiler.h>
13629+#include <linux/vs_sched.h>
13630+#include <linux/vs_cvirt.h>
13631
13632 #include <asm/switch_to.h>
13633 #include <asm/tlb.h>
13634@@ -3559,7 +3561,7 @@ SYSCALL_DEFINE1(nice, int, increment)
13635
13636 nice = clamp_val(nice, MIN_NICE, MAX_NICE);
13637 if (increment < 0 && !can_nice(current, nice))
13638- return -EPERM;
13639+ return vx_flags(VXF_IGNEG_NICE, 0) ? 0 : -EPERM;
13640
13641 retval = security_task_setnice(current, nice);
13642 if (retval)
13643diff -NurpP --minimal linux-4.4.116/kernel/sched/cputime.c linux-4.4.116-vs2.3.9.7/kernel/sched/cputime.c
13644--- linux-4.4.116/kernel/sched/cputime.c 2018-02-22 21:20:00.000000000 +0000
13645+++ linux-4.4.116-vs2.3.9.7/kernel/sched/cputime.c 2018-01-09 16:36:33.000000000 +0000
13646@@ -4,6 +4,7 @@
13647 #include <linux/kernel_stat.h>
13648 #include <linux/static_key.h>
13649 #include <linux/context_tracking.h>
13650+#include <linux/vs_sched.h>
13651 #include "sched.h"
13652
13653
13654@@ -135,14 +136,17 @@ static inline void task_group_account_fi
13655 void account_user_time(struct task_struct *p, cputime_t cputime,
13656 cputime_t cputime_scaled)
13657 {
13658+ struct vx_info *vxi = p->vx_info; /* p is _always_ current */
13659+ int nice = (task_nice(p) > 0);
13660 int index;
13661
13662 /* Add user time to process. */
13663 p->utime += cputime;
13664 p->utimescaled += cputime_scaled;
13665+ vx_account_user(vxi, cputime, nice);
13666 account_group_user_time(p, cputime);
13667
13668- index = (task_nice(p) > 0) ? CPUTIME_NICE : CPUTIME_USER;
13669+ index = (nice) ? CPUTIME_NICE : CPUTIME_USER;
13670
13671 /* Add user time to cpustat. */
13672 task_group_account_field(p, index, (__force u64) cputime);
13673@@ -189,9 +193,12 @@ static inline
13674 void __account_system_time(struct task_struct *p, cputime_t cputime,
13675 cputime_t cputime_scaled, int index)
13676 {
13677+ struct vx_info *vxi = p->vx_info; /* p is _always_ current */
13678+
13679 /* Add system time to process. */
13680 p->stime += cputime;
13681 p->stimescaled += cputime_scaled;
13682+ vx_account_system(vxi, cputime, 0 /* do we have idle time? */);
13683 account_group_system_time(p, cputime);
13684
13685 /* Add system time to cpustat. */
13686diff -NurpP --minimal linux-4.4.116/kernel/sched/fair.c linux-4.4.116-vs2.3.9.7/kernel/sched/fair.c
13687--- linux-4.4.116/kernel/sched/fair.c 2018-02-22 21:20:00.000000000 +0000
13688+++ linux-4.4.116-vs2.3.9.7/kernel/sched/fair.c 2018-01-09 16:36:33.000000000 +0000
13689@@ -30,6 +30,7 @@
13690 #include <linux/mempolicy.h>
13691 #include <linux/migrate.h>
13692 #include <linux/task_work.h>
13693+#include <linux/vs_cvirt.h>
13694
13695 #include <trace/events/sched.h>
13696
13697@@ -3055,6 +3056,8 @@ enqueue_entity(struct cfs_rq *cfs_rq, st
13698 __enqueue_entity(cfs_rq, se);
13699 se->on_rq = 1;
13700
13701+ if (entity_is_task(se))
13702+ vx_activate_task(task_of(se));
13703 if (cfs_rq->nr_running == 1) {
13704 list_add_leaf_cfs_rq(cfs_rq);
13705 check_enqueue_throttle(cfs_rq);
13706@@ -3136,6 +3139,8 @@ dequeue_entity(struct cfs_rq *cfs_rq, st
13707 if (se != cfs_rq->curr)
13708 __dequeue_entity(cfs_rq, se);
13709 se->on_rq = 0;
13710+ if (entity_is_task(se))
13711+ vx_deactivate_task(task_of(se));
13712 account_entity_dequeue(cfs_rq, se);
13713
13714 /*
13715diff -NurpP --minimal linux-4.4.116/kernel/sched/loadavg.c linux-4.4.116-vs2.3.9.7/kernel/sched/loadavg.c
13716--- linux-4.4.116/kernel/sched/loadavg.c 2018-02-22 21:20:00.000000000 +0000
13717+++ linux-4.4.116-vs2.3.9.7/kernel/sched/loadavg.c 2018-01-24 23:01:30.000000000 +0000
13718@@ -73,9 +73,16 @@ EXPORT_SYMBOL(avenrun); /* should be rem
13719 */
13720 void get_avenrun(unsigned long *loads, unsigned long offset, int shift)
13721 {
13722- loads[0] = (avenrun[0] + offset) << shift;
13723- loads[1] = (avenrun[1] + offset) << shift;
13724- loads[2] = (avenrun[2] + offset) << shift;
13725+ if (vx_flags(VXF_VIRT_LOAD, 0)) {
13726+ struct vx_info *vxi = current_vx_info();
13727+ loads[0] = (vxi->cvirt.load[0] + offset) << shift;
13728+ loads[1] = (vxi->cvirt.load[1] + offset) << shift;
13729+ loads[2] = (vxi->cvirt.load[2] + offset) << shift;
13730+ } else {
13731+ loads[0] = (avenrun[0] + offset) << shift;
13732+ loads[1] = (avenrun[1] + offset) << shift;
13733+ loads[2] = (avenrun[2] + offset) << shift;
13734+ }
13735 }
13736
13737 long calc_load_fold_active(struct rq *this_rq)
13738diff -NurpP --minimal linux-4.4.116/kernel/signal.c linux-4.4.116-vs2.3.9.7/kernel/signal.c
13739--- linux-4.4.116/kernel/signal.c 2018-02-22 21:20:00.000000000 +0000
13740+++ linux-4.4.116-vs2.3.9.7/kernel/signal.c 2018-01-11 08:03:00.000000000 +0000
13741@@ -34,6 +34,8 @@
13742 #include <linux/compat.h>
13743 #include <linux/cn_proc.h>
13744 #include <linux/compiler.h>
13745+#include <linux/vs_context.h>
13746+#include <linux/vs_pid.h>
13747
13748 #define CREATE_TRACE_POINTS
13749 #include <trace/events/signal.h>
13750@@ -726,9 +728,18 @@ static int check_kill_permission(int sig
13751 struct pid *sid;
13752 int error;
13753
13754+ vxdprintk(VXD_CBIT(misc, 7),
13755+ "check_kill_permission(%d,%p,%p[#%u,%u])",
13756+ sig, info, t, vx_task_xid(t), t->pid);
13757+
13758 if (!valid_signal(sig))
13759 return -EINVAL;
13760
13761+/* FIXME: needed? if so, why?
13762+ if ((info != SEND_SIG_NOINFO) &&
13763+ (is_si_special(info) || !si_fromuser(info)))
13764+ goto skip; */
13765+
13766 if (!si_fromuser(info))
13767 return 0;
13768
13769@@ -752,6 +763,20 @@ static int check_kill_permission(int sig
13770 }
13771 }
13772
13773+ error = -EPERM;
13774+ if (t->pid == 1 && current->xid)
13775+ return error;
13776+
13777+ error = -ESRCH;
13778+ /* FIXME: we shouldn't return ESRCH ever, to avoid
13779+ loops, maybe ENOENT or EACCES? */
13780+ if (!vx_check(vx_task_xid(t), VS_WATCH_P | VS_IDENT)) {
13781+ vxdprintk(current->xid || VXD_CBIT(misc, 7),
13782+ "signal %d[%p] xid mismatch %p[#%u,%u] xid=#%u",
13783+ sig, info, t, vx_task_xid(t), t->pid, current->xid);
13784+ return error;
13785+ }
13786+/* skip: */
13787 return security_task_kill(t, info, sig, 0);
13788 }
13789
13790@@ -1303,8 +1328,14 @@ int kill_pid_info(int sig, struct siginf
13791 for (;;) {
13792 rcu_read_lock();
13793 p = pid_task(pid, PIDTYPE_PID);
13794- if (p)
13795- error = group_send_sig_info(sig, info, p);
13796+ if (p) {
13797+ if (vx_check(vx_task_xid(p), VS_IDENT))
13798+ error = group_send_sig_info(sig, info, p);
13799+ else {
13800+ rcu_read_unlock();
13801+ return -ESRCH;
13802+ }
13803+ }
13804 rcu_read_unlock();
13805 if (likely(!p || error != -ESRCH))
13806 return error;
13807@@ -1349,7 +1380,7 @@ int kill_pid_info_as_cred(int sig, struc
13808
13809 rcu_read_lock();
13810 p = pid_task(pid, PIDTYPE_PID);
13811- if (!p) {
13812+ if (!p || !vx_check(vx_task_xid(p), VS_IDENT)) {
13813 ret = -ESRCH;
13814 goto out_unlock;
13815 }
13816@@ -1401,8 +1432,10 @@ static int kill_something_info(int sig,
13817 struct task_struct * p;
13818
13819 for_each_process(p) {
13820- if (task_pid_vnr(p) > 1 &&
13821- !same_thread_group(p, current)) {
13822+ if (vx_check(vx_task_xid(p), VS_ADMIN|VS_IDENT) &&
13823+ task_pid_vnr(p) > 1 &&
13824+ !same_thread_group(p, current) &&
13825+ !vx_current_initpid(p->pid)) {
13826 int err = group_send_sig_info(sig, info, p);
13827 ++count;
13828 if (err != -EPERM)
13829@@ -2255,6 +2288,11 @@ relock:
13830 !sig_kernel_only(signr))
13831 continue;
13832
13833+ /* virtual init is protected against user signals */
13834+ if ((ksig->info.si_code == SI_USER) &&
13835+ vx_current_initpid(current->pid))
13836+ continue;
13837+
13838 if (sig_kernel_stop(signr)) {
13839 /*
13840 * The default action is to stop all threads in
13841diff -NurpP --minimal linux-4.4.116/kernel/softirq.c linux-4.4.116-vs2.3.9.7/kernel/softirq.c
13842--- linux-4.4.116/kernel/softirq.c 2015-04-12 22:12:50.000000000 +0000
13843+++ linux-4.4.116-vs2.3.9.7/kernel/softirq.c 2018-01-09 16:36:34.000000000 +0000
13844@@ -26,6 +26,7 @@
13845 #include <linux/smpboot.h>
13846 #include <linux/tick.h>
13847 #include <linux/irq.h>
13848+#include <linux/vs_context.h>
13849
13850 #define CREATE_TRACE_POINTS
13851 #include <trace/events/irq.h>
13852diff -NurpP --minimal linux-4.4.116/kernel/sys.c linux-4.4.116-vs2.3.9.7/kernel/sys.c
13853--- linux-4.4.116/kernel/sys.c 2018-02-22 21:20:00.000000000 +0000
13854+++ linux-4.4.116-vs2.3.9.7/kernel/sys.c 2018-01-09 17:00:36.000000000 +0000
13855@@ -54,6 +54,7 @@
13856 #include <linux/cred.h>
13857
13858 #include <linux/kmsg_dump.h>
13859+#include <linux/vs_pid.h>
13860 /* Move somewhere else to avoid recompiling? */
13861 #include <generated/utsrelease.h>
13862
13863@@ -157,7 +158,10 @@ static int set_one_prio(struct task_stru
13864 goto out;
13865 }
13866 if (niceval < task_nice(p) && !can_nice(p, niceval)) {
13867- error = -EACCES;
13868+ if (vx_flags(VXF_IGNEG_NICE, 0))
13869+ error = 0;
13870+ else
13871+ error = -EACCES;
13872 goto out;
13873 }
13874 no_nice = security_task_setnice(p, niceval);
13875@@ -208,6 +212,8 @@ SYSCALL_DEFINE3(setpriority, int, which,
13876 else
13877 pgrp = task_pgrp(current);
13878 do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
13879+ if (!vx_check(p->xid, VS_ADMIN_P | VS_IDENT))
13880+ continue;
13881 error = set_one_prio(p, niceval, error);
13882 } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
13883 break;
13884@@ -274,6 +280,8 @@ SYSCALL_DEFINE2(getpriority, int, which,
13885 else
13886 pgrp = task_pgrp(current);
13887 do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
13888+ if (!vx_check(p->xid, VS_ADMIN_P | VS_IDENT))
13889+ continue;
13890 niceval = nice_to_rlimit(task_nice(p));
13891 if (niceval > retval)
13892 retval = niceval;
13893@@ -290,6 +298,8 @@ SYSCALL_DEFINE2(getpriority, int, which,
13894 goto out_unlock; /* No processes for this user */
13895 }
13896 do_each_thread(g, p) {
13897+ if (!vx_check(p->xid, VS_ADMIN_P | VS_IDENT))
13898+ continue;
13899 if (uid_eq(task_uid(p), uid) && task_pid_vnr(p)) {
13900 niceval = nice_to_rlimit(task_nice(p));
13901 if (niceval > retval)
13902@@ -1217,7 +1227,8 @@ SYSCALL_DEFINE2(sethostname, char __user
13903 int errno;
13904 char tmp[__NEW_UTS_LEN];
13905
13906- if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))
13907+ if (!vx_ns_capable(current->nsproxy->uts_ns->user_ns,
13908+ CAP_SYS_ADMIN, VXC_SET_UTSNAME))
13909 return -EPERM;
13910
13911 if (len < 0 || len > __NEW_UTS_LEN)
13912@@ -1268,7 +1279,8 @@ SYSCALL_DEFINE2(setdomainname, char __us
13913 int errno;
13914 char tmp[__NEW_UTS_LEN];
13915
13916- if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))
13917+ if (!vx_ns_capable(current->nsproxy->uts_ns->user_ns,
13918+ CAP_SYS_ADMIN, VXC_SET_UTSNAME))
13919 return -EPERM;
13920 if (len < 0 || len > __NEW_UTS_LEN)
13921 return -EINVAL;
13922@@ -1386,7 +1398,7 @@ int do_prlimit(struct task_struct *tsk,
13923 /* Keep the capable check against init_user_ns until
13924 cgroups can contain all limits */
13925 if (new_rlim->rlim_max > rlim->rlim_max &&
13926- !capable(CAP_SYS_RESOURCE))
13927+ !vx_capable(CAP_SYS_RESOURCE, VXC_SET_RLIMIT))
13928 retval = -EPERM;
13929 if (!retval)
13930 retval = security_task_setrlimit(tsk->group_leader,
13931@@ -1439,7 +1451,8 @@ static int check_prlimit_permission(stru
13932 gid_eq(cred->gid, tcred->sgid) &&
13933 gid_eq(cred->gid, tcred->gid))
13934 return 0;
13935- if (ns_capable(tcred->user_ns, CAP_SYS_RESOURCE))
13936+ if (vx_ns_capable(tcred->user_ns,
13937+ CAP_SYS_RESOURCE, VXC_SET_RLIMIT))
13938 return 0;
13939
13940 return -EPERM;
13941diff -NurpP --minimal linux-4.4.116/kernel/sysctl.c linux-4.4.116-vs2.3.9.7/kernel/sysctl.c
13942--- linux-4.4.116/kernel/sysctl.c 2018-02-22 21:20:00.000000000 +0000
13943+++ linux-4.4.116-vs2.3.9.7/kernel/sysctl.c 2018-01-09 16:36:34.000000000 +0000
13944@@ -87,6 +87,7 @@
13945 #if defined(CONFIG_PROVE_LOCKING) || defined(CONFIG_LOCK_STAT)
13946 #include <linux/lockdep.h>
13947 #endif
13948+extern char vshelper_path[];
13949 #ifdef CONFIG_CHR_DEV_SG
13950 #include <scsi/sg.h>
13951 #endif
13952@@ -279,6 +280,13 @@ static int max_extfrag_threshold = 1000;
13953
13954 static struct ctl_table kern_table[] = {
13955 {
13956+ .procname = "vshelper",
13957+ .data = &vshelper_path,
13958+ .maxlen = 256,
13959+ .mode = 0644,
13960+ .proc_handler = proc_dostring,
13961+ },
13962+ {
13963 .procname = "sched_child_runs_first",
13964 .data = &sysctl_sched_child_runs_first,
13965 .maxlen = sizeof(unsigned int),
13966@@ -1385,7 +1393,6 @@ static struct ctl_table vm_table[] = {
13967 .extra1 = &zero,
13968 .extra2 = &one,
13969 },
13970-
13971 #endif /* CONFIG_COMPACTION */
13972 {
13973 .procname = "min_free_kbytes",
13974diff -NurpP --minimal linux-4.4.116/kernel/sysctl_binary.c linux-4.4.116-vs2.3.9.7/kernel/sysctl_binary.c
13975--- linux-4.4.116/kernel/sysctl_binary.c 2018-02-22 21:20:00.000000000 +0000
13976+++ linux-4.4.116-vs2.3.9.7/kernel/sysctl_binary.c 2018-01-09 16:36:34.000000000 +0000
13977@@ -73,6 +73,7 @@ static const struct bin_table bin_kern_t
13978
13979 { CTL_INT, KERN_PANIC, "panic" },
13980 { CTL_INT, KERN_REALROOTDEV, "real-root-dev" },
13981+ { CTL_STR, KERN_VSHELPER, "vshelper" },
13982
13983 { CTL_STR, KERN_SPARC_REBOOT, "reboot-cmd" },
13984 { CTL_INT, KERN_CTLALTDEL, "ctrl-alt-del" },
13985diff -NurpP --minimal linux-4.4.116/kernel/time/posix-timers.c linux-4.4.116-vs2.3.9.7/kernel/time/posix-timers.c
13986--- linux-4.4.116/kernel/time/posix-timers.c 2018-02-22 21:20:00.000000000 +0000
13987+++ linux-4.4.116-vs2.3.9.7/kernel/time/posix-timers.c 2018-02-22 21:30:19.000000000 +0000
13988@@ -48,6 +48,7 @@
13989 #include <linux/workqueue.h>
13990 #include <linux/export.h>
13991 #include <linux/hashtable.h>
13992+#include <linux/vs_context.h>
13993
13994 #include "timekeeping.h"
13995
13996@@ -407,6 +408,7 @@ int posix_timer_event(struct k_itimer *t
13997 {
13998 struct task_struct *task;
13999 int shared, ret = -1;
14000+
14001 /*
14002 * FIXME: if ->sigq is queued we can race with
14003 * dequeue_signal()->do_schedule_next_timer().
14004@@ -423,10 +425,18 @@ int posix_timer_event(struct k_itimer *t
14005 rcu_read_lock();
14006 task = pid_task(timr->it_pid, PIDTYPE_PID);
14007 if (task) {
14008+ struct vx_info_save vxis;
14009+ struct vx_info *vxi;
14010+
14011+ vxi = get_vx_info(task->vx_info);
14012+ enter_vx_info(vxi, &vxis);
14013 shared = !(timr->it_sigev_notify & SIGEV_THREAD_ID);
14014 ret = send_sigqueue(timr->sigq, task, shared);
14015+ leave_vx_info(&vxis);
14016+ put_vx_info(vxi);
14017 }
14018 rcu_read_unlock();
14019+
14020 /* If we failed to send the signal the timer stops. */
14021 return ret > 0;
14022 }
14023diff -NurpP --minimal linux-4.4.116/kernel/time/time.c linux-4.4.116-vs2.3.9.7/kernel/time/time.c
14024--- linux-4.4.116/kernel/time/time.c 2016-07-05 04:12:39.000000000 +0000
14025+++ linux-4.4.116-vs2.3.9.7/kernel/time/time.c 2018-01-09 16:36:34.000000000 +0000
14026@@ -37,6 +37,7 @@
14027 #include <linux/fs.h>
14028 #include <linux/math64.h>
14029 #include <linux/ptrace.h>
14030+#include <linux/vs_time.h>
14031
14032 #include <asm/uaccess.h>
14033 #include <asm/unistd.h>
14034@@ -93,7 +94,7 @@ SYSCALL_DEFINE1(stime, time_t __user *,
14035 if (err)
14036 return err;
14037
14038- do_settimeofday(&tv);
14039+ vx_settimeofday(&tv);
14040 return 0;
14041 }
14042
14043@@ -186,7 +187,7 @@ int do_sys_settimeofday(const struct tim
14044 }
14045 }
14046 if (tv)
14047- return do_settimeofday(tv);
14048+ return vx_settimeofday(tv);
14049 return 0;
14050 }
14051
14052diff -NurpP --minimal linux-4.4.116/kernel/time/timekeeping.c linux-4.4.116-vs2.3.9.7/kernel/time/timekeeping.c
14053--- linux-4.4.116/kernel/time/timekeeping.c 2018-02-22 21:20:00.000000000 +0000
14054+++ linux-4.4.116-vs2.3.9.7/kernel/time/timekeeping.c 2018-01-09 17:02:47.000000000 +0000
14055@@ -23,6 +23,7 @@
14056 #include <linux/stop_machine.h>
14057 #include <linux/pvclock_gtod.h>
14058 #include <linux/compiler.h>
14059+#include <linux/vs_time.h>
14060
14061 #include "tick-internal.h"
14062 #include "ntp_internal.h"
14063@@ -921,7 +922,9 @@ void ktime_get_raw_and_real_ts64(struct
14064 } while (read_seqcount_retry(&tk_core.seq, seq));
14065
14066 timespec64_add_ns(ts_raw, nsecs_raw);
14067+ vx_adjust_timespec(ts_raw);
14068 timespec64_add_ns(ts_real, nsecs_real);
14069+ vx_adjust_timespec(ts_real);
14070 }
14071 EXPORT_SYMBOL(ktime_get_raw_and_real_ts64);
14072
14073diff -NurpP --minimal linux-4.4.116/kernel/time/timer.c linux-4.4.116-vs2.3.9.7/kernel/time/timer.c
14074--- linux-4.4.116/kernel/time/timer.c 2018-02-22 21:20:00.000000000 +0000
14075+++ linux-4.4.116-vs2.3.9.7/kernel/time/timer.c 2018-02-10 15:16:50.000000000 +0000
14076@@ -42,6 +42,10 @@
14077 #include <linux/sched/sysctl.h>
14078 #include <linux/slab.h>
14079 #include <linux/compat.h>
14080+#include <linux/vs_base.h>
14081+#include <linux/vs_cvirt.h>
14082+#include <linux/vs_pid.h>
14083+#include <linux/vserver/sched.h>
14084
14085 #include <asm/uaccess.h>
14086 #include <asm/unistd.h>
14087diff -NurpP --minimal linux-4.4.116/kernel/user_namespace.c linux-4.4.116-vs2.3.9.7/kernel/user_namespace.c
14088--- linux-4.4.116/kernel/user_namespace.c 2016-07-05 04:12:39.000000000 +0000
14089+++ linux-4.4.116-vs2.3.9.7/kernel/user_namespace.c 2018-01-09 16:36:34.000000000 +0000
14090@@ -22,6 +22,7 @@
14091 #include <linux/ctype.h>
14092 #include <linux/projid.h>
14093 #include <linux/fs_struct.h>
14094+#include <linux/vserver/global.h>
14095
14096 static struct kmem_cache *user_ns_cachep __read_mostly;
14097 static DEFINE_MUTEX(userns_state_mutex);
14098@@ -97,6 +98,7 @@ int create_user_ns(struct cred *new)
14099
14100 atomic_set(&ns->count, 1);
14101 /* Leave the new->user_ns reference with the new user namespace. */
14102+ atomic_inc(&vs_global_user_ns);
14103 ns->parent = parent_ns;
14104 ns->level = parent_ns->level + 1;
14105 ns->owner = owner;
14106@@ -145,6 +147,7 @@ void free_user_ns(struct user_namespace
14107 key_put(ns->persistent_keyring_register);
14108 #endif
14109 ns_free_inum(&ns->ns);
14110+ atomic_dec(&vs_global_user_ns);
14111 kmem_cache_free(user_ns_cachep, ns);
14112 ns = parent;
14113 } while (atomic_dec_and_test(&parent->count));
14114@@ -358,6 +361,18 @@ gid_t from_kgid_munged(struct user_names
14115 }
14116 EXPORT_SYMBOL(from_kgid_munged);
14117
14118+ktag_t make_ktag(struct user_namespace *from, vtag_t tag)
14119+{
14120+ return KTAGT_INIT(tag);
14121+}
14122+EXPORT_SYMBOL(make_ktag);
14123+
14124+vtag_t from_ktag(struct user_namespace *to, ktag_t tag)
14125+{
14126+ return __ktag_val(tag);
14127+}
14128+EXPORT_SYMBOL(from_ktag);
14129+
14130 /**
14131 * make_kprojid - Map a user-namespace projid pair into a kprojid.
14132 * @ns: User namespace that the projid is in
14133diff -NurpP --minimal linux-4.4.116/kernel/utsname.c linux-4.4.116-vs2.3.9.7/kernel/utsname.c
14134--- linux-4.4.116/kernel/utsname.c 2015-04-12 22:12:50.000000000 +0000
14135+++ linux-4.4.116-vs2.3.9.7/kernel/utsname.c 2018-01-09 16:36:34.000000000 +0000
14136@@ -16,14 +16,17 @@
14137 #include <linux/slab.h>
14138 #include <linux/user_namespace.h>
14139 #include <linux/proc_ns.h>
14140+#include <linux/vserver/global.h>
14141
14142 static struct uts_namespace *create_uts_ns(void)
14143 {
14144 struct uts_namespace *uts_ns;
14145
14146 uts_ns = kmalloc(sizeof(struct uts_namespace), GFP_KERNEL);
14147- if (uts_ns)
14148+ if (uts_ns) {
14149 kref_init(&uts_ns->kref);
14150+ atomic_inc(&vs_global_uts_ns);
14151+ }
14152 return uts_ns;
14153 }
14154
14155@@ -87,6 +90,7 @@ void free_uts_ns(struct kref *kref)
14156 ns = container_of(kref, struct uts_namespace, kref);
14157 put_user_ns(ns->user_ns);
14158 ns_free_inum(&ns->ns);
14159+ atomic_dec(&vs_global_uts_ns);
14160 kfree(ns);
14161 }
14162
14163diff -NurpP --minimal linux-4.4.116/kernel/vserver/Kconfig linux-4.4.116-vs2.3.9.7/kernel/vserver/Kconfig
14164--- linux-4.4.116/kernel/vserver/Kconfig 1970-01-01 00:00:00.000000000 +0000
14165+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/Kconfig 2018-01-09 16:36:34.000000000 +0000
14166@@ -0,0 +1,230 @@
14167+#
14168+# Linux VServer configuration
14169+#
14170+
14171+menu "Linux VServer"
14172+
14173+config VSERVER_AUTO_LBACK
14174+ bool "Automatically Assign Loopback IP"
14175+ default y
14176+ help
14177+ Automatically assign a guest specific loopback
14178+ IP and add it to the kernel network stack on
14179+ startup.
14180+
14181+config VSERVER_AUTO_SINGLE
14182+ bool "Automatic Single IP Special Casing"
14183+ default n
14184+ help
14185+ This allows network contexts with a single IP to
14186+ automatically remap 0.0.0.0 bindings to that IP,
14187+ avoiding further network checks and improving
14188+ performance.
14189+
14190+ (note: such guests do not allow to change the ip
14191+ on the fly and do not show loopback addresses)
14192+
14193+config VSERVER_COWBL
14194+ bool "Enable COW Immutable Link Breaking"
14195+ default y
14196+ help
14197+ This enables the COW (Copy-On-Write) link break code.
14198+ It allows you to treat unified files like normal files
14199+ when writing to them (which will implicitely break the
14200+ link and create a copy of the unified file)
14201+
14202+config VSERVER_VTIME
14203+ bool "Enable Virtualized Guest Time (EXPERIMENTAL)"
14204+ default n
14205+ help
14206+ This enables per guest time offsets to allow for
14207+ adjusting the system clock individually per guest.
14208+ this adds some overhead to the time functions and
14209+ therefore should not be enabled without good reason.
14210+
14211+config VSERVER_DEVICE
14212+ bool "Enable Guest Device Mapping (EXPERIMENTAL)"
14213+ default n
14214+ help
14215+ This enables generic device remapping.
14216+
14217+config VSERVER_PROC_SECURE
14218+ bool "Enable Proc Security"
14219+ depends on PROC_FS
14220+ default y
14221+ help
14222+ This configures ProcFS security to initially hide
14223+ non-process entries for all contexts except the main and
14224+ spectator context (i.e. for all guests), which is a secure
14225+ default.
14226+
14227+ (note: on 1.2x the entries were visible by default)
14228+
14229+choice
14230+ prompt "Persistent Inode Tagging"
14231+ default TAGGING_ID24
14232+ help
14233+ This adds persistent context information to filesystems
14234+ mounted with the tagxid option. Tagging is a requirement
14235+ for per-context disk limits and per-context quota.
14236+
14237+
14238+config TAGGING_NONE
14239+ bool "Disabled"
14240+ help
14241+ do not store per-context information in inodes.
14242+
14243+config TAGGING_UID16
14244+ bool "UID16/GID32"
14245+ help
14246+ reduces UID to 16 bit, but leaves GID at 32 bit.
14247+
14248+config TAGGING_GID16
14249+ bool "UID32/GID16"
14250+ help
14251+ reduces GID to 16 bit, but leaves UID at 32 bit.
14252+
14253+config TAGGING_ID24
14254+ bool "UID24/GID24"
14255+ help
14256+ uses the upper 8bit from UID and GID for XID tagging
14257+ which leaves 24bit for UID/GID each, which should be
14258+ more than sufficient for normal use.
14259+
14260+config TAGGING_INTERN
14261+ bool "UID32/GID32"
14262+ help
14263+ this uses otherwise reserved inode fields in the on
14264+ disk representation, which limits the use to a few
14265+ filesystems (currently ext2 and ext3)
14266+
14267+endchoice
14268+
14269+config TAG_NFSD
14270+ bool "Tag NFSD User Auth and Files"
14271+ default n
14272+ help
14273+ Enable this if you do want the in-kernel NFS
14274+ Server to use the tagging specified above.
14275+ (will require patched clients too)
14276+
14277+config VSERVER_PRIVACY
14278+ bool "Honor Privacy Aspects of Guests"
14279+ default n
14280+ help
14281+ When enabled, most context checks will disallow
14282+ access to structures assigned to a specific context,
14283+ like ptys or loop devices.
14284+
14285+config VSERVER_CONTEXTS
14286+ int "Maximum number of Contexts (1-65533)" if EMBEDDED
14287+ range 1 65533
14288+ default "768" if 64BIT
14289+ default "256"
14290+ help
14291+ This setting will optimize certain data structures
14292+ and memory allocations according to the expected
14293+ maximum.
14294+
14295+ note: this is not a strict upper limit.
14296+
14297+config VSERVER_WARN
14298+ bool "VServer Warnings"
14299+ default y
14300+ help
14301+ This enables various runtime warnings, which will
14302+ notify about potential manipulation attempts or
14303+ resource shortage. It is generally considered to
14304+ be a good idea to have that enabled.
14305+
14306+config VSERVER_WARN_DEVPTS
14307+ bool "VServer DevPTS Warnings"
14308+ depends on VSERVER_WARN
14309+ default y
14310+ help
14311+ This enables DevPTS related warnings, issued when a
14312+ process inside a context tries to lookup or access
14313+ a dynamic pts from the host or a different context.
14314+
14315+config VSERVER_DEBUG
14316+ bool "VServer Debugging Code"
14317+ default n
14318+ help
14319+ Set this to yes if you want to be able to activate
14320+ debugging output at runtime. It adds a very small
14321+ overhead to all vserver related functions and
14322+ increases the kernel size by about 20k.
14323+
14324+config VSERVER_HISTORY
14325+ bool "VServer History Tracing"
14326+ depends on VSERVER_DEBUG
14327+ default n
14328+ help
14329+ Set this to yes if you want to record the history of
14330+ linux-vserver activities, so they can be replayed in
14331+ the event of a kernel panic or oops.
14332+
14333+config VSERVER_HISTORY_SIZE
14334+ int "Per-CPU History Size (32-65536)"
14335+ depends on VSERVER_HISTORY
14336+ range 32 65536
14337+ default 64
14338+ help
14339+ This allows you to specify the number of entries in
14340+ the per-CPU history buffer.
14341+
14342+config VSERVER_EXTRA_MNT_CHECK
14343+ bool "Extra Checks for Reachability"
14344+ default n
14345+ help
14346+ Set this to yes if you want to do extra checks for
14347+ vfsmount reachability in the proc filesystem code.
14348+ This shouldn't be required on any setup utilizing
14349+ mnt namespaces.
14350+
14351+choice
14352+ prompt "Quotes used in debug and warn messages"
14353+ default QUOTES_ISO8859
14354+
14355+config QUOTES_ISO8859
14356+ bool "Extended ASCII (ISO 8859) angle quotes"
14357+ help
14358+ This uses the extended ASCII characters \xbb
14359+ and \xab for quoting file and process names.
14360+
14361+config QUOTES_UTF8
14362+ bool "UTF-8 angle quotes"
14363+ help
14364+ This uses the the UTF-8 sequences for angle
14365+ quotes to quote file and process names.
14366+
14367+config QUOTES_ASCII
14368+ bool "ASCII single quotes"
14369+ help
14370+ This uses the ASCII single quote character
14371+ (\x27) to quote file and process names.
14372+
14373+endchoice
14374+
14375+endmenu
14376+
14377+
14378+config VSERVER
14379+ bool
14380+ default y
14381+ select NAMESPACES
14382+ select UTS_NS
14383+ select IPC_NS
14384+# select USER_NS
14385+ select SYSVIPC
14386+
14387+config VSERVER_SECURITY
14388+ bool
14389+ depends on SECURITY
14390+ default y
14391+ select SECURITY_CAPABILITIES
14392+
14393+config VSERVER_DISABLED
14394+ bool
14395+ default n
14396+
14397diff -NurpP --minimal linux-4.4.116/kernel/vserver/Makefile linux-4.4.116-vs2.3.9.7/kernel/vserver/Makefile
14398--- linux-4.4.116/kernel/vserver/Makefile 1970-01-01 00:00:00.000000000 +0000
14399+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/Makefile 2018-01-09 16:36:34.000000000 +0000
14400@@ -0,0 +1,18 @@
14401+#
14402+# Makefile for the Linux vserver routines.
14403+#
14404+
14405+
14406+obj-y += vserver.o
14407+
14408+vserver-y := switch.o context.o space.o sched.o network.o inode.o \
14409+ limit.o cvirt.o cacct.o signal.o helper.o init.o \
14410+ dlimit.o tag.o
14411+
14412+vserver-$(CONFIG_INET) += inet.o
14413+vserver-$(CONFIG_PROC_FS) += proc.o
14414+vserver-$(CONFIG_VSERVER_DEBUG) += sysctl.o debug.o
14415+vserver-$(CONFIG_VSERVER_HISTORY) += history.o
14416+vserver-$(CONFIG_VSERVER_MONITOR) += monitor.o
14417+vserver-$(CONFIG_VSERVER_DEVICE) += device.o
14418+
14419diff -NurpP --minimal linux-4.4.116/kernel/vserver/cacct.c linux-4.4.116-vs2.3.9.7/kernel/vserver/cacct.c
14420--- linux-4.4.116/kernel/vserver/cacct.c 1970-01-01 00:00:00.000000000 +0000
14421+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/cacct.c 2018-01-09 16:36:34.000000000 +0000
14422@@ -0,0 +1,42 @@
14423+/*
14424+ * linux/kernel/vserver/cacct.c
14425+ *
14426+ * Virtual Server: Context Accounting
14427+ *
14428+ * Copyright (C) 2006-2007 Herbert P?tzl
14429+ *
14430+ * V0.01 added accounting stats
14431+ *
14432+ */
14433+
14434+#include <linux/types.h>
14435+#include <linux/vs_context.h>
14436+#include <linux/vserver/cacct_cmd.h>
14437+#include <linux/vserver/cacct_int.h>
14438+
14439+#include <asm/errno.h>
14440+#include <asm/uaccess.h>
14441+
14442+
14443+int vc_sock_stat(struct vx_info *vxi, void __user *data)
14444+{
14445+ struct vcmd_sock_stat_v0 vc_data;
14446+ int j, field;
14447+
14448+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
14449+ return -EFAULT;
14450+
14451+ field = vc_data.field;
14452+ if ((field < 0) || (field >= VXA_SOCK_SIZE))
14453+ return -EINVAL;
14454+
14455+ for (j = 0; j < 3; j++) {
14456+ vc_data.count[j] = vx_sock_count(&vxi->cacct, field, j);
14457+ vc_data.total[j] = vx_sock_total(&vxi->cacct, field, j);
14458+ }
14459+
14460+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
14461+ return -EFAULT;
14462+ return 0;
14463+}
14464+
14465diff -NurpP --minimal linux-4.4.116/kernel/vserver/cacct_init.h linux-4.4.116-vs2.3.9.7/kernel/vserver/cacct_init.h
14466--- linux-4.4.116/kernel/vserver/cacct_init.h 1970-01-01 00:00:00.000000000 +0000
14467+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/cacct_init.h 2018-01-09 16:36:34.000000000 +0000
14468@@ -0,0 +1,25 @@
14469+
14470+
14471+static inline void vx_info_init_cacct(struct _vx_cacct *cacct)
14472+{
14473+ int i, j;
14474+
14475+
14476+ for (i = 0; i < VXA_SOCK_SIZE; i++) {
14477+ for (j = 0; j < 3; j++) {
14478+ atomic_long_set(&cacct->sock[i][j].count, 0);
14479+ atomic_long_set(&cacct->sock[i][j].total, 0);
14480+ }
14481+ }
14482+ for (i = 0; i < 8; i++)
14483+ atomic_set(&cacct->slab[i], 0);
14484+ for (i = 0; i < 5; i++)
14485+ for (j = 0; j < 4; j++)
14486+ atomic_set(&cacct->page[i][j], 0);
14487+}
14488+
14489+static inline void vx_info_exit_cacct(struct _vx_cacct *cacct)
14490+{
14491+ return;
14492+}
14493+
14494diff -NurpP --minimal linux-4.4.116/kernel/vserver/cacct_proc.h linux-4.4.116-vs2.3.9.7/kernel/vserver/cacct_proc.h
14495--- linux-4.4.116/kernel/vserver/cacct_proc.h 1970-01-01 00:00:00.000000000 +0000
14496+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/cacct_proc.h 2018-01-09 16:36:34.000000000 +0000
14497@@ -0,0 +1,53 @@
14498+#ifndef _VX_CACCT_PROC_H
14499+#define _VX_CACCT_PROC_H
14500+
14501+#include <linux/vserver/cacct_int.h>
14502+
14503+
14504+#define VX_SOCKA_TOP \
14505+ "Type\t recv #/bytes\t\t send #/bytes\t\t fail #/bytes\n"
14506+
14507+static inline int vx_info_proc_cacct(struct _vx_cacct *cacct, char *buffer)
14508+{
14509+ int i, j, length = 0;
14510+ static char *type[VXA_SOCK_SIZE] = {
14511+ "UNSPEC", "UNIX", "INET", "INET6", "PACKET", "OTHER"
14512+ };
14513+
14514+ length += sprintf(buffer + length, VX_SOCKA_TOP);
14515+ for (i = 0; i < VXA_SOCK_SIZE; i++) {
14516+ length += sprintf(buffer + length, "%s:", type[i]);
14517+ for (j = 0; j < 3; j++) {
14518+ length += sprintf(buffer + length,
14519+ "\t%10lu/%-10lu",
14520+ vx_sock_count(cacct, i, j),
14521+ vx_sock_total(cacct, i, j));
14522+ }
14523+ buffer[length++] = '\n';
14524+ }
14525+
14526+ length += sprintf(buffer + length, "\n");
14527+ length += sprintf(buffer + length,
14528+ "slab:\t %8u %8u %8u %8u\n",
14529+ atomic_read(&cacct->slab[1]),
14530+ atomic_read(&cacct->slab[4]),
14531+ atomic_read(&cacct->slab[0]),
14532+ atomic_read(&cacct->slab[2]));
14533+
14534+ length += sprintf(buffer + length, "\n");
14535+ for (i = 0; i < 5; i++) {
14536+ length += sprintf(buffer + length,
14537+ "page[%d]: %8u %8u %8u %8u\t %8u %8u %8u %8u\n", i,
14538+ atomic_read(&cacct->page[i][0]),
14539+ atomic_read(&cacct->page[i][1]),
14540+ atomic_read(&cacct->page[i][2]),
14541+ atomic_read(&cacct->page[i][3]),
14542+ atomic_read(&cacct->page[i][4]),
14543+ atomic_read(&cacct->page[i][5]),
14544+ atomic_read(&cacct->page[i][6]),
14545+ atomic_read(&cacct->page[i][7]));
14546+ }
14547+ return length;
14548+}
14549+
14550+#endif /* _VX_CACCT_PROC_H */
14551diff -NurpP --minimal linux-4.4.116/kernel/vserver/context.c linux-4.4.116-vs2.3.9.7/kernel/vserver/context.c
14552--- linux-4.4.116/kernel/vserver/context.c 1970-01-01 00:00:00.000000000 +0000
14553+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/context.c 2018-01-09 16:36:34.000000000 +0000
14554@@ -0,0 +1,1119 @@
14555+/*
14556+ * linux/kernel/vserver/context.c
14557+ *
14558+ * Virtual Server: Context Support
14559+ *
14560+ * Copyright (C) 2003-2011 Herbert P?tzl
14561+ *
14562+ * V0.01 context helper
14563+ * V0.02 vx_ctx_kill syscall command
14564+ * V0.03 replaced context_info calls
14565+ * V0.04 redesign of struct (de)alloc
14566+ * V0.05 rlimit basic implementation
14567+ * V0.06 task_xid and info commands
14568+ * V0.07 context flags and caps
14569+ * V0.08 switch to RCU based hash
14570+ * V0.09 revert to non RCU for now
14571+ * V0.10 and back to working RCU hash
14572+ * V0.11 and back to locking again
14573+ * V0.12 referenced context store
14574+ * V0.13 separate per cpu data
14575+ * V0.14 changed vcmds to vxi arg
14576+ * V0.15 added context stat
14577+ * V0.16 have __create claim() the vxi
14578+ * V0.17 removed older and legacy stuff
14579+ * V0.18 added user credentials
14580+ * V0.19 added warn mask
14581+ *
14582+ */
14583+
14584+#include <linux/slab.h>
14585+#include <linux/types.h>
14586+#include <linux/security.h>
14587+#include <linux/pid_namespace.h>
14588+#include <linux/capability.h>
14589+
14590+#include <linux/vserver/context.h>
14591+#include <linux/vserver/network.h>
14592+#include <linux/vserver/debug.h>
14593+#include <linux/vserver/limit.h>
14594+#include <linux/vserver/limit_int.h>
14595+#include <linux/vserver/space.h>
14596+#include <linux/init_task.h>
14597+#include <linux/fs_struct.h>
14598+#include <linux/cred.h>
14599+
14600+#include <linux/vs_context.h>
14601+#include <linux/vs_limit.h>
14602+#include <linux/vs_pid.h>
14603+#include <linux/vserver/context_cmd.h>
14604+
14605+#include "cvirt_init.h"
14606+#include "cacct_init.h"
14607+#include "limit_init.h"
14608+#include "sched_init.h"
14609+
14610+
14611+atomic_t vx_global_ctotal = ATOMIC_INIT(0);
14612+atomic_t vx_global_cactive = ATOMIC_INIT(0);
14613+
14614+
14615+/* now inactive context structures */
14616+
14617+static struct hlist_head vx_info_inactive = HLIST_HEAD_INIT;
14618+
14619+static DEFINE_SPINLOCK(vx_info_inactive_lock);
14620+
14621+
14622+/* __alloc_vx_info()
14623+
14624+ * allocate an initialized vx_info struct
14625+ * doesn't make it visible (hash) */
14626+
14627+static struct vx_info *__alloc_vx_info(vxid_t xid)
14628+{
14629+ struct vx_info *new = NULL;
14630+ int cpu, index;
14631+
14632+ vxdprintk(VXD_CBIT(xid, 0), "alloc_vx_info(%d)*", xid);
14633+
14634+ /* would this benefit from a slab cache? */
14635+ new = kmalloc(sizeof(struct vx_info), GFP_KERNEL);
14636+ if (!new)
14637+ return 0;
14638+
14639+ memset(new, 0, sizeof(struct vx_info));
14640+#ifdef CONFIG_SMP
14641+ new->ptr_pc = alloc_percpu(struct _vx_info_pc);
14642+ if (!new->ptr_pc)
14643+ goto error;
14644+#endif
14645+ new->vx_id = xid;
14646+ INIT_HLIST_NODE(&new->vx_hlist);
14647+ atomic_set(&new->vx_usecnt, 0);
14648+ atomic_set(&new->vx_tasks, 0);
14649+ new->vx_parent = NULL;
14650+ new->vx_state = 0;
14651+ init_waitqueue_head(&new->vx_wait);
14652+
14653+ /* prepare reaper */
14654+ get_task_struct(init_pid_ns.child_reaper);
14655+ new->vx_reaper = init_pid_ns.child_reaper;
14656+ new->vx_badness_bias = 0;
14657+
14658+ /* rest of init goes here */
14659+ vx_info_init_limit(&new->limit);
14660+ vx_info_init_sched(&new->sched);
14661+ vx_info_init_cvirt(&new->cvirt);
14662+ vx_info_init_cacct(&new->cacct);
14663+
14664+ /* per cpu data structures */
14665+ for_each_possible_cpu(cpu) {
14666+ vx_info_init_sched_pc(
14667+ &vx_per_cpu(new, sched_pc, cpu), cpu);
14668+ vx_info_init_cvirt_pc(
14669+ &vx_per_cpu(new, cvirt_pc, cpu), cpu);
14670+ }
14671+
14672+ new->vx_flags = VXF_INIT_SET;
14673+ new->vx_bcaps = CAP_FULL_SET; // maybe ~CAP_SETPCAP
14674+ new->vx_ccaps = 0;
14675+ new->vx_umask = 0;
14676+ new->vx_wmask = 0;
14677+
14678+ new->reboot_cmd = 0;
14679+ new->exit_code = 0;
14680+
14681+ // preconfig spaces
14682+ for (index = 0; index < VX_SPACES; index++) {
14683+ struct _vx_space *space = &new->space[index];
14684+
14685+ // filesystem
14686+ spin_lock(&init_fs.lock);
14687+ init_fs.users++;
14688+ spin_unlock(&init_fs.lock);
14689+ space->vx_fs = &init_fs;
14690+
14691+ /* FIXME: do we want defaults? */
14692+ // space->vx_real_cred = 0;
14693+ // space->vx_cred = 0;
14694+ }
14695+
14696+
14697+ vxdprintk(VXD_CBIT(xid, 0),
14698+ "alloc_vx_info(%d) = %p", xid, new);
14699+ vxh_alloc_vx_info(new);
14700+ atomic_inc(&vx_global_ctotal);
14701+ return new;
14702+#ifdef CONFIG_SMP
14703+error:
14704+ kfree(new);
14705+ return 0;
14706+#endif
14707+}
14708+
14709+/* __dealloc_vx_info()
14710+
14711+ * final disposal of vx_info */
14712+
14713+static void __dealloc_vx_info(struct vx_info *vxi)
14714+{
14715+#ifdef CONFIG_VSERVER_WARN
14716+ struct vx_info_save vxis;
14717+ int cpu;
14718+#endif
14719+ vxdprintk(VXD_CBIT(xid, 0),
14720+ "dealloc_vx_info(%p)", vxi);
14721+ vxh_dealloc_vx_info(vxi);
14722+
14723+#ifdef CONFIG_VSERVER_WARN
14724+ enter_vx_info(vxi, &vxis);
14725+ vx_info_exit_limit(&vxi->limit);
14726+ vx_info_exit_sched(&vxi->sched);
14727+ vx_info_exit_cvirt(&vxi->cvirt);
14728+ vx_info_exit_cacct(&vxi->cacct);
14729+
14730+ for_each_possible_cpu(cpu) {
14731+ vx_info_exit_sched_pc(
14732+ &vx_per_cpu(vxi, sched_pc, cpu), cpu);
14733+ vx_info_exit_cvirt_pc(
14734+ &vx_per_cpu(vxi, cvirt_pc, cpu), cpu);
14735+ }
14736+ leave_vx_info(&vxis);
14737+#endif
14738+
14739+ vxi->vx_id = -1;
14740+ vxi->vx_state |= VXS_RELEASED;
14741+
14742+#ifdef CONFIG_SMP
14743+ free_percpu(vxi->ptr_pc);
14744+#endif
14745+ kfree(vxi);
14746+ atomic_dec(&vx_global_ctotal);
14747+}
14748+
14749+static void __shutdown_vx_info(struct vx_info *vxi)
14750+{
14751+ struct nsproxy *nsproxy;
14752+ struct fs_struct *fs;
14753+ struct cred *cred;
14754+ int index, kill;
14755+
14756+ might_sleep();
14757+
14758+ vxi->vx_state |= VXS_SHUTDOWN;
14759+ vs_state_change(vxi, VSC_SHUTDOWN);
14760+
14761+ for (index = 0; index < VX_SPACES; index++) {
14762+ struct _vx_space *space = &vxi->space[index];
14763+
14764+ nsproxy = xchg(&space->vx_nsproxy, NULL);
14765+ if (nsproxy)
14766+ put_nsproxy(nsproxy);
14767+
14768+ fs = xchg(&space->vx_fs, NULL);
14769+ spin_lock(&fs->lock);
14770+ kill = !--fs->users;
14771+ spin_unlock(&fs->lock);
14772+ if (kill)
14773+ free_fs_struct(fs);
14774+
14775+ cred = (struct cred *)xchg(&space->vx_cred, NULL);
14776+ if (cred)
14777+ abort_creds(cred);
14778+ }
14779+}
14780+
14781+/* exported stuff */
14782+
14783+void free_vx_info(struct vx_info *vxi)
14784+{
14785+ unsigned long flags;
14786+ unsigned index;
14787+
14788+ /* check for reference counts first */
14789+ BUG_ON(atomic_read(&vxi->vx_usecnt));
14790+ BUG_ON(atomic_read(&vxi->vx_tasks));
14791+
14792+ /* context must not be hashed */
14793+ BUG_ON(vx_info_state(vxi, VXS_HASHED));
14794+
14795+ /* context shutdown is mandatory */
14796+ BUG_ON(!vx_info_state(vxi, VXS_SHUTDOWN));
14797+
14798+ /* spaces check */
14799+ for (index = 0; index < VX_SPACES; index++) {
14800+ struct _vx_space *space = &vxi->space[index];
14801+
14802+ BUG_ON(space->vx_nsproxy);
14803+ BUG_ON(space->vx_fs);
14804+ // BUG_ON(space->vx_real_cred);
14805+ // BUG_ON(space->vx_cred);
14806+ }
14807+
14808+ spin_lock_irqsave(&vx_info_inactive_lock, flags);
14809+ hlist_del(&vxi->vx_hlist);
14810+ spin_unlock_irqrestore(&vx_info_inactive_lock, flags);
14811+
14812+ __dealloc_vx_info(vxi);
14813+}
14814+
14815+
14816+/* hash table for vx_info hash */
14817+
14818+#define VX_HASH_SIZE 13
14819+
14820+static struct hlist_head vx_info_hash[VX_HASH_SIZE] =
14821+ { [0 ... VX_HASH_SIZE-1] = HLIST_HEAD_INIT };
14822+
14823+static DEFINE_SPINLOCK(vx_info_hash_lock);
14824+
14825+
14826+static inline unsigned int __hashval(vxid_t xid)
14827+{
14828+ return (xid % VX_HASH_SIZE);
14829+}
14830+
14831+
14832+
14833+/* __hash_vx_info()
14834+
14835+ * add the vxi to the global hash table
14836+ * requires the hash_lock to be held */
14837+
14838+static inline void __hash_vx_info(struct vx_info *vxi)
14839+{
14840+ struct hlist_head *head;
14841+
14842+ vxd_assert_lock(&vx_info_hash_lock);
14843+ vxdprintk(VXD_CBIT(xid, 4),
14844+ "__hash_vx_info: %p[#%d]", vxi, vxi->vx_id);
14845+ vxh_hash_vx_info(vxi);
14846+
14847+ /* context must not be hashed */
14848+ BUG_ON(vx_info_state(vxi, VXS_HASHED));
14849+
14850+ vxi->vx_state |= VXS_HASHED;
14851+ head = &vx_info_hash[__hashval(vxi->vx_id)];
14852+ hlist_add_head(&vxi->vx_hlist, head);
14853+ atomic_inc(&vx_global_cactive);
14854+}
14855+
14856+/* __unhash_vx_info()
14857+
14858+ * remove the vxi from the global hash table
14859+ * requires the hash_lock to be held */
14860+
14861+static inline void __unhash_vx_info(struct vx_info *vxi)
14862+{
14863+ unsigned long flags;
14864+
14865+ vxd_assert_lock(&vx_info_hash_lock);
14866+ vxdprintk(VXD_CBIT(xid, 4),
14867+ "__unhash_vx_info: %p[#%d.%d.%d]", vxi, vxi->vx_id,
14868+ atomic_read(&vxi->vx_usecnt), atomic_read(&vxi->vx_tasks));
14869+ vxh_unhash_vx_info(vxi);
14870+
14871+ /* context must be hashed */
14872+ BUG_ON(!vx_info_state(vxi, VXS_HASHED));
14873+ /* but without tasks */
14874+ BUG_ON(atomic_read(&vxi->vx_tasks));
14875+
14876+ vxi->vx_state &= ~VXS_HASHED;
14877+ hlist_del_init(&vxi->vx_hlist);
14878+ spin_lock_irqsave(&vx_info_inactive_lock, flags);
14879+ hlist_add_head(&vxi->vx_hlist, &vx_info_inactive);
14880+ spin_unlock_irqrestore(&vx_info_inactive_lock, flags);
14881+ atomic_dec(&vx_global_cactive);
14882+}
14883+
14884+
14885+/* __lookup_vx_info()
14886+
14887+ * requires the hash_lock to be held
14888+ * doesn't increment the vx_refcnt */
14889+
14890+static inline struct vx_info *__lookup_vx_info(vxid_t xid)
14891+{
14892+ struct hlist_head *head = &vx_info_hash[__hashval(xid)];
14893+ struct hlist_node *pos;
14894+ struct vx_info *vxi;
14895+
14896+ vxd_assert_lock(&vx_info_hash_lock);
14897+ hlist_for_each(pos, head) {
14898+ vxi = hlist_entry(pos, struct vx_info, vx_hlist);
14899+
14900+ if (vxi->vx_id == xid)
14901+ goto found;
14902+ }
14903+ vxi = NULL;
14904+found:
14905+ vxdprintk(VXD_CBIT(xid, 0),
14906+ "__lookup_vx_info(#%u): %p[#%u]",
14907+ xid, vxi, vxi ? vxi->vx_id : 0);
14908+ vxh_lookup_vx_info(vxi, xid);
14909+ return vxi;
14910+}
14911+
14912+
14913+/* __create_vx_info()
14914+
14915+ * create the requested context
14916+ * get(), claim() and hash it */
14917+
14918+static struct vx_info *__create_vx_info(int id)
14919+{
14920+ struct vx_info *new, *vxi = NULL;
14921+
14922+ vxdprintk(VXD_CBIT(xid, 1), "create_vx_info(%d)*", id);
14923+
14924+ if (!(new = __alloc_vx_info(id)))
14925+ return ERR_PTR(-ENOMEM);
14926+
14927+ /* required to make dynamic xids unique */
14928+ spin_lock(&vx_info_hash_lock);
14929+
14930+ /* static context requested */
14931+ if ((vxi = __lookup_vx_info(id))) {
14932+ vxdprintk(VXD_CBIT(xid, 0),
14933+ "create_vx_info(%d) = %p (already there)", id, vxi);
14934+ if (vx_info_flags(vxi, VXF_STATE_SETUP, 0))
14935+ vxi = ERR_PTR(-EBUSY);
14936+ else
14937+ vxi = ERR_PTR(-EEXIST);
14938+ goto out_unlock;
14939+ }
14940+ /* new context */
14941+ vxdprintk(VXD_CBIT(xid, 0),
14942+ "create_vx_info(%d) = %p (new)", id, new);
14943+ claim_vx_info(new, NULL);
14944+ __hash_vx_info(get_vx_info(new));
14945+ vxi = new, new = NULL;
14946+
14947+out_unlock:
14948+ spin_unlock(&vx_info_hash_lock);
14949+ vxh_create_vx_info(IS_ERR(vxi) ? NULL : vxi, id);
14950+ if (new)
14951+ __dealloc_vx_info(new);
14952+ return vxi;
14953+}
14954+
14955+
14956+/* exported stuff */
14957+
14958+
14959+void unhash_vx_info(struct vx_info *vxi)
14960+{
14961+ spin_lock(&vx_info_hash_lock);
14962+ __unhash_vx_info(vxi);
14963+ spin_unlock(&vx_info_hash_lock);
14964+ __shutdown_vx_info(vxi);
14965+ __wakeup_vx_info(vxi);
14966+}
14967+
14968+
14969+/* lookup_vx_info()
14970+
14971+ * search for a vx_info and get() it
14972+ * negative id means current */
14973+
14974+struct vx_info *lookup_vx_info(int id)
14975+{
14976+ struct vx_info *vxi = NULL;
14977+
14978+ if (id < 0) {
14979+ vxi = get_vx_info(current_vx_info());
14980+ } else if (id > 1) {
14981+ spin_lock(&vx_info_hash_lock);
14982+ vxi = get_vx_info(__lookup_vx_info(id));
14983+ spin_unlock(&vx_info_hash_lock);
14984+ }
14985+ return vxi;
14986+}
14987+
14988+/* xid_is_hashed()
14989+
14990+ * verify that xid is still hashed */
14991+
14992+int xid_is_hashed(vxid_t xid)
14993+{
14994+ int hashed;
14995+
14996+ spin_lock(&vx_info_hash_lock);
14997+ hashed = (__lookup_vx_info(xid) != NULL);
14998+ spin_unlock(&vx_info_hash_lock);
14999+ return hashed;
15000+}
15001+
15002+#ifdef CONFIG_PROC_FS
15003+
15004+/* get_xid_list()
15005+
15006+ * get a subset of hashed xids for proc
15007+ * assumes size is at least one */
15008+
15009+int get_xid_list(int index, unsigned int *xids, int size)
15010+{
15011+ int hindex, nr_xids = 0;
15012+
15013+ /* only show current and children */
15014+ if (!vx_check(0, VS_ADMIN | VS_WATCH)) {
15015+ if (index > 0)
15016+ return 0;
15017+ xids[nr_xids] = vx_current_xid();
15018+ return 1;
15019+ }
15020+
15021+ for (hindex = 0; hindex < VX_HASH_SIZE; hindex++) {
15022+ struct hlist_head *head = &vx_info_hash[hindex];
15023+ struct hlist_node *pos;
15024+
15025+ spin_lock(&vx_info_hash_lock);
15026+ hlist_for_each(pos, head) {
15027+ struct vx_info *vxi;
15028+
15029+ if (--index > 0)
15030+ continue;
15031+
15032+ vxi = hlist_entry(pos, struct vx_info, vx_hlist);
15033+ xids[nr_xids] = vxi->vx_id;
15034+ if (++nr_xids >= size) {
15035+ spin_unlock(&vx_info_hash_lock);
15036+ goto out;
15037+ }
15038+ }
15039+ /* keep the lock time short */
15040+ spin_unlock(&vx_info_hash_lock);
15041+ }
15042+out:
15043+ return nr_xids;
15044+}
15045+#endif
15046+
15047+#ifdef CONFIG_VSERVER_DEBUG
15048+
15049+void dump_vx_info_inactive(int level)
15050+{
15051+ struct hlist_node *entry, *next;
15052+
15053+ hlist_for_each_safe(entry, next, &vx_info_inactive) {
15054+ struct vx_info *vxi =
15055+ list_entry(entry, struct vx_info, vx_hlist);
15056+
15057+ dump_vx_info(vxi, level);
15058+ }
15059+}
15060+
15061+#endif
15062+
15063+#if 0
15064+int vx_migrate_user(struct task_struct *p, struct vx_info *vxi)
15065+{
15066+ struct user_struct *new_user, *old_user;
15067+
15068+ if (!p || !vxi)
15069+ BUG();
15070+
15071+ if (vx_info_flags(vxi, VXF_INFO_PRIVATE, 0))
15072+ return -EACCES;
15073+
15074+ new_user = alloc_uid(vxi->vx_id, p->uid);
15075+ if (!new_user)
15076+ return -ENOMEM;
15077+
15078+ old_user = p->user;
15079+ if (new_user != old_user) {
15080+ atomic_inc(&new_user->processes);
15081+ atomic_dec(&old_user->processes);
15082+ p->user = new_user;
15083+ }
15084+ free_uid(old_user);
15085+ return 0;
15086+}
15087+#endif
15088+
15089+#if 0
15090+void vx_mask_cap_bset(struct vx_info *vxi, struct task_struct *p)
15091+{
15092+ // p->cap_effective &= vxi->vx_cap_bset;
15093+ p->cap_effective =
15094+ cap_intersect(p->cap_effective, vxi->cap_bset);
15095+ // p->cap_inheritable &= vxi->vx_cap_bset;
15096+ p->cap_inheritable =
15097+ cap_intersect(p->cap_inheritable, vxi->cap_bset);
15098+ // p->cap_permitted &= vxi->vx_cap_bset;
15099+ p->cap_permitted =
15100+ cap_intersect(p->cap_permitted, vxi->cap_bset);
15101+}
15102+#endif
15103+
15104+
15105+#include <linux/file.h>
15106+#include <linux/fdtable.h>
15107+
15108+static int vx_openfd_task(struct task_struct *tsk)
15109+{
15110+ struct files_struct *files = tsk->files;
15111+ struct fdtable *fdt;
15112+ const unsigned long *bptr;
15113+ int count, total;
15114+
15115+ /* no rcu_read_lock() because of spin_lock() */
15116+ spin_lock(&files->file_lock);
15117+ fdt = files_fdtable(files);
15118+ bptr = fdt->open_fds;
15119+ count = fdt->max_fds / (sizeof(unsigned long) * 8);
15120+ for (total = 0; count > 0; count--) {
15121+ if (*bptr)
15122+ total += hweight_long(*bptr);
15123+ bptr++;
15124+ }
15125+ spin_unlock(&files->file_lock);
15126+ return total;
15127+}
15128+
15129+
15130+/* for *space compatibility */
15131+
15132+asmlinkage long sys_unshare(unsigned long);
15133+
15134+/*
15135+ * migrate task to new context
15136+ * gets vxi, puts old_vxi on change
15137+ * optionally unshares namespaces (hack)
15138+ */
15139+
15140+int vx_migrate_task(struct task_struct *p, struct vx_info *vxi, int unshare)
15141+{
15142+ struct vx_info *old_vxi;
15143+ int ret = 0;
15144+
15145+ if (!p || !vxi)
15146+ BUG();
15147+
15148+ vxdprintk(VXD_CBIT(xid, 5),
15149+ "vx_migrate_task(%p,%p[#%d.%d])", p, vxi,
15150+ vxi->vx_id, atomic_read(&vxi->vx_usecnt));
15151+
15152+ if (vx_info_flags(vxi, VXF_INFO_PRIVATE, 0) &&
15153+ !vx_info_flags(vxi, VXF_STATE_SETUP, 0))
15154+ return -EACCES;
15155+
15156+ if (vx_info_state(vxi, VXS_SHUTDOWN))
15157+ return -EFAULT;
15158+
15159+ old_vxi = task_get_vx_info(p);
15160+ if (old_vxi == vxi)
15161+ goto out;
15162+
15163+// if (!(ret = vx_migrate_user(p, vxi))) {
15164+ {
15165+ int openfd;
15166+
15167+ task_lock(p);
15168+ openfd = vx_openfd_task(p);
15169+
15170+ if (old_vxi) {
15171+ atomic_dec(&old_vxi->cvirt.nr_threads);
15172+ atomic_dec(&old_vxi->cvirt.nr_running);
15173+ __rlim_dec(&old_vxi->limit, RLIMIT_NPROC);
15174+ /* FIXME: what about the struct files here? */
15175+ __rlim_sub(&old_vxi->limit, VLIMIT_OPENFD, openfd);
15176+ /* account for the executable */
15177+ __rlim_dec(&old_vxi->limit, VLIMIT_DENTRY);
15178+ }
15179+ atomic_inc(&vxi->cvirt.nr_threads);
15180+ atomic_inc(&vxi->cvirt.nr_running);
15181+ __rlim_inc(&vxi->limit, RLIMIT_NPROC);
15182+ /* FIXME: what about the struct files here? */
15183+ __rlim_add(&vxi->limit, VLIMIT_OPENFD, openfd);
15184+ /* account for the executable */
15185+ __rlim_inc(&vxi->limit, VLIMIT_DENTRY);
15186+
15187+ if (old_vxi) {
15188+ release_vx_info(old_vxi, p);
15189+ clr_vx_info(&p->vx_info);
15190+ }
15191+ claim_vx_info(vxi, p);
15192+ set_vx_info(&p->vx_info, vxi);
15193+ p->xid = vxi->vx_id;
15194+
15195+ vxdprintk(VXD_CBIT(xid, 5),
15196+ "moved task %p into vxi:%p[#%d]",
15197+ p, vxi, vxi->vx_id);
15198+
15199+ // vx_mask_cap_bset(vxi, p);
15200+ task_unlock(p);
15201+
15202+ /* hack for *spaces to provide compatibility */
15203+ if (unshare) {
15204+ struct nsproxy *old_nsp, *new_nsp;
15205+
15206+ ret = unshare_nsproxy_namespaces(
15207+ CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER,
15208+ &new_nsp, NULL, NULL);
15209+ if (ret)
15210+ goto out;
15211+
15212+ old_nsp = xchg(&p->nsproxy, new_nsp);
15213+ vx_set_space(vxi,
15214+ CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER, 0);
15215+ put_nsproxy(old_nsp);
15216+ }
15217+ }
15218+out:
15219+ put_vx_info(old_vxi);
15220+ return ret;
15221+}
15222+
15223+int vx_set_reaper(struct vx_info *vxi, struct task_struct *p)
15224+{
15225+ struct task_struct *old_reaper;
15226+ struct vx_info *reaper_vxi;
15227+
15228+ if (!vxi)
15229+ return -EINVAL;
15230+
15231+ vxdprintk(VXD_CBIT(xid, 6),
15232+ "vx_set_reaper(%p[#%d],%p[#%d,%d])",
15233+ vxi, vxi->vx_id, p, p->xid, p->pid);
15234+
15235+ old_reaper = vxi->vx_reaper;
15236+ if (old_reaper == p)
15237+ return 0;
15238+
15239+ reaper_vxi = task_get_vx_info(p);
15240+ if (reaper_vxi && reaper_vxi != vxi) {
15241+ vxwprintk(1,
15242+ "Unsuitable reaper [" VS_Q("%s") ",%u:#%u] "
15243+ "for [xid #%u]",
15244+ p->comm, p->pid, p->xid, vx_current_xid());
15245+ goto out;
15246+ }
15247+
15248+ /* set new child reaper */
15249+ get_task_struct(p);
15250+ vxi->vx_reaper = p;
15251+ put_task_struct(old_reaper);
15252+out:
15253+ put_vx_info(reaper_vxi);
15254+ return 0;
15255+}
15256+
15257+int vx_set_init(struct vx_info *vxi, struct task_struct *p)
15258+{
15259+ if (!vxi)
15260+ return -EINVAL;
15261+
15262+ vxdprintk(VXD_CBIT(xid, 6),
15263+ "vx_set_init(%p[#%d],%p[#%d,%d,%d])",
15264+ vxi, vxi->vx_id, p, p->xid, p->pid, p->tgid);
15265+
15266+ vxi->vx_flags &= ~VXF_STATE_INIT;
15267+ // vxi->vx_initpid = p->tgid;
15268+ vxi->vx_initpid = p->pid;
15269+ return 0;
15270+}
15271+
15272+void vx_exit_init(struct vx_info *vxi, struct task_struct *p, int code)
15273+{
15274+ vxdprintk(VXD_CBIT(xid, 6),
15275+ "vx_exit_init(%p[#%d],%p[#%d,%d,%d])",
15276+ vxi, vxi->vx_id, p, p->xid, p->pid, p->tgid);
15277+
15278+ vxi->exit_code = code;
15279+ vxi->vx_initpid = 0;
15280+}
15281+
15282+
15283+void vx_set_persistent(struct vx_info *vxi)
15284+{
15285+ vxdprintk(VXD_CBIT(xid, 6),
15286+ "vx_set_persistent(%p[#%d])", vxi, vxi->vx_id);
15287+
15288+ get_vx_info(vxi);
15289+ claim_vx_info(vxi, NULL);
15290+}
15291+
15292+void vx_clear_persistent(struct vx_info *vxi)
15293+{
15294+ vxdprintk(VXD_CBIT(xid, 6),
15295+ "vx_clear_persistent(%p[#%d])", vxi, vxi->vx_id);
15296+
15297+ release_vx_info(vxi, NULL);
15298+ put_vx_info(vxi);
15299+}
15300+
15301+void vx_update_persistent(struct vx_info *vxi)
15302+{
15303+ if (vx_info_flags(vxi, VXF_PERSISTENT, 0))
15304+ vx_set_persistent(vxi);
15305+ else
15306+ vx_clear_persistent(vxi);
15307+}
15308+
15309+
15310+/* task must be current or locked */
15311+
15312+void exit_vx_info(struct task_struct *p, int code)
15313+{
15314+ struct vx_info *vxi = p->vx_info;
15315+
15316+ if (vxi) {
15317+ atomic_dec(&vxi->cvirt.nr_threads);
15318+ vx_nproc_dec(p);
15319+
15320+ vxi->exit_code = code;
15321+ release_vx_info(vxi, p);
15322+ }
15323+}
15324+
15325+void exit_vx_info_early(struct task_struct *p, int code)
15326+{
15327+ struct vx_info *vxi = p->vx_info;
15328+
15329+ if (vxi) {
15330+ if (vxi->vx_initpid == p->pid)
15331+ vx_exit_init(vxi, p, code);
15332+ if (vxi->vx_reaper == p)
15333+ vx_set_reaper(vxi, init_pid_ns.child_reaper);
15334+ }
15335+}
15336+
15337+
15338+/* vserver syscall commands below here */
15339+
15340+/* taks xid and vx_info functions */
15341+
15342+#include <asm/uaccess.h>
15343+
15344+
15345+int vc_task_xid(uint32_t id)
15346+{
15347+ vxid_t xid;
15348+
15349+ if (id) {
15350+ struct task_struct *tsk;
15351+
15352+ rcu_read_lock();
15353+ tsk = find_task_by_real_pid(id);
15354+ xid = (tsk) ? tsk->xid : -ESRCH;
15355+ rcu_read_unlock();
15356+ } else
15357+ xid = vx_current_xid();
15358+ return xid;
15359+}
15360+
15361+
15362+int vc_vx_info(struct vx_info *vxi, void __user *data)
15363+{
15364+ struct vcmd_vx_info_v0 vc_data;
15365+
15366+ vc_data.xid = vxi->vx_id;
15367+ vc_data.initpid = vxi->vx_initpid;
15368+
15369+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15370+ return -EFAULT;
15371+ return 0;
15372+}
15373+
15374+
15375+int vc_ctx_stat(struct vx_info *vxi, void __user *data)
15376+{
15377+ struct vcmd_ctx_stat_v0 vc_data;
15378+
15379+ vc_data.usecnt = atomic_read(&vxi->vx_usecnt);
15380+ vc_data.tasks = atomic_read(&vxi->vx_tasks);
15381+
15382+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15383+ return -EFAULT;
15384+ return 0;
15385+}
15386+
15387+
15388+/* context functions */
15389+
15390+int vc_ctx_create(uint32_t xid, void __user *data)
15391+{
15392+ struct vcmd_ctx_create vc_data = { .flagword = VXF_INIT_SET };
15393+ struct vx_info *new_vxi;
15394+ int ret;
15395+
15396+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
15397+ return -EFAULT;
15398+
15399+ if ((xid > MAX_S_CONTEXT) || (xid < 2))
15400+ return -EINVAL;
15401+
15402+ new_vxi = __create_vx_info(xid);
15403+ if (IS_ERR(new_vxi))
15404+ return PTR_ERR(new_vxi);
15405+
15406+ /* initial flags */
15407+ new_vxi->vx_flags = vc_data.flagword;
15408+
15409+ ret = -ENOEXEC;
15410+ if (vs_state_change(new_vxi, VSC_STARTUP))
15411+ goto out;
15412+
15413+ ret = vx_migrate_task(current, new_vxi, (!data));
15414+ if (ret)
15415+ goto out;
15416+
15417+ /* return context id on success */
15418+ ret = new_vxi->vx_id;
15419+
15420+ /* get a reference for persistent contexts */
15421+ if ((vc_data.flagword & VXF_PERSISTENT))
15422+ vx_set_persistent(new_vxi);
15423+out:
15424+ release_vx_info(new_vxi, NULL);
15425+ put_vx_info(new_vxi);
15426+ return ret;
15427+}
15428+
15429+
15430+int vc_ctx_migrate(struct vx_info *vxi, void __user *data)
15431+{
15432+ struct vcmd_ctx_migrate vc_data = { .flagword = 0 };
15433+ int ret;
15434+
15435+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
15436+ return -EFAULT;
15437+
15438+ ret = vx_migrate_task(current, vxi, 0);
15439+ if (ret)
15440+ return ret;
15441+ if (vc_data.flagword & VXM_SET_INIT)
15442+ ret = vx_set_init(vxi, current);
15443+ if (ret)
15444+ return ret;
15445+ if (vc_data.flagword & VXM_SET_REAPER)
15446+ ret = vx_set_reaper(vxi, current);
15447+ return ret;
15448+}
15449+
15450+
15451+int vc_get_cflags(struct vx_info *vxi, void __user *data)
15452+{
15453+ struct vcmd_ctx_flags_v0 vc_data;
15454+
15455+ vc_data.flagword = vxi->vx_flags;
15456+
15457+ /* special STATE flag handling */
15458+ vc_data.mask = vs_mask_flags(~0ULL, vxi->vx_flags, VXF_ONE_TIME);
15459+
15460+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15461+ return -EFAULT;
15462+ return 0;
15463+}
15464+
15465+int vc_set_cflags(struct vx_info *vxi, void __user *data)
15466+{
15467+ struct vcmd_ctx_flags_v0 vc_data;
15468+ uint64_t mask, trigger;
15469+
15470+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
15471+ return -EFAULT;
15472+
15473+ /* special STATE flag handling */
15474+ mask = vs_mask_mask(vc_data.mask, vxi->vx_flags, VXF_ONE_TIME);
15475+ trigger = (mask & vxi->vx_flags) ^ (mask & vc_data.flagword);
15476+
15477+ if (vxi == current_vx_info()) {
15478+ /* if (trigger & VXF_STATE_SETUP)
15479+ vx_mask_cap_bset(vxi, current); */
15480+ if (trigger & VXF_STATE_INIT) {
15481+ int ret;
15482+
15483+ ret = vx_set_init(vxi, current);
15484+ if (ret)
15485+ return ret;
15486+ ret = vx_set_reaper(vxi, current);
15487+ if (ret)
15488+ return ret;
15489+ }
15490+ }
15491+
15492+ vxi->vx_flags = vs_mask_flags(vxi->vx_flags,
15493+ vc_data.flagword, mask);
15494+ if (trigger & VXF_PERSISTENT)
15495+ vx_update_persistent(vxi);
15496+
15497+ return 0;
15498+}
15499+
15500+
15501+static inline uint64_t caps_from_cap_t(kernel_cap_t c)
15502+{
15503+ uint64_t v = c.cap[0] | ((uint64_t)c.cap[1] << 32);
15504+
15505+ // printk("caps_from_cap_t(%08x:%08x) = %016llx\n", c.cap[1], c.cap[0], v);
15506+ return v;
15507+}
15508+
15509+static inline kernel_cap_t cap_t_from_caps(uint64_t v)
15510+{
15511+ kernel_cap_t c = __cap_empty_set;
15512+
15513+ c.cap[0] = v & 0xFFFFFFFF;
15514+ c.cap[1] = (v >> 32) & 0xFFFFFFFF;
15515+
15516+ // printk("cap_t_from_caps(%016llx) = %08x:%08x\n", v, c.cap[1], c.cap[0]);
15517+ return c;
15518+}
15519+
15520+
15521+static int do_get_caps(struct vx_info *vxi, uint64_t *bcaps, uint64_t *ccaps)
15522+{
15523+ if (bcaps)
15524+ *bcaps = caps_from_cap_t(vxi->vx_bcaps);
15525+ if (ccaps)
15526+ *ccaps = vxi->vx_ccaps;
15527+
15528+ return 0;
15529+}
15530+
15531+int vc_get_ccaps(struct vx_info *vxi, void __user *data)
15532+{
15533+ struct vcmd_ctx_caps_v1 vc_data;
15534+ int ret;
15535+
15536+ ret = do_get_caps(vxi, NULL, &vc_data.ccaps);
15537+ if (ret)
15538+ return ret;
15539+ vc_data.cmask = ~0ULL;
15540+
15541+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15542+ return -EFAULT;
15543+ return 0;
15544+}
15545+
15546+static int do_set_caps(struct vx_info *vxi,
15547+ uint64_t bcaps, uint64_t bmask, uint64_t ccaps, uint64_t cmask)
15548+{
15549+ uint64_t bcold = caps_from_cap_t(vxi->vx_bcaps);
15550+
15551+#if 0
15552+ printk("do_set_caps(%16llx, %16llx, %16llx, %16llx)\n",
15553+ bcaps, bmask, ccaps, cmask);
15554+#endif
15555+ vxi->vx_bcaps = cap_t_from_caps(
15556+ vs_mask_flags(bcold, bcaps, bmask));
15557+ vxi->vx_ccaps = vs_mask_flags(vxi->vx_ccaps, ccaps, cmask);
15558+
15559+ return 0;
15560+}
15561+
15562+int vc_set_ccaps(struct vx_info *vxi, void __user *data)
15563+{
15564+ struct vcmd_ctx_caps_v1 vc_data;
15565+
15566+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
15567+ return -EFAULT;
15568+
15569+ return do_set_caps(vxi, 0, 0, vc_data.ccaps, vc_data.cmask);
15570+}
15571+
15572+int vc_get_bcaps(struct vx_info *vxi, void __user *data)
15573+{
15574+ struct vcmd_bcaps vc_data;
15575+ int ret;
15576+
15577+ ret = do_get_caps(vxi, &vc_data.bcaps, NULL);
15578+ if (ret)
15579+ return ret;
15580+ vc_data.bmask = ~0ULL;
15581+
15582+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15583+ return -EFAULT;
15584+ return 0;
15585+}
15586+
15587+int vc_set_bcaps(struct vx_info *vxi, void __user *data)
15588+{
15589+ struct vcmd_bcaps vc_data;
15590+
15591+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
15592+ return -EFAULT;
15593+
15594+ return do_set_caps(vxi, vc_data.bcaps, vc_data.bmask, 0, 0);
15595+}
15596+
15597+
15598+int vc_get_umask(struct vx_info *vxi, void __user *data)
15599+{
15600+ struct vcmd_umask vc_data;
15601+
15602+ vc_data.umask = vxi->vx_umask;
15603+ vc_data.mask = ~0ULL;
15604+
15605+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15606+ return -EFAULT;
15607+ return 0;
15608+}
15609+
15610+int vc_set_umask(struct vx_info *vxi, void __user *data)
15611+{
15612+ struct vcmd_umask vc_data;
15613+
15614+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
15615+ return -EFAULT;
15616+
15617+ vxi->vx_umask = vs_mask_flags(vxi->vx_umask,
15618+ vc_data.umask, vc_data.mask);
15619+ return 0;
15620+}
15621+
15622+
15623+int vc_get_wmask(struct vx_info *vxi, void __user *data)
15624+{
15625+ struct vcmd_wmask vc_data;
15626+
15627+ vc_data.wmask = vxi->vx_wmask;
15628+ vc_data.mask = ~0ULL;
15629+
15630+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15631+ return -EFAULT;
15632+ return 0;
15633+}
15634+
15635+int vc_set_wmask(struct vx_info *vxi, void __user *data)
15636+{
15637+ struct vcmd_wmask vc_data;
15638+
15639+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
15640+ return -EFAULT;
15641+
15642+ vxi->vx_wmask = vs_mask_flags(vxi->vx_wmask,
15643+ vc_data.wmask, vc_data.mask);
15644+ return 0;
15645+}
15646+
15647+
15648+int vc_get_badness(struct vx_info *vxi, void __user *data)
15649+{
15650+ struct vcmd_badness_v0 vc_data;
15651+
15652+ vc_data.bias = vxi->vx_badness_bias;
15653+
15654+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15655+ return -EFAULT;
15656+ return 0;
15657+}
15658+
15659+int vc_set_badness(struct vx_info *vxi, void __user *data)
15660+{
15661+ struct vcmd_badness_v0 vc_data;
15662+
15663+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
15664+ return -EFAULT;
15665+
15666+ vxi->vx_badness_bias = vc_data.bias;
15667+ return 0;
15668+}
15669+
15670+#include <linux/module.h>
15671+
15672+EXPORT_SYMBOL_GPL(free_vx_info);
15673+
15674diff -NurpP --minimal linux-4.4.116/kernel/vserver/cvirt.c linux-4.4.116-vs2.3.9.7/kernel/vserver/cvirt.c
15675--- linux-4.4.116/kernel/vserver/cvirt.c 1970-01-01 00:00:00.000000000 +0000
15676+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/cvirt.c 2018-01-09 22:27:39.000000000 +0000
15677@@ -0,0 +1,313 @@
15678+/*
15679+ * linux/kernel/vserver/cvirt.c
15680+ *
15681+ * Virtual Server: Context Virtualization
15682+ *
15683+ * Copyright (C) 2004-2007 Herbert P?tzl
15684+ *
15685+ * V0.01 broken out from limit.c
15686+ * V0.02 added utsname stuff
15687+ * V0.03 changed vcmds to vxi arg
15688+ *
15689+ */
15690+
15691+#include <linux/types.h>
15692+#include <linux/utsname.h>
15693+#include <linux/vs_cvirt.h>
15694+#include <linux/vserver/switch.h>
15695+#include <linux/vserver/cvirt_cmd.h>
15696+
15697+#include <asm/uaccess.h>
15698+
15699+
15700+void vx_vsi_boottime(struct timespec *boottime)
15701+{
15702+ struct vx_info *vxi = current_vx_info();
15703+
15704+ set_normalized_timespec(boottime,
15705+ boottime->tv_sec + vxi->cvirt.bias_uptime.tv_sec,
15706+ boottime->tv_nsec + vxi->cvirt.bias_uptime.tv_nsec);
15707+ return;
15708+}
15709+
15710+void vx_vsi_uptime(struct timespec *uptime, struct timespec *idle)
15711+{
15712+ struct vx_info *vxi = current_vx_info();
15713+
15714+ set_normalized_timespec(uptime,
15715+ uptime->tv_sec - vxi->cvirt.bias_uptime.tv_sec,
15716+ uptime->tv_nsec - vxi->cvirt.bias_uptime.tv_nsec);
15717+ if (!idle)
15718+ return;
15719+ set_normalized_timespec(idle,
15720+ idle->tv_sec - vxi->cvirt.bias_idle.tv_sec,
15721+ idle->tv_nsec - vxi->cvirt.bias_idle.tv_nsec);
15722+ return;
15723+}
15724+
15725+uint64_t vx_idle_jiffies(void)
15726+{
15727+ return init_task.utime + init_task.stime;
15728+}
15729+
15730+
15731+
15732+static inline uint32_t __update_loadavg(uint32_t load,
15733+ int wsize, int delta, int n)
15734+{
15735+ unsigned long long calc, prev;
15736+
15737+ /* just set it to n */
15738+ if (unlikely(delta >= wsize))
15739+ return (n << FSHIFT);
15740+
15741+ calc = delta * n;
15742+ calc <<= FSHIFT;
15743+ prev = (wsize - delta);
15744+ prev *= load;
15745+ calc += prev;
15746+ do_div(calc, wsize);
15747+ return calc;
15748+}
15749+
15750+
15751+void vx_update_load(struct vx_info *vxi)
15752+{
15753+ uint32_t now, last, delta;
15754+ unsigned int nr_running, nr_uninterruptible;
15755+ unsigned int total;
15756+ unsigned long flags;
15757+
15758+ spin_lock_irqsave(&vxi->cvirt.load_lock, flags);
15759+
15760+ now = jiffies;
15761+ last = vxi->cvirt.load_last;
15762+ delta = now - last;
15763+
15764+ if (delta < 5*HZ)
15765+ goto out;
15766+
15767+ nr_running = atomic_read(&vxi->cvirt.nr_running);
15768+ nr_uninterruptible = atomic_read(&vxi->cvirt.nr_uninterruptible);
15769+ total = nr_running + nr_uninterruptible;
15770+
15771+ vxi->cvirt.load[0] = __update_loadavg(vxi->cvirt.load[0],
15772+ 60*HZ, delta, total);
15773+ vxi->cvirt.load[1] = __update_loadavg(vxi->cvirt.load[1],
15774+ 5*60*HZ, delta, total);
15775+ vxi->cvirt.load[2] = __update_loadavg(vxi->cvirt.load[2],
15776+ 15*60*HZ, delta, total);
15777+
15778+ vxi->cvirt.load_last = now;
15779+out:
15780+ atomic_inc(&vxi->cvirt.load_updates);
15781+ spin_unlock_irqrestore(&vxi->cvirt.load_lock, flags);
15782+}
15783+
15784+
15785+/*
15786+ * Commands to do_syslog:
15787+ *
15788+ * 0 -- Close the log. Currently a NOP.
15789+ * 1 -- Open the log. Currently a NOP.
15790+ * 2 -- Read from the log.
15791+ * 3 -- Read all messages remaining in the ring buffer.
15792+ * 4 -- Read and clear all messages remaining in the ring buffer
15793+ * 5 -- Clear ring buffer.
15794+ * 6 -- Disable printk's to console
15795+ * 7 -- Enable printk's to console
15796+ * 8 -- Set level of messages printed to console
15797+ * 9 -- Return number of unread characters in the log buffer
15798+ * 10 -- Return size of the log buffer
15799+ */
15800+int vx_do_syslog(int type, char __user *buf, int len)
15801+{
15802+ int error = 0;
15803+ int do_clear = 0;
15804+ struct vx_info *vxi = current_vx_info();
15805+ struct _vx_syslog *log;
15806+
15807+ if (!vxi)
15808+ return -EINVAL;
15809+ log = &vxi->cvirt.syslog;
15810+
15811+ switch (type) {
15812+ case 0: /* Close log */
15813+ case 1: /* Open log */
15814+ break;
15815+ case 2: /* Read from log */
15816+ error = wait_event_interruptible(log->log_wait,
15817+ (log->log_start - log->log_end));
15818+ if (error)
15819+ break;
15820+ spin_lock_irq(&log->logbuf_lock);
15821+ spin_unlock_irq(&log->logbuf_lock);
15822+ break;
15823+ case 4: /* Read/clear last kernel messages */
15824+ do_clear = 1;
15825+ /* fall through */
15826+ case 3: /* Read last kernel messages */
15827+ return 0;
15828+
15829+ case 5: /* Clear ring buffer */
15830+ return 0;
15831+
15832+ case 6: /* Disable logging to console */
15833+ case 7: /* Enable logging to console */
15834+ case 8: /* Set level of messages printed to console */
15835+ break;
15836+
15837+ case 9: /* Number of chars in the log buffer */
15838+ return 0;
15839+ case 10: /* Size of the log buffer */
15840+ return 0;
15841+ default:
15842+ error = -EINVAL;
15843+ break;
15844+ }
15845+ return error;
15846+}
15847+
15848+
15849+/* virtual host info names */
15850+
15851+static char *vx_vhi_name(struct vx_info *vxi, int id)
15852+{
15853+ struct nsproxy *nsproxy;
15854+ struct uts_namespace *uts;
15855+
15856+ if (id == VHIN_CONTEXT)
15857+ return vxi->vx_name;
15858+
15859+ nsproxy = vxi->space[0].vx_nsproxy;
15860+ if (!nsproxy)
15861+ return NULL;
15862+
15863+ uts = nsproxy->uts_ns;
15864+ if (!uts)
15865+ return NULL;
15866+
15867+ switch (id) {
15868+ case VHIN_SYSNAME:
15869+ return uts->name.sysname;
15870+ case VHIN_NODENAME:
15871+ return uts->name.nodename;
15872+ case VHIN_RELEASE:
15873+ return uts->name.release;
15874+ case VHIN_VERSION:
15875+ return uts->name.version;
15876+ case VHIN_MACHINE:
15877+ return uts->name.machine;
15878+ case VHIN_DOMAINNAME:
15879+ return uts->name.domainname;
15880+ default:
15881+ return NULL;
15882+ }
15883+ return NULL;
15884+}
15885+
15886+int vc_set_vhi_name(struct vx_info *vxi, void __user *data)
15887+{
15888+ struct vcmd_vhi_name_v0 vc_data;
15889+ char *name;
15890+
15891+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
15892+ return -EFAULT;
15893+
15894+ name = vx_vhi_name(vxi, vc_data.field);
15895+ if (!name)
15896+ return -EINVAL;
15897+
15898+ memcpy(name, vc_data.name, 65);
15899+ return 0;
15900+}
15901+
15902+int vc_get_vhi_name(struct vx_info *vxi, void __user *data)
15903+{
15904+ struct vcmd_vhi_name_v0 vc_data;
15905+ char *name;
15906+
15907+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
15908+ return -EFAULT;
15909+
15910+ name = vx_vhi_name(vxi, vc_data.field);
15911+ if (!name)
15912+ return -EINVAL;
15913+
15914+ memcpy(vc_data.name, name, 65);
15915+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15916+ return -EFAULT;
15917+ return 0;
15918+}
15919+
15920+
15921+int vc_virt_stat(struct vx_info *vxi, void __user *data)
15922+{
15923+ struct vcmd_virt_stat_v0 vc_data;
15924+ struct _vx_cvirt *cvirt = &vxi->cvirt;
15925+ struct timespec uptime;
15926+
15927+ ktime_get_ts(&uptime);
15928+ set_normalized_timespec(&uptime,
15929+ uptime.tv_sec - cvirt->bias_uptime.tv_sec,
15930+ uptime.tv_nsec - cvirt->bias_uptime.tv_nsec);
15931+
15932+ vc_data.offset = timespec_to_ns(&cvirt->bias_ts);
15933+ vc_data.uptime = timespec_to_ns(&uptime);
15934+ vc_data.nr_threads = atomic_read(&cvirt->nr_threads);
15935+ vc_data.nr_running = atomic_read(&cvirt->nr_running);
15936+ vc_data.nr_uninterruptible = atomic_read(&cvirt->nr_uninterruptible);
15937+ vc_data.nr_onhold = atomic_read(&cvirt->nr_onhold);
15938+ vc_data.nr_forks = atomic_read(&cvirt->total_forks);
15939+ vc_data.load[0] = cvirt->load[0];
15940+ vc_data.load[1] = cvirt->load[1];
15941+ vc_data.load[2] = cvirt->load[2];
15942+
15943+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
15944+ return -EFAULT;
15945+ return 0;
15946+}
15947+
15948+
15949+#ifdef CONFIG_VSERVER_VTIME
15950+
15951+/* virtualized time base */
15952+
15953+void vx_adjust_timespec(struct timespec *ts)
15954+{
15955+ struct vx_info *vxi;
15956+
15957+ if (!vx_flags(VXF_VIRT_TIME, 0))
15958+ return;
15959+
15960+ vxi = current_vx_info();
15961+ ts->tv_sec += vxi->cvirt.bias_ts.tv_sec;
15962+ ts->tv_nsec += vxi->cvirt.bias_ts.tv_nsec;
15963+
15964+ if (ts->tv_nsec >= NSEC_PER_SEC) {
15965+ ts->tv_sec++;
15966+ ts->tv_nsec -= NSEC_PER_SEC;
15967+ } else if (ts->tv_nsec < 0) {
15968+ ts->tv_sec--;
15969+ ts->tv_nsec += NSEC_PER_SEC;
15970+ }
15971+}
15972+
15973+int vx_settimeofday(const struct timespec *ts)
15974+{
15975+ struct timespec ats, delta;
15976+ struct vx_info *vxi;
15977+
15978+ if (!vx_flags(VXF_VIRT_TIME, 0))
15979+ return do_settimeofday(ts);
15980+
15981+ getnstimeofday(&ats);
15982+ delta = timespec_sub(*ts, ats);
15983+
15984+ vxi = current_vx_info();
15985+ vxi->cvirt.bias_ts = timespec_add(vxi->cvirt.bias_ts, delta);
15986+ return 0;
15987+}
15988+
15989+#endif
15990+
15991diff -NurpP --minimal linux-4.4.116/kernel/vserver/cvirt_init.h linux-4.4.116-vs2.3.9.7/kernel/vserver/cvirt_init.h
15992--- linux-4.4.116/kernel/vserver/cvirt_init.h 1970-01-01 00:00:00.000000000 +0000
15993+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/cvirt_init.h 2018-01-09 22:16:00.000000000 +0000
15994@@ -0,0 +1,70 @@
15995+
15996+
15997+extern uint64_t vx_idle_jiffies(void);
15998+
15999+static inline void vx_info_init_cvirt(struct _vx_cvirt *cvirt)
16000+{
16001+ uint64_t idle_jiffies = vx_idle_jiffies();
16002+ uint64_t nsuptime;
16003+
16004+ ktime_get_ts(&cvirt->bias_uptime);
16005+ nsuptime = (unsigned long long)cvirt->bias_uptime.tv_sec
16006+ * NSEC_PER_SEC + cvirt->bias_uptime.tv_nsec;
16007+ cvirt->bias_clock = nsec_to_clock_t(nsuptime);
16008+ cvirt->bias_ts.tv_sec = 0;
16009+ cvirt->bias_ts.tv_nsec = 0;
16010+
16011+ jiffies_to_timespec(idle_jiffies, &cvirt->bias_idle);
16012+ atomic_set(&cvirt->nr_threads, 0);
16013+ atomic_set(&cvirt->nr_running, 0);
16014+ atomic_set(&cvirt->nr_uninterruptible, 0);
16015+ atomic_set(&cvirt->nr_onhold, 0);
16016+
16017+ spin_lock_init(&cvirt->load_lock);
16018+ cvirt->load_last = jiffies;
16019+ atomic_set(&cvirt->load_updates, 0);
16020+ cvirt->load[0] = 0;
16021+ cvirt->load[1] = 0;
16022+ cvirt->load[2] = 0;
16023+ atomic_set(&cvirt->total_forks, 0);
16024+
16025+ spin_lock_init(&cvirt->syslog.logbuf_lock);
16026+ init_waitqueue_head(&cvirt->syslog.log_wait);
16027+ cvirt->syslog.log_start = 0;
16028+ cvirt->syslog.log_end = 0;
16029+ cvirt->syslog.con_start = 0;
16030+ cvirt->syslog.logged_chars = 0;
16031+}
16032+
16033+static inline
16034+void vx_info_init_cvirt_pc(struct _vx_cvirt_pc *cvirt_pc, int cpu)
16035+{
16036+ // cvirt_pc->cpustat = { 0 };
16037+}
16038+
16039+static inline void vx_info_exit_cvirt(struct _vx_cvirt *cvirt)
16040+{
16041+#ifdef CONFIG_VSERVER_WARN
16042+ int value;
16043+#endif
16044+ vxwprintk_xid((value = atomic_read(&cvirt->nr_threads)),
16045+ "!!! cvirt: %p[nr_threads] = %d on exit.",
16046+ cvirt, value);
16047+ vxwprintk_xid((value = atomic_read(&cvirt->nr_running)),
16048+ "!!! cvirt: %p[nr_running] = %d on exit.",
16049+ cvirt, value);
16050+ vxwprintk_xid((value = atomic_read(&cvirt->nr_uninterruptible)),
16051+ "!!! cvirt: %p[nr_uninterruptible] = %d on exit.",
16052+ cvirt, value);
16053+ vxwprintk_xid((value = atomic_read(&cvirt->nr_onhold)),
16054+ "!!! cvirt: %p[nr_onhold] = %d on exit.",
16055+ cvirt, value);
16056+ return;
16057+}
16058+
16059+static inline
16060+void vx_info_exit_cvirt_pc(struct _vx_cvirt_pc *cvirt_pc, int cpu)
16061+{
16062+ return;
16063+}
16064+
16065diff -NurpP --minimal linux-4.4.116/kernel/vserver/cvirt_proc.h linux-4.4.116-vs2.3.9.7/kernel/vserver/cvirt_proc.h
16066--- linux-4.4.116/kernel/vserver/cvirt_proc.h 1970-01-01 00:00:00.000000000 +0000
16067+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/cvirt_proc.h 2018-01-09 16:36:34.000000000 +0000
16068@@ -0,0 +1,123 @@
16069+#ifndef _VX_CVIRT_PROC_H
16070+#define _VX_CVIRT_PROC_H
16071+
16072+#include <linux/nsproxy.h>
16073+#include <linux/mnt_namespace.h>
16074+#include <linux/ipc_namespace.h>
16075+#include <linux/utsname.h>
16076+#include <linux/ipc.h>
16077+
16078+extern int vx_info_mnt_namespace(struct mnt_namespace *, char *);
16079+
16080+static inline
16081+int vx_info_proc_nsproxy(struct nsproxy *nsproxy, char *buffer)
16082+{
16083+ struct mnt_namespace *ns;
16084+ struct uts_namespace *uts;
16085+ struct ipc_namespace *ipc;
16086+ int length = 0;
16087+
16088+ if (!nsproxy)
16089+ goto out;
16090+
16091+ length += sprintf(buffer + length,
16092+ "NSProxy:\t%p [%p,%p,%p]\n",
16093+ nsproxy, nsproxy->mnt_ns,
16094+ nsproxy->uts_ns, nsproxy->ipc_ns);
16095+
16096+ ns = nsproxy->mnt_ns;
16097+ if (!ns)
16098+ goto skip_ns;
16099+
16100+ length += vx_info_mnt_namespace(ns, buffer + length);
16101+
16102+skip_ns:
16103+
16104+ uts = nsproxy->uts_ns;
16105+ if (!uts)
16106+ goto skip_uts;
16107+
16108+ length += sprintf(buffer + length,
16109+ "SysName:\t%.*s\n"
16110+ "NodeName:\t%.*s\n"
16111+ "Release:\t%.*s\n"
16112+ "Version:\t%.*s\n"
16113+ "Machine:\t%.*s\n"
16114+ "DomainName:\t%.*s\n",
16115+ __NEW_UTS_LEN, uts->name.sysname,
16116+ __NEW_UTS_LEN, uts->name.nodename,
16117+ __NEW_UTS_LEN, uts->name.release,
16118+ __NEW_UTS_LEN, uts->name.version,
16119+ __NEW_UTS_LEN, uts->name.machine,
16120+ __NEW_UTS_LEN, uts->name.domainname);
16121+skip_uts:
16122+
16123+ ipc = nsproxy->ipc_ns;
16124+ if (!ipc)
16125+ goto skip_ipc;
16126+
16127+ length += sprintf(buffer + length,
16128+ "SEMS:\t\t%d %d %d %d %d\n"
16129+ "MSG:\t\t%d %d %d\n"
16130+ "SHM:\t\t%lu %lu %d %ld\n",
16131+ ipc->sem_ctls[0], ipc->sem_ctls[1],
16132+ ipc->sem_ctls[2], ipc->sem_ctls[3],
16133+ ipc->used_sems,
16134+ ipc->msg_ctlmax, ipc->msg_ctlmnb, ipc->msg_ctlmni,
16135+ (unsigned long)ipc->shm_ctlmax,
16136+ (unsigned long)ipc->shm_ctlall,
16137+ ipc->shm_ctlmni, ipc->shm_tot);
16138+skip_ipc:
16139+out:
16140+ return length;
16141+}
16142+
16143+
16144+#include <linux/sched.h>
16145+
16146+#define LOAD_INT(x) ((x) >> FSHIFT)
16147+#define LOAD_FRAC(x) LOAD_INT(((x) & (FIXED_1 - 1)) * 100)
16148+
16149+static inline
16150+int vx_info_proc_cvirt(struct _vx_cvirt *cvirt, char *buffer)
16151+{
16152+ int length = 0;
16153+ int a, b, c;
16154+
16155+ length += sprintf(buffer + length,
16156+ "BiasUptime:\t%lu.%02lu\n",
16157+ (unsigned long)cvirt->bias_uptime.tv_sec,
16158+ (cvirt->bias_uptime.tv_nsec / (NSEC_PER_SEC / 100)));
16159+
16160+ a = cvirt->load[0] + (FIXED_1 / 200);
16161+ b = cvirt->load[1] + (FIXED_1 / 200);
16162+ c = cvirt->load[2] + (FIXED_1 / 200);
16163+ length += sprintf(buffer + length,
16164+ "nr_threads:\t%d\n"
16165+ "nr_running:\t%d\n"
16166+ "nr_unintr:\t%d\n"
16167+ "nr_onhold:\t%d\n"
16168+ "load_updates:\t%d\n"
16169+ "loadavg:\t%d.%02d %d.%02d %d.%02d\n"
16170+ "total_forks:\t%d\n",
16171+ atomic_read(&cvirt->nr_threads),
16172+ atomic_read(&cvirt->nr_running),
16173+ atomic_read(&cvirt->nr_uninterruptible),
16174+ atomic_read(&cvirt->nr_onhold),
16175+ atomic_read(&cvirt->load_updates),
16176+ LOAD_INT(a), LOAD_FRAC(a),
16177+ LOAD_INT(b), LOAD_FRAC(b),
16178+ LOAD_INT(c), LOAD_FRAC(c),
16179+ atomic_read(&cvirt->total_forks));
16180+ return length;
16181+}
16182+
16183+static inline
16184+int vx_info_proc_cvirt_pc(struct _vx_cvirt_pc *cvirt_pc,
16185+ char *buffer, int cpu)
16186+{
16187+ int length = 0;
16188+ return length;
16189+}
16190+
16191+#endif /* _VX_CVIRT_PROC_H */
16192diff -NurpP --minimal linux-4.4.116/kernel/vserver/debug.c linux-4.4.116-vs2.3.9.7/kernel/vserver/debug.c
16193--- linux-4.4.116/kernel/vserver/debug.c 1970-01-01 00:00:00.000000000 +0000
16194+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/debug.c 2018-01-09 16:36:34.000000000 +0000
16195@@ -0,0 +1,32 @@
16196+/*
16197+ * kernel/vserver/debug.c
16198+ *
16199+ * Copyright (C) 2005-2007 Herbert P?tzl
16200+ *
16201+ * V0.01 vx_info dump support
16202+ *
16203+ */
16204+
16205+#include <linux/module.h>
16206+
16207+#include <linux/vserver/context.h>
16208+
16209+
16210+void dump_vx_info(struct vx_info *vxi, int level)
16211+{
16212+ printk("vx_info %p[#%d, %d.%d, %4x]\n", vxi, vxi->vx_id,
16213+ atomic_read(&vxi->vx_usecnt),
16214+ atomic_read(&vxi->vx_tasks),
16215+ vxi->vx_state);
16216+ if (level > 0) {
16217+ __dump_vx_limit(&vxi->limit);
16218+ __dump_vx_sched(&vxi->sched);
16219+ __dump_vx_cvirt(&vxi->cvirt);
16220+ __dump_vx_cacct(&vxi->cacct);
16221+ }
16222+ printk("---\n");
16223+}
16224+
16225+
16226+EXPORT_SYMBOL_GPL(dump_vx_info);
16227+
16228diff -NurpP --minimal linux-4.4.116/kernel/vserver/device.c linux-4.4.116-vs2.3.9.7/kernel/vserver/device.c
16229--- linux-4.4.116/kernel/vserver/device.c 1970-01-01 00:00:00.000000000 +0000
16230+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/device.c 2018-01-09 16:36:34.000000000 +0000
16231@@ -0,0 +1,443 @@
16232+/*
16233+ * linux/kernel/vserver/device.c
16234+ *
16235+ * Linux-VServer: Device Support
16236+ *
16237+ * Copyright (C) 2006 Herbert P?tzl
16238+ * Copyright (C) 2007 Daniel Hokka Zakrisson
16239+ *
16240+ * V0.01 device mapping basics
16241+ * V0.02 added defaults
16242+ *
16243+ */
16244+
16245+#include <linux/slab.h>
16246+#include <linux/rcupdate.h>
16247+#include <linux/fs.h>
16248+#include <linux/namei.h>
16249+#include <linux/hash.h>
16250+
16251+#include <asm/errno.h>
16252+#include <asm/uaccess.h>
16253+#include <linux/vserver/base.h>
16254+#include <linux/vserver/debug.h>
16255+#include <linux/vserver/context.h>
16256+#include <linux/vserver/device.h>
16257+#include <linux/vserver/device_cmd.h>
16258+
16259+
16260+#define DMAP_HASH_BITS 4
16261+
16262+
16263+struct vs_mapping {
16264+ union {
16265+ struct hlist_node hlist;
16266+ struct list_head list;
16267+ } u;
16268+#define dm_hlist u.hlist
16269+#define dm_list u.list
16270+ vxid_t xid;
16271+ dev_t device;
16272+ struct vx_dmap_target target;
16273+};
16274+
16275+
16276+static struct hlist_head dmap_main_hash[1 << DMAP_HASH_BITS];
16277+
16278+static DEFINE_SPINLOCK(dmap_main_hash_lock);
16279+
16280+static struct vx_dmap_target dmap_defaults[2] = {
16281+ { .flags = DATTR_OPEN },
16282+ { .flags = DATTR_OPEN },
16283+};
16284+
16285+
16286+struct kmem_cache *dmap_cachep __read_mostly;
16287+
16288+int __init dmap_cache_init(void)
16289+{
16290+ dmap_cachep = kmem_cache_create("dmap_cache",
16291+ sizeof(struct vs_mapping), 0,
16292+ SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
16293+ return 0;
16294+}
16295+
16296+__initcall(dmap_cache_init);
16297+
16298+
16299+static inline unsigned int __hashval(dev_t dev, int bits)
16300+{
16301+ return hash_long((unsigned long)dev, bits);
16302+}
16303+
16304+
16305+/* __hash_mapping()
16306+ * add the mapping to the hash table
16307+ */
16308+static inline void __hash_mapping(struct vx_info *vxi, struct vs_mapping *vdm)
16309+{
16310+ spinlock_t *hash_lock = &dmap_main_hash_lock;
16311+ struct hlist_head *head, *hash = dmap_main_hash;
16312+ int device = vdm->device;
16313+
16314+ spin_lock(hash_lock);
16315+ vxdprintk(VXD_CBIT(misc, 8), "__hash_mapping: %p[#%d] %08x:%08x",
16316+ vxi, vxi ? vxi->vx_id : 0, device, vdm->target.target);
16317+
16318+ head = &hash[__hashval(device, DMAP_HASH_BITS)];
16319+ hlist_add_head(&vdm->dm_hlist, head);
16320+ spin_unlock(hash_lock);
16321+}
16322+
16323+
16324+static inline int __mode_to_default(umode_t mode)
16325+{
16326+ switch (mode) {
16327+ case S_IFBLK:
16328+ return 0;
16329+ case S_IFCHR:
16330+ return 1;
16331+ default:
16332+ BUG();
16333+ }
16334+}
16335+
16336+
16337+/* __set_default()
16338+ * set a default
16339+ */
16340+static inline void __set_default(struct vx_info *vxi, umode_t mode,
16341+ struct vx_dmap_target *vdmt)
16342+{
16343+ spinlock_t *hash_lock = &dmap_main_hash_lock;
16344+ spin_lock(hash_lock);
16345+
16346+ if (vxi)
16347+ vxi->dmap.targets[__mode_to_default(mode)] = *vdmt;
16348+ else
16349+ dmap_defaults[__mode_to_default(mode)] = *vdmt;
16350+
16351+
16352+ spin_unlock(hash_lock);
16353+
16354+ vxdprintk(VXD_CBIT(misc, 8), "__set_default: %p[#%u] %08x %04x",
16355+ vxi, vxi ? vxi->vx_id : 0, vdmt->target, vdmt->flags);
16356+}
16357+
16358+
16359+/* __remove_default()
16360+ * remove a default
16361+ */
16362+static inline int __remove_default(struct vx_info *vxi, umode_t mode)
16363+{
16364+ spinlock_t *hash_lock = &dmap_main_hash_lock;
16365+ spin_lock(hash_lock);
16366+
16367+ if (vxi)
16368+ vxi->dmap.targets[__mode_to_default(mode)].flags = 0;
16369+ else /* remove == reset */
16370+ dmap_defaults[__mode_to_default(mode)].flags = DATTR_OPEN | mode;
16371+
16372+ spin_unlock(hash_lock);
16373+ return 0;
16374+}
16375+
16376+
16377+/* __find_mapping()
16378+ * find a mapping in the hash table
16379+ *
16380+ * caller must hold hash_lock
16381+ */
16382+static inline int __find_mapping(vxid_t xid, dev_t device, umode_t mode,
16383+ struct vs_mapping **local, struct vs_mapping **global)
16384+{
16385+ struct hlist_head *hash = dmap_main_hash;
16386+ struct hlist_head *head = &hash[__hashval(device, DMAP_HASH_BITS)];
16387+ struct hlist_node *pos;
16388+ struct vs_mapping *vdm;
16389+
16390+ *local = NULL;
16391+ if (global)
16392+ *global = NULL;
16393+
16394+ hlist_for_each(pos, head) {
16395+ vdm = hlist_entry(pos, struct vs_mapping, dm_hlist);
16396+
16397+ if ((vdm->device == device) &&
16398+ !((vdm->target.flags ^ mode) & S_IFMT)) {
16399+ if (vdm->xid == xid) {
16400+ *local = vdm;
16401+ return 1;
16402+ } else if (global && vdm->xid == 0)
16403+ *global = vdm;
16404+ }
16405+ }
16406+
16407+ if (global && *global)
16408+ return 0;
16409+ else
16410+ return -ENOENT;
16411+}
16412+
16413+
16414+/* __lookup_mapping()
16415+ * find a mapping and store the result in target and flags
16416+ */
16417+static inline int __lookup_mapping(struct vx_info *vxi,
16418+ dev_t device, dev_t *target, int *flags, umode_t mode)
16419+{
16420+ spinlock_t *hash_lock = &dmap_main_hash_lock;
16421+ struct vs_mapping *vdm, *global;
16422+ struct vx_dmap_target *vdmt;
16423+ int ret = 0;
16424+ vxid_t xid = vxi->vx_id;
16425+ int index;
16426+
16427+ spin_lock(hash_lock);
16428+ if (__find_mapping(xid, device, mode, &vdm, &global) > 0) {
16429+ ret = 1;
16430+ vdmt = &vdm->target;
16431+ goto found;
16432+ }
16433+
16434+ index = __mode_to_default(mode);
16435+ if (vxi && vxi->dmap.targets[index].flags) {
16436+ ret = 2;
16437+ vdmt = &vxi->dmap.targets[index];
16438+ } else if (global) {
16439+ ret = 3;
16440+ vdmt = &global->target;
16441+ goto found;
16442+ } else {
16443+ ret = 4;
16444+ vdmt = &dmap_defaults[index];
16445+ }
16446+
16447+found:
16448+ if (target && (vdmt->flags & DATTR_REMAP))
16449+ *target = vdmt->target;
16450+ else if (target)
16451+ *target = device;
16452+ if (flags)
16453+ *flags = vdmt->flags;
16454+
16455+ spin_unlock(hash_lock);
16456+
16457+ return ret;
16458+}
16459+
16460+
16461+/* __remove_mapping()
16462+ * remove a mapping from the hash table
16463+ */
16464+static inline int __remove_mapping(struct vx_info *vxi, dev_t device,
16465+ umode_t mode)
16466+{
16467+ spinlock_t *hash_lock = &dmap_main_hash_lock;
16468+ struct vs_mapping *vdm = NULL;
16469+ int ret = 0;
16470+
16471+ spin_lock(hash_lock);
16472+
16473+ ret = __find_mapping((vxi ? vxi->vx_id : 0), device, mode, &vdm,
16474+ NULL);
16475+ vxdprintk(VXD_CBIT(misc, 8), "__remove_mapping: %p[#%d] %08x %04x",
16476+ vxi, vxi ? vxi->vx_id : 0, device, mode);
16477+ if (ret < 0)
16478+ goto out;
16479+ hlist_del(&vdm->dm_hlist);
16480+
16481+out:
16482+ spin_unlock(hash_lock);
16483+ if (vdm)
16484+ kmem_cache_free(dmap_cachep, vdm);
16485+ return ret;
16486+}
16487+
16488+
16489+
16490+int vs_map_device(struct vx_info *vxi,
16491+ dev_t device, dev_t *target, umode_t mode)
16492+{
16493+ int ret, flags = DATTR_MASK;
16494+
16495+ if (!vxi) {
16496+ if (target)
16497+ *target = device;
16498+ goto out;
16499+ }
16500+ ret = __lookup_mapping(vxi, device, target, &flags, mode);
16501+ vxdprintk(VXD_CBIT(misc, 8), "vs_map_device: %08x target: %08x flags: %04x mode: %04x mapped=%d",
16502+ device, target ? *target : 0, flags, mode, ret);
16503+out:
16504+ return (flags & DATTR_MASK);
16505+}
16506+
16507+
16508+
16509+static int do_set_mapping(struct vx_info *vxi,
16510+ dev_t device, dev_t target, int flags, umode_t mode)
16511+{
16512+ if (device) {
16513+ struct vs_mapping *new;
16514+
16515+ new = kmem_cache_alloc(dmap_cachep, GFP_KERNEL);
16516+ if (!new)
16517+ return -ENOMEM;
16518+
16519+ INIT_HLIST_NODE(&new->dm_hlist);
16520+ new->device = device;
16521+ new->target.target = target;
16522+ new->target.flags = flags | mode;
16523+ new->xid = (vxi ? vxi->vx_id : 0);
16524+
16525+ vxdprintk(VXD_CBIT(misc, 8), "do_set_mapping: %08x target: %08x flags: %04x", device, target, flags);
16526+ __hash_mapping(vxi, new);
16527+ } else {
16528+ struct vx_dmap_target new = {
16529+ .target = target,
16530+ .flags = flags | mode,
16531+ };
16532+ __set_default(vxi, mode, &new);
16533+ }
16534+ return 0;
16535+}
16536+
16537+
16538+static int do_unset_mapping(struct vx_info *vxi,
16539+ dev_t device, dev_t target, int flags, umode_t mode)
16540+{
16541+ int ret = -EINVAL;
16542+
16543+ if (device) {
16544+ ret = __remove_mapping(vxi, device, mode);
16545+ if (ret < 0)
16546+ goto out;
16547+ } else {
16548+ ret = __remove_default(vxi, mode);
16549+ if (ret < 0)
16550+ goto out;
16551+ }
16552+
16553+out:
16554+ return ret;
16555+}
16556+
16557+
16558+static inline int __user_device(const char __user *name, dev_t *dev,
16559+ umode_t *mode)
16560+{
16561+ struct path path;
16562+ int ret;
16563+
16564+ if (!name) {
16565+ *dev = 0;
16566+ return 0;
16567+ }
16568+ ret = user_lpath(name, &path);
16569+ if (ret)
16570+ return ret;
16571+ if (path.dentry->d_inode) {
16572+ *dev = path.dentry->d_inode->i_rdev;
16573+ *mode = path.dentry->d_inode->i_mode;
16574+ }
16575+ path_put(&path);
16576+ return 0;
16577+}
16578+
16579+static inline int __mapping_mode(dev_t device, dev_t target,
16580+ umode_t device_mode, umode_t target_mode, umode_t *mode)
16581+{
16582+ if (device)
16583+ *mode = device_mode & S_IFMT;
16584+ else if (target)
16585+ *mode = target_mode & S_IFMT;
16586+ else
16587+ return -EINVAL;
16588+
16589+ /* if both given, device and target mode have to match */
16590+ if (device && target &&
16591+ ((device_mode ^ target_mode) & S_IFMT))
16592+ return -EINVAL;
16593+ return 0;
16594+}
16595+
16596+
16597+static inline int do_mapping(struct vx_info *vxi, const char __user *device_path,
16598+ const char __user *target_path, int flags, int set)
16599+{
16600+ dev_t device = ~0, target = ~0;
16601+ umode_t device_mode = 0, target_mode = 0, mode;
16602+ int ret;
16603+
16604+ ret = __user_device(device_path, &device, &device_mode);
16605+ if (ret)
16606+ return ret;
16607+ ret = __user_device(target_path, &target, &target_mode);
16608+ if (ret)
16609+ return ret;
16610+
16611+ ret = __mapping_mode(device, target,
16612+ device_mode, target_mode, &mode);
16613+ if (ret)
16614+ return ret;
16615+
16616+ if (set)
16617+ return do_set_mapping(vxi, device, target,
16618+ flags, mode);
16619+ else
16620+ return do_unset_mapping(vxi, device, target,
16621+ flags, mode);
16622+}
16623+
16624+
16625+int vc_set_mapping(struct vx_info *vxi, void __user *data)
16626+{
16627+ struct vcmd_set_mapping_v0 vc_data;
16628+
16629+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
16630+ return -EFAULT;
16631+
16632+ return do_mapping(vxi, vc_data.device, vc_data.target,
16633+ vc_data.flags, 1);
16634+}
16635+
16636+int vc_unset_mapping(struct vx_info *vxi, void __user *data)
16637+{
16638+ struct vcmd_set_mapping_v0 vc_data;
16639+
16640+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
16641+ return -EFAULT;
16642+
16643+ return do_mapping(vxi, vc_data.device, vc_data.target,
16644+ vc_data.flags, 0);
16645+}
16646+
16647+
16648+#ifdef CONFIG_COMPAT
16649+
16650+int vc_set_mapping_x32(struct vx_info *vxi, void __user *data)
16651+{
16652+ struct vcmd_set_mapping_v0_x32 vc_data;
16653+
16654+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
16655+ return -EFAULT;
16656+
16657+ return do_mapping(vxi, compat_ptr(vc_data.device_ptr),
16658+ compat_ptr(vc_data.target_ptr), vc_data.flags, 1);
16659+}
16660+
16661+int vc_unset_mapping_x32(struct vx_info *vxi, void __user *data)
16662+{
16663+ struct vcmd_set_mapping_v0_x32 vc_data;
16664+
16665+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
16666+ return -EFAULT;
16667+
16668+ return do_mapping(vxi, compat_ptr(vc_data.device_ptr),
16669+ compat_ptr(vc_data.target_ptr), vc_data.flags, 0);
16670+}
16671+
16672+#endif /* CONFIG_COMPAT */
16673+
16674+
16675diff -NurpP --minimal linux-4.4.116/kernel/vserver/dlimit.c linux-4.4.116-vs2.3.9.7/kernel/vserver/dlimit.c
16676--- linux-4.4.116/kernel/vserver/dlimit.c 1970-01-01 00:00:00.000000000 +0000
16677+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/dlimit.c 2018-01-09 16:36:34.000000000 +0000
16678@@ -0,0 +1,528 @@
16679+/*
16680+ * linux/kernel/vserver/dlimit.c
16681+ *
16682+ * Virtual Server: Context Disk Limits
16683+ *
16684+ * Copyright (C) 2004-2009 Herbert P?tzl
16685+ *
16686+ * V0.01 initial version
16687+ * V0.02 compat32 splitup
16688+ * V0.03 extended interface
16689+ *
16690+ */
16691+
16692+#include <linux/statfs.h>
16693+#include <linux/sched.h>
16694+#include <linux/namei.h>
16695+#include <linux/vs_tag.h>
16696+#include <linux/vs_dlimit.h>
16697+#include <linux/vserver/dlimit_cmd.h>
16698+#include <linux/slab.h>
16699+// #include <linux/gfp.h>
16700+
16701+#include <asm/uaccess.h>
16702+
16703+/* __alloc_dl_info()
16704+
16705+ * allocate an initialized dl_info struct
16706+ * doesn't make it visible (hash) */
16707+
16708+static struct dl_info *__alloc_dl_info(struct super_block *sb, vtag_t tag)
16709+{
16710+ struct dl_info *new = NULL;
16711+
16712+ vxdprintk(VXD_CBIT(dlim, 5),
16713+ "alloc_dl_info(%p,%d)*", sb, tag);
16714+
16715+ /* would this benefit from a slab cache? */
16716+ new = kmalloc(sizeof(struct dl_info), GFP_KERNEL);
16717+ if (!new)
16718+ return 0;
16719+
16720+ memset(new, 0, sizeof(struct dl_info));
16721+ new->dl_tag = tag;
16722+ new->dl_sb = sb;
16723+ // INIT_RCU_HEAD(&new->dl_rcu);
16724+ INIT_HLIST_NODE(&new->dl_hlist);
16725+ spin_lock_init(&new->dl_lock);
16726+ atomic_set(&new->dl_refcnt, 0);
16727+ atomic_set(&new->dl_usecnt, 0);
16728+
16729+ /* rest of init goes here */
16730+
16731+ vxdprintk(VXD_CBIT(dlim, 4),
16732+ "alloc_dl_info(%p,%d) = %p", sb, tag, new);
16733+ return new;
16734+}
16735+
16736+/* __dealloc_dl_info()
16737+
16738+ * final disposal of dl_info */
16739+
16740+static void __dealloc_dl_info(struct dl_info *dli)
16741+{
16742+ vxdprintk(VXD_CBIT(dlim, 4),
16743+ "dealloc_dl_info(%p)", dli);
16744+
16745+ dli->dl_hlist.next = LIST_POISON1;
16746+ dli->dl_tag = -1;
16747+ dli->dl_sb = 0;
16748+
16749+ BUG_ON(atomic_read(&dli->dl_usecnt));
16750+ BUG_ON(atomic_read(&dli->dl_refcnt));
16751+
16752+ kfree(dli);
16753+}
16754+
16755+
16756+/* hash table for dl_info hash */
16757+
16758+#define DL_HASH_SIZE 13
16759+
16760+struct hlist_head dl_info_hash[DL_HASH_SIZE];
16761+
16762+static DEFINE_SPINLOCK(dl_info_hash_lock);
16763+
16764+
16765+static inline unsigned int __hashval(struct super_block *sb, vtag_t tag)
16766+{
16767+ return ((tag ^ (unsigned long)sb) % DL_HASH_SIZE);
16768+}
16769+
16770+
16771+
16772+/* __hash_dl_info()
16773+
16774+ * add the dli to the global hash table
16775+ * requires the hash_lock to be held */
16776+
16777+static inline void __hash_dl_info(struct dl_info *dli)
16778+{
16779+ struct hlist_head *head;
16780+
16781+ vxdprintk(VXD_CBIT(dlim, 6),
16782+ "__hash_dl_info: %p[#%d]", dli, dli->dl_tag);
16783+ get_dl_info(dli);
16784+ head = &dl_info_hash[__hashval(dli->dl_sb, dli->dl_tag)];
16785+ hlist_add_head_rcu(&dli->dl_hlist, head);
16786+}
16787+
16788+/* __unhash_dl_info()
16789+
16790+ * remove the dli from the global hash table
16791+ * requires the hash_lock to be held */
16792+
16793+static inline void __unhash_dl_info(struct dl_info *dli)
16794+{
16795+ vxdprintk(VXD_CBIT(dlim, 6),
16796+ "__unhash_dl_info: %p[#%d]", dli, dli->dl_tag);
16797+ hlist_del_rcu(&dli->dl_hlist);
16798+ put_dl_info(dli);
16799+}
16800+
16801+
16802+/* __lookup_dl_info()
16803+
16804+ * requires the rcu_read_lock()
16805+ * doesn't increment the dl_refcnt */
16806+
16807+static inline struct dl_info *__lookup_dl_info(struct super_block *sb, vtag_t tag)
16808+{
16809+ struct hlist_head *head = &dl_info_hash[__hashval(sb, tag)];
16810+ struct dl_info *dli;
16811+
16812+ hlist_for_each_entry_rcu(dli, head, dl_hlist) {
16813+ if (dli->dl_tag == tag && dli->dl_sb == sb)
16814+ return dli;
16815+ }
16816+ return NULL;
16817+}
16818+
16819+
16820+struct dl_info *locate_dl_info(struct super_block *sb, vtag_t tag)
16821+{
16822+ struct dl_info *dli;
16823+
16824+ rcu_read_lock();
16825+ dli = get_dl_info(__lookup_dl_info(sb, tag));
16826+ vxdprintk(VXD_CBIT(dlim, 7),
16827+ "locate_dl_info(%p,#%d) = %p", sb, tag, dli);
16828+ rcu_read_unlock();
16829+ return dli;
16830+}
16831+
16832+void rcu_free_dl_info(struct rcu_head *head)
16833+{
16834+ struct dl_info *dli = container_of(head, struct dl_info, dl_rcu);
16835+ int usecnt, refcnt;
16836+
16837+ BUG_ON(!dli || !head);
16838+
16839+ usecnt = atomic_read(&dli->dl_usecnt);
16840+ BUG_ON(usecnt < 0);
16841+
16842+ refcnt = atomic_read(&dli->dl_refcnt);
16843+ BUG_ON(refcnt < 0);
16844+
16845+ vxdprintk(VXD_CBIT(dlim, 3),
16846+ "rcu_free_dl_info(%p)", dli);
16847+ if (!usecnt)
16848+ __dealloc_dl_info(dli);
16849+ else
16850+ printk("!!! rcu didn't free\n");
16851+}
16852+
16853+
16854+
16855+
16856+static int do_addrem_dlimit(uint32_t id, const char __user *name,
16857+ uint32_t flags, int add)
16858+{
16859+ struct path path;
16860+ int ret;
16861+
16862+ ret = user_lpath(name, &path);
16863+ if (!ret) {
16864+ struct super_block *sb;
16865+ struct dl_info *dli;
16866+
16867+ ret = -EINVAL;
16868+ if (!path.dentry->d_inode)
16869+ goto out_release;
16870+ if (!(sb = path.dentry->d_inode->i_sb))
16871+ goto out_release;
16872+
16873+ if (add) {
16874+ dli = __alloc_dl_info(sb, id);
16875+ spin_lock(&dl_info_hash_lock);
16876+
16877+ ret = -EEXIST;
16878+ if (__lookup_dl_info(sb, id))
16879+ goto out_unlock;
16880+ __hash_dl_info(dli);
16881+ dli = NULL;
16882+ } else {
16883+ spin_lock(&dl_info_hash_lock);
16884+ dli = __lookup_dl_info(sb, id);
16885+
16886+ ret = -ESRCH;
16887+ if (!dli)
16888+ goto out_unlock;
16889+ __unhash_dl_info(dli);
16890+ }
16891+ ret = 0;
16892+ out_unlock:
16893+ spin_unlock(&dl_info_hash_lock);
16894+ if (add && dli)
16895+ __dealloc_dl_info(dli);
16896+ out_release:
16897+ path_put(&path);
16898+ }
16899+ return ret;
16900+}
16901+
16902+int vc_add_dlimit(uint32_t id, void __user *data)
16903+{
16904+ struct vcmd_ctx_dlimit_base_v0 vc_data;
16905+
16906+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
16907+ return -EFAULT;
16908+
16909+ return do_addrem_dlimit(id, vc_data.name, vc_data.flags, 1);
16910+}
16911+
16912+int vc_rem_dlimit(uint32_t id, void __user *data)
16913+{
16914+ struct vcmd_ctx_dlimit_base_v0 vc_data;
16915+
16916+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
16917+ return -EFAULT;
16918+
16919+ return do_addrem_dlimit(id, vc_data.name, vc_data.flags, 0);
16920+}
16921+
16922+#ifdef CONFIG_COMPAT
16923+
16924+int vc_add_dlimit_x32(uint32_t id, void __user *data)
16925+{
16926+ struct vcmd_ctx_dlimit_base_v0_x32 vc_data;
16927+
16928+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
16929+ return -EFAULT;
16930+
16931+ return do_addrem_dlimit(id,
16932+ compat_ptr(vc_data.name_ptr), vc_data.flags, 1);
16933+}
16934+
16935+int vc_rem_dlimit_x32(uint32_t id, void __user *data)
16936+{
16937+ struct vcmd_ctx_dlimit_base_v0_x32 vc_data;
16938+
16939+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
16940+ return -EFAULT;
16941+
16942+ return do_addrem_dlimit(id,
16943+ compat_ptr(vc_data.name_ptr), vc_data.flags, 0);
16944+}
16945+
16946+#endif /* CONFIG_COMPAT */
16947+
16948+
16949+static inline
16950+int do_set_dlimit(uint32_t id, const char __user *name,
16951+ uint32_t space_used, uint32_t space_total,
16952+ uint32_t inodes_used, uint32_t inodes_total,
16953+ uint32_t reserved, uint32_t flags)
16954+{
16955+ struct path path;
16956+ int ret;
16957+
16958+ ret = user_lpath(name, &path);
16959+ if (!ret) {
16960+ struct super_block *sb;
16961+ struct dl_info *dli;
16962+
16963+ ret = -EINVAL;
16964+ if (!path.dentry->d_inode)
16965+ goto out_release;
16966+ if (!(sb = path.dentry->d_inode->i_sb))
16967+ goto out_release;
16968+
16969+ /* sanity checks */
16970+ if ((reserved != CDLIM_KEEP &&
16971+ reserved > 100) ||
16972+ (inodes_used != CDLIM_KEEP &&
16973+ inodes_used > inodes_total) ||
16974+ (space_used != CDLIM_KEEP &&
16975+ space_used > space_total))
16976+ goto out_release;
16977+
16978+ ret = -ESRCH;
16979+ dli = locate_dl_info(sb, id);
16980+ if (!dli)
16981+ goto out_release;
16982+
16983+ spin_lock(&dli->dl_lock);
16984+
16985+ if (inodes_used != CDLIM_KEEP)
16986+ dli->dl_inodes_used = inodes_used;
16987+ if (inodes_total != CDLIM_KEEP)
16988+ dli->dl_inodes_total = inodes_total;
16989+ if (space_used != CDLIM_KEEP)
16990+ dli->dl_space_used = dlimit_space_32to64(
16991+ space_used, flags, DLIMS_USED);
16992+
16993+ if (space_total == CDLIM_INFINITY)
16994+ dli->dl_space_total = DLIM_INFINITY;
16995+ else if (space_total != CDLIM_KEEP)
16996+ dli->dl_space_total = dlimit_space_32to64(
16997+ space_total, flags, DLIMS_TOTAL);
16998+
16999+ if (reserved != CDLIM_KEEP)
17000+ dli->dl_nrlmult = (1 << 10) * (100 - reserved) / 100;
17001+
17002+ spin_unlock(&dli->dl_lock);
17003+
17004+ put_dl_info(dli);
17005+ ret = 0;
17006+
17007+ out_release:
17008+ path_put(&path);
17009+ }
17010+ return ret;
17011+}
17012+
17013+int vc_set_dlimit(uint32_t id, void __user *data)
17014+{
17015+ struct vcmd_ctx_dlimit_v0 vc_data;
17016+
17017+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
17018+ return -EFAULT;
17019+
17020+ return do_set_dlimit(id, vc_data.name,
17021+ vc_data.space_used, vc_data.space_total,
17022+ vc_data.inodes_used, vc_data.inodes_total,
17023+ vc_data.reserved, vc_data.flags);
17024+}
17025+
17026+#ifdef CONFIG_COMPAT
17027+
17028+int vc_set_dlimit_x32(uint32_t id, void __user *data)
17029+{
17030+ struct vcmd_ctx_dlimit_v0_x32 vc_data;
17031+
17032+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
17033+ return -EFAULT;
17034+
17035+ return do_set_dlimit(id, compat_ptr(vc_data.name_ptr),
17036+ vc_data.space_used, vc_data.space_total,
17037+ vc_data.inodes_used, vc_data.inodes_total,
17038+ vc_data.reserved, vc_data.flags);
17039+}
17040+
17041+#endif /* CONFIG_COMPAT */
17042+
17043+
17044+static inline
17045+int do_get_dlimit(uint32_t id, const char __user *name,
17046+ uint32_t *space_used, uint32_t *space_total,
17047+ uint32_t *inodes_used, uint32_t *inodes_total,
17048+ uint32_t *reserved, uint32_t *flags)
17049+{
17050+ struct path path;
17051+ int ret;
17052+
17053+ ret = user_lpath(name, &path);
17054+ if (!ret) {
17055+ struct super_block *sb;
17056+ struct dl_info *dli;
17057+
17058+ ret = -EINVAL;
17059+ if (!path.dentry->d_inode)
17060+ goto out_release;
17061+ if (!(sb = path.dentry->d_inode->i_sb))
17062+ goto out_release;
17063+
17064+ ret = -ESRCH;
17065+ dli = locate_dl_info(sb, id);
17066+ if (!dli)
17067+ goto out_release;
17068+
17069+ spin_lock(&dli->dl_lock);
17070+ *inodes_used = dli->dl_inodes_used;
17071+ *inodes_total = dli->dl_inodes_total;
17072+
17073+ *space_used = dlimit_space_64to32(
17074+ dli->dl_space_used, flags, DLIMS_USED);
17075+
17076+ if (dli->dl_space_total == DLIM_INFINITY)
17077+ *space_total = CDLIM_INFINITY;
17078+ else
17079+ *space_total = dlimit_space_64to32(
17080+ dli->dl_space_total, flags, DLIMS_TOTAL);
17081+
17082+ *reserved = 100 - ((dli->dl_nrlmult * 100 + 512) >> 10);
17083+ spin_unlock(&dli->dl_lock);
17084+
17085+ put_dl_info(dli);
17086+ ret = -EFAULT;
17087+
17088+ ret = 0;
17089+ out_release:
17090+ path_put(&path);
17091+ }
17092+ return ret;
17093+}
17094+
17095+
17096+int vc_get_dlimit(uint32_t id, void __user *data)
17097+{
17098+ struct vcmd_ctx_dlimit_v0 vc_data;
17099+ int ret;
17100+
17101+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
17102+ return -EFAULT;
17103+
17104+ ret = do_get_dlimit(id, vc_data.name,
17105+ &vc_data.space_used, &vc_data.space_total,
17106+ &vc_data.inodes_used, &vc_data.inodes_total,
17107+ &vc_data.reserved, &vc_data.flags);
17108+ if (ret)
17109+ return ret;
17110+
17111+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
17112+ return -EFAULT;
17113+ return 0;
17114+}
17115+
17116+#ifdef CONFIG_COMPAT
17117+
17118+int vc_get_dlimit_x32(uint32_t id, void __user *data)
17119+{
17120+ struct vcmd_ctx_dlimit_v0_x32 vc_data;
17121+ int ret;
17122+
17123+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
17124+ return -EFAULT;
17125+
17126+ ret = do_get_dlimit(id, compat_ptr(vc_data.name_ptr),
17127+ &vc_data.space_used, &vc_data.space_total,
17128+ &vc_data.inodes_used, &vc_data.inodes_total,
17129+ &vc_data.reserved, &vc_data.flags);
17130+ if (ret)
17131+ return ret;
17132+
17133+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
17134+ return -EFAULT;
17135+ return 0;
17136+}
17137+
17138+#endif /* CONFIG_COMPAT */
17139+
17140+
17141+void vx_vsi_statfs(struct super_block *sb, struct kstatfs *buf)
17142+{
17143+ struct dl_info *dli;
17144+ __u64 blimit, bfree, bavail;
17145+ __u32 ifree;
17146+
17147+ dli = locate_dl_info(sb, dx_current_tag());
17148+ if (!dli)
17149+ return;
17150+
17151+ spin_lock(&dli->dl_lock);
17152+ if (dli->dl_inodes_total == (unsigned long)DLIM_INFINITY)
17153+ goto no_ilim;
17154+
17155+ /* reduce max inodes available to limit */
17156+ if (buf->f_files > dli->dl_inodes_total)
17157+ buf->f_files = dli->dl_inodes_total;
17158+
17159+ ifree = dli->dl_inodes_total - dli->dl_inodes_used;
17160+ /* reduce free inodes to min */
17161+ if (ifree < buf->f_ffree)
17162+ buf->f_ffree = ifree;
17163+
17164+no_ilim:
17165+ if (dli->dl_space_total == DLIM_INFINITY)
17166+ goto no_blim;
17167+
17168+ blimit = dli->dl_space_total >> sb->s_blocksize_bits;
17169+
17170+ if (dli->dl_space_total < dli->dl_space_used)
17171+ bfree = 0;
17172+ else
17173+ bfree = (dli->dl_space_total - dli->dl_space_used)
17174+ >> sb->s_blocksize_bits;
17175+
17176+ bavail = ((dli->dl_space_total >> 10) * dli->dl_nrlmult);
17177+ if (bavail < dli->dl_space_used)
17178+ bavail = 0;
17179+ else
17180+ bavail = (bavail - dli->dl_space_used)
17181+ >> sb->s_blocksize_bits;
17182+
17183+ /* reduce max space available to limit */
17184+ if (buf->f_blocks > blimit)
17185+ buf->f_blocks = blimit;
17186+
17187+ /* reduce free space to min */
17188+ if (bfree < buf->f_bfree)
17189+ buf->f_bfree = bfree;
17190+
17191+ /* reduce avail space to min */
17192+ if (bavail < buf->f_bavail)
17193+ buf->f_bavail = bavail;
17194+
17195+no_blim:
17196+ spin_unlock(&dli->dl_lock);
17197+ put_dl_info(dli);
17198+
17199+ return;
17200+}
17201+
17202+#include <linux/module.h>
17203+
17204+EXPORT_SYMBOL_GPL(locate_dl_info);
17205+EXPORT_SYMBOL_GPL(rcu_free_dl_info);
17206+
17207diff -NurpP --minimal linux-4.4.116/kernel/vserver/helper.c linux-4.4.116-vs2.3.9.7/kernel/vserver/helper.c
17208--- linux-4.4.116/kernel/vserver/helper.c 1970-01-01 00:00:00.000000000 +0000
17209+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/helper.c 2018-01-09 16:36:34.000000000 +0000
17210@@ -0,0 +1,242 @@
17211+/*
17212+ * linux/kernel/vserver/helper.c
17213+ *
17214+ * Virtual Context Support
17215+ *
17216+ * Copyright (C) 2004-2007 Herbert P?tzl
17217+ *
17218+ * V0.01 basic helper
17219+ *
17220+ */
17221+
17222+#include <linux/kmod.h>
17223+#include <linux/reboot.h>
17224+#include <linux/vs_context.h>
17225+#include <linux/vs_network.h>
17226+#include <linux/vserver/signal.h>
17227+
17228+
17229+char vshelper_path[255] = "/sbin/vshelper";
17230+
17231+static int vshelper_init(struct subprocess_info *info, struct cred *new_cred)
17232+{
17233+ current->flags &= ~PF_NO_SETAFFINITY;
17234+ return 0;
17235+}
17236+
17237+static int vs_call_usermodehelper(char *path, char **argv, char **envp, int wait)
17238+{
17239+ struct subprocess_info *info;
17240+ gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;
17241+
17242+ info = call_usermodehelper_setup(path, argv, envp, gfp_mask,
17243+ vshelper_init, NULL, NULL);
17244+ if (info == NULL)
17245+ return -ENOMEM;
17246+
17247+ return call_usermodehelper_exec(info, wait);
17248+}
17249+
17250+static int do_vshelper(char *name, char *argv[], char *envp[], int sync)
17251+{
17252+ int ret;
17253+
17254+ if ((ret = vs_call_usermodehelper(name, argv, envp,
17255+ sync ? UMH_WAIT_PROC : UMH_WAIT_EXEC))) {
17256+ printk(KERN_WARNING "%s: (%s %s) returned %s with %d\n",
17257+ name, argv[1], argv[2],
17258+ sync ? "sync" : "async", ret);
17259+ }
17260+ vxdprintk(VXD_CBIT(switch, 4),
17261+ "%s: (%s %s) returned %s with %d",
17262+ name, argv[1], argv[2], sync ? "sync" : "async", ret);
17263+ return ret;
17264+}
17265+
17266+/*
17267+ * vshelper path is set via /proc/sys
17268+ * invoked by vserver sys_reboot(), with
17269+ * the following arguments
17270+ *
17271+ * argv [0] = vshelper_path;
17272+ * argv [1] = action: "restart", "halt", "poweroff", ...
17273+ * argv [2] = context identifier
17274+ *
17275+ * envp [*] = type-specific parameters
17276+ */
17277+
17278+long vs_reboot_helper(struct vx_info *vxi, int cmd, void __user *arg)
17279+{
17280+ char id_buf[8], cmd_buf[16];
17281+ char uid_buf[16], pid_buf[16];
17282+ int ret;
17283+
17284+ char *argv[] = {vshelper_path, NULL, id_buf, 0};
17285+ char *envp[] = {"HOME=/", "TERM=linux",
17286+ "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
17287+ uid_buf, pid_buf, cmd_buf, 0};
17288+
17289+ if (vx_info_state(vxi, VXS_HELPER))
17290+ return -EAGAIN;
17291+ vxi->vx_state |= VXS_HELPER;
17292+
17293+ snprintf(id_buf, sizeof(id_buf), "%d", vxi->vx_id);
17294+
17295+ snprintf(cmd_buf, sizeof(cmd_buf), "VS_CMD=%08x", cmd);
17296+ snprintf(uid_buf, sizeof(uid_buf), "VS_UID=%d",
17297+ from_kuid(&init_user_ns, current_uid()));
17298+ snprintf(pid_buf, sizeof(pid_buf), "VS_PID=%d", current->pid);
17299+
17300+ switch (cmd) {
17301+ case LINUX_REBOOT_CMD_RESTART:
17302+ argv[1] = "restart";
17303+ break;
17304+
17305+ case LINUX_REBOOT_CMD_HALT:
17306+ argv[1] = "halt";
17307+ break;
17308+
17309+ case LINUX_REBOOT_CMD_POWER_OFF:
17310+ argv[1] = "poweroff";
17311+ break;
17312+
17313+ case LINUX_REBOOT_CMD_SW_SUSPEND:
17314+ argv[1] = "swsusp";
17315+ break;
17316+
17317+ case LINUX_REBOOT_CMD_OOM:
17318+ argv[1] = "oom";
17319+ break;
17320+
17321+ default:
17322+ vxi->vx_state &= ~VXS_HELPER;
17323+ return 0;
17324+ }
17325+
17326+ ret = do_vshelper(vshelper_path, argv, envp, 0);
17327+ vxi->vx_state &= ~VXS_HELPER;
17328+ __wakeup_vx_info(vxi);
17329+ return (ret) ? -EPERM : 0;
17330+}
17331+
17332+
17333+long vs_reboot(unsigned int cmd, void __user *arg)
17334+{
17335+ struct vx_info *vxi = current_vx_info();
17336+ long ret = 0;
17337+
17338+ vxdprintk(VXD_CBIT(misc, 5),
17339+ "vs_reboot(%p[#%d],%u)",
17340+ vxi, vxi ? vxi->vx_id : 0, cmd);
17341+
17342+ ret = vs_reboot_helper(vxi, cmd, arg);
17343+ if (ret)
17344+ return ret;
17345+
17346+ vxi->reboot_cmd = cmd;
17347+ if (vx_info_flags(vxi, VXF_REBOOT_KILL, 0)) {
17348+ switch (cmd) {
17349+ case LINUX_REBOOT_CMD_RESTART:
17350+ case LINUX_REBOOT_CMD_HALT:
17351+ case LINUX_REBOOT_CMD_POWER_OFF:
17352+ vx_info_kill(vxi, 0, SIGKILL);
17353+ vx_info_kill(vxi, 1, SIGKILL);
17354+ default:
17355+ break;
17356+ }
17357+ }
17358+ return 0;
17359+}
17360+
17361+long vs_oom_action(unsigned int cmd)
17362+{
17363+ struct vx_info *vxi = current_vx_info();
17364+ long ret = 0;
17365+
17366+ vxdprintk(VXD_CBIT(misc, 5),
17367+ "vs_oom_action(%p[#%d],%u)",
17368+ vxi, vxi ? vxi->vx_id : 0, cmd);
17369+
17370+ ret = vs_reboot_helper(vxi, cmd, NULL);
17371+ if (ret)
17372+ return ret;
17373+
17374+ vxi->reboot_cmd = cmd;
17375+ if (vx_info_flags(vxi, VXF_REBOOT_KILL, 0)) {
17376+ vx_info_kill(vxi, 0, SIGKILL);
17377+ vx_info_kill(vxi, 1, SIGKILL);
17378+ }
17379+ return 0;
17380+}
17381+
17382+/*
17383+ * argv [0] = vshelper_path;
17384+ * argv [1] = action: "startup", "shutdown"
17385+ * argv [2] = context identifier
17386+ *
17387+ * envp [*] = type-specific parameters
17388+ */
17389+
17390+long vs_state_change(struct vx_info *vxi, unsigned int cmd)
17391+{
17392+ char id_buf[8], cmd_buf[16];
17393+ char *argv[] = {vshelper_path, NULL, id_buf, 0};
17394+ char *envp[] = {"HOME=/", "TERM=linux",
17395+ "PATH=/sbin:/usr/sbin:/bin:/usr/bin", cmd_buf, 0};
17396+
17397+ if (!vx_info_flags(vxi, VXF_SC_HELPER, 0))
17398+ return 0;
17399+
17400+ snprintf(id_buf, sizeof(id_buf), "%d", vxi->vx_id);
17401+ snprintf(cmd_buf, sizeof(cmd_buf), "VS_CMD=%08x", cmd);
17402+
17403+ switch (cmd) {
17404+ case VSC_STARTUP:
17405+ argv[1] = "startup";
17406+ break;
17407+ case VSC_SHUTDOWN:
17408+ argv[1] = "shutdown";
17409+ break;
17410+ default:
17411+ return 0;
17412+ }
17413+
17414+ return do_vshelper(vshelper_path, argv, envp, 1);
17415+}
17416+
17417+
17418+/*
17419+ * argv [0] = vshelper_path;
17420+ * argv [1] = action: "netup", "netdown"
17421+ * argv [2] = context identifier
17422+ *
17423+ * envp [*] = type-specific parameters
17424+ */
17425+
17426+long vs_net_change(struct nx_info *nxi, unsigned int cmd)
17427+{
17428+ char id_buf[8], cmd_buf[16];
17429+ char *argv[] = {vshelper_path, NULL, id_buf, 0};
17430+ char *envp[] = {"HOME=/", "TERM=linux",
17431+ "PATH=/sbin:/usr/sbin:/bin:/usr/bin", cmd_buf, 0};
17432+
17433+ if (!nx_info_flags(nxi, NXF_SC_HELPER, 0))
17434+ return 0;
17435+
17436+ snprintf(id_buf, sizeof(id_buf), "%d", nxi->nx_id);
17437+ snprintf(cmd_buf, sizeof(cmd_buf), "VS_CMD=%08x", cmd);
17438+
17439+ switch (cmd) {
17440+ case VSC_NETUP:
17441+ argv[1] = "netup";
17442+ break;
17443+ case VSC_NETDOWN:
17444+ argv[1] = "netdown";
17445+ break;
17446+ default:
17447+ return 0;
17448+ }
17449+
17450+ return do_vshelper(vshelper_path, argv, envp, 1);
17451+}
17452+
17453diff -NurpP --minimal linux-4.4.116/kernel/vserver/history.c linux-4.4.116-vs2.3.9.7/kernel/vserver/history.c
17454--- linux-4.4.116/kernel/vserver/history.c 1970-01-01 00:00:00.000000000 +0000
17455+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/history.c 2018-01-09 16:36:34.000000000 +0000
17456@@ -0,0 +1,258 @@
17457+/*
17458+ * kernel/vserver/history.c
17459+ *
17460+ * Virtual Context History Backtrace
17461+ *
17462+ * Copyright (C) 2004-2007 Herbert P?tzl
17463+ *
17464+ * V0.01 basic structure
17465+ * V0.02 hash/unhash and trace
17466+ * V0.03 preemption fixes
17467+ *
17468+ */
17469+
17470+#include <linux/module.h>
17471+#include <asm/uaccess.h>
17472+
17473+#include <linux/vserver/context.h>
17474+#include <linux/vserver/debug.h>
17475+#include <linux/vserver/debug_cmd.h>
17476+#include <linux/vserver/history.h>
17477+
17478+
17479+#ifdef CONFIG_VSERVER_HISTORY
17480+#define VXH_SIZE CONFIG_VSERVER_HISTORY_SIZE
17481+#else
17482+#define VXH_SIZE 64
17483+#endif
17484+
17485+struct _vx_history {
17486+ unsigned int counter;
17487+
17488+ struct _vx_hist_entry entry[VXH_SIZE + 1];
17489+};
17490+
17491+
17492+DEFINE_PER_CPU(struct _vx_history, vx_history_buffer);
17493+
17494+unsigned volatile int vxh_active = 1;
17495+
17496+static atomic_t sequence = ATOMIC_INIT(0);
17497+
17498+
17499+/* vxh_advance()
17500+
17501+ * requires disabled preemption */
17502+
17503+struct _vx_hist_entry *vxh_advance(void *loc)
17504+{
17505+ unsigned int cpu = smp_processor_id();
17506+ struct _vx_history *hist = &per_cpu(vx_history_buffer, cpu);
17507+ struct _vx_hist_entry *entry;
17508+ unsigned int index;
17509+
17510+ index = vxh_active ? (hist->counter++ % VXH_SIZE) : VXH_SIZE;
17511+ entry = &hist->entry[index];
17512+
17513+ entry->seq = atomic_inc_return(&sequence);
17514+ entry->loc = loc;
17515+ return entry;
17516+}
17517+
17518+EXPORT_SYMBOL_GPL(vxh_advance);
17519+
17520+
17521+#define VXH_LOC_FMTS "(#%04x,*%d):%p"
17522+
17523+#define VXH_LOC_ARGS(e) (e)->seq, cpu, (e)->loc
17524+
17525+
17526+#define VXH_VXI_FMTS "%p[#%d,%d.%d]"
17527+
17528+#define VXH_VXI_ARGS(e) (e)->vxi.ptr, \
17529+ (e)->vxi.ptr ? (e)->vxi.xid : 0, \
17530+ (e)->vxi.ptr ? (e)->vxi.usecnt : 0, \
17531+ (e)->vxi.ptr ? (e)->vxi.tasks : 0
17532+
17533+void vxh_dump_entry(struct _vx_hist_entry *e, unsigned cpu)
17534+{
17535+ switch (e->type) {
17536+ case VXH_THROW_OOPS:
17537+ printk( VXH_LOC_FMTS " oops \n", VXH_LOC_ARGS(e));
17538+ break;
17539+
17540+ case VXH_GET_VX_INFO:
17541+ case VXH_PUT_VX_INFO:
17542+ printk( VXH_LOC_FMTS " %s_vx_info " VXH_VXI_FMTS "\n",
17543+ VXH_LOC_ARGS(e),
17544+ (e->type == VXH_GET_VX_INFO) ? "get" : "put",
17545+ VXH_VXI_ARGS(e));
17546+ break;
17547+
17548+ case VXH_INIT_VX_INFO:
17549+ case VXH_SET_VX_INFO:
17550+ case VXH_CLR_VX_INFO:
17551+ printk( VXH_LOC_FMTS " %s_vx_info " VXH_VXI_FMTS " @%p\n",
17552+ VXH_LOC_ARGS(e),
17553+ (e->type == VXH_INIT_VX_INFO) ? "init" :
17554+ ((e->type == VXH_SET_VX_INFO) ? "set" : "clr"),
17555+ VXH_VXI_ARGS(e), e->sc.data);
17556+ break;
17557+
17558+ case VXH_CLAIM_VX_INFO:
17559+ case VXH_RELEASE_VX_INFO:
17560+ printk( VXH_LOC_FMTS " %s_vx_info " VXH_VXI_FMTS " @%p\n",
17561+ VXH_LOC_ARGS(e),
17562+ (e->type == VXH_CLAIM_VX_INFO) ? "claim" : "release",
17563+ VXH_VXI_ARGS(e), e->sc.data);
17564+ break;
17565+
17566+ case VXH_ALLOC_VX_INFO:
17567+ case VXH_DEALLOC_VX_INFO:
17568+ printk( VXH_LOC_FMTS " %s_vx_info " VXH_VXI_FMTS "\n",
17569+ VXH_LOC_ARGS(e),
17570+ (e->type == VXH_ALLOC_VX_INFO) ? "alloc" : "dealloc",
17571+ VXH_VXI_ARGS(e));
17572+ break;
17573+
17574+ case VXH_HASH_VX_INFO:
17575+ case VXH_UNHASH_VX_INFO:
17576+ printk( VXH_LOC_FMTS " __%s_vx_info " VXH_VXI_FMTS "\n",
17577+ VXH_LOC_ARGS(e),
17578+ (e->type == VXH_HASH_VX_INFO) ? "hash" : "unhash",
17579+ VXH_VXI_ARGS(e));
17580+ break;
17581+
17582+ case VXH_LOC_VX_INFO:
17583+ case VXH_LOOKUP_VX_INFO:
17584+ case VXH_CREATE_VX_INFO:
17585+ printk( VXH_LOC_FMTS " __%s_vx_info [#%d] -> " VXH_VXI_FMTS "\n",
17586+ VXH_LOC_ARGS(e),
17587+ (e->type == VXH_CREATE_VX_INFO) ? "create" :
17588+ ((e->type == VXH_LOC_VX_INFO) ? "loc" : "lookup"),
17589+ e->ll.arg, VXH_VXI_ARGS(e));
17590+ break;
17591+ }
17592+}
17593+
17594+static void __vxh_dump_history(void)
17595+{
17596+ unsigned int i, cpu;
17597+
17598+ printk("History:\tSEQ: %8x\tNR_CPUS: %d\n",
17599+ atomic_read(&sequence), NR_CPUS);
17600+
17601+ for (i = 0; i < VXH_SIZE; i++) {
17602+ for_each_online_cpu(cpu) {
17603+ struct _vx_history *hist =
17604+ &per_cpu(vx_history_buffer, cpu);
17605+ unsigned int index = (hist->counter - i) % VXH_SIZE;
17606+ struct _vx_hist_entry *entry = &hist->entry[index];
17607+
17608+ vxh_dump_entry(entry, cpu);
17609+ }
17610+ }
17611+}
17612+
17613+void vxh_dump_history(void)
17614+{
17615+ vxh_active = 0;
17616+#ifdef CONFIG_SMP
17617+ local_irq_enable();
17618+ smp_send_stop();
17619+ local_irq_disable();
17620+#endif
17621+ __vxh_dump_history();
17622+}
17623+
17624+
17625+/* vserver syscall commands below here */
17626+
17627+
17628+int vc_dump_history(uint32_t id)
17629+{
17630+ vxh_active = 0;
17631+ __vxh_dump_history();
17632+ vxh_active = 1;
17633+
17634+ return 0;
17635+}
17636+
17637+
17638+int do_read_history(struct __user _vx_hist_entry *data,
17639+ int cpu, uint32_t *index, uint32_t *count)
17640+{
17641+ int pos, ret = 0;
17642+ struct _vx_history *hist = &per_cpu(vx_history_buffer, cpu);
17643+ int end = hist->counter;
17644+ int start = end - VXH_SIZE + 2;
17645+ int idx = *index;
17646+
17647+ /* special case: get current pos */
17648+ if (!*count) {
17649+ *index = end;
17650+ return 0;
17651+ }
17652+
17653+ /* have we lost some data? */
17654+ if (idx < start)
17655+ idx = start;
17656+
17657+ for (pos = 0; (pos < *count) && (idx < end); pos++, idx++) {
17658+ struct _vx_hist_entry *entry =
17659+ &hist->entry[idx % VXH_SIZE];
17660+
17661+ /* send entry to userspace */
17662+ ret = copy_to_user(&data[pos], entry, sizeof(*entry));
17663+ if (ret)
17664+ break;
17665+ }
17666+ /* save new index and count */
17667+ *index = idx;
17668+ *count = pos;
17669+ return ret ? ret : (*index < end);
17670+}
17671+
17672+int vc_read_history(uint32_t id, void __user *data)
17673+{
17674+ struct vcmd_read_history_v0 vc_data;
17675+ int ret;
17676+
17677+ if (id >= NR_CPUS)
17678+ return -EINVAL;
17679+
17680+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
17681+ return -EFAULT;
17682+
17683+ ret = do_read_history((struct __user _vx_hist_entry *)vc_data.data,
17684+ id, &vc_data.index, &vc_data.count);
17685+
17686+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
17687+ return -EFAULT;
17688+ return ret;
17689+}
17690+
17691+#ifdef CONFIG_COMPAT
17692+
17693+int vc_read_history_x32(uint32_t id, void __user *data)
17694+{
17695+ struct vcmd_read_history_v0_x32 vc_data;
17696+ int ret;
17697+
17698+ if (id >= NR_CPUS)
17699+ return -EINVAL;
17700+
17701+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
17702+ return -EFAULT;
17703+
17704+ ret = do_read_history((struct __user _vx_hist_entry *)
17705+ compat_ptr(vc_data.data_ptr),
17706+ id, &vc_data.index, &vc_data.count);
17707+
17708+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
17709+ return -EFAULT;
17710+ return ret;
17711+}
17712+
17713+#endif /* CONFIG_COMPAT */
17714+
17715diff -NurpP --minimal linux-4.4.116/kernel/vserver/inet.c linux-4.4.116-vs2.3.9.7/kernel/vserver/inet.c
17716--- linux-4.4.116/kernel/vserver/inet.c 1970-01-01 00:00:00.000000000 +0000
17717+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/inet.c 2018-01-09 16:36:34.000000000 +0000
17718@@ -0,0 +1,236 @@
17719+
17720+#include <linux/in.h>
17721+#include <linux/inetdevice.h>
17722+#include <linux/export.h>
17723+#include <linux/vs_inet.h>
17724+#include <linux/vs_inet6.h>
17725+#include <linux/vserver/debug.h>
17726+#include <net/route.h>
17727+#include <net/addrconf.h>
17728+
17729+
17730+int nx_v4_addr_conflict(struct nx_info *nxi1, struct nx_info *nxi2)
17731+{
17732+ int ret = 0;
17733+
17734+ if (!nxi1 || !nxi2 || nxi1 == nxi2)
17735+ ret = 1;
17736+ else {
17737+ struct nx_addr_v4 *ptr;
17738+ unsigned long irqflags;
17739+
17740+ spin_lock_irqsave(&nxi1->addr_lock, irqflags);
17741+ for (ptr = &nxi1->v4; ptr; ptr = ptr->next) {
17742+ if (v4_nx_addr_in_nx_info(nxi2, ptr, -1)) {
17743+ ret = 1;
17744+ break;
17745+ }
17746+ }
17747+ spin_unlock_irqrestore(&nxi1->addr_lock, irqflags);
17748+ }
17749+
17750+ vxdprintk(VXD_CBIT(net, 2),
17751+ "nx_v4_addr_conflict(%p,%p): %d",
17752+ nxi1, nxi2, ret);
17753+
17754+ return ret;
17755+}
17756+
17757+
17758+#ifdef CONFIG_IPV6
17759+
17760+int nx_v6_addr_conflict(struct nx_info *nxi1, struct nx_info *nxi2)
17761+{
17762+ int ret = 0;
17763+
17764+ if (!nxi1 || !nxi2 || nxi1 == nxi2)
17765+ ret = 1;
17766+ else {
17767+ struct nx_addr_v6 *ptr;
17768+ unsigned long irqflags;
17769+
17770+ spin_lock_irqsave(&nxi1->addr_lock, irqflags);
17771+ for (ptr = &nxi1->v6; ptr; ptr = ptr->next) {
17772+ if (v6_nx_addr_in_nx_info(nxi2, ptr, -1)) {
17773+ ret = 1;
17774+ break;
17775+ }
17776+ }
17777+ spin_unlock_irqrestore(&nxi1->addr_lock, irqflags);
17778+ }
17779+
17780+ vxdprintk(VXD_CBIT(net, 2),
17781+ "nx_v6_addr_conflict(%p,%p): %d",
17782+ nxi1, nxi2, ret);
17783+
17784+ return ret;
17785+}
17786+
17787+#endif
17788+
17789+int v4_dev_in_nx_info(struct net_device *dev, struct nx_info *nxi)
17790+{
17791+ struct in_device *in_dev;
17792+ struct in_ifaddr **ifap;
17793+ struct in_ifaddr *ifa;
17794+ int ret = 0;
17795+
17796+ if (!dev)
17797+ goto out;
17798+ in_dev = in_dev_get(dev);
17799+ if (!in_dev)
17800+ goto out;
17801+
17802+ for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
17803+ ifap = &ifa->ifa_next) {
17804+ if (v4_addr_in_nx_info(nxi, ifa->ifa_local, NXA_MASK_SHOW)) {
17805+ ret = 1;
17806+ break;
17807+ }
17808+ }
17809+ in_dev_put(in_dev);
17810+out:
17811+ return ret;
17812+}
17813+
17814+
17815+#ifdef CONFIG_IPV6
17816+
17817+int v6_dev_in_nx_info(struct net_device *dev, struct nx_info *nxi)
17818+{
17819+ struct inet6_dev *in_dev;
17820+ struct inet6_ifaddr *ifa;
17821+ int ret = 0;
17822+
17823+ if (!dev)
17824+ goto out;
17825+ in_dev = in6_dev_get(dev);
17826+ if (!in_dev)
17827+ goto out;
17828+
17829+ // for (ifap = &in_dev->addr_list; (ifa = *ifap) != NULL;
17830+ list_for_each_entry(ifa, &in_dev->addr_list, if_list) {
17831+ if (v6_addr_in_nx_info(nxi, &ifa->addr, -1)) {
17832+ ret = 1;
17833+ break;
17834+ }
17835+ }
17836+ in6_dev_put(in_dev);
17837+out:
17838+ return ret;
17839+}
17840+
17841+#endif
17842+
17843+int dev_in_nx_info(struct net_device *dev, struct nx_info *nxi)
17844+{
17845+ int ret = 1;
17846+
17847+ if (!nxi)
17848+ goto out;
17849+ if (nxi->v4.type && v4_dev_in_nx_info(dev, nxi))
17850+ goto out;
17851+#ifdef CONFIG_IPV6
17852+ ret = 2;
17853+ if (nxi->v6.type && v6_dev_in_nx_info(dev, nxi))
17854+ goto out;
17855+#endif
17856+ ret = 0;
17857+out:
17858+ vxdprintk(VXD_CBIT(net, 3),
17859+ "dev_in_nx_info(%p,%p[#%d]) = %d",
17860+ dev, nxi, nxi ? nxi->nx_id : 0, ret);
17861+ return ret;
17862+}
17863+
17864+struct rtable *ip_v4_find_src(struct net *net, struct nx_info *nxi,
17865+ struct flowi4 *fl4)
17866+{
17867+ struct rtable *rt;
17868+
17869+ if (!nxi)
17870+ return NULL;
17871+
17872+ /* FIXME: handle lback only case */
17873+ if (!NX_IPV4(nxi))
17874+ return ERR_PTR(-EPERM);
17875+
17876+ vxdprintk(VXD_CBIT(net, 4),
17877+ "ip_v4_find_src(%p[#%u]) " NIPQUAD_FMT " -> " NIPQUAD_FMT,
17878+ nxi, nxi ? nxi->nx_id : 0,
17879+ NIPQUAD(fl4->saddr), NIPQUAD(fl4->daddr));
17880+
17881+ /* single IP is unconditional */
17882+ if (nx_info_flags(nxi, NXF_SINGLE_IP, 0) &&
17883+ (fl4->saddr == INADDR_ANY))
17884+ fl4->saddr = nxi->v4.ip[0].s_addr;
17885+
17886+ if (fl4->saddr == INADDR_ANY) {
17887+ struct nx_addr_v4 *ptr;
17888+ __be32 found = 0;
17889+
17890+ rt = __ip_route_output_key(net, fl4);
17891+ if (!IS_ERR(rt)) {
17892+ found = fl4->saddr;
17893+ ip_rt_put(rt);
17894+ vxdprintk(VXD_CBIT(net, 4),
17895+ "ip_v4_find_src(%p[#%u]) rok[%u]: " NIPQUAD_FMT,
17896+ nxi, nxi ? nxi->nx_id : 0, fl4->flowi4_oif, NIPQUAD(found));
17897+ if (v4_addr_in_nx_info(nxi, found, NXA_MASK_BIND))
17898+ goto found;
17899+ }
17900+
17901+ WARN_ON_ONCE(in_irq());
17902+ spin_lock_bh(&nxi->addr_lock);
17903+ for (ptr = &nxi->v4; ptr; ptr = ptr->next) {
17904+ __be32 primary = ptr->ip[0].s_addr;
17905+ __be32 mask = ptr->mask.s_addr;
17906+ __be32 neta = primary & mask;
17907+
17908+ vxdprintk(VXD_CBIT(net, 4), "ip_v4_find_src(%p[#%u]) chk: "
17909+ NIPQUAD_FMT "/" NIPQUAD_FMT "/" NIPQUAD_FMT,
17910+ nxi, nxi ? nxi->nx_id : 0, NIPQUAD(primary),
17911+ NIPQUAD(mask), NIPQUAD(neta));
17912+ if ((found & mask) != neta)
17913+ continue;
17914+
17915+ fl4->saddr = primary;
17916+ rt = __ip_route_output_key(net, fl4);
17917+ vxdprintk(VXD_CBIT(net, 4),
17918+ "ip_v4_find_src(%p[#%u]) rok[%u]: " NIPQUAD_FMT,
17919+ nxi, nxi ? nxi->nx_id : 0, fl4->flowi4_oif, NIPQUAD(primary));
17920+ if (!IS_ERR(rt)) {
17921+ found = fl4->saddr;
17922+ ip_rt_put(rt);
17923+ if (found == primary)
17924+ goto found_unlock;
17925+ }
17926+ }
17927+ /* still no source ip? */
17928+ found = ipv4_is_loopback(fl4->daddr)
17929+ ? IPI_LOOPBACK : nxi->v4.ip[0].s_addr;
17930+ found_unlock:
17931+ spin_unlock_bh(&nxi->addr_lock);
17932+ found:
17933+ /* assign src ip to flow */
17934+ fl4->saddr = found;
17935+
17936+ } else {
17937+ if (!v4_addr_in_nx_info(nxi, fl4->saddr, NXA_MASK_BIND))
17938+ return ERR_PTR(-EPERM);
17939+ }
17940+
17941+ if (nx_info_flags(nxi, NXF_LBACK_REMAP, 0)) {
17942+ if (ipv4_is_loopback(fl4->daddr))
17943+ fl4->daddr = nxi->v4_lback.s_addr;
17944+ if (ipv4_is_loopback(fl4->saddr))
17945+ fl4->saddr = nxi->v4_lback.s_addr;
17946+ } else if (ipv4_is_loopback(fl4->daddr) &&
17947+ !nx_info_flags(nxi, NXF_LBACK_ALLOW, 0))
17948+ return ERR_PTR(-EPERM);
17949+
17950+ return NULL;
17951+}
17952+
17953+EXPORT_SYMBOL_GPL(ip_v4_find_src);
17954+
17955diff -NurpP --minimal linux-4.4.116/kernel/vserver/init.c linux-4.4.116-vs2.3.9.7/kernel/vserver/init.c
17956--- linux-4.4.116/kernel/vserver/init.c 1970-01-01 00:00:00.000000000 +0000
17957+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/init.c 2018-01-09 22:31:39.000000000 +0000
17958@@ -0,0 +1,46 @@
17959+/*
17960+ * linux/kernel/init.c
17961+ *
17962+ * Virtual Server Init
17963+ *
17964+ * Copyright (C) 2004-2007 Herbert P?tzl
17965+ *
17966+ * V0.01 basic structure
17967+ *
17968+ */
17969+
17970+#include <linux/init.h>
17971+#include <linux/module.h>
17972+
17973+int vserver_register_sysctl(void);
17974+void vserver_unregister_sysctl(void);
17975+
17976+
17977+static int __init init_vserver(void)
17978+{
17979+ int ret = 0;
17980+
17981+#ifdef CONFIG_VSERVER_DEBUG
17982+ vserver_register_sysctl();
17983+#endif
17984+ return ret;
17985+}
17986+
17987+
17988+static void __exit exit_vserver(void)
17989+{
17990+
17991+#ifdef CONFIG_VSERVER_DEBUG
17992+ vserver_unregister_sysctl();
17993+#endif
17994+ return;
17995+}
17996+
17997+/* FIXME: GFP_ZONETYPES gone
17998+long vx_slab[GFP_ZONETYPES]; */
17999+long vx_area;
18000+
18001+
18002+module_init(init_vserver);
18003+module_exit(exit_vserver);
18004+
18005diff -NurpP --minimal linux-4.4.116/kernel/vserver/inode.c linux-4.4.116-vs2.3.9.7/kernel/vserver/inode.c
18006--- linux-4.4.116/kernel/vserver/inode.c 1970-01-01 00:00:00.000000000 +0000
18007+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/inode.c 2018-01-09 22:24:56.000000000 +0000
18008@@ -0,0 +1,440 @@
18009+/*
18010+ * linux/kernel/vserver/inode.c
18011+ *
18012+ * Virtual Server: File System Support
18013+ *
18014+ * Copyright (C) 2004-2007 Herbert P?tzl
18015+ *
18016+ * V0.01 separated from vcontext V0.05
18017+ * V0.02 moved to tag (instead of xid)
18018+ *
18019+ */
18020+
18021+#include <linux/tty.h>
18022+#include <linux/proc_fs.h>
18023+#include <linux/devpts_fs.h>
18024+#include <linux/fs.h>
18025+#include <linux/file.h>
18026+#include <linux/mount.h>
18027+#include <linux/parser.h>
18028+#include <linux/namei.h>
18029+#include <linux/magic.h>
18030+#include <linux/slab.h>
18031+#include <linux/vserver/inode.h>
18032+#include <linux/vserver/inode_cmd.h>
18033+#include <linux/vs_base.h>
18034+#include <linux/vs_tag.h>
18035+
18036+#include <asm/uaccess.h>
18037+#include <../../fs/proc/internal.h>
18038+
18039+
18040+static int __vc_get_iattr(struct inode *in, uint32_t *tag, uint32_t *flags, uint32_t *mask)
18041+{
18042+ struct proc_dir_entry *entry;
18043+
18044+ if (!in || !in->i_sb)
18045+ return -ESRCH;
18046+
18047+ *flags = IATTR_TAG
18048+ | (IS_IMMUTABLE(in) ? IATTR_IMMUTABLE : 0)
18049+ | (IS_IXUNLINK(in) ? IATTR_IXUNLINK : 0)
18050+ | (IS_BARRIER(in) ? IATTR_BARRIER : 0)
18051+ | (IS_COW(in) ? IATTR_COW : 0);
18052+ *mask = IATTR_IXUNLINK | IATTR_IMMUTABLE | IATTR_COW;
18053+
18054+ if (S_ISDIR(in->i_mode))
18055+ *mask |= IATTR_BARRIER;
18056+
18057+ if (IS_TAGGED(in)) {
18058+ *tag = i_tag_read(in);
18059+ *mask |= IATTR_TAG;
18060+ }
18061+
18062+ switch (in->i_sb->s_magic) {
18063+ case PROC_SUPER_MAGIC:
18064+ entry = PROC_I(in)->pde;
18065+
18066+ /* check for specific inodes? */
18067+ if (entry)
18068+ *mask |= IATTR_FLAGS;
18069+ if (entry)
18070+ *flags |= (entry->vx_flags & IATTR_FLAGS);
18071+ else
18072+ *flags |= (PROC_I(in)->vx_flags & IATTR_FLAGS);
18073+ break;
18074+
18075+ case DEVPTS_SUPER_MAGIC:
18076+ *tag = i_tag_read(in);
18077+ *mask |= IATTR_TAG;
18078+ break;
18079+
18080+ default:
18081+ break;
18082+ }
18083+ return 0;
18084+}
18085+
18086+int vc_get_iattr(void __user *data)
18087+{
18088+ struct path path;
18089+ struct vcmd_ctx_iattr_v1 vc_data = { .tag = -1 };
18090+ int ret;
18091+
18092+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18093+ return -EFAULT;
18094+
18095+ ret = user_lpath(vc_data.name, &path);
18096+ if (!ret) {
18097+ ret = __vc_get_iattr(path.dentry->d_inode,
18098+ &vc_data.tag, &vc_data.flags, &vc_data.mask);
18099+ path_put(&path);
18100+ }
18101+ if (ret)
18102+ return ret;
18103+
18104+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
18105+ ret = -EFAULT;
18106+ return ret;
18107+}
18108+
18109+#ifdef CONFIG_COMPAT
18110+
18111+int vc_get_iattr_x32(void __user *data)
18112+{
18113+ struct path path;
18114+ struct vcmd_ctx_iattr_v1_x32 vc_data = { .tag = -1 };
18115+ int ret;
18116+
18117+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18118+ return -EFAULT;
18119+
18120+ ret = user_lpath(compat_ptr(vc_data.name_ptr), &path);
18121+ if (!ret) {
18122+ ret = __vc_get_iattr(path.dentry->d_inode,
18123+ &vc_data.tag, &vc_data.flags, &vc_data.mask);
18124+ path_put(&path);
18125+ }
18126+ if (ret)
18127+ return ret;
18128+
18129+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
18130+ ret = -EFAULT;
18131+ return ret;
18132+}
18133+
18134+#endif /* CONFIG_COMPAT */
18135+
18136+
18137+int vc_fget_iattr(uint32_t fd, void __user *data)
18138+{
18139+ struct file *filp;
18140+ struct vcmd_ctx_fiattr_v0 vc_data = { .tag = -1 };
18141+ int ret;
18142+
18143+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18144+ return -EFAULT;
18145+
18146+ filp = fget(fd);
18147+ if (!filp || !filp->f_path.dentry || !filp->f_path.dentry->d_inode)
18148+ return -EBADF;
18149+
18150+ ret = __vc_get_iattr(filp->f_path.dentry->d_inode,
18151+ &vc_data.tag, &vc_data.flags, &vc_data.mask);
18152+
18153+ fput(filp);
18154+
18155+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
18156+ ret = -EFAULT;
18157+ return ret;
18158+}
18159+
18160+
18161+static int __vc_set_iattr(struct dentry *de, uint32_t *tag, uint32_t *flags, uint32_t *mask)
18162+{
18163+ struct inode *in = de->d_inode;
18164+ int error = 0, is_proc = 0, has_tag = 0;
18165+ struct iattr attr = { 0 };
18166+
18167+ if (!in || !in->i_sb)
18168+ return -ESRCH;
18169+
18170+ is_proc = (in->i_sb->s_magic == PROC_SUPER_MAGIC);
18171+ if ((*mask & IATTR_FLAGS) && !is_proc)
18172+ return -EINVAL;
18173+
18174+ has_tag = IS_TAGGED(in) ||
18175+ (in->i_sb->s_magic == DEVPTS_SUPER_MAGIC);
18176+ if ((*mask & IATTR_TAG) && !has_tag)
18177+ return -EINVAL;
18178+
18179+ mutex_lock(&in->i_mutex);
18180+ if (*mask & IATTR_TAG) {
18181+ attr.ia_tag = make_ktag(&init_user_ns, *tag);
18182+ attr.ia_valid |= ATTR_TAG;
18183+ }
18184+
18185+ if (*mask & IATTR_FLAGS) {
18186+ struct proc_dir_entry *entry = PROC_I(in)->pde;
18187+ unsigned int iflags = PROC_I(in)->vx_flags;
18188+
18189+ iflags = (iflags & ~(*mask & IATTR_FLAGS))
18190+ | (*flags & IATTR_FLAGS);
18191+ PROC_I(in)->vx_flags = iflags;
18192+ if (entry)
18193+ entry->vx_flags = iflags;
18194+ }
18195+
18196+ if (*mask & (IATTR_IMMUTABLE | IATTR_IXUNLINK |
18197+ IATTR_BARRIER | IATTR_COW)) {
18198+ int iflags = in->i_flags;
18199+ int vflags = in->i_vflags;
18200+
18201+ if (*mask & IATTR_IMMUTABLE) {
18202+ if (*flags & IATTR_IMMUTABLE)
18203+ iflags |= S_IMMUTABLE;
18204+ else
18205+ iflags &= ~S_IMMUTABLE;
18206+ }
18207+ if (*mask & IATTR_IXUNLINK) {
18208+ if (*flags & IATTR_IXUNLINK)
18209+ iflags |= S_IXUNLINK;
18210+ else
18211+ iflags &= ~S_IXUNLINK;
18212+ }
18213+ if (S_ISDIR(in->i_mode) && (*mask & IATTR_BARRIER)) {
18214+ if (*flags & IATTR_BARRIER)
18215+ vflags |= V_BARRIER;
18216+ else
18217+ vflags &= ~V_BARRIER;
18218+ }
18219+ if (S_ISREG(in->i_mode) && (*mask & IATTR_COW)) {
18220+ if (*flags & IATTR_COW)
18221+ vflags |= V_COW;
18222+ else
18223+ vflags &= ~V_COW;
18224+ }
18225+ if (in->i_op && in->i_op->sync_flags) {
18226+ error = in->i_op->sync_flags(in, iflags, vflags);
18227+ if (error)
18228+ goto out;
18229+ }
18230+ }
18231+
18232+ if (attr.ia_valid) {
18233+ if (in->i_op && in->i_op->setattr)
18234+ error = in->i_op->setattr(de, &attr);
18235+ else {
18236+ error = inode_change_ok(in, &attr);
18237+ if (!error) {
18238+ setattr_copy(in, &attr);
18239+ mark_inode_dirty(in);
18240+ }
18241+ }
18242+ }
18243+
18244+out:
18245+ mutex_unlock(&in->i_mutex);
18246+ return error;
18247+}
18248+
18249+int vc_set_iattr(void __user *data)
18250+{
18251+ struct path path;
18252+ struct vcmd_ctx_iattr_v1 vc_data;
18253+ int ret;
18254+
18255+ if (!capable(CAP_LINUX_IMMUTABLE))
18256+ return -EPERM;
18257+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18258+ return -EFAULT;
18259+
18260+ ret = user_lpath(vc_data.name, &path);
18261+ if (!ret) {
18262+ ret = __vc_set_iattr(path.dentry,
18263+ &vc_data.tag, &vc_data.flags, &vc_data.mask);
18264+ path_put(&path);
18265+ }
18266+
18267+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
18268+ ret = -EFAULT;
18269+ return ret;
18270+}
18271+
18272+#ifdef CONFIG_COMPAT
18273+
18274+int vc_set_iattr_x32(void __user *data)
18275+{
18276+ struct path path;
18277+ struct vcmd_ctx_iattr_v1_x32 vc_data;
18278+ int ret;
18279+
18280+ if (!capable(CAP_LINUX_IMMUTABLE))
18281+ return -EPERM;
18282+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18283+ return -EFAULT;
18284+
18285+ ret = user_lpath(compat_ptr(vc_data.name_ptr), &path);
18286+ if (!ret) {
18287+ ret = __vc_set_iattr(path.dentry,
18288+ &vc_data.tag, &vc_data.flags, &vc_data.mask);
18289+ path_put(&path);
18290+ }
18291+
18292+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
18293+ ret = -EFAULT;
18294+ return ret;
18295+}
18296+
18297+#endif /* CONFIG_COMPAT */
18298+
18299+int vc_fset_iattr(uint32_t fd, void __user *data)
18300+{
18301+ struct file *filp;
18302+ struct vcmd_ctx_fiattr_v0 vc_data;
18303+ int ret;
18304+
18305+ if (!capable(CAP_LINUX_IMMUTABLE))
18306+ return -EPERM;
18307+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18308+ return -EFAULT;
18309+
18310+ filp = fget(fd);
18311+ if (!filp || !filp->f_path.dentry || !filp->f_path.dentry->d_inode)
18312+ return -EBADF;
18313+
18314+ ret = __vc_set_iattr(filp->f_path.dentry, &vc_data.tag,
18315+ &vc_data.flags, &vc_data.mask);
18316+
18317+ fput(filp);
18318+
18319+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
18320+ return -EFAULT;
18321+ return ret;
18322+}
18323+
18324+
18325+enum { Opt_notagcheck, Opt_tag, Opt_notag, Opt_tagid, Opt_err };
18326+
18327+static match_table_t tokens = {
18328+ {Opt_notagcheck, "notagcheck"},
18329+#ifdef CONFIG_PROPAGATE
18330+ {Opt_notag, "notag"},
18331+ {Opt_tag, "tag"},
18332+ {Opt_tagid, "tagid=%u"},
18333+#endif
18334+ {Opt_err, NULL}
18335+};
18336+
18337+
18338+static void __dx_parse_remove(char *string, char *opt)
18339+{
18340+ char *p = strstr(string, opt);
18341+ char *q = p;
18342+
18343+ if (p) {
18344+ while (*q != '\0' && *q != ',')
18345+ q++;
18346+ while (*q)
18347+ *p++ = *q++;
18348+ while (*p)
18349+ *p++ = '\0';
18350+ }
18351+}
18352+
18353+int dx_parse_tag(char *string, vtag_t *tag, int remove, int *mnt_flags,
18354+ unsigned long *flags)
18355+{
18356+ int set = 0;
18357+ substring_t args[MAX_OPT_ARGS];
18358+ int token;
18359+ char *s, *p, *opts;
18360+#if defined(CONFIG_PROPAGATE) || defined(CONFIG_VSERVER_DEBUG)
18361+ int option = 0;
18362+#endif
18363+
18364+ if (!string)
18365+ return 0;
18366+ s = kstrdup(string, GFP_KERNEL | GFP_ATOMIC);
18367+ if (!s)
18368+ return 0;
18369+
18370+ opts = s;
18371+ while ((p = strsep(&opts, ",")) != NULL) {
18372+ token = match_token(p, tokens, args);
18373+
18374+ switch (token) {
18375+#ifdef CONFIG_PROPAGATE
18376+ case Opt_tag:
18377+ if (tag)
18378+ *tag = 0;
18379+ if (remove)
18380+ __dx_parse_remove(s, "tag");
18381+ *mnt_flags |= MNT_TAGID;
18382+ set |= MNT_TAGID;
18383+ break;
18384+ case Opt_notag:
18385+ if (remove)
18386+ __dx_parse_remove(s, "notag");
18387+ *mnt_flags |= MNT_NOTAG;
18388+ set |= MNT_NOTAG;
18389+ break;
18390+ case Opt_tagid:
18391+ if (tag && !match_int(args, &option))
18392+ *tag = option;
18393+ if (remove)
18394+ __dx_parse_remove(s, "tagid");
18395+ *mnt_flags |= MNT_TAGID;
18396+ set |= MNT_TAGID;
18397+ break;
18398+#endif /* CONFIG_PROPAGATE */
18399+ case Opt_notagcheck:
18400+ if (remove)
18401+ __dx_parse_remove(s, "notagcheck");
18402+ *flags |= MS_NOTAGCHECK;
18403+ set |= MS_NOTAGCHECK;
18404+ break;
18405+ }
18406+ vxdprintk(VXD_CBIT(tag, 7),
18407+ "dx_parse_tag(" VS_Q("%s") "): %d:#%d",
18408+ p, token, option);
18409+ }
18410+ if (set)
18411+ strcpy(string, s);
18412+ kfree(s);
18413+ return set;
18414+}
18415+
18416+#ifdef CONFIG_PROPAGATE
18417+
18418+void __dx_propagate_tag(struct nameidata *nd, struct inode *inode)
18419+{
18420+ vtag_t new_tag = 0;
18421+ struct vfsmount *mnt;
18422+ int propagate;
18423+
18424+ if (!nd)
18425+ return;
18426+ mnt = nd->path.mnt;
18427+ if (!mnt)
18428+ return;
18429+
18430+ propagate = (mnt->mnt_flags & MNT_TAGID);
18431+ if (propagate)
18432+ new_tag = mnt->mnt_tag;
18433+
18434+ vxdprintk(VXD_CBIT(tag, 7),
18435+ "dx_propagate_tag(%p[#%lu.%d]): %d,%d",
18436+ inode, inode->i_ino, inode->i_tag,
18437+ new_tag, (propagate) ? 1 : 0);
18438+
18439+ if (propagate)
18440+ i_tag_write(inode, new_tag);
18441+}
18442+
18443+#include <linux/module.h>
18444+
18445+EXPORT_SYMBOL_GPL(__dx_propagate_tag);
18446+
18447+#endif /* CONFIG_PROPAGATE */
18448+
18449diff -NurpP --minimal linux-4.4.116/kernel/vserver/limit.c linux-4.4.116-vs2.3.9.7/kernel/vserver/limit.c
18450--- linux-4.4.116/kernel/vserver/limit.c 1970-01-01 00:00:00.000000000 +0000
18451+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/limit.c 2018-01-24 23:13:15.000000000 +0000
18452@@ -0,0 +1,386 @@
18453+/*
18454+ * linux/kernel/vserver/limit.c
18455+ *
18456+ * Virtual Server: Context Limits
18457+ *
18458+ * Copyright (C) 2004-2010 Herbert P?tzl
18459+ *
18460+ * V0.01 broken out from vcontext V0.05
18461+ * V0.02 changed vcmds to vxi arg
18462+ * V0.03 added memory cgroup support
18463+ *
18464+ */
18465+
18466+#include <linux/sched.h>
18467+#include <linux/module.h>
18468+#include <linux/memcontrol.h>
18469+#include <linux/page_counter.h>
18470+#include <linux/vs_limit.h>
18471+#include <linux/vserver/limit.h>
18472+#include <linux/vserver/limit_cmd.h>
18473+
18474+#include <asm/uaccess.h>
18475+
18476+
18477+const char *vlimit_name[NUM_LIMITS] = {
18478+ [RLIMIT_CPU] = "CPU",
18479+ [RLIMIT_NPROC] = "NPROC",
18480+ [RLIMIT_NOFILE] = "NOFILE",
18481+ [RLIMIT_LOCKS] = "LOCKS",
18482+ [RLIMIT_SIGPENDING] = "SIGP",
18483+ [RLIMIT_MSGQUEUE] = "MSGQ",
18484+
18485+ [VLIMIT_NSOCK] = "NSOCK",
18486+ [VLIMIT_OPENFD] = "OPENFD",
18487+ [VLIMIT_SHMEM] = "SHMEM",
18488+ [VLIMIT_DENTRY] = "DENTRY",
18489+};
18490+
18491+EXPORT_SYMBOL_GPL(vlimit_name);
18492+
18493+#define MASK_ENTRY(x) (1 << (x))
18494+
18495+const struct vcmd_ctx_rlimit_mask_v0 vlimit_mask = {
18496+ /* minimum */
18497+ 0
18498+ , /* softlimit */
18499+ 0
18500+ , /* maximum */
18501+ MASK_ENTRY( RLIMIT_NPROC ) |
18502+ MASK_ENTRY( RLIMIT_NOFILE ) |
18503+ MASK_ENTRY( RLIMIT_LOCKS ) |
18504+ MASK_ENTRY( RLIMIT_MSGQUEUE ) |
18505+
18506+ MASK_ENTRY( VLIMIT_NSOCK ) |
18507+ MASK_ENTRY( VLIMIT_OPENFD ) |
18508+ MASK_ENTRY( VLIMIT_SHMEM ) |
18509+ MASK_ENTRY( VLIMIT_DENTRY ) |
18510+ 0
18511+};
18512+ /* accounting only */
18513+uint32_t account_mask =
18514+ MASK_ENTRY( VLIMIT_SEMARY ) |
18515+ MASK_ENTRY( VLIMIT_NSEMS ) |
18516+ MASK_ENTRY( VLIMIT_MAPPED ) |
18517+ 0;
18518+
18519+
18520+static int is_valid_vlimit(int id)
18521+{
18522+ uint32_t mask = vlimit_mask.minimum |
18523+ vlimit_mask.softlimit | vlimit_mask.maximum;
18524+ return mask & (1 << id);
18525+}
18526+
18527+static int is_accounted_vlimit(int id)
18528+{
18529+ if (is_valid_vlimit(id))
18530+ return 1;
18531+ return account_mask & (1 << id);
18532+}
18533+
18534+
18535+static inline uint64_t vc_get_soft(struct vx_info *vxi, int id)
18536+{
18537+ rlim_t limit = __rlim_soft(&vxi->limit, id);
18538+ return VX_VLIM(limit);
18539+}
18540+
18541+static inline uint64_t vc_get_hard(struct vx_info *vxi, int id)
18542+{
18543+ rlim_t limit = __rlim_hard(&vxi->limit, id);
18544+ return VX_VLIM(limit);
18545+}
18546+
18547+static int do_get_rlimit(struct vx_info *vxi, uint32_t id,
18548+ uint64_t *minimum, uint64_t *softlimit, uint64_t *maximum)
18549+{
18550+ if (!is_valid_vlimit(id))
18551+ return -EINVAL;
18552+
18553+ if (minimum)
18554+ *minimum = CRLIM_UNSET;
18555+ if (softlimit)
18556+ *softlimit = vc_get_soft(vxi, id);
18557+ if (maximum)
18558+ *maximum = vc_get_hard(vxi, id);
18559+ return 0;
18560+}
18561+
18562+int vc_get_rlimit(struct vx_info *vxi, void __user *data)
18563+{
18564+ struct vcmd_ctx_rlimit_v0 vc_data;
18565+ int ret;
18566+
18567+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18568+ return -EFAULT;
18569+
18570+ ret = do_get_rlimit(vxi, vc_data.id,
18571+ &vc_data.minimum, &vc_data.softlimit, &vc_data.maximum);
18572+ if (ret)
18573+ return ret;
18574+
18575+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
18576+ return -EFAULT;
18577+ return 0;
18578+}
18579+
18580+static int do_set_rlimit(struct vx_info *vxi, uint32_t id,
18581+ uint64_t minimum, uint64_t softlimit, uint64_t maximum)
18582+{
18583+ if (!is_valid_vlimit(id))
18584+ return -EINVAL;
18585+
18586+ if (maximum != CRLIM_KEEP)
18587+ __rlim_hard(&vxi->limit, id) = VX_RLIM(maximum);
18588+ if (softlimit != CRLIM_KEEP)
18589+ __rlim_soft(&vxi->limit, id) = VX_RLIM(softlimit);
18590+
18591+ /* clamp soft limit */
18592+ if (__rlim_soft(&vxi->limit, id) > __rlim_hard(&vxi->limit, id))
18593+ __rlim_soft(&vxi->limit, id) = __rlim_hard(&vxi->limit, id);
18594+
18595+ return 0;
18596+}
18597+
18598+int vc_set_rlimit(struct vx_info *vxi, void __user *data)
18599+{
18600+ struct vcmd_ctx_rlimit_v0 vc_data;
18601+
18602+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18603+ return -EFAULT;
18604+
18605+ return do_set_rlimit(vxi, vc_data.id,
18606+ vc_data.minimum, vc_data.softlimit, vc_data.maximum);
18607+}
18608+
18609+#ifdef CONFIG_IA32_EMULATION
18610+
18611+int vc_set_rlimit_x32(struct vx_info *vxi, void __user *data)
18612+{
18613+ struct vcmd_ctx_rlimit_v0_x32 vc_data;
18614+
18615+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18616+ return -EFAULT;
18617+
18618+ return do_set_rlimit(vxi, vc_data.id,
18619+ vc_data.minimum, vc_data.softlimit, vc_data.maximum);
18620+}
18621+
18622+int vc_get_rlimit_x32(struct vx_info *vxi, void __user *data)
18623+{
18624+ struct vcmd_ctx_rlimit_v0_x32 vc_data;
18625+ int ret;
18626+
18627+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18628+ return -EFAULT;
18629+
18630+ ret = do_get_rlimit(vxi, vc_data.id,
18631+ &vc_data.minimum, &vc_data.softlimit, &vc_data.maximum);
18632+ if (ret)
18633+ return ret;
18634+
18635+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
18636+ return -EFAULT;
18637+ return 0;
18638+}
18639+
18640+#endif /* CONFIG_IA32_EMULATION */
18641+
18642+
18643+int vc_get_rlimit_mask(uint32_t id, void __user *data)
18644+{
18645+ if (copy_to_user(data, &vlimit_mask, sizeof(vlimit_mask)))
18646+ return -EFAULT;
18647+ return 0;
18648+}
18649+
18650+
18651+static inline void vx_reset_hits(struct _vx_limit *limit)
18652+{
18653+ int lim;
18654+
18655+ for (lim = 0; lim < NUM_LIMITS; lim++) {
18656+ atomic_set(&__rlim_lhit(limit, lim), 0);
18657+ }
18658+}
18659+
18660+int vc_reset_hits(struct vx_info *vxi, void __user *data)
18661+{
18662+ vx_reset_hits(&vxi->limit);
18663+ return 0;
18664+}
18665+
18666+static inline void vx_reset_minmax(struct _vx_limit *limit)
18667+{
18668+ rlim_t value;
18669+ int lim;
18670+
18671+ for (lim = 0; lim < NUM_LIMITS; lim++) {
18672+ value = __rlim_get(limit, lim);
18673+ __rlim_rmax(limit, lim) = value;
18674+ __rlim_rmin(limit, lim) = value;
18675+ }
18676+}
18677+
18678+int vc_reset_minmax(struct vx_info *vxi, void __user *data)
18679+{
18680+ vx_reset_minmax(&vxi->limit);
18681+ return 0;
18682+}
18683+
18684+
18685+int vc_rlimit_stat(struct vx_info *vxi, void __user *data)
18686+{
18687+ struct vcmd_rlimit_stat_v0 vc_data;
18688+ struct _vx_limit *limit = &vxi->limit;
18689+ int id;
18690+
18691+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
18692+ return -EFAULT;
18693+
18694+ id = vc_data.id;
18695+ if (!is_accounted_vlimit(id))
18696+ return -EINVAL;
18697+
18698+ vx_limit_fixup(limit, id);
18699+ vc_data.hits = atomic_read(&__rlim_lhit(limit, id));
18700+ vc_data.value = __rlim_get(limit, id);
18701+ vc_data.minimum = __rlim_rmin(limit, id);
18702+ vc_data.maximum = __rlim_rmax(limit, id);
18703+
18704+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
18705+ return -EFAULT;
18706+ return 0;
18707+}
18708+
18709+
18710+#ifdef CONFIG_MEMCG
18711+
18712+void dump_sysinfo(struct sysinfo *si)
18713+{
18714+ printk(KERN_INFO "sysinfo: memunit=%u\n"
18715+ "\ttotalram:\t%lu\n"
18716+ "\tfreeram:\t%lu\n"
18717+ "\tsharedram:\t%lu\n"
18718+ "\tbufferram:\t%lu\n"
18719+ "\ttotalswap:\t%lu\n"
18720+ "\tfreeswap:\t%lu\n"
18721+ "\ttotalhigh:\t%lu\n"
18722+ "\tfreehigh:\t%lu\n",
18723+ si->mem_unit,
18724+ si->totalram,
18725+ si->freeram,
18726+ si->sharedram,
18727+ si->bufferram,
18728+ si->totalswap,
18729+ si->freeswap,
18730+ si->totalhigh,
18731+ si->freehigh);
18732+}
18733+
18734+void vx_vsi_meminfo(struct sysinfo *val)
18735+{
18736+ struct mem_cgroup *mcg;
18737+ unsigned long res_limit, res_usage;
18738+ unsigned shift;
18739+
18740+ if (VXD_CBIT(cvirt, 4))
18741+ dump_sysinfo(val);
18742+
18743+ rcu_read_lock();
18744+ mcg = mem_cgroup_from_task(current);
18745+ if (VXD_CBIT(cvirt, 5))
18746+ dump_mem_cgroup(mcg);
18747+ rcu_read_unlock();
18748+ if (!mcg)
18749+ goto out;
18750+
18751+ res_limit = mem_cgroup_mem_limit_pages(mcg);
18752+ res_usage = mem_cgroup_mem_usage_pages(mcg);
18753+ shift = val->mem_unit == 1 ? PAGE_SHIFT : 0;
18754+
18755+ if (res_limit != PAGE_COUNTER_MAX)
18756+ val->totalram = res_limit << shift;
18757+ val->freeram = val->totalram - (res_usage << shift);
18758+ val->bufferram = 0;
18759+ val->totalhigh = 0;
18760+ val->freehigh = 0;
18761+out:
18762+ return;
18763+}
18764+
18765+void vx_vsi_swapinfo(struct sysinfo *val)
18766+{
18767+#ifdef CONFIG_MEMCG_SWAP
18768+ struct mem_cgroup *mcg;
18769+ unsigned long res_limit, res_usage, memsw_limit, memsw_usage;
18770+ signed long swap_limit, swap_usage;
18771+ unsigned shift;
18772+
18773+ if (VXD_CBIT(cvirt, 6))
18774+ dump_sysinfo(val);
18775+
18776+ rcu_read_lock();
18777+ mcg = mem_cgroup_from_task(current);
18778+ if (VXD_CBIT(cvirt, 7))
18779+ dump_mem_cgroup(mcg);
18780+ rcu_read_unlock();
18781+ if (!mcg)
18782+ goto out;
18783+
18784+ res_limit = mem_cgroup_mem_limit_pages(mcg);
18785+
18786+ /* memory unlimited */
18787+ if (res_limit == PAGE_COUNTER_MAX)
18788+ goto out;
18789+
18790+ res_usage = mem_cgroup_mem_usage_pages(mcg);
18791+ memsw_limit = mem_cgroup_memsw_limit_pages(mcg);
18792+ memsw_usage = mem_cgroup_memsw_usage_pages(mcg);
18793+ shift = val->mem_unit == 1 ? PAGE_SHIFT : 0;
18794+
18795+ swap_limit = memsw_limit - res_limit;
18796+ /* we have a swap limit? */
18797+ if (memsw_limit != PAGE_COUNTER_MAX)
18798+ val->totalswap = swap_limit << shift;
18799+
18800+ /* calculate swap part */
18801+ swap_usage = (memsw_usage > res_usage) ?
18802+ memsw_usage - res_usage : 0;
18803+
18804+ /* total shown minus usage gives free swap */
18805+ val->freeswap = (swap_usage < swap_limit) ?
18806+ val->totalswap - (swap_usage << shift) : 0;
18807+out:
18808+#else /* !CONFIG_MEMCG_SWAP */
18809+ val->totalswap = 0;
18810+ val->freeswap = 0;
18811+#endif /* !CONFIG_MEMCG_SWAP */
18812+ return;
18813+}
18814+
18815+long vx_vsi_cached(struct sysinfo *val)
18816+{
18817+ long cache = 0;
18818+#ifdef CONFIG_MEMCG_BROKEN
18819+ struct mem_cgroup *mcg;
18820+
18821+ if (VXD_CBIT(cvirt, 8))
18822+ dump_sysinfo(val);
18823+
18824+ rcu_read_lock();
18825+ mcg = mem_cgroup_from_task(current);
18826+ if (VXD_CBIT(cvirt, 9))
18827+ dump_mem_cgroup(mcg);
18828+ rcu_read_unlock();
18829+ if (!mcg)
18830+ goto out;
18831+
18832+ // cache = mem_cgroup_stat_read_cache(mcg);
18833+out:
18834+#endif
18835+ return cache;
18836+}
18837+#endif /* !CONFIG_MEMCG */
18838+
18839diff -NurpP --minimal linux-4.4.116/kernel/vserver/limit_init.h linux-4.4.116-vs2.3.9.7/kernel/vserver/limit_init.h
18840--- linux-4.4.116/kernel/vserver/limit_init.h 1970-01-01 00:00:00.000000000 +0000
18841+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/limit_init.h 2018-01-09 16:36:34.000000000 +0000
18842@@ -0,0 +1,31 @@
18843+
18844+
18845+static inline void vx_info_init_limit(struct _vx_limit *limit)
18846+{
18847+ int lim;
18848+
18849+ for (lim = 0; lim < NUM_LIMITS; lim++) {
18850+ __rlim_soft(limit, lim) = RLIM_INFINITY;
18851+ __rlim_hard(limit, lim) = RLIM_INFINITY;
18852+ __rlim_set(limit, lim, 0);
18853+ atomic_set(&__rlim_lhit(limit, lim), 0);
18854+ __rlim_rmin(limit, lim) = 0;
18855+ __rlim_rmax(limit, lim) = 0;
18856+ }
18857+}
18858+
18859+static inline void vx_info_exit_limit(struct _vx_limit *limit)
18860+{
18861+ rlim_t value;
18862+ int lim;
18863+
18864+ for (lim = 0; lim < NUM_LIMITS; lim++) {
18865+ if ((1 << lim) & VLIM_NOCHECK)
18866+ continue;
18867+ value = __rlim_get(limit, lim);
18868+ vxwprintk_xid(value,
18869+ "!!! limit: %p[%s,%d] = %ld on exit.",
18870+ limit, vlimit_name[lim], lim, (long)value);
18871+ }
18872+}
18873+
18874diff -NurpP --minimal linux-4.4.116/kernel/vserver/limit_proc.h linux-4.4.116-vs2.3.9.7/kernel/vserver/limit_proc.h
18875--- linux-4.4.116/kernel/vserver/limit_proc.h 1970-01-01 00:00:00.000000000 +0000
18876+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/limit_proc.h 2018-01-09 16:36:34.000000000 +0000
18877@@ -0,0 +1,57 @@
18878+#ifndef _VX_LIMIT_PROC_H
18879+#define _VX_LIMIT_PROC_H
18880+
18881+#include <linux/vserver/limit_int.h>
18882+
18883+
18884+#define VX_LIMIT_FMT ":\t%8ld\t%8ld/%8ld\t%8lld/%8lld\t%6d\n"
18885+#define VX_LIMIT_TOP \
18886+ "Limit\t current\t min/max\t\t soft/hard\t\thits\n"
18887+
18888+#define VX_LIMIT_ARG(r) \
18889+ (unsigned long)__rlim_get(limit, r), \
18890+ (unsigned long)__rlim_rmin(limit, r), \
18891+ (unsigned long)__rlim_rmax(limit, r), \
18892+ VX_VLIM(__rlim_soft(limit, r)), \
18893+ VX_VLIM(__rlim_hard(limit, r)), \
18894+ atomic_read(&__rlim_lhit(limit, r))
18895+
18896+static inline int vx_info_proc_limit(struct _vx_limit *limit, char *buffer)
18897+{
18898+ vx_limit_fixup(limit, -1);
18899+ return sprintf(buffer, VX_LIMIT_TOP
18900+ "PROC" VX_LIMIT_FMT
18901+ "VM" VX_LIMIT_FMT
18902+ "VML" VX_LIMIT_FMT
18903+ "RSS" VX_LIMIT_FMT
18904+ "ANON" VX_LIMIT_FMT
18905+ "RMAP" VX_LIMIT_FMT
18906+ "FILES" VX_LIMIT_FMT
18907+ "OFD" VX_LIMIT_FMT
18908+ "LOCKS" VX_LIMIT_FMT
18909+ "SOCK" VX_LIMIT_FMT
18910+ "MSGQ" VX_LIMIT_FMT
18911+ "SHM" VX_LIMIT_FMT
18912+ "SEMA" VX_LIMIT_FMT
18913+ "SEMS" VX_LIMIT_FMT
18914+ "DENT" VX_LIMIT_FMT,
18915+ VX_LIMIT_ARG(RLIMIT_NPROC),
18916+ VX_LIMIT_ARG(RLIMIT_AS),
18917+ VX_LIMIT_ARG(RLIMIT_MEMLOCK),
18918+ VX_LIMIT_ARG(RLIMIT_RSS),
18919+ VX_LIMIT_ARG(VLIMIT_ANON),
18920+ VX_LIMIT_ARG(VLIMIT_MAPPED),
18921+ VX_LIMIT_ARG(RLIMIT_NOFILE),
18922+ VX_LIMIT_ARG(VLIMIT_OPENFD),
18923+ VX_LIMIT_ARG(RLIMIT_LOCKS),
18924+ VX_LIMIT_ARG(VLIMIT_NSOCK),
18925+ VX_LIMIT_ARG(RLIMIT_MSGQUEUE),
18926+ VX_LIMIT_ARG(VLIMIT_SHMEM),
18927+ VX_LIMIT_ARG(VLIMIT_SEMARY),
18928+ VX_LIMIT_ARG(VLIMIT_NSEMS),
18929+ VX_LIMIT_ARG(VLIMIT_DENTRY));
18930+}
18931+
18932+#endif /* _VX_LIMIT_PROC_H */
18933+
18934+
18935diff -NurpP --minimal linux-4.4.116/kernel/vserver/network.c linux-4.4.116-vs2.3.9.7/kernel/vserver/network.c
18936--- linux-4.4.116/kernel/vserver/network.c 1970-01-01 00:00:00.000000000 +0000
18937+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/network.c 2018-01-09 16:36:34.000000000 +0000
18938@@ -0,0 +1,1053 @@
18939+/*
18940+ * linux/kernel/vserver/network.c
18941+ *
18942+ * Virtual Server: Network Support
18943+ *
18944+ * Copyright (C) 2003-2007 Herbert P?tzl
18945+ *
18946+ * V0.01 broken out from vcontext V0.05
18947+ * V0.02 cleaned up implementation
18948+ * V0.03 added equiv nx commands
18949+ * V0.04 switch to RCU based hash
18950+ * V0.05 and back to locking again
18951+ * V0.06 changed vcmds to nxi arg
18952+ * V0.07 have __create claim() the nxi
18953+ *
18954+ */
18955+
18956+#include <linux/err.h>
18957+#include <linux/slab.h>
18958+#include <linux/rcupdate.h>
18959+#include <net/ipv6.h>
18960+
18961+#include <linux/vs_network.h>
18962+#include <linux/vs_pid.h>
18963+#include <linux/vserver/network_cmd.h>
18964+
18965+
18966+atomic_t nx_global_ctotal = ATOMIC_INIT(0);
18967+atomic_t nx_global_cactive = ATOMIC_INIT(0);
18968+
18969+static struct kmem_cache *nx_addr_v4_cachep = NULL;
18970+static struct kmem_cache *nx_addr_v6_cachep = NULL;
18971+
18972+
18973+static int __init init_network(void)
18974+{
18975+ nx_addr_v4_cachep = kmem_cache_create("nx_v4_addr_cache",
18976+ sizeof(struct nx_addr_v4), 0,
18977+ SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
18978+ nx_addr_v6_cachep = kmem_cache_create("nx_v6_addr_cache",
18979+ sizeof(struct nx_addr_v6), 0,
18980+ SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
18981+ return 0;
18982+}
18983+
18984+
18985+/* __alloc_nx_addr_v4() */
18986+
18987+static inline struct nx_addr_v4 *__alloc_nx_addr_v4(void)
18988+{
18989+ struct nx_addr_v4 *nxa = kmem_cache_alloc(
18990+ nx_addr_v4_cachep, GFP_KERNEL);
18991+
18992+ if (!IS_ERR(nxa))
18993+ memset(nxa, 0, sizeof(*nxa));
18994+ return nxa;
18995+}
18996+
18997+/* __dealloc_nx_addr_v4() */
18998+
18999+static inline void __dealloc_nx_addr_v4(struct nx_addr_v4 *nxa)
19000+{
19001+ kmem_cache_free(nx_addr_v4_cachep, nxa);
19002+}
19003+
19004+/* __dealloc_nx_addr_v4_all() */
19005+
19006+static inline void __dealloc_nx_addr_v4_all(struct nx_addr_v4 *nxa)
19007+{
19008+ while (nxa) {
19009+ struct nx_addr_v4 *next = nxa->next;
19010+
19011+ __dealloc_nx_addr_v4(nxa);
19012+ nxa = next;
19013+ }
19014+}
19015+
19016+
19017+#ifdef CONFIG_IPV6
19018+
19019+/* __alloc_nx_addr_v6() */
19020+
19021+static inline struct nx_addr_v6 *__alloc_nx_addr_v6(void)
19022+{
19023+ struct nx_addr_v6 *nxa = kmem_cache_alloc(
19024+ nx_addr_v6_cachep, GFP_KERNEL);
19025+
19026+ if (!IS_ERR(nxa))
19027+ memset(nxa, 0, sizeof(*nxa));
19028+ return nxa;
19029+}
19030+
19031+/* __dealloc_nx_addr_v6() */
19032+
19033+static inline void __dealloc_nx_addr_v6(struct nx_addr_v6 *nxa)
19034+{
19035+ kmem_cache_free(nx_addr_v6_cachep, nxa);
19036+}
19037+
19038+/* __dealloc_nx_addr_v6_all() */
19039+
19040+static inline void __dealloc_nx_addr_v6_all(struct nx_addr_v6 *nxa)
19041+{
19042+ while (nxa) {
19043+ struct nx_addr_v6 *next = nxa->next;
19044+
19045+ __dealloc_nx_addr_v6(nxa);
19046+ nxa = next;
19047+ }
19048+}
19049+
19050+#endif /* CONFIG_IPV6 */
19051+
19052+/* __alloc_nx_info()
19053+
19054+ * allocate an initialized nx_info struct
19055+ * doesn't make it visible (hash) */
19056+
19057+static struct nx_info *__alloc_nx_info(vnid_t nid)
19058+{
19059+ struct nx_info *new = NULL;
19060+
19061+ vxdprintk(VXD_CBIT(nid, 1), "alloc_nx_info(%d)*", nid);
19062+
19063+ /* would this benefit from a slab cache? */
19064+ new = kmalloc(sizeof(struct nx_info), GFP_KERNEL);
19065+ if (!new)
19066+ return 0;
19067+
19068+ memset(new, 0, sizeof(struct nx_info));
19069+ new->nx_id = nid;
19070+ INIT_HLIST_NODE(&new->nx_hlist);
19071+ atomic_set(&new->nx_usecnt, 0);
19072+ atomic_set(&new->nx_tasks, 0);
19073+ spin_lock_init(&new->addr_lock);
19074+ new->nx_state = 0;
19075+
19076+ new->nx_flags = NXF_INIT_SET;
19077+
19078+ /* rest of init goes here */
19079+
19080+ new->v4_lback.s_addr = htonl(INADDR_LOOPBACK);
19081+ new->v4_bcast.s_addr = htonl(INADDR_BROADCAST);
19082+
19083+ vxdprintk(VXD_CBIT(nid, 0),
19084+ "alloc_nx_info(%d) = %p", nid, new);
19085+ atomic_inc(&nx_global_ctotal);
19086+ return new;
19087+}
19088+
19089+/* __dealloc_nx_info()
19090+
19091+ * final disposal of nx_info */
19092+
19093+static void __dealloc_nx_info(struct nx_info *nxi)
19094+{
19095+ vxdprintk(VXD_CBIT(nid, 0),
19096+ "dealloc_nx_info(%p)", nxi);
19097+
19098+ nxi->nx_hlist.next = LIST_POISON1;
19099+ nxi->nx_id = -1;
19100+
19101+ BUG_ON(atomic_read(&nxi->nx_usecnt));
19102+ BUG_ON(atomic_read(&nxi->nx_tasks));
19103+
19104+ __dealloc_nx_addr_v4_all(nxi->v4.next);
19105+#ifdef CONFIG_IPV6
19106+ __dealloc_nx_addr_v6_all(nxi->v6.next);
19107+#endif
19108+
19109+ nxi->nx_state |= NXS_RELEASED;
19110+ kfree(nxi);
19111+ atomic_dec(&nx_global_ctotal);
19112+}
19113+
19114+static void __shutdown_nx_info(struct nx_info *nxi)
19115+{
19116+ nxi->nx_state |= NXS_SHUTDOWN;
19117+ vs_net_change(nxi, VSC_NETDOWN);
19118+}
19119+
19120+/* exported stuff */
19121+
19122+void free_nx_info(struct nx_info *nxi)
19123+{
19124+ /* context shutdown is mandatory */
19125+ BUG_ON(nxi->nx_state != NXS_SHUTDOWN);
19126+
19127+ /* context must not be hashed */
19128+ BUG_ON(nxi->nx_state & NXS_HASHED);
19129+
19130+ BUG_ON(atomic_read(&nxi->nx_usecnt));
19131+ BUG_ON(atomic_read(&nxi->nx_tasks));
19132+
19133+ __dealloc_nx_info(nxi);
19134+}
19135+
19136+
19137+void __nx_set_lback(struct nx_info *nxi)
19138+{
19139+ int nid = nxi->nx_id;
19140+ __be32 lback = htonl(INADDR_LOOPBACK ^ ((nid & 0xFFFF) << 8));
19141+
19142+ nxi->v4_lback.s_addr = lback;
19143+}
19144+
19145+extern int __nx_inet_add_lback(__be32 addr);
19146+extern int __nx_inet_del_lback(__be32 addr);
19147+
19148+
19149+/* hash table for nx_info hash */
19150+
19151+#define NX_HASH_SIZE 13
19152+
19153+struct hlist_head nx_info_hash[NX_HASH_SIZE];
19154+
19155+static DEFINE_SPINLOCK(nx_info_hash_lock);
19156+
19157+
19158+static inline unsigned int __hashval(vnid_t nid)
19159+{
19160+ return (nid % NX_HASH_SIZE);
19161+}
19162+
19163+
19164+
19165+/* __hash_nx_info()
19166+
19167+ * add the nxi to the global hash table
19168+ * requires the hash_lock to be held */
19169+
19170+static inline void __hash_nx_info(struct nx_info *nxi)
19171+{
19172+ struct hlist_head *head;
19173+
19174+ vxd_assert_lock(&nx_info_hash_lock);
19175+ vxdprintk(VXD_CBIT(nid, 4),
19176+ "__hash_nx_info: %p[#%d]", nxi, nxi->nx_id);
19177+
19178+ /* context must not be hashed */
19179+ BUG_ON(nx_info_state(nxi, NXS_HASHED));
19180+
19181+ nxi->nx_state |= NXS_HASHED;
19182+ head = &nx_info_hash[__hashval(nxi->nx_id)];
19183+ hlist_add_head(&nxi->nx_hlist, head);
19184+ atomic_inc(&nx_global_cactive);
19185+}
19186+
19187+/* __unhash_nx_info()
19188+
19189+ * remove the nxi from the global hash table
19190+ * requires the hash_lock to be held */
19191+
19192+static inline void __unhash_nx_info(struct nx_info *nxi)
19193+{
19194+ vxd_assert_lock(&nx_info_hash_lock);
19195+ vxdprintk(VXD_CBIT(nid, 4),
19196+ "__unhash_nx_info: %p[#%d.%d.%d]", nxi, nxi->nx_id,
19197+ atomic_read(&nxi->nx_usecnt), atomic_read(&nxi->nx_tasks));
19198+
19199+ /* context must be hashed */
19200+ BUG_ON(!nx_info_state(nxi, NXS_HASHED));
19201+ /* but without tasks */
19202+ BUG_ON(atomic_read(&nxi->nx_tasks));
19203+
19204+ nxi->nx_state &= ~NXS_HASHED;
19205+ hlist_del(&nxi->nx_hlist);
19206+ atomic_dec(&nx_global_cactive);
19207+}
19208+
19209+
19210+/* __lookup_nx_info()
19211+
19212+ * requires the hash_lock to be held
19213+ * doesn't increment the nx_refcnt */
19214+
19215+static inline struct nx_info *__lookup_nx_info(vnid_t nid)
19216+{
19217+ struct hlist_head *head = &nx_info_hash[__hashval(nid)];
19218+ struct hlist_node *pos;
19219+ struct nx_info *nxi;
19220+
19221+ vxd_assert_lock(&nx_info_hash_lock);
19222+ hlist_for_each(pos, head) {
19223+ nxi = hlist_entry(pos, struct nx_info, nx_hlist);
19224+
19225+ if (nxi->nx_id == nid)
19226+ goto found;
19227+ }
19228+ nxi = NULL;
19229+found:
19230+ vxdprintk(VXD_CBIT(nid, 0),
19231+ "__lookup_nx_info(#%u): %p[#%u]",
19232+ nid, nxi, nxi ? nxi->nx_id : 0);
19233+ return nxi;
19234+}
19235+
19236+
19237+/* __create_nx_info()
19238+
19239+ * create the requested context
19240+ * get(), claim() and hash it */
19241+
19242+static struct nx_info *__create_nx_info(int id)
19243+{
19244+ struct nx_info *new, *nxi = NULL;
19245+
19246+ vxdprintk(VXD_CBIT(nid, 1), "create_nx_info(%d)*", id);
19247+
19248+ if (!(new = __alloc_nx_info(id)))
19249+ return ERR_PTR(-ENOMEM);
19250+
19251+ /* required to make dynamic xids unique */
19252+ spin_lock(&nx_info_hash_lock);
19253+
19254+ /* static context requested */
19255+ if ((nxi = __lookup_nx_info(id))) {
19256+ vxdprintk(VXD_CBIT(nid, 0),
19257+ "create_nx_info(%d) = %p (already there)", id, nxi);
19258+ if (nx_info_flags(nxi, NXF_STATE_SETUP, 0))
19259+ nxi = ERR_PTR(-EBUSY);
19260+ else
19261+ nxi = ERR_PTR(-EEXIST);
19262+ goto out_unlock;
19263+ }
19264+ /* new context */
19265+ vxdprintk(VXD_CBIT(nid, 0),
19266+ "create_nx_info(%d) = %p (new)", id, new);
19267+ claim_nx_info(new, NULL);
19268+ __nx_set_lback(new);
19269+ __hash_nx_info(get_nx_info(new));
19270+ nxi = new, new = NULL;
19271+
19272+out_unlock:
19273+ spin_unlock(&nx_info_hash_lock);
19274+ if (new)
19275+ __dealloc_nx_info(new);
19276+ return nxi;
19277+}
19278+
19279+
19280+
19281+/* exported stuff */
19282+
19283+
19284+void unhash_nx_info(struct nx_info *nxi)
19285+{
19286+ __shutdown_nx_info(nxi);
19287+ spin_lock(&nx_info_hash_lock);
19288+ __unhash_nx_info(nxi);
19289+ spin_unlock(&nx_info_hash_lock);
19290+}
19291+
19292+/* lookup_nx_info()
19293+
19294+ * search for a nx_info and get() it
19295+ * negative id means current */
19296+
19297+struct nx_info *lookup_nx_info(int id)
19298+{
19299+ struct nx_info *nxi = NULL;
19300+
19301+ if (id < 0) {
19302+ nxi = get_nx_info(current_nx_info());
19303+ } else if (id > 1) {
19304+ spin_lock(&nx_info_hash_lock);
19305+ nxi = get_nx_info(__lookup_nx_info(id));
19306+ spin_unlock(&nx_info_hash_lock);
19307+ }
19308+ return nxi;
19309+}
19310+
19311+/* nid_is_hashed()
19312+
19313+ * verify that nid is still hashed */
19314+
19315+int nid_is_hashed(vnid_t nid)
19316+{
19317+ int hashed;
19318+
19319+ spin_lock(&nx_info_hash_lock);
19320+ hashed = (__lookup_nx_info(nid) != NULL);
19321+ spin_unlock(&nx_info_hash_lock);
19322+ return hashed;
19323+}
19324+
19325+
19326+#ifdef CONFIG_PROC_FS
19327+
19328+/* get_nid_list()
19329+
19330+ * get a subset of hashed nids for proc
19331+ * assumes size is at least one */
19332+
19333+int get_nid_list(int index, unsigned int *nids, int size)
19334+{
19335+ int hindex, nr_nids = 0;
19336+
19337+ /* only show current and children */
19338+ if (!nx_check(0, VS_ADMIN | VS_WATCH)) {
19339+ if (index > 0)
19340+ return 0;
19341+ nids[nr_nids] = nx_current_nid();
19342+ return 1;
19343+ }
19344+
19345+ for (hindex = 0; hindex < NX_HASH_SIZE; hindex++) {
19346+ struct hlist_head *head = &nx_info_hash[hindex];
19347+ struct hlist_node *pos;
19348+
19349+ spin_lock(&nx_info_hash_lock);
19350+ hlist_for_each(pos, head) {
19351+ struct nx_info *nxi;
19352+
19353+ if (--index > 0)
19354+ continue;
19355+
19356+ nxi = hlist_entry(pos, struct nx_info, nx_hlist);
19357+ nids[nr_nids] = nxi->nx_id;
19358+ if (++nr_nids >= size) {
19359+ spin_unlock(&nx_info_hash_lock);
19360+ goto out;
19361+ }
19362+ }
19363+ /* keep the lock time short */
19364+ spin_unlock(&nx_info_hash_lock);
19365+ }
19366+out:
19367+ return nr_nids;
19368+}
19369+#endif
19370+
19371+
19372+/*
19373+ * migrate task to new network
19374+ * gets nxi, puts old_nxi on change
19375+ */
19376+
19377+int nx_migrate_task(struct task_struct *p, struct nx_info *nxi)
19378+{
19379+ struct nx_info *old_nxi;
19380+ int ret = 0;
19381+
19382+ if (!p || !nxi)
19383+ BUG();
19384+
19385+ vxdprintk(VXD_CBIT(nid, 5),
19386+ "nx_migrate_task(%p,%p[#%d.%d.%d])",
19387+ p, nxi, nxi->nx_id,
19388+ atomic_read(&nxi->nx_usecnt),
19389+ atomic_read(&nxi->nx_tasks));
19390+
19391+ if (nx_info_flags(nxi, NXF_INFO_PRIVATE, 0) &&
19392+ !nx_info_flags(nxi, NXF_STATE_SETUP, 0))
19393+ return -EACCES;
19394+
19395+ if (nx_info_state(nxi, NXS_SHUTDOWN))
19396+ return -EFAULT;
19397+
19398+ /* maybe disallow this completely? */
19399+ old_nxi = task_get_nx_info(p);
19400+ if (old_nxi == nxi)
19401+ goto out;
19402+
19403+ task_lock(p);
19404+ if (old_nxi)
19405+ clr_nx_info(&p->nx_info);
19406+ claim_nx_info(nxi, p);
19407+ set_nx_info(&p->nx_info, nxi);
19408+ p->nid = nxi->nx_id;
19409+ task_unlock(p);
19410+
19411+ vxdprintk(VXD_CBIT(nid, 5),
19412+ "moved task %p into nxi:%p[#%d]",
19413+ p, nxi, nxi->nx_id);
19414+
19415+ if (old_nxi)
19416+ release_nx_info(old_nxi, p);
19417+ ret = 0;
19418+out:
19419+ put_nx_info(old_nxi);
19420+ return ret;
19421+}
19422+
19423+
19424+void nx_set_persistent(struct nx_info *nxi)
19425+{
19426+ vxdprintk(VXD_CBIT(nid, 6),
19427+ "nx_set_persistent(%p[#%d])", nxi, nxi->nx_id);
19428+
19429+ get_nx_info(nxi);
19430+ claim_nx_info(nxi, NULL);
19431+}
19432+
19433+void nx_clear_persistent(struct nx_info *nxi)
19434+{
19435+ vxdprintk(VXD_CBIT(nid, 6),
19436+ "nx_clear_persistent(%p[#%d])", nxi, nxi->nx_id);
19437+
19438+ release_nx_info(nxi, NULL);
19439+ put_nx_info(nxi);
19440+}
19441+
19442+void nx_update_persistent(struct nx_info *nxi)
19443+{
19444+ if (nx_info_flags(nxi, NXF_PERSISTENT, 0))
19445+ nx_set_persistent(nxi);
19446+ else
19447+ nx_clear_persistent(nxi);
19448+}
19449+
19450+/* vserver syscall commands below here */
19451+
19452+/* taks nid and nx_info functions */
19453+
19454+#include <asm/uaccess.h>
19455+
19456+
19457+int vc_task_nid(uint32_t id)
19458+{
19459+ vnid_t nid;
19460+
19461+ if (id) {
19462+ struct task_struct *tsk;
19463+
19464+ rcu_read_lock();
19465+ tsk = find_task_by_real_pid(id);
19466+ nid = (tsk) ? tsk->nid : -ESRCH;
19467+ rcu_read_unlock();
19468+ } else
19469+ nid = nx_current_nid();
19470+ return nid;
19471+}
19472+
19473+
19474+int vc_nx_info(struct nx_info *nxi, void __user *data)
19475+{
19476+ struct vcmd_nx_info_v0 vc_data;
19477+
19478+ vc_data.nid = nxi->nx_id;
19479+
19480+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
19481+ return -EFAULT;
19482+ return 0;
19483+}
19484+
19485+
19486+/* network functions */
19487+
19488+int vc_net_create(uint32_t nid, void __user *data)
19489+{
19490+ struct vcmd_net_create vc_data = { .flagword = NXF_INIT_SET };
19491+ struct nx_info *new_nxi;
19492+ int ret;
19493+
19494+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
19495+ return -EFAULT;
19496+
19497+ if ((nid > MAX_S_CONTEXT) || (nid < 2))
19498+ return -EINVAL;
19499+
19500+ new_nxi = __create_nx_info(nid);
19501+ if (IS_ERR(new_nxi))
19502+ return PTR_ERR(new_nxi);
19503+
19504+ /* initial flags */
19505+ new_nxi->nx_flags = vc_data.flagword;
19506+
19507+ ret = -ENOEXEC;
19508+ if (vs_net_change(new_nxi, VSC_NETUP))
19509+ goto out;
19510+
19511+ ret = nx_migrate_task(current, new_nxi);
19512+ if (ret)
19513+ goto out;
19514+
19515+ /* return context id on success */
19516+ ret = new_nxi->nx_id;
19517+
19518+ /* get a reference for persistent contexts */
19519+ if ((vc_data.flagword & NXF_PERSISTENT))
19520+ nx_set_persistent(new_nxi);
19521+out:
19522+ release_nx_info(new_nxi, NULL);
19523+ put_nx_info(new_nxi);
19524+ return ret;
19525+}
19526+
19527+
19528+int vc_net_migrate(struct nx_info *nxi, void __user *data)
19529+{
19530+ return nx_migrate_task(current, nxi);
19531+}
19532+
19533+
19534+static inline
19535+struct nx_addr_v4 *__find_v4_addr(struct nx_info *nxi,
19536+ __be32 ip, __be32 ip2, __be32 mask, uint16_t type, uint16_t flags,
19537+ struct nx_addr_v4 **prev)
19538+{
19539+ struct nx_addr_v4 *nxa = &nxi->v4;
19540+
19541+ for (; nxa; nxa = nxa->next) {
19542+ if ((nxa->ip[0].s_addr == ip) &&
19543+ (nxa->ip[1].s_addr == ip2) &&
19544+ (nxa->mask.s_addr == mask) &&
19545+ (nxa->type == type) &&
19546+ (nxa->flags == flags))
19547+ return nxa;
19548+
19549+ /* save previous entry */
19550+ if (prev)
19551+ *prev = nxa;
19552+ }
19553+ return NULL;
19554+}
19555+
19556+int do_add_v4_addr(struct nx_info *nxi, __be32 ip, __be32 ip2, __be32 mask,
19557+ uint16_t type, uint16_t flags)
19558+{
19559+ struct nx_addr_v4 *nxa = NULL;
19560+ struct nx_addr_v4 *new = __alloc_nx_addr_v4();
19561+ unsigned long irqflags;
19562+ int ret = -EEXIST;
19563+
19564+ if (IS_ERR(new))
19565+ return PTR_ERR(new);
19566+
19567+ spin_lock_irqsave(&nxi->addr_lock, irqflags);
19568+ if (__find_v4_addr(nxi, ip, ip2, mask, type, flags, &nxa))
19569+ goto out_unlock;
19570+
19571+ if (NX_IPV4(nxi)) {
19572+ nxa->next = new;
19573+ nxa = new;
19574+ new = NULL;
19575+
19576+ /* remove single ip for ip list */
19577+ nxi->nx_flags &= ~NXF_SINGLE_IP;
19578+ }
19579+
19580+ nxa->ip[0].s_addr = ip;
19581+ nxa->ip[1].s_addr = ip2;
19582+ nxa->mask.s_addr = mask;
19583+ nxa->type = type;
19584+ nxa->flags = flags;
19585+ ret = 0;
19586+out_unlock:
19587+ spin_unlock_irqrestore(&nxi->addr_lock, irqflags);
19588+ if (new)
19589+ __dealloc_nx_addr_v4(new);
19590+ return ret;
19591+}
19592+
19593+int do_remove_v4_addr(struct nx_info *nxi, __be32 ip, __be32 ip2, __be32 mask,
19594+ uint16_t type, uint16_t flags)
19595+{
19596+ struct nx_addr_v4 *nxa = NULL;
19597+ struct nx_addr_v4 *old = NULL;
19598+ unsigned long irqflags;
19599+ int ret = 0;
19600+
19601+ spin_lock_irqsave(&nxi->addr_lock, irqflags);
19602+ switch (type) {
19603+ case NXA_TYPE_ADDR:
19604+ old = __find_v4_addr(nxi, ip, ip2, mask, type, flags, &nxa);
19605+ if (old) {
19606+ if (nxa) {
19607+ nxa->next = old->next;
19608+ old->next = NULL;
19609+ } else {
19610+ if (old->next) {
19611+ nxa = old;
19612+ old = old->next;
19613+ *nxa = *old;
19614+ old->next = NULL;
19615+ } else {
19616+ memset(old, 0, sizeof(*old));
19617+ old = NULL;
19618+ }
19619+ }
19620+ } else
19621+ ret = -ESRCH;
19622+ break;
19623+
19624+ case NXA_TYPE_ANY:
19625+ nxa = &nxi->v4;
19626+ old = nxa->next;
19627+ memset(nxa, 0, sizeof(*nxa));
19628+ break;
19629+
19630+ default:
19631+ ret = -EINVAL;
19632+ }
19633+ spin_unlock_irqrestore(&nxi->addr_lock, irqflags);
19634+ __dealloc_nx_addr_v4_all(old);
19635+ return ret;
19636+}
19637+
19638+
19639+int vc_net_add(struct nx_info *nxi, void __user *data)
19640+{
19641+ struct vcmd_net_addr_v0 vc_data;
19642+ int index, ret = 0;
19643+
19644+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
19645+ return -EFAULT;
19646+
19647+ switch (vc_data.type) {
19648+ case NXA_TYPE_IPV4:
19649+ if ((vc_data.count < 1) || (vc_data.count > 4))
19650+ return -EINVAL;
19651+
19652+ index = 0;
19653+ while (index < vc_data.count) {
19654+ ret = do_add_v4_addr(nxi, vc_data.ip[index].s_addr, 0,
19655+ vc_data.mask[index].s_addr, NXA_TYPE_ADDR, 0);
19656+ if (ret)
19657+ return ret;
19658+ index++;
19659+ }
19660+ ret = index;
19661+ break;
19662+
19663+ case NXA_TYPE_IPV4|NXA_MOD_BCAST:
19664+ nxi->v4_bcast = vc_data.ip[0];
19665+ ret = 1;
19666+ break;
19667+
19668+ case NXA_TYPE_IPV4|NXA_MOD_LBACK:
19669+ nxi->v4_lback = vc_data.ip[0];
19670+ ret = 1;
19671+ break;
19672+
19673+ default:
19674+ ret = -EINVAL;
19675+ break;
19676+ }
19677+ return ret;
19678+}
19679+
19680+int vc_net_remove(struct nx_info *nxi, void __user *data)
19681+{
19682+ struct vcmd_net_addr_v0 vc_data;
19683+
19684+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
19685+ return -EFAULT;
19686+
19687+ switch (vc_data.type) {
19688+ case NXA_TYPE_ANY:
19689+ return do_remove_v4_addr(nxi, 0, 0, 0, vc_data.type, 0);
19690+ default:
19691+ return -EINVAL;
19692+ }
19693+ return 0;
19694+}
19695+
19696+
19697+int vc_net_add_ipv4_v1(struct nx_info *nxi, void __user *data)
19698+{
19699+ struct vcmd_net_addr_ipv4_v1 vc_data;
19700+
19701+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
19702+ return -EFAULT;
19703+
19704+ switch (vc_data.type) {
19705+ case NXA_TYPE_ADDR:
19706+ case NXA_TYPE_MASK:
19707+ return do_add_v4_addr(nxi, vc_data.ip.s_addr, 0,
19708+ vc_data.mask.s_addr, vc_data.type, vc_data.flags);
19709+
19710+ case NXA_TYPE_ADDR | NXA_MOD_BCAST:
19711+ nxi->v4_bcast = vc_data.ip;
19712+ break;
19713+
19714+ case NXA_TYPE_ADDR | NXA_MOD_LBACK:
19715+ nxi->v4_lback = vc_data.ip;
19716+ break;
19717+
19718+ default:
19719+ return -EINVAL;
19720+ }
19721+ return 0;
19722+}
19723+
19724+int vc_net_add_ipv4(struct nx_info *nxi, void __user *data)
19725+{
19726+ struct vcmd_net_addr_ipv4_v2 vc_data;
19727+
19728+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
19729+ return -EFAULT;
19730+
19731+ switch (vc_data.type) {
19732+ case NXA_TYPE_ADDR:
19733+ case NXA_TYPE_MASK:
19734+ case NXA_TYPE_RANGE:
19735+ return do_add_v4_addr(nxi, vc_data.ip.s_addr, vc_data.ip2.s_addr,
19736+ vc_data.mask.s_addr, vc_data.type, vc_data.flags);
19737+
19738+ case NXA_TYPE_ADDR | NXA_MOD_BCAST:
19739+ nxi->v4_bcast = vc_data.ip;
19740+ break;
19741+
19742+ case NXA_TYPE_ADDR | NXA_MOD_LBACK:
19743+ nxi->v4_lback = vc_data.ip;
19744+ break;
19745+
19746+ default:
19747+ return -EINVAL;
19748+ }
19749+ return 0;
19750+}
19751+
19752+int vc_net_rem_ipv4_v1(struct nx_info *nxi, void __user *data)
19753+{
19754+ struct vcmd_net_addr_ipv4_v1 vc_data;
19755+
19756+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
19757+ return -EFAULT;
19758+
19759+ return do_remove_v4_addr(nxi, vc_data.ip.s_addr, 0,
19760+ vc_data.mask.s_addr, vc_data.type, vc_data.flags);
19761+}
19762+
19763+int vc_net_rem_ipv4(struct nx_info *nxi, void __user *data)
19764+{
19765+ struct vcmd_net_addr_ipv4_v2 vc_data;
19766+
19767+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
19768+ return -EFAULT;
19769+
19770+ return do_remove_v4_addr(nxi, vc_data.ip.s_addr, vc_data.ip2.s_addr,
19771+ vc_data.mask.s_addr, vc_data.type, vc_data.flags);
19772+}
19773+
19774+#ifdef CONFIG_IPV6
19775+
19776+static inline
19777+struct nx_addr_v6 *__find_v6_addr(struct nx_info *nxi,
19778+ struct in6_addr *ip, struct in6_addr *mask,
19779+ uint32_t prefix, uint16_t type, uint16_t flags,
19780+ struct nx_addr_v6 **prev)
19781+{
19782+ struct nx_addr_v6 *nxa = &nxi->v6;
19783+
19784+ for (; nxa; nxa = nxa->next) {
19785+ if (ipv6_addr_equal(&nxa->ip, ip) &&
19786+ ipv6_addr_equal(&nxa->mask, mask) &&
19787+ (nxa->prefix == prefix) &&
19788+ (nxa->type == type) &&
19789+ (nxa->flags == flags))
19790+ return nxa;
19791+
19792+ /* save previous entry */
19793+ if (prev)
19794+ *prev = nxa;
19795+ }
19796+ return NULL;
19797+}
19798+
19799+
19800+int do_add_v6_addr(struct nx_info *nxi,
19801+ struct in6_addr *ip, struct in6_addr *mask,
19802+ uint32_t prefix, uint16_t type, uint16_t flags)
19803+{
19804+ struct nx_addr_v6 *nxa = NULL;
19805+ struct nx_addr_v6 *new = __alloc_nx_addr_v6();
19806+ unsigned long irqflags;
19807+ int ret = -EEXIST;
19808+
19809+ if (IS_ERR(new))
19810+ return PTR_ERR(new);
19811+
19812+ spin_lock_irqsave(&nxi->addr_lock, irqflags);
19813+ if (__find_v6_addr(nxi, ip, mask, prefix, type, flags, &nxa))
19814+ goto out_unlock;
19815+
19816+ if (NX_IPV6(nxi)) {
19817+ nxa->next = new;
19818+ nxa = new;
19819+ new = NULL;
19820+ }
19821+
19822+ nxa->ip = *ip;
19823+ nxa->mask = *mask;
19824+ nxa->prefix = prefix;
19825+ nxa->type = type;
19826+ nxa->flags = flags;
19827+ ret = 0;
19828+out_unlock:
19829+ spin_unlock_irqrestore(&nxi->addr_lock, irqflags);
19830+ if (new)
19831+ __dealloc_nx_addr_v6(new);
19832+ return ret;
19833+}
19834+
19835+int do_remove_v6_addr(struct nx_info *nxi,
19836+ struct in6_addr *ip, struct in6_addr *mask,
19837+ uint32_t prefix, uint16_t type, uint16_t flags)
19838+{
19839+ struct nx_addr_v6 *nxa = NULL;
19840+ struct nx_addr_v6 *old = NULL;
19841+ unsigned long irqflags;
19842+ int ret = 0;
19843+
19844+ spin_lock_irqsave(&nxi->addr_lock, irqflags);
19845+ switch (type) {
19846+ case NXA_TYPE_ADDR:
19847+ old = __find_v6_addr(nxi, ip, mask, prefix, type, flags, &nxa);
19848+ if (old) {
19849+ if (nxa) {
19850+ nxa->next = old->next;
19851+ old->next = NULL;
19852+ } else {
19853+ if (old->next) {
19854+ nxa = old;
19855+ old = old->next;
19856+ *nxa = *old;
19857+ old->next = NULL;
19858+ } else {
19859+ memset(old, 0, sizeof(*old));
19860+ old = NULL;
19861+ }
19862+ }
19863+ } else
19864+ ret = -ESRCH;
19865+ break;
19866+
19867+ case NXA_TYPE_ANY:
19868+ nxa = &nxi->v6;
19869+ old = nxa->next;
19870+ memset(nxa, 0, sizeof(*nxa));
19871+ break;
19872+
19873+ default:
19874+ ret = -EINVAL;
19875+ }
19876+ spin_unlock_irqrestore(&nxi->addr_lock, irqflags);
19877+ __dealloc_nx_addr_v6_all(old);
19878+ return ret;
19879+}
19880+
19881+int vc_net_add_ipv6(struct nx_info *nxi, void __user *data)
19882+{
19883+ struct vcmd_net_addr_ipv6_v1 vc_data;
19884+
19885+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
19886+ return -EFAULT;
19887+
19888+ switch (vc_data.type) {
19889+ case NXA_TYPE_ADDR:
19890+ memset(&vc_data.mask, ~0, sizeof(vc_data.mask));
19891+ /* fallthrough */
19892+ case NXA_TYPE_MASK:
19893+ return do_add_v6_addr(nxi, &vc_data.ip, &vc_data.mask,
19894+ vc_data.prefix, vc_data.type, vc_data.flags);
19895+ default:
19896+ return -EINVAL;
19897+ }
19898+ return 0;
19899+}
19900+
19901+int vc_net_remove_ipv6(struct nx_info *nxi, void __user *data)
19902+{
19903+ struct vcmd_net_addr_ipv6_v1 vc_data;
19904+
19905+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
19906+ return -EFAULT;
19907+
19908+ switch (vc_data.type) {
19909+ case NXA_TYPE_ADDR:
19910+ memset(&vc_data.mask, ~0, sizeof(vc_data.mask));
19911+ /* fallthrough */
19912+ case NXA_TYPE_MASK:
19913+ return do_remove_v6_addr(nxi, &vc_data.ip, &vc_data.mask,
19914+ vc_data.prefix, vc_data.type, vc_data.flags);
19915+ case NXA_TYPE_ANY:
19916+ return do_remove_v6_addr(nxi, NULL, NULL, 0, vc_data.type, 0);
19917+ default:
19918+ return -EINVAL;
19919+ }
19920+ return 0;
19921+}
19922+
19923+#endif /* CONFIG_IPV6 */
19924+
19925+
19926+int vc_get_nflags(struct nx_info *nxi, void __user *data)
19927+{
19928+ struct vcmd_net_flags_v0 vc_data;
19929+
19930+ vc_data.flagword = nxi->nx_flags;
19931+
19932+ /* special STATE flag handling */
19933+ vc_data.mask = vs_mask_flags(~0ULL, nxi->nx_flags, NXF_ONE_TIME);
19934+
19935+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
19936+ return -EFAULT;
19937+ return 0;
19938+}
19939+
19940+int vc_set_nflags(struct nx_info *nxi, void __user *data)
19941+{
19942+ struct vcmd_net_flags_v0 vc_data;
19943+ uint64_t mask, trigger;
19944+
19945+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
19946+ return -EFAULT;
19947+
19948+ /* special STATE flag handling */
19949+ mask = vs_mask_mask(vc_data.mask, nxi->nx_flags, NXF_ONE_TIME);
19950+ trigger = (mask & nxi->nx_flags) ^ (mask & vc_data.flagword);
19951+
19952+ nxi->nx_flags = vs_mask_flags(nxi->nx_flags,
19953+ vc_data.flagword, mask);
19954+ if (trigger & NXF_PERSISTENT)
19955+ nx_update_persistent(nxi);
19956+
19957+ return 0;
19958+}
19959+
19960+int vc_get_ncaps(struct nx_info *nxi, void __user *data)
19961+{
19962+ struct vcmd_net_caps_v0 vc_data;
19963+
19964+ vc_data.ncaps = nxi->nx_ncaps;
19965+ vc_data.cmask = ~0ULL;
19966+
19967+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
19968+ return -EFAULT;
19969+ return 0;
19970+}
19971+
19972+int vc_set_ncaps(struct nx_info *nxi, void __user *data)
19973+{
19974+ struct vcmd_net_caps_v0 vc_data;
19975+
19976+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
19977+ return -EFAULT;
19978+
19979+ nxi->nx_ncaps = vs_mask_flags(nxi->nx_ncaps,
19980+ vc_data.ncaps, vc_data.cmask);
19981+ return 0;
19982+}
19983+
19984+
19985+#include <linux/module.h>
19986+
19987+module_init(init_network);
19988+
19989+EXPORT_SYMBOL_GPL(free_nx_info);
19990+EXPORT_SYMBOL_GPL(unhash_nx_info);
19991+
19992diff -NurpP --minimal linux-4.4.116/kernel/vserver/proc.c linux-4.4.116-vs2.3.9.7/kernel/vserver/proc.c
19993--- linux-4.4.116/kernel/vserver/proc.c 1970-01-01 00:00:00.000000000 +0000
19994+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/proc.c 2018-01-11 12:02:42.000000000 +0000
19995@@ -0,0 +1,1040 @@
19996+/*
19997+ * linux/kernel/vserver/proc.c
19998+ *
19999+ * Virtual Context Support
20000+ *
20001+ * Copyright (C) 2003-2011 Herbert P?tzl
20002+ *
20003+ * V0.01 basic structure
20004+ * V0.02 adaptation vs1.3.0
20005+ * V0.03 proc permissions
20006+ * V0.04 locking/generic
20007+ * V0.05 next generation procfs
20008+ * V0.06 inode validation
20009+ * V0.07 generic rewrite vid
20010+ * V0.08 remove inode type
20011+ * V0.09 added u/wmask info
20012+ *
20013+ */
20014+
20015+#include <linux/proc_fs.h>
20016+#include <linux/fs_struct.h>
20017+#include <linux/mount.h>
20018+#include <linux/namei.h>
20019+#include <asm/unistd.h>
20020+
20021+#include <linux/vs_context.h>
20022+#include <linux/vs_network.h>
20023+#include <linux/vs_cvirt.h>
20024+
20025+#include <linux/in.h>
20026+#include <linux/inetdevice.h>
20027+#include <linux/vs_inet.h>
20028+#include <linux/vs_inet6.h>
20029+
20030+#include <linux/vserver/global.h>
20031+
20032+#include "cvirt_proc.h"
20033+#include "cacct_proc.h"
20034+#include "limit_proc.h"
20035+#include "sched_proc.h"
20036+#include "vci_config.h"
20037+
20038+#include <../../fs/proc/internal.h>
20039+
20040+
20041+static inline char *print_cap_t(char *buffer, kernel_cap_t *c)
20042+{
20043+ unsigned __capi;
20044+
20045+ CAP_FOR_EACH_U32(__capi) {
20046+ buffer += sprintf(buffer, "%08x",
20047+ c->cap[(_KERNEL_CAPABILITY_U32S-1) - __capi]);
20048+ }
20049+ return buffer;
20050+}
20051+
20052+
20053+static struct proc_dir_entry *proc_virtual;
20054+
20055+static struct proc_dir_entry *proc_virtnet;
20056+
20057+
20058+/* first the actual feeds */
20059+
20060+
20061+static int proc_vci(char *buffer)
20062+{
20063+ return sprintf(buffer,
20064+ "VCIVersion:\t%04x:%04x\n"
20065+ "VCISyscall:\t%d\n"
20066+ "VCIKernel:\t%08x\n",
20067+ VCI_VERSION >> 16,
20068+ VCI_VERSION & 0xFFFF,
20069+ __NR_vserver,
20070+ vci_kernel_config());
20071+}
20072+
20073+static int proc_virtual_info(char *buffer)
20074+{
20075+ return proc_vci(buffer);
20076+}
20077+
20078+static int proc_virtual_status(char *buffer)
20079+{
20080+ return sprintf(buffer,
20081+ "#CTotal:\t%d\n"
20082+ "#CActive:\t%d\n"
20083+ "#NSProxy:\t%d\t%d %d %d %d %d %d\n"
20084+ "#InitTask:\t%d\t%d %d\n",
20085+ atomic_read(&vx_global_ctotal),
20086+ atomic_read(&vx_global_cactive),
20087+ atomic_read(&vs_global_nsproxy),
20088+ atomic_read(&vs_global_fs),
20089+ atomic_read(&vs_global_mnt_ns),
20090+ atomic_read(&vs_global_uts_ns),
20091+ atomic_read(&nr_ipc_ns),
20092+ atomic_read(&vs_global_user_ns),
20093+ atomic_read(&vs_global_pid_ns),
20094+ atomic_read(&init_task.usage),
20095+ atomic_read(&init_task.nsproxy->count),
20096+ init_task.fs->users);
20097+}
20098+
20099+
20100+int proc_vxi_info(struct vx_info *vxi, char *buffer)
20101+{
20102+ int length;
20103+
20104+ length = sprintf(buffer,
20105+ "ID:\t%d\n"
20106+ "Info:\t%p\n"
20107+ "Init:\t%d\n"
20108+ "OOM:\t%lld\n",
20109+ vxi->vx_id,
20110+ vxi,
20111+ vxi->vx_initpid,
20112+ vxi->vx_badness_bias);
20113+ return length;
20114+}
20115+
20116+int proc_vxi_status(struct vx_info *vxi, char *buffer)
20117+{
20118+ char *orig = buffer;
20119+
20120+ buffer += sprintf(buffer,
20121+ "UseCnt:\t%d\n"
20122+ "Tasks:\t%d\n"
20123+ "Flags:\t%016llx\n",
20124+ atomic_read(&vxi->vx_usecnt),
20125+ atomic_read(&vxi->vx_tasks),
20126+ (unsigned long long)vxi->vx_flags);
20127+
20128+ buffer += sprintf(buffer, "BCaps:\t");
20129+ buffer = print_cap_t(buffer, &vxi->vx_bcaps);
20130+ buffer += sprintf(buffer, "\n");
20131+
20132+ buffer += sprintf(buffer,
20133+ "CCaps:\t%016llx\n"
20134+ "Umask:\t%16llx\n"
20135+ "Wmask:\t%16llx\n"
20136+ "Spaces:\t%08lx %08lx\n",
20137+ (unsigned long long)vxi->vx_ccaps,
20138+ (unsigned long long)vxi->vx_umask,
20139+ (unsigned long long)vxi->vx_wmask,
20140+ vxi->space[0].vx_nsmask, vxi->space[1].vx_nsmask);
20141+ return buffer - orig;
20142+}
20143+
20144+int proc_vxi_limit(struct vx_info *vxi, char *buffer)
20145+{
20146+ return vx_info_proc_limit(&vxi->limit, buffer);
20147+}
20148+
20149+int proc_vxi_sched(struct vx_info *vxi, char *buffer)
20150+{
20151+ int cpu, length;
20152+
20153+ length = vx_info_proc_sched(&vxi->sched, buffer);
20154+ for_each_online_cpu(cpu) {
20155+ length += vx_info_proc_sched_pc(
20156+ &vx_per_cpu(vxi, sched_pc, cpu),
20157+ buffer + length, cpu);
20158+ }
20159+ return length;
20160+}
20161+
20162+int proc_vxi_nsproxy0(struct vx_info *vxi, char *buffer)
20163+{
20164+ return vx_info_proc_nsproxy(vxi->space[0].vx_nsproxy, buffer);
20165+}
20166+
20167+int proc_vxi_nsproxy1(struct vx_info *vxi, char *buffer)
20168+{
20169+ return vx_info_proc_nsproxy(vxi->space[1].vx_nsproxy, buffer);
20170+}
20171+
20172+int proc_vxi_cvirt(struct vx_info *vxi, char *buffer)
20173+{
20174+ int cpu, length;
20175+
20176+ vx_update_load(vxi);
20177+ length = vx_info_proc_cvirt(&vxi->cvirt, buffer);
20178+ for_each_online_cpu(cpu) {
20179+ length += vx_info_proc_cvirt_pc(
20180+ &vx_per_cpu(vxi, cvirt_pc, cpu),
20181+ buffer + length, cpu);
20182+ }
20183+ return length;
20184+}
20185+
20186+int proc_vxi_cacct(struct vx_info *vxi, char *buffer)
20187+{
20188+ return vx_info_proc_cacct(&vxi->cacct, buffer);
20189+}
20190+
20191+
20192+static int proc_virtnet_info(char *buffer)
20193+{
20194+ return proc_vci(buffer);
20195+}
20196+
20197+static int proc_virtnet_status(char *buffer)
20198+{
20199+ return sprintf(buffer,
20200+ "#CTotal:\t%d\n"
20201+ "#CActive:\t%d\n",
20202+ atomic_read(&nx_global_ctotal),
20203+ atomic_read(&nx_global_cactive));
20204+}
20205+
20206+int proc_nxi_info(struct nx_info *nxi, char *buffer)
20207+{
20208+ struct nx_addr_v4 *v4a;
20209+#ifdef CONFIG_IPV6
20210+ struct nx_addr_v6 *v6a;
20211+#endif
20212+ int length, i;
20213+
20214+ length = sprintf(buffer,
20215+ "ID:\t%d\n"
20216+ "Info:\t%p\n"
20217+ "Bcast:\t" NIPQUAD_FMT "\n"
20218+ "Lback:\t" NIPQUAD_FMT "\n",
20219+ nxi->nx_id,
20220+ nxi,
20221+ NIPQUAD(nxi->v4_bcast.s_addr),
20222+ NIPQUAD(nxi->v4_lback.s_addr));
20223+
20224+ if (!NX_IPV4(nxi))
20225+ goto skip_v4;
20226+ for (i = 0, v4a = &nxi->v4; v4a; i++, v4a = v4a->next)
20227+ length += sprintf(buffer + length, "%d:\t" NXAV4_FMT "\n",
20228+ i, NXAV4(v4a));
20229+skip_v4:
20230+#ifdef CONFIG_IPV6
20231+ if (!NX_IPV6(nxi))
20232+ goto skip_v6;
20233+ for (i = 0, v6a = &nxi->v6; v6a; i++, v6a = v6a->next)
20234+ length += sprintf(buffer + length, "%d:\t" NXAV6_FMT "\n",
20235+ i, NXAV6(v6a));
20236+skip_v6:
20237+#endif
20238+ return length;
20239+}
20240+
20241+int proc_nxi_status(struct nx_info *nxi, char *buffer)
20242+{
20243+ int length;
20244+
20245+ length = sprintf(buffer,
20246+ "UseCnt:\t%d\n"
20247+ "Tasks:\t%d\n"
20248+ "Flags:\t%016llx\n"
20249+ "NCaps:\t%016llx\n",
20250+ atomic_read(&nxi->nx_usecnt),
20251+ atomic_read(&nxi->nx_tasks),
20252+ (unsigned long long)nxi->nx_flags,
20253+ (unsigned long long)nxi->nx_ncaps);
20254+ return length;
20255+}
20256+
20257+
20258+
20259+/* here the inode helpers */
20260+
20261+struct vs_entry {
20262+ int len;
20263+ char *name;
20264+ mode_t mode;
20265+ struct inode_operations *iop;
20266+ struct file_operations *fop;
20267+ union proc_op op;
20268+};
20269+
20270+static struct inode *vs_proc_make_inode(struct super_block *sb, struct vs_entry *p)
20271+{
20272+ struct inode *inode = new_inode(sb);
20273+
20274+ if (!inode)
20275+ goto out;
20276+
20277+ inode->i_mode = p->mode;
20278+ if (p->iop)
20279+ inode->i_op = p->iop;
20280+ if (p->fop)
20281+ inode->i_fop = p->fop;
20282+
20283+ set_nlink(inode, (p->mode & S_IFDIR) ? 2 : 1);
20284+ inode->i_flags |= S_IMMUTABLE;
20285+
20286+ inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
20287+
20288+ i_uid_write(inode, 0);
20289+ i_gid_write(inode, 0);
20290+ i_tag_write(inode, 0);
20291+out:
20292+ return inode;
20293+}
20294+
20295+static struct dentry *vs_proc_instantiate(struct inode *dir,
20296+ struct dentry *dentry, int id, void *ptr)
20297+{
20298+ struct vs_entry *p = ptr;
20299+ struct inode *inode = vs_proc_make_inode(dir->i_sb, p);
20300+ struct dentry *error = ERR_PTR(-EINVAL);
20301+
20302+ if (!inode)
20303+ goto out;
20304+
20305+ PROC_I(inode)->op = p->op;
20306+ PROC_I(inode)->fd = id;
20307+ d_add(dentry, inode);
20308+ error = NULL;
20309+out:
20310+ return error;
20311+}
20312+
20313+/* Lookups */
20314+
20315+typedef struct dentry *vx_instantiate_t(struct inode *, struct dentry *, int, void *);
20316+
20317+
20318+/*
20319+ * Fill a directory entry.
20320+ *
20321+ * If possible create the dcache entry and derive our inode number and
20322+ * file type from dcache entry.
20323+ *
20324+ * Since all of the proc inode numbers are dynamically generated, the inode
20325+ * numbers do not exist until the inode is cache. This means creating the
20326+ * the dcache entry in iterate is necessary to keep the inode numbers
20327+ * reported by iterate in sync with the inode numbers reported
20328+ * by stat.
20329+ */
20330+static int vx_proc_fill_cache(struct file *filp, struct dir_context *ctx,
20331+ char *name, int len, vx_instantiate_t instantiate, int id, void *ptr)
20332+{
20333+ struct dentry *child, *dir = filp->f_path.dentry;
20334+ struct inode *inode;
20335+ struct qstr qname;
20336+ ino_t ino = 0;
20337+ unsigned type = DT_UNKNOWN;
20338+
20339+ qname.name = name;
20340+ qname.len = len;
20341+ qname.hash = full_name_hash(name, len);
20342+
20343+ child = d_lookup(dir, &qname);
20344+ if (!child) {
20345+ struct dentry *new;
20346+ new = d_alloc(dir, &qname);
20347+ if (new) {
20348+ child = instantiate(dir->d_inode, new, id, ptr);
20349+ if (child)
20350+ dput(new);
20351+ else
20352+ child = new;
20353+ }
20354+ }
20355+ if (!child || IS_ERR(child) || !child->d_inode)
20356+ goto end_instantiate;
20357+ inode = child->d_inode;
20358+ if (inode) {
20359+ ino = inode->i_ino;
20360+ type = inode->i_mode >> 12;
20361+ }
20362+ dput(child);
20363+end_instantiate:
20364+ if (!ino)
20365+ ino = 1;
20366+ return !dir_emit(ctx, name, len, ino, type);
20367+}
20368+
20369+
20370+
20371+/* get and revalidate vx_info/xid */
20372+
20373+static inline
20374+struct vx_info *get_proc_vx_info(struct inode *inode)
20375+{
20376+ return lookup_vx_info(PROC_I(inode)->fd);
20377+}
20378+
20379+static int proc_xid_revalidate(struct dentry *dentry, unsigned int flags)
20380+{
20381+ struct inode *inode = dentry->d_inode;
20382+ vxid_t xid = PROC_I(inode)->fd;
20383+
20384+ if (flags & LOOKUP_RCU) /* FIXME: can be dropped? */
20385+ return -ECHILD;
20386+
20387+ if (!xid || xid_is_hashed(xid))
20388+ return 1;
20389+ d_drop(dentry);
20390+ return 0;
20391+}
20392+
20393+
20394+/* get and revalidate nx_info/nid */
20395+
20396+static int proc_nid_revalidate(struct dentry *dentry, unsigned int flags)
20397+{
20398+ struct inode *inode = dentry->d_inode;
20399+ vnid_t nid = PROC_I(inode)->fd;
20400+
20401+ if (flags & LOOKUP_RCU) /* FIXME: can be dropped? */
20402+ return -ECHILD;
20403+
20404+ if (!nid || nid_is_hashed(nid))
20405+ return 1;
20406+ d_drop(dentry);
20407+ return 0;
20408+}
20409+
20410+
20411+
20412+#define PROC_BLOCK_SIZE (PAGE_SIZE - 1024)
20413+
20414+static ssize_t proc_vs_info_read(struct file *file, char __user *buf,
20415+ size_t count, loff_t *ppos)
20416+{
20417+ struct inode *inode = file->f_path.dentry->d_inode;
20418+ unsigned long page;
20419+ ssize_t length = 0;
20420+
20421+ if (count > PROC_BLOCK_SIZE)
20422+ count = PROC_BLOCK_SIZE;
20423+
20424+ /* fade that out as soon as stable */
20425+ WARN_ON(PROC_I(inode)->fd);
20426+
20427+ if (!(page = __get_free_page(GFP_KERNEL)))
20428+ return -ENOMEM;
20429+
20430+ BUG_ON(!PROC_I(inode)->op.proc_vs_read);
20431+ length = PROC_I(inode)->op.proc_vs_read((char *)page);
20432+
20433+ if (length >= 0)
20434+ length = simple_read_from_buffer(buf, count, ppos,
20435+ (char *)page, length);
20436+
20437+ free_page(page);
20438+ return length;
20439+}
20440+
20441+static ssize_t proc_vx_info_read(struct file *file, char __user *buf,
20442+ size_t count, loff_t *ppos)
20443+{
20444+ struct inode *inode = file->f_path.dentry->d_inode;
20445+ struct vx_info *vxi = NULL;
20446+ vxid_t xid = PROC_I(inode)->fd;
20447+ unsigned long page;
20448+ ssize_t length = 0;
20449+
20450+ if (count > PROC_BLOCK_SIZE)
20451+ count = PROC_BLOCK_SIZE;
20452+
20453+ /* fade that out as soon as stable */
20454+ WARN_ON(!xid);
20455+ vxi = lookup_vx_info(xid);
20456+ if (!vxi)
20457+ goto out;
20458+
20459+ length = -ENOMEM;
20460+ if (!(page = __get_free_page(GFP_KERNEL)))
20461+ goto out_put;
20462+
20463+ BUG_ON(!PROC_I(inode)->op.proc_vxi_read);
20464+ length = PROC_I(inode)->op.proc_vxi_read(vxi, (char *)page);
20465+
20466+ if (length >= 0)
20467+ length = simple_read_from_buffer(buf, count, ppos,
20468+ (char *)page, length);
20469+
20470+ free_page(page);
20471+out_put:
20472+ put_vx_info(vxi);
20473+out:
20474+ return length;
20475+}
20476+
20477+static ssize_t proc_nx_info_read(struct file *file, char __user *buf,
20478+ size_t count, loff_t *ppos)
20479+{
20480+ struct inode *inode = file->f_path.dentry->d_inode;
20481+ struct nx_info *nxi = NULL;
20482+ vnid_t nid = PROC_I(inode)->fd;
20483+ unsigned long page;
20484+ ssize_t length = 0;
20485+
20486+ if (count > PROC_BLOCK_SIZE)
20487+ count = PROC_BLOCK_SIZE;
20488+
20489+ /* fade that out as soon as stable */
20490+ WARN_ON(!nid);
20491+ nxi = lookup_nx_info(nid);
20492+ if (!nxi)
20493+ goto out;
20494+
20495+ length = -ENOMEM;
20496+ if (!(page = __get_free_page(GFP_KERNEL)))
20497+ goto out_put;
20498+
20499+ BUG_ON(!PROC_I(inode)->op.proc_nxi_read);
20500+ length = PROC_I(inode)->op.proc_nxi_read(nxi, (char *)page);
20501+
20502+ if (length >= 0)
20503+ length = simple_read_from_buffer(buf, count, ppos,
20504+ (char *)page, length);
20505+
20506+ free_page(page);
20507+out_put:
20508+ put_nx_info(nxi);
20509+out:
20510+ return length;
20511+}
20512+
20513+
20514+
20515+/* here comes the lower level */
20516+
20517+
20518+#define NOD(NAME, MODE, IOP, FOP, OP) { \
20519+ .len = sizeof(NAME) - 1, \
20520+ .name = (NAME), \
20521+ .mode = MODE, \
20522+ .iop = IOP, \
20523+ .fop = FOP, \
20524+ .op = OP, \
20525+}
20526+
20527+
20528+#define DIR(NAME, MODE, OTYPE) \
20529+ NOD(NAME, (S_IFDIR | (MODE)), \
20530+ &proc_ ## OTYPE ## _inode_operations, \
20531+ &proc_ ## OTYPE ## _file_operations, { } )
20532+
20533+#define INF(NAME, MODE, OTYPE) \
20534+ NOD(NAME, (S_IFREG | (MODE)), NULL, \
20535+ &proc_vs_info_file_operations, \
20536+ { .proc_vs_read = &proc_##OTYPE } )
20537+
20538+#define VINF(NAME, MODE, OTYPE) \
20539+ NOD(NAME, (S_IFREG | (MODE)), NULL, \
20540+ &proc_vx_info_file_operations, \
20541+ { .proc_vxi_read = &proc_##OTYPE } )
20542+
20543+#define NINF(NAME, MODE, OTYPE) \
20544+ NOD(NAME, (S_IFREG | (MODE)), NULL, \
20545+ &proc_nx_info_file_operations, \
20546+ { .proc_nxi_read = &proc_##OTYPE } )
20547+
20548+
20549+static struct file_operations proc_vs_info_file_operations = {
20550+ .read = proc_vs_info_read,
20551+};
20552+
20553+static struct file_operations proc_vx_info_file_operations = {
20554+ .read = proc_vx_info_read,
20555+};
20556+
20557+static struct dentry_operations proc_xid_dentry_operations = {
20558+ .d_revalidate = proc_xid_revalidate,
20559+};
20560+
20561+static struct vs_entry vx_base_stuff[] = {
20562+ VINF("info", S_IRUGO, vxi_info),
20563+ VINF("status", S_IRUGO, vxi_status),
20564+ VINF("limit", S_IRUGO, vxi_limit),
20565+ VINF("sched", S_IRUGO, vxi_sched),
20566+ VINF("nsproxy", S_IRUGO, vxi_nsproxy0),
20567+ VINF("nsproxy1",S_IRUGO, vxi_nsproxy1),
20568+ VINF("cvirt", S_IRUGO, vxi_cvirt),
20569+ VINF("cacct", S_IRUGO, vxi_cacct),
20570+ {}
20571+};
20572+
20573+
20574+
20575+
20576+static struct dentry *proc_xid_instantiate(struct inode *dir,
20577+ struct dentry *dentry, int id, void *ptr)
20578+{
20579+ dentry->d_op = &proc_xid_dentry_operations;
20580+ return vs_proc_instantiate(dir, dentry, id, ptr);
20581+}
20582+
20583+static struct dentry *proc_xid_lookup(struct inode *dir,
20584+ struct dentry *dentry, unsigned int flags)
20585+{
20586+ struct vs_entry *p = vx_base_stuff;
20587+ struct dentry *error = ERR_PTR(-ENOENT);
20588+
20589+ for (; p->name; p++) {
20590+ if (p->len != dentry->d_name.len)
20591+ continue;
20592+ if (!memcmp(dentry->d_name.name, p->name, p->len))
20593+ break;
20594+ }
20595+ if (!p->name)
20596+ goto out;
20597+
20598+ error = proc_xid_instantiate(dir, dentry, PROC_I(dir)->fd, p);
20599+out:
20600+ return error;
20601+}
20602+
20603+static int proc_xid_iterate(struct file *filp, struct dir_context *ctx)
20604+{
20605+ struct dentry *dentry = filp->f_path.dentry;
20606+ struct inode *inode = dentry->d_inode;
20607+ struct vs_entry *p = vx_base_stuff;
20608+ int size = sizeof(vx_base_stuff) / sizeof(struct vs_entry);
20609+ int index;
20610+
20611+ if (!dir_emit_dots(filp, ctx))
20612+ return 0;
20613+
20614+ index = ctx->pos - 2;
20615+ if (index < size) {
20616+ for (p += index; p->name; p++) {
20617+ if (vx_proc_fill_cache(filp, ctx, p->name, p->len,
20618+ vs_proc_instantiate, PROC_I(inode)->fd, p))
20619+ return 0;
20620+ ctx->pos++;
20621+ }
20622+ }
20623+ return 1;
20624+}
20625+
20626+
20627+
20628+static struct file_operations proc_nx_info_file_operations = {
20629+ .read = proc_nx_info_read,
20630+};
20631+
20632+static struct dentry_operations proc_nid_dentry_operations = {
20633+ .d_revalidate = proc_nid_revalidate,
20634+};
20635+
20636+static struct vs_entry nx_base_stuff[] = {
20637+ NINF("info", S_IRUGO, nxi_info),
20638+ NINF("status", S_IRUGO, nxi_status),
20639+ {}
20640+};
20641+
20642+
20643+static struct dentry *proc_nid_instantiate(struct inode *dir,
20644+ struct dentry *dentry, int id, void *ptr)
20645+{
20646+ dentry->d_op = &proc_nid_dentry_operations;
20647+ return vs_proc_instantiate(dir, dentry, id, ptr);
20648+}
20649+
20650+static struct dentry *proc_nid_lookup(struct inode *dir,
20651+ struct dentry *dentry, unsigned int flags)
20652+{
20653+ struct vs_entry *p = nx_base_stuff;
20654+ struct dentry *error = ERR_PTR(-ENOENT);
20655+
20656+ for (; p->name; p++) {
20657+ if (p->len != dentry->d_name.len)
20658+ continue;
20659+ if (!memcmp(dentry->d_name.name, p->name, p->len))
20660+ break;
20661+ }
20662+ if (!p->name)
20663+ goto out;
20664+
20665+ error = proc_nid_instantiate(dir, dentry, PROC_I(dir)->fd, p);
20666+out:
20667+ return error;
20668+}
20669+
20670+static int proc_nid_iterate(struct file *filp, struct dir_context *ctx)
20671+{
20672+ struct dentry *dentry = filp->f_path.dentry;
20673+ struct inode *inode = dentry->d_inode;
20674+ struct vs_entry *p = nx_base_stuff;
20675+ int size = sizeof(nx_base_stuff) / sizeof(struct vs_entry);
20676+ int index;
20677+
20678+ if (!dir_emit_dots(filp, ctx))
20679+ return 0;
20680+
20681+ index = ctx->pos - 2;
20682+ if (index < size) {
20683+ for (p += index; p->name; p++) {
20684+ if (vx_proc_fill_cache(filp, ctx, p->name, p->len,
20685+ vs_proc_instantiate, PROC_I(inode)->fd, p))
20686+ return 0;
20687+ ctx->pos++;
20688+ }
20689+ }
20690+ return 1;
20691+}
20692+
20693+
20694+#define MAX_MULBY10 ((~0U - 9) / 10)
20695+
20696+static inline int atovid(const char *str, int len)
20697+{
20698+ int vid, c;
20699+
20700+ vid = 0;
20701+ while (len-- > 0) {
20702+ c = *str - '0';
20703+ str++;
20704+ if (c > 9)
20705+ return -1;
20706+ if (vid >= MAX_MULBY10)
20707+ return -1;
20708+ vid *= 10;
20709+ vid += c;
20710+ if (!vid)
20711+ return -1;
20712+ }
20713+ return vid;
20714+}
20715+
20716+/* now the upper level (virtual) */
20717+
20718+
20719+static struct file_operations proc_xid_file_operations = {
20720+ .read = generic_read_dir,
20721+ .iterate = proc_xid_iterate,
20722+};
20723+
20724+static struct inode_operations proc_xid_inode_operations = {
20725+ .lookup = proc_xid_lookup,
20726+};
20727+
20728+static struct vs_entry vx_virtual_stuff[] = {
20729+ INF("info", S_IRUGO, virtual_info),
20730+ INF("status", S_IRUGO, virtual_status),
20731+ DIR(NULL, S_IRUGO | S_IXUGO, xid),
20732+};
20733+
20734+
20735+static struct dentry *proc_virtual_lookup(struct inode *dir,
20736+ struct dentry *dentry, unsigned int flags)
20737+{
20738+ struct vs_entry *p = vx_virtual_stuff;
20739+ struct dentry *error = ERR_PTR(-ENOENT);
20740+ int id = 0;
20741+
20742+ for (; p->name; p++) {
20743+ if (p->len != dentry->d_name.len)
20744+ continue;
20745+ if (!memcmp(dentry->d_name.name, p->name, p->len))
20746+ break;
20747+ }
20748+ if (p->name)
20749+ goto instantiate;
20750+
20751+ id = atovid(dentry->d_name.name, dentry->d_name.len);
20752+ if ((id < 0) || !xid_is_hashed(id))
20753+ goto out;
20754+
20755+instantiate:
20756+ error = proc_xid_instantiate(dir, dentry, id, p);
20757+out:
20758+ return error;
20759+}
20760+
20761+static struct file_operations proc_nid_file_operations = {
20762+ .read = generic_read_dir,
20763+ .iterate = proc_nid_iterate,
20764+};
20765+
20766+static struct inode_operations proc_nid_inode_operations = {
20767+ .lookup = proc_nid_lookup,
20768+};
20769+
20770+static struct vs_entry nx_virtnet_stuff[] = {
20771+ INF("info", S_IRUGO, virtnet_info),
20772+ INF("status", S_IRUGO, virtnet_status),
20773+ DIR(NULL, S_IRUGO | S_IXUGO, nid),
20774+};
20775+
20776+
20777+static struct dentry *proc_virtnet_lookup(struct inode *dir,
20778+ struct dentry *dentry, unsigned int flags)
20779+{
20780+ struct vs_entry *p = nx_virtnet_stuff;
20781+ struct dentry *error = ERR_PTR(-ENOENT);
20782+ int id = 0;
20783+
20784+ for (; p->name; p++) {
20785+ if (p->len != dentry->d_name.len)
20786+ continue;
20787+ if (!memcmp(dentry->d_name.name, p->name, p->len))
20788+ break;
20789+ }
20790+ if (p->name)
20791+ goto instantiate;
20792+
20793+ id = atovid(dentry->d_name.name, dentry->d_name.len);
20794+ if ((id < 0) || !nid_is_hashed(id))
20795+ goto out;
20796+
20797+instantiate:
20798+ error = proc_nid_instantiate(dir, dentry, id, p);
20799+out:
20800+ return error;
20801+}
20802+
20803+
20804+#define PROC_MAXVIDS 32
20805+
20806+int proc_virtual_iterate(struct file *filp, struct dir_context *ctx)
20807+{
20808+ struct vs_entry *p = vx_virtual_stuff;
20809+ int size = sizeof(vx_virtual_stuff) / sizeof(struct vs_entry);
20810+ int index;
20811+ unsigned int xid_array[PROC_MAXVIDS];
20812+ char buf[PROC_NUMBUF];
20813+ unsigned int nr_xids, i;
20814+
20815+ if (!dir_emit_dots(filp, ctx))
20816+ return 0;
20817+
20818+ index = ctx->pos - 2;
20819+ if (index < size) {
20820+ for (p += index; p->name; p++) {
20821+ if (vx_proc_fill_cache(filp, ctx, p->name, p->len,
20822+ vs_proc_instantiate, 0, p))
20823+ return 0;
20824+ ctx->pos++;
20825+ }
20826+ }
20827+
20828+ index = ctx->pos - size;
20829+ p = &vx_virtual_stuff[size - 1];
20830+ nr_xids = get_xid_list(index, xid_array, PROC_MAXVIDS);
20831+ for (i = 0; i < nr_xids; i++) {
20832+ int n, xid = xid_array[i];
20833+ unsigned int j = PROC_NUMBUF;
20834+
20835+ n = xid;
20836+ do
20837+ buf[--j] = '0' + (n % 10);
20838+ while (n /= 10);
20839+
20840+ if (vx_proc_fill_cache(filp, ctx,
20841+ buf + j, PROC_NUMBUF - j,
20842+ vs_proc_instantiate, xid, p))
20843+ return 0;
20844+ ctx->pos++;
20845+ }
20846+ return 0;
20847+}
20848+
20849+static int proc_virtual_getattr(struct vfsmount *mnt,
20850+ struct dentry *dentry, struct kstat *stat)
20851+{
20852+ struct inode *inode = dentry->d_inode;
20853+
20854+ generic_fillattr(inode, stat);
20855+ stat->nlink = 2 + atomic_read(&vx_global_cactive);
20856+ return 0;
20857+}
20858+
20859+static struct file_operations proc_virtual_dir_operations = {
20860+ .read = generic_read_dir,
20861+ .iterate = proc_virtual_iterate,
20862+};
20863+
20864+static struct inode_operations proc_virtual_dir_inode_operations = {
20865+ .getattr = proc_virtual_getattr,
20866+ .lookup = proc_virtual_lookup,
20867+};
20868+
20869+
20870+
20871+int proc_virtnet_iterate(struct file *filp, struct dir_context *ctx)
20872+{
20873+ struct vs_entry *p = nx_virtnet_stuff;
20874+ int size = sizeof(nx_virtnet_stuff) / sizeof(struct vs_entry);
20875+ int index;
20876+ unsigned int nid_array[PROC_MAXVIDS];
20877+ char buf[PROC_NUMBUF];
20878+ unsigned int nr_nids, i;
20879+
20880+ if (!dir_emit_dots(filp, ctx))
20881+ return 0;
20882+
20883+ index = ctx->pos - 2;
20884+ if (index < size) {
20885+ for (p += index; p->name; p++) {
20886+ if (vx_proc_fill_cache(filp, ctx, p->name, p->len,
20887+ vs_proc_instantiate, 0, p))
20888+ return 0;
20889+ ctx->pos++;
20890+ }
20891+ }
20892+
20893+ index = ctx->pos - size;
20894+ p = &nx_virtnet_stuff[size - 1];
20895+ nr_nids = get_nid_list(index, nid_array, PROC_MAXVIDS);
20896+ for (i = 0; i < nr_nids; i++) {
20897+ int n, nid = nid_array[i];
20898+ unsigned int j = PROC_NUMBUF;
20899+
20900+ n = nid;
20901+ do
20902+ buf[--j] = '0' + (n % 10);
20903+ while (n /= 10);
20904+
20905+ if (vx_proc_fill_cache(filp, ctx,
20906+ buf + j, PROC_NUMBUF - j,
20907+ vs_proc_instantiate, nid, p))
20908+ return 0;
20909+ ctx->pos++;
20910+ }
20911+ return 0;
20912+}
20913+
20914+static int proc_virtnet_getattr(struct vfsmount *mnt,
20915+ struct dentry *dentry, struct kstat *stat)
20916+{
20917+ struct inode *inode = dentry->d_inode;
20918+
20919+ generic_fillattr(inode, stat);
20920+ stat->nlink = 2 + atomic_read(&nx_global_cactive);
20921+ return 0;
20922+}
20923+
20924+static struct file_operations proc_virtnet_dir_operations = {
20925+ .read = generic_read_dir,
20926+ .iterate = proc_virtnet_iterate,
20927+};
20928+
20929+static struct inode_operations proc_virtnet_dir_inode_operations = {
20930+ .getattr = proc_virtnet_getattr,
20931+ .lookup = proc_virtnet_lookup,
20932+};
20933+
20934+
20935+
20936+void proc_vx_init(void)
20937+{
20938+ struct proc_dir_entry *ent;
20939+
20940+ ent = proc_mkdir("virtual", 0);
20941+ if (ent) {
20942+ ent->proc_fops = &proc_virtual_dir_operations;
20943+ ent->proc_iops = &proc_virtual_dir_inode_operations;
20944+ }
20945+ proc_virtual = ent;
20946+
20947+ ent = proc_mkdir("virtnet", 0);
20948+ if (ent) {
20949+ ent->proc_fops = &proc_virtnet_dir_operations;
20950+ ent->proc_iops = &proc_virtnet_dir_inode_operations;
20951+ }
20952+ proc_virtnet = ent;
20953+}
20954+
20955+
20956+
20957+
20958+/* per pid info */
20959+
20960+void render_cap_t(struct seq_file *, const char *,
20961+ struct vx_info *, kernel_cap_t *);
20962+
20963+
20964+int proc_pid_vx_info(
20965+ struct seq_file *m,
20966+ struct pid_namespace *ns,
20967+ struct pid *pid,
20968+ struct task_struct *p)
20969+{
20970+ struct vx_info *vxi;
20971+
20972+ seq_printf(m, "XID:\t%d\n", vx_task_xid(p));
20973+
20974+ vxi = task_get_vx_info(p);
20975+ if (!vxi)
20976+ return 0;
20977+
20978+ render_cap_t(m, "BCaps:\t", vxi, &vxi->vx_bcaps);
20979+ seq_printf(m, "CCaps:\t%016llx\n",
20980+ (unsigned long long)vxi->vx_ccaps);
20981+ seq_printf(m, "CFlags:\t%016llx\n",
20982+ (unsigned long long)vxi->vx_flags);
20983+ seq_printf(m, "CIPid:\t%d\n", vxi->vx_initpid);
20984+
20985+ put_vx_info(vxi);
20986+ return 0;
20987+}
20988+
20989+
20990+int proc_pid_nx_info(
20991+ struct seq_file *m,
20992+ struct pid_namespace *ns,
20993+ struct pid *pid,
20994+ struct task_struct *p)
20995+{
20996+ struct nx_info *nxi;
20997+ struct nx_addr_v4 *v4a;
20998+#ifdef CONFIG_IPV6
20999+ struct nx_addr_v6 *v6a;
21000+#endif
21001+ int i;
21002+
21003+ seq_printf(m, "NID:\t%d\n", nx_task_nid(p));
21004+
21005+ nxi = task_get_nx_info(p);
21006+ if (!nxi)
21007+ return 0;
21008+
21009+ seq_printf(m, "NCaps:\t%016llx\n",
21010+ (unsigned long long)nxi->nx_ncaps);
21011+ seq_printf(m, "NFlags:\t%016llx\n",
21012+ (unsigned long long)nxi->nx_flags);
21013+
21014+ seq_printf(m, "V4Root[bcast]:\t" NIPQUAD_FMT "\n",
21015+ NIPQUAD(nxi->v4_bcast.s_addr));
21016+ seq_printf(m, "V4Root[lback]:\t" NIPQUAD_FMT "\n",
21017+ NIPQUAD(nxi->v4_lback.s_addr));
21018+ if (!NX_IPV4(nxi))
21019+ goto skip_v4;
21020+ for (i = 0, v4a = &nxi->v4; v4a; i++, v4a = v4a->next)
21021+ seq_printf(m, "V4Root[%d]:\t" NXAV4_FMT "\n",
21022+ i, NXAV4(v4a));
21023+skip_v4:
21024+#ifdef CONFIG_IPV6
21025+ if (!NX_IPV6(nxi))
21026+ goto skip_v6;
21027+ for (i = 0, v6a = &nxi->v6; v6a; i++, v6a = v6a->next)
21028+ seq_printf(m, "V6Root[%d]:\t" NXAV6_FMT "\n",
21029+ i, NXAV6(v6a));
21030+skip_v6:
21031+#endif
21032+ put_nx_info(nxi);
21033+ return 0;
21034+}
21035+
21036diff -NurpP --minimal linux-4.4.116/kernel/vserver/sched.c linux-4.4.116-vs2.3.9.7/kernel/vserver/sched.c
21037--- linux-4.4.116/kernel/vserver/sched.c 1970-01-01 00:00:00.000000000 +0000
21038+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/sched.c 2018-01-09 16:36:34.000000000 +0000
21039@@ -0,0 +1,83 @@
21040+/*
21041+ * linux/kernel/vserver/sched.c
21042+ *
21043+ * Virtual Server: Scheduler Support
21044+ *
21045+ * Copyright (C) 2004-2010 Herbert P?tzl
21046+ *
21047+ * V0.01 adapted Sam Vilains version to 2.6.3
21048+ * V0.02 removed legacy interface
21049+ * V0.03 changed vcmds to vxi arg
21050+ * V0.04 removed older and legacy interfaces
21051+ * V0.05 removed scheduler code/commands
21052+ *
21053+ */
21054+
21055+#include <linux/vs_context.h>
21056+#include <linux/vs_sched.h>
21057+#include <linux/cpumask.h>
21058+#include <linux/vserver/sched_cmd.h>
21059+
21060+#include <asm/uaccess.h>
21061+
21062+
21063+void vx_update_sched_param(struct _vx_sched *sched,
21064+ struct _vx_sched_pc *sched_pc)
21065+{
21066+ sched_pc->prio_bias = sched->prio_bias;
21067+}
21068+
21069+static int do_set_prio_bias(struct vx_info *vxi, struct vcmd_prio_bias *data)
21070+{
21071+ int cpu;
21072+
21073+ if (data->prio_bias > MAX_PRIO_BIAS)
21074+ data->prio_bias = MAX_PRIO_BIAS;
21075+ if (data->prio_bias < MIN_PRIO_BIAS)
21076+ data->prio_bias = MIN_PRIO_BIAS;
21077+
21078+ if (data->cpu_id != ~0) {
21079+ vxi->sched.update = *get_cpu_mask(data->cpu_id);
21080+ cpumask_and(&vxi->sched.update, &vxi->sched.update,
21081+ cpu_online_mask);
21082+ } else
21083+ cpumask_copy(&vxi->sched.update, cpu_online_mask);
21084+
21085+ for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)vxi->sched.update)
21086+ vx_update_sched_param(&vxi->sched,
21087+ &vx_per_cpu(vxi, sched_pc, cpu));
21088+ return 0;
21089+}
21090+
21091+int vc_set_prio_bias(struct vx_info *vxi, void __user *data)
21092+{
21093+ struct vcmd_prio_bias vc_data;
21094+
21095+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
21096+ return -EFAULT;
21097+
21098+ return do_set_prio_bias(vxi, &vc_data);
21099+}
21100+
21101+int vc_get_prio_bias(struct vx_info *vxi, void __user *data)
21102+{
21103+ struct vcmd_prio_bias vc_data;
21104+ struct _vx_sched_pc *pcd;
21105+ int cpu;
21106+
21107+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
21108+ return -EFAULT;
21109+
21110+ cpu = vc_data.cpu_id;
21111+
21112+ if (!cpu_possible(cpu))
21113+ return -EINVAL;
21114+
21115+ pcd = &vx_per_cpu(vxi, sched_pc, cpu);
21116+ vc_data.prio_bias = pcd->prio_bias;
21117+
21118+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
21119+ return -EFAULT;
21120+ return 0;
21121+}
21122+
21123diff -NurpP --minimal linux-4.4.116/kernel/vserver/sched_init.h linux-4.4.116-vs2.3.9.7/kernel/vserver/sched_init.h
21124--- linux-4.4.116/kernel/vserver/sched_init.h 1970-01-01 00:00:00.000000000 +0000
21125+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/sched_init.h 2018-01-09 16:36:34.000000000 +0000
21126@@ -0,0 +1,27 @@
21127+
21128+static inline void vx_info_init_sched(struct _vx_sched *sched)
21129+{
21130+ /* scheduling; hard code starting values as constants */
21131+ sched->prio_bias = 0;
21132+}
21133+
21134+static inline
21135+void vx_info_init_sched_pc(struct _vx_sched_pc *sched_pc, int cpu)
21136+{
21137+ sched_pc->prio_bias = 0;
21138+
21139+ sched_pc->user_ticks = 0;
21140+ sched_pc->sys_ticks = 0;
21141+ sched_pc->hold_ticks = 0;
21142+}
21143+
21144+static inline void vx_info_exit_sched(struct _vx_sched *sched)
21145+{
21146+ return;
21147+}
21148+
21149+static inline
21150+void vx_info_exit_sched_pc(struct _vx_sched_pc *sched_pc, int cpu)
21151+{
21152+ return;
21153+}
21154diff -NurpP --minimal linux-4.4.116/kernel/vserver/sched_proc.h linux-4.4.116-vs2.3.9.7/kernel/vserver/sched_proc.h
21155--- linux-4.4.116/kernel/vserver/sched_proc.h 1970-01-01 00:00:00.000000000 +0000
21156+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/sched_proc.h 2018-01-09 16:36:34.000000000 +0000
21157@@ -0,0 +1,32 @@
21158+#ifndef _VX_SCHED_PROC_H
21159+#define _VX_SCHED_PROC_H
21160+
21161+
21162+static inline
21163+int vx_info_proc_sched(struct _vx_sched *sched, char *buffer)
21164+{
21165+ int length = 0;
21166+
21167+ length += sprintf(buffer,
21168+ "PrioBias:\t%8d\n",
21169+ sched->prio_bias);
21170+ return length;
21171+}
21172+
21173+static inline
21174+int vx_info_proc_sched_pc(struct _vx_sched_pc *sched_pc,
21175+ char *buffer, int cpu)
21176+{
21177+ int length = 0;
21178+
21179+ length += sprintf(buffer + length,
21180+ "cpu %d: %lld %lld %lld", cpu,
21181+ (unsigned long long)sched_pc->user_ticks,
21182+ (unsigned long long)sched_pc->sys_ticks,
21183+ (unsigned long long)sched_pc->hold_ticks);
21184+ length += sprintf(buffer + length,
21185+ " %d\n", sched_pc->prio_bias);
21186+ return length;
21187+}
21188+
21189+#endif /* _VX_SCHED_PROC_H */
21190diff -NurpP --minimal linux-4.4.116/kernel/vserver/signal.c linux-4.4.116-vs2.3.9.7/kernel/vserver/signal.c
21191--- linux-4.4.116/kernel/vserver/signal.c 1970-01-01 00:00:00.000000000 +0000
21192+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/signal.c 2018-01-09 16:36:34.000000000 +0000
21193@@ -0,0 +1,134 @@
21194+/*
21195+ * linux/kernel/vserver/signal.c
21196+ *
21197+ * Virtual Server: Signal Support
21198+ *
21199+ * Copyright (C) 2003-2007 Herbert P?tzl
21200+ *
21201+ * V0.01 broken out from vcontext V0.05
21202+ * V0.02 changed vcmds to vxi arg
21203+ * V0.03 adjusted siginfo for kill
21204+ *
21205+ */
21206+
21207+#include <asm/uaccess.h>
21208+
21209+#include <linux/vs_context.h>
21210+#include <linux/vs_pid.h>
21211+#include <linux/vserver/signal_cmd.h>
21212+
21213+
21214+int vx_info_kill(struct vx_info *vxi, int pid, int sig)
21215+{
21216+ int retval, count = 0;
21217+ struct task_struct *p;
21218+ struct siginfo *sip = SEND_SIG_PRIV;
21219+
21220+ retval = -ESRCH;
21221+ vxdprintk(VXD_CBIT(misc, 4),
21222+ "vx_info_kill(%p[#%d],%d,%d)*",
21223+ vxi, vxi->vx_id, pid, sig);
21224+ read_lock(&tasklist_lock);
21225+ switch (pid) {
21226+ case 0:
21227+ case -1:
21228+ for_each_process(p) {
21229+ int err = 0;
21230+
21231+ if (vx_task_xid(p) != vxi->vx_id || p->pid <= 1 ||
21232+ (pid && vxi->vx_initpid == p->pid))
21233+ continue;
21234+
21235+ err = group_send_sig_info(sig, sip, p);
21236+ ++count;
21237+ if (err != -EPERM)
21238+ retval = err;
21239+ }
21240+ break;
21241+
21242+ case 1:
21243+ if (vxi->vx_initpid) {
21244+ pid = vxi->vx_initpid;
21245+ /* for now, only SIGINT to private init ... */
21246+ if (!vx_info_flags(vxi, VXF_STATE_ADMIN, 0) &&
21247+ /* ... as long as there are tasks left */
21248+ (atomic_read(&vxi->vx_tasks) > 1))
21249+ sig = SIGINT;
21250+ }
21251+ /* fallthrough */
21252+ default:
21253+ rcu_read_lock();
21254+ p = find_task_by_real_pid(pid);
21255+ rcu_read_unlock();
21256+ if (p) {
21257+ if (vx_task_xid(p) == vxi->vx_id)
21258+ retval = group_send_sig_info(sig, sip, p);
21259+ }
21260+ break;
21261+ }
21262+ read_unlock(&tasklist_lock);
21263+ vxdprintk(VXD_CBIT(misc, 4),
21264+ "vx_info_kill(%p[#%d],%d,%d,%ld) = %d",
21265+ vxi, vxi->vx_id, pid, sig, (long)sip, retval);
21266+ return retval;
21267+}
21268+
21269+int vc_ctx_kill(struct vx_info *vxi, void __user *data)
21270+{
21271+ struct vcmd_ctx_kill_v0 vc_data;
21272+
21273+ if (copy_from_user(&vc_data, data, sizeof(vc_data)))
21274+ return -EFAULT;
21275+
21276+ /* special check to allow guest shutdown */
21277+ if (!vx_info_flags(vxi, VXF_STATE_ADMIN, 0) &&
21278+ /* forbid killall pid=0 when init is present */
21279+ (((vc_data.pid < 1) && vxi->vx_initpid) ||
21280+ (vc_data.pid > 1)))
21281+ return -EACCES;
21282+
21283+ return vx_info_kill(vxi, vc_data.pid, vc_data.sig);
21284+}
21285+
21286+
21287+static int __wait_exit(struct vx_info *vxi)
21288+{
21289+ DECLARE_WAITQUEUE(wait, current);
21290+ int ret = 0;
21291+
21292+ add_wait_queue(&vxi->vx_wait, &wait);
21293+ set_current_state(TASK_INTERRUPTIBLE);
21294+
21295+wait:
21296+ if (vx_info_state(vxi,
21297+ VXS_SHUTDOWN | VXS_HASHED | VXS_HELPER) == VXS_SHUTDOWN)
21298+ goto out;
21299+ if (signal_pending(current)) {
21300+ ret = -ERESTARTSYS;
21301+ goto out;
21302+ }
21303+ schedule();
21304+ goto wait;
21305+
21306+out:
21307+ set_current_state(TASK_RUNNING);
21308+ remove_wait_queue(&vxi->vx_wait, &wait);
21309+ return ret;
21310+}
21311+
21312+
21313+
21314+int vc_wait_exit(struct vx_info *vxi, void __user *data)
21315+{
21316+ struct vcmd_wait_exit_v0 vc_data;
21317+ int ret;
21318+
21319+ ret = __wait_exit(vxi);
21320+ vc_data.reboot_cmd = vxi->reboot_cmd;
21321+ vc_data.exit_code = vxi->exit_code;
21322+
21323+ if (copy_to_user(data, &vc_data, sizeof(vc_data)))
21324+ ret = -EFAULT;
21325+ return ret;
21326+}
21327+
21328diff -NurpP --minimal linux-4.4.116/kernel/vserver/space.c linux-4.4.116-vs2.3.9.7/kernel/vserver/space.c
21329--- linux-4.4.116/kernel/vserver/space.c 1970-01-01 00:00:00.000000000 +0000
21330+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/space.c 2018-01-09 16:36:34.000000000 +0000
21331@@ -0,0 +1,436 @@
21332+/*
21333+ * linux/kernel/vserver/space.c
21334+ *
21335+ * Virtual Server: Context Space Support
21336+ *
21337+ * Copyright (C) 2003-2010 Herbert P?tzl
21338+ *
21339+ * V0.01 broken out from context.c 0.07
21340+ * V0.02 added task locking for namespace
21341+ * V0.03 broken out vx_enter_namespace
21342+ * V0.04 added *space support and commands
21343+ * V0.05 added credential support
21344+ *
21345+ */
21346+
21347+#include <linux/utsname.h>
21348+#include <linux/nsproxy.h>
21349+#include <linux/err.h>
21350+#include <linux/fs_struct.h>
21351+#include <linux/cred.h>
21352+#include <asm/uaccess.h>
21353+
21354+#include <linux/vs_context.h>
21355+#include <linux/vserver/space.h>
21356+#include <linux/vserver/space_cmd.h>
21357+
21358+atomic_t vs_global_nsproxy = ATOMIC_INIT(0);
21359+atomic_t vs_global_fs = ATOMIC_INIT(0);
21360+atomic_t vs_global_mnt_ns = ATOMIC_INIT(0);
21361+atomic_t vs_global_uts_ns = ATOMIC_INIT(0);
21362+atomic_t vs_global_user_ns = ATOMIC_INIT(0);
21363+atomic_t vs_global_pid_ns = ATOMIC_INIT(0);
21364+
21365+
21366+/* namespace functions */
21367+
21368+#include <linux/mnt_namespace.h>
21369+#include <linux/user_namespace.h>
21370+#include <linux/pid_namespace.h>
21371+#include <linux/ipc_namespace.h>
21372+#include <net/net_namespace.h>
21373+#include "../fs/mount.h"
21374+
21375+
21376+static const struct vcmd_space_mask_v1 space_mask_v0 = {
21377+ .mask = CLONE_FS |
21378+ CLONE_NEWNS |
21379+#ifdef CONFIG_UTS_NS
21380+ CLONE_NEWUTS |
21381+#endif
21382+#ifdef CONFIG_IPC_NS
21383+ CLONE_NEWIPC |
21384+#endif
21385+#ifdef CONFIG_USER_NS
21386+ CLONE_NEWUSER |
21387+#endif
21388+ 0
21389+};
21390+
21391+static const struct vcmd_space_mask_v1 space_mask = {
21392+ .mask = CLONE_FS |
21393+ CLONE_NEWNS |
21394+#ifdef CONFIG_UTS_NS
21395+ CLONE_NEWUTS |
21396+#endif
21397+#ifdef CONFIG_IPC_NS
21398+ CLONE_NEWIPC |
21399+#endif
21400+#ifdef CONFIG_USER_NS
21401+ CLONE_NEWUSER |
21402+#endif
21403+#ifdef CONFIG_PID_NS
21404+ CLONE_NEWPID |
21405+#endif
21406+#ifdef CONFIG_NET_NS
21407+ CLONE_NEWNET |
21408+#endif
21409+ 0
21410+};
21411+
21412+static const struct vcmd_space_mask_v1 default_space_mask = {
21413+ .mask = CLONE_FS |
21414+ CLONE_NEWNS |
21415+#ifdef CONFIG_UTS_NS
21416+ CLONE_NEWUTS |
21417+#endif
21418+#ifdef CONFIG_IPC_NS
21419+ CLONE_NEWIPC |
21420+#endif
21421+#ifdef CONFIG_USER_NS
21422+// CLONE_NEWUSER |
21423+#endif
21424+#ifdef CONFIG_PID_NS
21425+// CLONE_NEWPID |
21426+#endif
21427+ 0
21428+};
21429+
21430+/*
21431+ * build a new nsproxy mix
21432+ * assumes that both proxies are 'const'
21433+ * does not touch nsproxy refcounts
21434+ * will hold a reference on the result.
21435+ */
21436+
21437+struct nsproxy *vs_mix_nsproxy(struct nsproxy *old_nsproxy,
21438+ struct nsproxy *new_nsproxy, unsigned long mask)
21439+{
21440+ struct mnt_namespace *old_ns;
21441+ struct uts_namespace *old_uts;
21442+ struct ipc_namespace *old_ipc;
21443+#ifdef CONFIG_PID_NS
21444+ struct pid_namespace *old_pid;
21445+#endif
21446+#ifdef CONFIG_NET_NS
21447+ struct net *old_net;
21448+#endif
21449+ struct nsproxy *nsproxy;
21450+
21451+ nsproxy = copy_nsproxy(old_nsproxy);
21452+ if (!nsproxy)
21453+ goto out;
21454+
21455+ if (mask & CLONE_NEWNS) {
21456+ old_ns = nsproxy->mnt_ns;
21457+ nsproxy->mnt_ns = new_nsproxy->mnt_ns;
21458+ if (nsproxy->mnt_ns)
21459+ get_mnt_ns(nsproxy->mnt_ns);
21460+ } else
21461+ old_ns = NULL;
21462+
21463+ if (mask & CLONE_NEWUTS) {
21464+ old_uts = nsproxy->uts_ns;
21465+ nsproxy->uts_ns = new_nsproxy->uts_ns;
21466+ if (nsproxy->uts_ns)
21467+ get_uts_ns(nsproxy->uts_ns);
21468+ } else
21469+ old_uts = NULL;
21470+
21471+ if (mask & CLONE_NEWIPC) {
21472+ old_ipc = nsproxy->ipc_ns;
21473+ nsproxy->ipc_ns = new_nsproxy->ipc_ns;
21474+ if (nsproxy->ipc_ns)
21475+ get_ipc_ns(nsproxy->ipc_ns);
21476+ } else
21477+ old_ipc = NULL;
21478+
21479+#ifdef CONFIG_PID_NS
21480+ if (mask & CLONE_NEWPID) {
21481+ old_pid = nsproxy->pid_ns_for_children;
21482+ nsproxy->pid_ns_for_children = new_nsproxy->pid_ns_for_children;
21483+ if (nsproxy->pid_ns_for_children)
21484+ get_pid_ns(nsproxy->pid_ns_for_children);
21485+ } else
21486+ old_pid = NULL;
21487+#endif
21488+#ifdef CONFIG_NET_NS
21489+ if (mask & CLONE_NEWNET) {
21490+ old_net = nsproxy->net_ns;
21491+ nsproxy->net_ns = new_nsproxy->net_ns;
21492+ if (nsproxy->net_ns)
21493+ get_net(nsproxy->net_ns);
21494+ } else
21495+ old_net = NULL;
21496+#endif
21497+ if (old_ns)
21498+ put_mnt_ns(old_ns);
21499+ if (old_uts)
21500+ put_uts_ns(old_uts);
21501+ if (old_ipc)
21502+ put_ipc_ns(old_ipc);
21503+#ifdef CONFIG_PID_NS
21504+ if (old_pid)
21505+ put_pid_ns(old_pid);
21506+#endif
21507+#ifdef CONFIG_NET_NS
21508+ if (old_net)
21509+ put_net(old_net);
21510+#endif
21511+out:
21512+ return nsproxy;
21513+}
21514+
21515+
21516+/*
21517+ * merge two nsproxy structs into a new one.
21518+ * will hold a reference on the result.
21519+ */
21520+
21521+static inline
21522+struct nsproxy *__vs_merge_nsproxy(struct nsproxy *old,
21523+ struct nsproxy *proxy, unsigned long mask)
21524+{
21525+ struct nsproxy null_proxy = { .mnt_ns = NULL };
21526+
21527+ if (!proxy)
21528+ return NULL;
21529+
21530+ if (mask) {
21531+ /* vs_mix_nsproxy returns with reference */
21532+ return vs_mix_nsproxy(old ? old : &null_proxy,
21533+ proxy, mask);
21534+ }
21535+ get_nsproxy(proxy);
21536+ return proxy;
21537+}
21538+
21539+
21540+int vx_enter_space(struct vx_info *vxi, unsigned long mask, unsigned index)
21541+{
21542+ struct nsproxy *proxy, *proxy_cur, *proxy_new;
21543+ struct fs_struct *fs_cur, *fs = NULL;
21544+ struct _vx_space *space;
21545+ int ret, kill = 0;
21546+
21547+ vxdprintk(VXD_CBIT(space, 8), "vx_enter_space(%p[#%u],0x%08lx,%d)",
21548+ vxi, vxi->vx_id, mask, index);
21549+
21550+ if (vx_info_flags(vxi, VXF_INFO_PRIVATE, 0))
21551+ return -EACCES;
21552+
21553+ if (index >= VX_SPACES)
21554+ return -EINVAL;
21555+
21556+ space = &vxi->space[index];
21557+
21558+ if (!mask)
21559+ mask = space->vx_nsmask;
21560+
21561+ if ((mask & space->vx_nsmask) != mask)
21562+ return -EINVAL;
21563+
21564+ if (mask & CLONE_FS) {
21565+ fs = copy_fs_struct(space->vx_fs);
21566+ if (!fs)
21567+ return -ENOMEM;
21568+ }
21569+ proxy = space->vx_nsproxy;
21570+
21571+ vxdprintk(VXD_CBIT(space, 9),
21572+ "vx_enter_space(%p[#%u],0x%08lx,%d) -> (%p,%p)",
21573+ vxi, vxi->vx_id, mask, index, proxy, fs);
21574+
21575+ task_lock(current);
21576+ fs_cur = current->fs;
21577+
21578+ if (mask & CLONE_FS) {
21579+ spin_lock(&fs_cur->lock);
21580+ current->fs = fs;
21581+ kill = !--fs_cur->users;
21582+ spin_unlock(&fs_cur->lock);
21583+ }
21584+
21585+ proxy_cur = current->nsproxy;
21586+ get_nsproxy(proxy_cur);
21587+ task_unlock(current);
21588+
21589+ if (kill)
21590+ free_fs_struct(fs_cur);
21591+
21592+ proxy_new = __vs_merge_nsproxy(proxy_cur, proxy, mask);
21593+ if (IS_ERR(proxy_new)) {
21594+ ret = PTR_ERR(proxy_new);
21595+ goto out_put;
21596+ }
21597+
21598+ proxy_new = xchg(&current->nsproxy, proxy_new);
21599+
21600+ if (mask & CLONE_NEWUSER) {
21601+ struct cred *cred;
21602+
21603+ vxdprintk(VXD_CBIT(space, 10),
21604+ "vx_enter_space(%p[#%u],%p) cred (%p,%p)",
21605+ vxi, vxi->vx_id, space->vx_cred,
21606+ current->real_cred, current->cred);
21607+
21608+ if (space->vx_cred) {
21609+ cred = __prepare_creds(space->vx_cred);
21610+ if (cred)
21611+ commit_creds(cred);
21612+ }
21613+ }
21614+
21615+ ret = 0;
21616+
21617+ if (proxy_new)
21618+ put_nsproxy(proxy_new);
21619+out_put:
21620+ if (proxy_cur)
21621+ put_nsproxy(proxy_cur);
21622+ return ret;
21623+}
21624+
21625+
21626+int vx_set_space(struct vx_info *vxi, unsigned long mask, unsigned index)
21627+{
21628+ struct nsproxy *proxy_vxi, *proxy_cur, *proxy_new;
21629+ struct fs_struct *fs_vxi, *fs = NULL;
21630+ struct _vx_space *space;
21631+ int ret, kill = 0;
21632+
21633+ vxdprintk(VXD_CBIT(space, 8), "vx_set_space(%p[#%u],0x%08lx,%d)",
21634+ vxi, vxi->vx_id, mask, index);
21635+
21636+ if ((mask & space_mask.mask) != mask)
21637+ return -EINVAL;
21638+
21639+ if (index >= VX_SPACES)
21640+ return -EINVAL;
21641+
21642+ space = &vxi->space[index];
21643+
21644+ proxy_vxi = space->vx_nsproxy;
21645+ fs_vxi = space->vx_fs;
21646+
21647+ if (mask & CLONE_FS) {
21648+ fs = copy_fs_struct(current->fs);
21649+ if (!fs)
21650+ return -ENOMEM;
21651+ }
21652+
21653+ task_lock(current);
21654+
21655+ if (mask & CLONE_FS) {
21656+ spin_lock(&fs_vxi->lock);
21657+ space->vx_fs = fs;
21658+ kill = !--fs_vxi->users;
21659+ spin_unlock(&fs_vxi->lock);
21660+ }
21661+
21662+ proxy_cur = current->nsproxy;
21663+ get_nsproxy(proxy_cur);
21664+ task_unlock(current);
21665+
21666+ if (kill)
21667+ free_fs_struct(fs_vxi);
21668+
21669+ proxy_new = __vs_merge_nsproxy(proxy_vxi, proxy_cur, mask);
21670+ if (IS_ERR(proxy_new)) {
21671+ ret = PTR_ERR(proxy_new);
21672+ goto out_put;
21673+ }
21674+
21675+ proxy_new = xchg(&space->vx_nsproxy, proxy_new);
21676+ space->vx_nsmask |= mask;
21677+
21678+ if (mask & CLONE_NEWUSER) {
21679+ struct cred *cred;
21680+
21681+ vxdprintk(VXD_CBIT(space, 10),
21682+ "vx_set_space(%p[#%u],%p) cred (%p,%p)",
21683+ vxi, vxi->vx_id, space->vx_cred,
21684+ current->real_cred, current->cred);
21685+
21686+ cred = prepare_creds();
21687+ cred = (struct cred *)xchg(&space->vx_cred, cred);
21688+ if (cred)
21689+ abort_creds(cred);
21690+ }
21691+
21692+ ret = 0;
21693+
21694+ if (proxy_new)
21695+ put_nsproxy(proxy_new);
21696+out_put:
21697+ if (proxy_cur)
21698+ put_nsproxy(proxy_cur);
21699+ return ret;
21700+}
21701+
21702+
21703+int vc_enter_space_v1(struct vx_info *vxi, void __user *data)
21704+{
21705+ struct vcmd_space_mask_v1 vc_data = { .mask = 0 };
21706+
21707+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
21708+ return -EFAULT;
21709+
21710+ return vx_enter_space(vxi, vc_data.mask, 0);
21711+}
21712+
21713+int vc_enter_space(struct vx_info *vxi, void __user *data)
21714+{
21715+ struct vcmd_space_mask_v2 vc_data = { .mask = 0 };
21716+
21717+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
21718+ return -EFAULT;
21719+
21720+ if (vc_data.index >= VX_SPACES)
21721+ return -EINVAL;
21722+
21723+ return vx_enter_space(vxi, vc_data.mask, vc_data.index);
21724+}
21725+
21726+int vc_set_space_v1(struct vx_info *vxi, void __user *data)
21727+{
21728+ struct vcmd_space_mask_v1 vc_data = { .mask = 0 };
21729+
21730+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
21731+ return -EFAULT;
21732+
21733+ return vx_set_space(vxi, vc_data.mask, 0);
21734+}
21735+
21736+int vc_set_space(struct vx_info *vxi, void __user *data)
21737+{
21738+ struct vcmd_space_mask_v2 vc_data = { .mask = 0 };
21739+
21740+ if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
21741+ return -EFAULT;
21742+
21743+ if (vc_data.index >= VX_SPACES)
21744+ return -EINVAL;
21745+
21746+ return vx_set_space(vxi, vc_data.mask, vc_data.index);
21747+}
21748+
21749+int vc_get_space_mask(void __user *data, int type)
21750+{
21751+ const struct vcmd_space_mask_v1 *mask;
21752+
21753+ if (type == 0)
21754+ mask = &space_mask_v0;
21755+ else if (type == 1)
21756+ mask = &space_mask;
21757+ else
21758+ mask = &default_space_mask;
21759+
21760+ vxdprintk(VXD_CBIT(space, 10),
21761+ "vc_get_space_mask(%d) = %08llx", type, mask->mask);
21762+
21763+ if (copy_to_user(data, mask, sizeof(*mask)))
21764+ return -EFAULT;
21765+ return 0;
21766+}
21767+
21768diff -NurpP --minimal linux-4.4.116/kernel/vserver/switch.c linux-4.4.116-vs2.3.9.7/kernel/vserver/switch.c
21769--- linux-4.4.116/kernel/vserver/switch.c 1970-01-01 00:00:00.000000000 +0000
21770+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/switch.c 2018-01-09 16:36:34.000000000 +0000
21771@@ -0,0 +1,556 @@
21772+/*
21773+ * linux/kernel/vserver/switch.c
21774+ *
21775+ * Virtual Server: Syscall Switch
21776+ *
21777+ * Copyright (C) 2003-2011 Herbert P?tzl
21778+ *
21779+ * V0.01 syscall switch
21780+ * V0.02 added signal to context
21781+ * V0.03 added rlimit functions
21782+ * V0.04 added iattr, task/xid functions
21783+ * V0.05 added debug/history stuff
21784+ * V0.06 added compat32 layer
21785+ * V0.07 vcmd args and perms
21786+ * V0.08 added status commands
21787+ * V0.09 added tag commands
21788+ * V0.10 added oom bias
21789+ * V0.11 added device commands
21790+ * V0.12 added warn mask
21791+ *
21792+ */
21793+
21794+#include <linux/vs_context.h>
21795+#include <linux/vs_network.h>
21796+#include <linux/vserver/switch.h>
21797+
21798+#include "vci_config.h"
21799+
21800+
21801+static inline
21802+int vc_get_version(uint32_t id)
21803+{
21804+ return VCI_VERSION;
21805+}
21806+
21807+static inline
21808+int vc_get_vci(uint32_t id)
21809+{
21810+ return vci_kernel_config();
21811+}
21812+
21813+#include <linux/vserver/context_cmd.h>
21814+#include <linux/vserver/cvirt_cmd.h>
21815+#include <linux/vserver/cacct_cmd.h>
21816+#include <linux/vserver/limit_cmd.h>
21817+#include <linux/vserver/network_cmd.h>
21818+#include <linux/vserver/sched_cmd.h>
21819+#include <linux/vserver/debug_cmd.h>
21820+#include <linux/vserver/inode_cmd.h>
21821+#include <linux/vserver/dlimit_cmd.h>
21822+#include <linux/vserver/signal_cmd.h>
21823+#include <linux/vserver/space_cmd.h>
21824+#include <linux/vserver/tag_cmd.h>
21825+#include <linux/vserver/device_cmd.h>
21826+
21827+#include <linux/vserver/inode.h>
21828+#include <linux/vserver/dlimit.h>
21829+
21830+
21831+#ifdef CONFIG_COMPAT
21832+#define __COMPAT(name, id, data, compat) \
21833+ (compat) ? name ## _x32(id, data) : name(id, data)
21834+#define __COMPAT_NO_ID(name, data, compat) \
21835+ (compat) ? name ## _x32(data) : name(data)
21836+#else
21837+#define __COMPAT(name, id, data, compat) \
21838+ name(id, data)
21839+#define __COMPAT_NO_ID(name, data, compat) \
21840+ name(data)
21841+#endif
21842+
21843+
21844+static inline
21845+long do_vcmd(uint32_t cmd, uint32_t id,
21846+ struct vx_info *vxi, struct nx_info *nxi,
21847+ void __user *data, int compat)
21848+{
21849+ switch (cmd) {
21850+
21851+ case VCMD_get_version:
21852+ return vc_get_version(id);
21853+ case VCMD_get_vci:
21854+ return vc_get_vci(id);
21855+
21856+ case VCMD_task_xid:
21857+ return vc_task_xid(id);
21858+ case VCMD_vx_info:
21859+ return vc_vx_info(vxi, data);
21860+
21861+ case VCMD_task_nid:
21862+ return vc_task_nid(id);
21863+ case VCMD_nx_info:
21864+ return vc_nx_info(nxi, data);
21865+
21866+ case VCMD_task_tag:
21867+ return vc_task_tag(id);
21868+
21869+ case VCMD_set_space_v1:
21870+ return vc_set_space_v1(vxi, data);
21871+ /* this is version 2 */
21872+ case VCMD_set_space:
21873+ return vc_set_space(vxi, data);
21874+
21875+ case VCMD_get_space_mask_v0:
21876+ return vc_get_space_mask(data, 0);
21877+ /* this is version 1 */
21878+ case VCMD_get_space_mask:
21879+ return vc_get_space_mask(data, 1);
21880+
21881+ case VCMD_get_space_default:
21882+ return vc_get_space_mask(data, -1);
21883+
21884+ case VCMD_set_umask:
21885+ return vc_set_umask(vxi, data);
21886+
21887+ case VCMD_get_umask:
21888+ return vc_get_umask(vxi, data);
21889+
21890+ case VCMD_set_wmask:
21891+ return vc_set_wmask(vxi, data);
21892+
21893+ case VCMD_get_wmask:
21894+ return vc_get_wmask(vxi, data);
21895+#ifdef CONFIG_IA32_EMULATION
21896+ case VCMD_get_rlimit:
21897+ return __COMPAT(vc_get_rlimit, vxi, data, compat);
21898+ case VCMD_set_rlimit:
21899+ return __COMPAT(vc_set_rlimit, vxi, data, compat);
21900+#else
21901+ case VCMD_get_rlimit:
21902+ return vc_get_rlimit(vxi, data);
21903+ case VCMD_set_rlimit:
21904+ return vc_set_rlimit(vxi, data);
21905+#endif
21906+ case VCMD_get_rlimit_mask:
21907+ return vc_get_rlimit_mask(id, data);
21908+ case VCMD_reset_hits:
21909+ return vc_reset_hits(vxi, data);
21910+ case VCMD_reset_minmax:
21911+ return vc_reset_minmax(vxi, data);
21912+
21913+ case VCMD_get_vhi_name:
21914+ return vc_get_vhi_name(vxi, data);
21915+ case VCMD_set_vhi_name:
21916+ return vc_set_vhi_name(vxi, data);
21917+
21918+ case VCMD_ctx_stat:
21919+ return vc_ctx_stat(vxi, data);
21920+ case VCMD_virt_stat:
21921+ return vc_virt_stat(vxi, data);
21922+ case VCMD_sock_stat:
21923+ return vc_sock_stat(vxi, data);
21924+ case VCMD_rlimit_stat:
21925+ return vc_rlimit_stat(vxi, data);
21926+
21927+ case VCMD_set_cflags:
21928+ return vc_set_cflags(vxi, data);
21929+ case VCMD_get_cflags:
21930+ return vc_get_cflags(vxi, data);
21931+
21932+ /* this is version 1 */
21933+ case VCMD_set_ccaps:
21934+ return vc_set_ccaps(vxi, data);
21935+ /* this is version 1 */
21936+ case VCMD_get_ccaps:
21937+ return vc_get_ccaps(vxi, data);
21938+ case VCMD_set_bcaps:
21939+ return vc_set_bcaps(vxi, data);
21940+ case VCMD_get_bcaps:
21941+ return vc_get_bcaps(vxi, data);
21942+
21943+ case VCMD_set_badness:
21944+ return vc_set_badness(vxi, data);
21945+ case VCMD_get_badness:
21946+ return vc_get_badness(vxi, data);
21947+
21948+ case VCMD_set_nflags:
21949+ return vc_set_nflags(nxi, data);
21950+ case VCMD_get_nflags:
21951+ return vc_get_nflags(nxi, data);
21952+
21953+ case VCMD_set_ncaps:
21954+ return vc_set_ncaps(nxi, data);
21955+ case VCMD_get_ncaps:
21956+ return vc_get_ncaps(nxi, data);
21957+
21958+ case VCMD_set_prio_bias:
21959+ return vc_set_prio_bias(vxi, data);
21960+ case VCMD_get_prio_bias:
21961+ return vc_get_prio_bias(vxi, data);
21962+ case VCMD_add_dlimit:
21963+ return __COMPAT(vc_add_dlimit, id, data, compat);
21964+ case VCMD_rem_dlimit:
21965+ return __COMPAT(vc_rem_dlimit, id, data, compat);
21966+ case VCMD_set_dlimit:
21967+ return __COMPAT(vc_set_dlimit, id, data, compat);
21968+ case VCMD_get_dlimit:
21969+ return __COMPAT(vc_get_dlimit, id, data, compat);
21970+
21971+ case VCMD_ctx_kill:
21972+ return vc_ctx_kill(vxi, data);
21973+
21974+ case VCMD_wait_exit:
21975+ return vc_wait_exit(vxi, data);
21976+
21977+ case VCMD_get_iattr:
21978+ return __COMPAT_NO_ID(vc_get_iattr, data, compat);
21979+ case VCMD_set_iattr:
21980+ return __COMPAT_NO_ID(vc_set_iattr, data, compat);
21981+
21982+ case VCMD_fget_iattr:
21983+ return vc_fget_iattr(id, data);
21984+ case VCMD_fset_iattr:
21985+ return vc_fset_iattr(id, data);
21986+
21987+ case VCMD_enter_space_v0:
21988+ return vc_enter_space_v1(vxi, NULL);
21989+ case VCMD_enter_space_v1:
21990+ return vc_enter_space_v1(vxi, data);
21991+ /* this is version 2 */
21992+ case VCMD_enter_space:
21993+ return vc_enter_space(vxi, data);
21994+
21995+ case VCMD_ctx_create_v0:
21996+ return vc_ctx_create(id, NULL);
21997+ case VCMD_ctx_create:
21998+ return vc_ctx_create(id, data);
21999+ case VCMD_ctx_migrate_v0:
22000+ return vc_ctx_migrate(vxi, NULL);
22001+ case VCMD_ctx_migrate:
22002+ return vc_ctx_migrate(vxi, data);
22003+
22004+ case VCMD_net_create_v0:
22005+ return vc_net_create(id, NULL);
22006+ case VCMD_net_create:
22007+ return vc_net_create(id, data);
22008+ case VCMD_net_migrate:
22009+ return vc_net_migrate(nxi, data);
22010+
22011+ case VCMD_tag_migrate:
22012+ return vc_tag_migrate(id);
22013+
22014+ case VCMD_net_add:
22015+ return vc_net_add(nxi, data);
22016+ case VCMD_net_remove:
22017+ return vc_net_remove(nxi, data);
22018+
22019+ case VCMD_net_add_ipv4_v1:
22020+ return vc_net_add_ipv4_v1(nxi, data);
22021+ /* this is version 2 */
22022+ case VCMD_net_add_ipv4:
22023+ return vc_net_add_ipv4(nxi, data);
22024+
22025+ case VCMD_net_rem_ipv4_v1:
22026+ return vc_net_rem_ipv4_v1(nxi, data);
22027+ /* this is version 2 */
22028+ case VCMD_net_rem_ipv4:
22029+ return vc_net_rem_ipv4(nxi, data);
22030+#ifdef CONFIG_IPV6
22031+ case VCMD_net_add_ipv6:
22032+ return vc_net_add_ipv6(nxi, data);
22033+ case VCMD_net_remove_ipv6:
22034+ return vc_net_remove_ipv6(nxi, data);
22035+#endif
22036+/* case VCMD_add_match_ipv4:
22037+ return vc_add_match_ipv4(nxi, data);
22038+ case VCMD_get_match_ipv4:
22039+ return vc_get_match_ipv4(nxi, data);
22040+#ifdef CONFIG_IPV6
22041+ case VCMD_add_match_ipv6:
22042+ return vc_add_match_ipv6(nxi, data);
22043+ case VCMD_get_match_ipv6:
22044+ return vc_get_match_ipv6(nxi, data);
22045+#endif */
22046+
22047+#ifdef CONFIG_VSERVER_DEVICE
22048+ case VCMD_set_mapping:
22049+ return __COMPAT(vc_set_mapping, vxi, data, compat);
22050+ case VCMD_unset_mapping:
22051+ return __COMPAT(vc_unset_mapping, vxi, data, compat);
22052+#endif
22053+#ifdef CONFIG_VSERVER_HISTORY
22054+ case VCMD_dump_history:
22055+ return vc_dump_history(id);
22056+ case VCMD_read_history:
22057+ return __COMPAT(vc_read_history, id, data, compat);
22058+#endif
22059+ default:
22060+ vxwprintk_task(1, "unimplemented VCMD_%02d_%d[%d]",
22061+ VC_CATEGORY(cmd), VC_COMMAND(cmd), VC_VERSION(cmd));
22062+ }
22063+ return -ENOSYS;
22064+}
22065+
22066+
22067+#define __VCMD(vcmd, _perm, _args, _flags) \
22068+ case VCMD_ ## vcmd: perm = _perm; \
22069+ args = _args; flags = _flags; break
22070+
22071+
22072+#define VCA_NONE 0x00
22073+#define VCA_VXI 0x01
22074+#define VCA_NXI 0x02
22075+
22076+#define VCF_NONE 0x00
22077+#define VCF_INFO 0x01
22078+#define VCF_ADMIN 0x02
22079+#define VCF_ARES 0x06 /* includes admin */
22080+#define VCF_SETUP 0x08
22081+
22082+#define VCF_ZIDOK 0x10 /* zero id okay */
22083+
22084+
22085+static inline
22086+long do_vserver(uint32_t cmd, uint32_t id, void __user *data, int compat)
22087+{
22088+ long ret;
22089+ int permit = -1, state = 0;
22090+ int perm = -1, args = 0, flags = 0;
22091+ struct vx_info *vxi = NULL;
22092+ struct nx_info *nxi = NULL;
22093+
22094+ switch (cmd) {
22095+ /* unpriviledged commands */
22096+ __VCMD(get_version, 0, VCA_NONE, 0);
22097+ __VCMD(get_vci, 0, VCA_NONE, 0);
22098+ __VCMD(get_rlimit_mask, 0, VCA_NONE, 0);
22099+ __VCMD(get_space_mask_v0,0, VCA_NONE, 0);
22100+ __VCMD(get_space_mask, 0, VCA_NONE, 0);
22101+ __VCMD(get_space_default,0, VCA_NONE, 0);
22102+
22103+ /* info commands */
22104+ __VCMD(task_xid, 2, VCA_NONE, 0);
22105+ __VCMD(reset_hits, 2, VCA_VXI, 0);
22106+ __VCMD(reset_minmax, 2, VCA_VXI, 0);
22107+ __VCMD(vx_info, 3, VCA_VXI, VCF_INFO);
22108+ __VCMD(get_bcaps, 3, VCA_VXI, VCF_INFO);
22109+ __VCMD(get_ccaps, 3, VCA_VXI, VCF_INFO);
22110+ __VCMD(get_cflags, 3, VCA_VXI, VCF_INFO);
22111+ __VCMD(get_umask, 3, VCA_VXI, VCF_INFO);
22112+ __VCMD(get_wmask, 3, VCA_VXI, VCF_INFO);
22113+ __VCMD(get_badness, 3, VCA_VXI, VCF_INFO);
22114+ __VCMD(get_vhi_name, 3, VCA_VXI, VCF_INFO);
22115+ __VCMD(get_rlimit, 3, VCA_VXI, VCF_INFO);
22116+
22117+ __VCMD(ctx_stat, 3, VCA_VXI, VCF_INFO);
22118+ __VCMD(virt_stat, 3, VCA_VXI, VCF_INFO);
22119+ __VCMD(sock_stat, 3, VCA_VXI, VCF_INFO);
22120+ __VCMD(rlimit_stat, 3, VCA_VXI, VCF_INFO);
22121+
22122+ __VCMD(task_nid, 2, VCA_NONE, 0);
22123+ __VCMD(nx_info, 3, VCA_NXI, VCF_INFO);
22124+ __VCMD(get_ncaps, 3, VCA_NXI, VCF_INFO);
22125+ __VCMD(get_nflags, 3, VCA_NXI, VCF_INFO);
22126+
22127+ __VCMD(task_tag, 2, VCA_NONE, 0);
22128+
22129+ __VCMD(get_iattr, 2, VCA_NONE, 0);
22130+ __VCMD(fget_iattr, 2, VCA_NONE, 0);
22131+ __VCMD(get_dlimit, 3, VCA_NONE, VCF_INFO);
22132+ __VCMD(get_prio_bias, 3, VCA_VXI, VCF_INFO);
22133+
22134+ /* lower admin commands */
22135+ __VCMD(wait_exit, 4, VCA_VXI, VCF_INFO);
22136+ __VCMD(ctx_create_v0, 5, VCA_NONE, 0);
22137+ __VCMD(ctx_create, 5, VCA_NONE, 0);
22138+ __VCMD(ctx_migrate_v0, 5, VCA_VXI, VCF_ADMIN);
22139+ __VCMD(ctx_migrate, 5, VCA_VXI, VCF_ADMIN);
22140+ __VCMD(enter_space_v0, 5, VCA_VXI, VCF_ADMIN);
22141+ __VCMD(enter_space_v1, 5, VCA_VXI, VCF_ADMIN);
22142+ __VCMD(enter_space, 5, VCA_VXI, VCF_ADMIN);
22143+
22144+ __VCMD(net_create_v0, 5, VCA_NONE, 0);
22145+ __VCMD(net_create, 5, VCA_NONE, 0);
22146+ __VCMD(net_migrate, 5, VCA_NXI, VCF_ADMIN);
22147+
22148+ __VCMD(tag_migrate, 5, VCA_NONE, VCF_ADMIN);
22149+
22150+ /* higher admin commands */
22151+ __VCMD(ctx_kill, 6, VCA_VXI, VCF_ARES);
22152+ __VCMD(set_space_v1, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22153+ __VCMD(set_space, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22154+
22155+ __VCMD(set_ccaps, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22156+ __VCMD(set_bcaps, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22157+ __VCMD(set_cflags, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22158+ __VCMD(set_umask, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22159+ __VCMD(set_wmask, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22160+ __VCMD(set_badness, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22161+
22162+ __VCMD(set_vhi_name, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22163+ __VCMD(set_rlimit, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22164+ __VCMD(set_prio_bias, 7, VCA_VXI, VCF_ARES | VCF_SETUP);
22165+
22166+ __VCMD(set_ncaps, 7, VCA_NXI, VCF_ARES | VCF_SETUP);
22167+ __VCMD(set_nflags, 7, VCA_NXI, VCF_ARES | VCF_SETUP);
22168+ __VCMD(net_add, 8, VCA_NXI, VCF_ARES | VCF_SETUP);
22169+ __VCMD(net_remove, 8, VCA_NXI, VCF_ARES | VCF_SETUP);
22170+ __VCMD(net_add_ipv4_v1, 8, VCA_NXI, VCF_ARES | VCF_SETUP);
22171+ __VCMD(net_rem_ipv4_v1, 8, VCA_NXI, VCF_ARES | VCF_SETUP);
22172+ __VCMD(net_add_ipv4, 8, VCA_NXI, VCF_ARES | VCF_SETUP);
22173+ __VCMD(net_rem_ipv4, 8, VCA_NXI, VCF_ARES | VCF_SETUP);
22174+#ifdef CONFIG_IPV6
22175+ __VCMD(net_add_ipv6, 8, VCA_NXI, VCF_ARES | VCF_SETUP);
22176+ __VCMD(net_remove_ipv6, 8, VCA_NXI, VCF_ARES | VCF_SETUP);
22177+#endif
22178+ __VCMD(set_iattr, 7, VCA_NONE, 0);
22179+ __VCMD(fset_iattr, 7, VCA_NONE, 0);
22180+ __VCMD(set_dlimit, 7, VCA_NONE, VCF_ARES);
22181+ __VCMD(add_dlimit, 8, VCA_NONE, VCF_ARES);
22182+ __VCMD(rem_dlimit, 8, VCA_NONE, VCF_ARES);
22183+
22184+#ifdef CONFIG_VSERVER_DEVICE
22185+ __VCMD(set_mapping, 8, VCA_VXI, VCF_ARES|VCF_ZIDOK);
22186+ __VCMD(unset_mapping, 8, VCA_VXI, VCF_ARES|VCF_ZIDOK);
22187+#endif
22188+ /* debug level admin commands */
22189+#ifdef CONFIG_VSERVER_HISTORY
22190+ __VCMD(dump_history, 9, VCA_NONE, 0);
22191+ __VCMD(read_history, 9, VCA_NONE, 0);
22192+#endif
22193+
22194+ default:
22195+ perm = -1;
22196+ }
22197+
22198+ vxdprintk(VXD_CBIT(switch, 0),
22199+ "vc: VCMD_%02d_%d[%d], %d,%p [%d,%d,%x,%x]",
22200+ VC_CATEGORY(cmd), VC_COMMAND(cmd),
22201+ VC_VERSION(cmd), id, data, compat,
22202+ perm, args, flags);
22203+
22204+ ret = -ENOSYS;
22205+ if (perm < 0)
22206+ goto out;
22207+
22208+ state = 1;
22209+ if (!capable(CAP_CONTEXT))
22210+ goto out;
22211+
22212+ state = 2;
22213+ /* moved here from the individual commands */
22214+ ret = -EPERM;
22215+ if ((perm > 1) && !capable(CAP_SYS_ADMIN))
22216+ goto out;
22217+
22218+ state = 3;
22219+ /* vcmd involves resource management */
22220+ ret = -EPERM;
22221+ if ((flags & VCF_ARES) && !capable(CAP_SYS_RESOURCE))
22222+ goto out;
22223+
22224+ state = 4;
22225+ /* various legacy exceptions */
22226+ switch (cmd) {
22227+ /* will go away when spectator is a cap */
22228+ case VCMD_ctx_migrate_v0:
22229+ case VCMD_ctx_migrate:
22230+ if (id == 1) {
22231+ current->xid = 1;
22232+ ret = 1;
22233+ goto out;
22234+ }
22235+ break;
22236+
22237+ /* will go away when spectator is a cap */
22238+ case VCMD_net_migrate:
22239+ if (id == 1) {
22240+ current->nid = 1;
22241+ ret = 1;
22242+ goto out;
22243+ }
22244+ break;
22245+ }
22246+
22247+ /* vcmds are fine by default */
22248+ permit = 1;
22249+
22250+ /* admin type vcmds require admin ... */
22251+ if (flags & VCF_ADMIN)
22252+ permit = vx_check(0, VS_ADMIN) ? 1 : 0;
22253+
22254+ /* ... but setup type vcmds override that */
22255+ if (!permit && (flags & VCF_SETUP))
22256+ permit = vx_flags(VXF_STATE_SETUP, 0) ? 2 : 0;
22257+
22258+ state = 5;
22259+ ret = -EPERM;
22260+ if (!permit)
22261+ goto out;
22262+
22263+ state = 6;
22264+ if (!id && (flags & VCF_ZIDOK))
22265+ goto skip_id;
22266+
22267+ ret = -ESRCH;
22268+ if (args & VCA_VXI) {
22269+ vxi = lookup_vx_info(id);
22270+ if (!vxi)
22271+ goto out;
22272+
22273+ if ((flags & VCF_ADMIN) &&
22274+ /* special case kill for shutdown */
22275+ (cmd != VCMD_ctx_kill) &&
22276+ /* can context be administrated? */
22277+ !vx_info_flags(vxi, VXF_STATE_ADMIN, 0)) {
22278+ ret = -EACCES;
22279+ goto out_vxi;
22280+ }
22281+ }
22282+ state = 7;
22283+ if (args & VCA_NXI) {
22284+ nxi = lookup_nx_info(id);
22285+ if (!nxi)
22286+ goto out_vxi;
22287+
22288+ if ((flags & VCF_ADMIN) &&
22289+ /* can context be administrated? */
22290+ !nx_info_flags(nxi, NXF_STATE_ADMIN, 0)) {
22291+ ret = -EACCES;
22292+ goto out_nxi;
22293+ }
22294+ }
22295+skip_id:
22296+ state = 8;
22297+ ret = do_vcmd(cmd, id, vxi, nxi, data, compat);
22298+
22299+out_nxi:
22300+ if ((args & VCA_NXI) && nxi)
22301+ put_nx_info(nxi);
22302+out_vxi:
22303+ if ((args & VCA_VXI) && vxi)
22304+ put_vx_info(vxi);
22305+out:
22306+ vxdprintk(VXD_CBIT(switch, 1),
22307+ "vc: VCMD_%02d_%d[%d] = %08lx(%ld) [%d,%d]",
22308+ VC_CATEGORY(cmd), VC_COMMAND(cmd),
22309+ VC_VERSION(cmd), ret, ret, state, permit);
22310+ return ret;
22311+}
22312+
22313+asmlinkage long
22314+sys_vserver(uint32_t cmd, uint32_t id, void __user *data)
22315+{
22316+ return do_vserver(cmd, id, data, 0);
22317+}
22318+
22319+#ifdef CONFIG_COMPAT
22320+
22321+asmlinkage long
22322+sys32_vserver(uint32_t cmd, uint32_t id, void __user *data)
22323+{
22324+ return do_vserver(cmd, id, data, 1);
22325+}
22326+
22327+#endif /* CONFIG_COMPAT */
22328diff -NurpP --minimal linux-4.4.116/kernel/vserver/sysctl.c linux-4.4.116-vs2.3.9.7/kernel/vserver/sysctl.c
22329--- linux-4.4.116/kernel/vserver/sysctl.c 1970-01-01 00:00:00.000000000 +0000
22330+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/sysctl.c 2018-01-09 16:36:34.000000000 +0000
22331@@ -0,0 +1,247 @@
22332+/*
22333+ * kernel/vserver/sysctl.c
22334+ *
22335+ * Virtual Context Support
22336+ *
22337+ * Copyright (C) 2004-2007 Herbert P?tzl
22338+ *
22339+ * V0.01 basic structure
22340+ *
22341+ */
22342+
22343+#include <linux/module.h>
22344+#include <linux/ctype.h>
22345+#include <linux/sysctl.h>
22346+#include <linux/parser.h>
22347+#include <asm/uaccess.h>
22348+
22349+enum {
22350+ CTL_DEBUG_ERROR = 0,
22351+ CTL_DEBUG_SWITCH = 1,
22352+ CTL_DEBUG_XID,
22353+ CTL_DEBUG_NID,
22354+ CTL_DEBUG_TAG,
22355+ CTL_DEBUG_NET,
22356+ CTL_DEBUG_LIMIT,
22357+ CTL_DEBUG_CRES,
22358+ CTL_DEBUG_DLIM,
22359+ CTL_DEBUG_QUOTA,
22360+ CTL_DEBUG_CVIRT,
22361+ CTL_DEBUG_SPACE,
22362+ CTL_DEBUG_PERM,
22363+ CTL_DEBUG_MISC,
22364+};
22365+
22366+
22367+unsigned int vs_debug_switch = 0;
22368+unsigned int vs_debug_xid = 0;
22369+unsigned int vs_debug_nid = 0;
22370+unsigned int vs_debug_tag = 0;
22371+unsigned int vs_debug_net = 0;
22372+unsigned int vs_debug_limit = 0;
22373+unsigned int vs_debug_cres = 0;
22374+unsigned int vs_debug_dlim = 0;
22375+unsigned int vs_debug_quota = 0;
22376+unsigned int vs_debug_cvirt = 0;
22377+unsigned int vs_debug_space = 0;
22378+unsigned int vs_debug_perm = 0;
22379+unsigned int vs_debug_misc = 0;
22380+
22381+
22382+static struct ctl_table_header *vserver_table_header;
22383+static struct ctl_table vserver_root_table[];
22384+
22385+
22386+void vserver_register_sysctl(void)
22387+{
22388+ if (!vserver_table_header) {
22389+ vserver_table_header = register_sysctl_table(vserver_root_table);
22390+ }
22391+
22392+}
22393+
22394+void vserver_unregister_sysctl(void)
22395+{
22396+ if (vserver_table_header) {
22397+ unregister_sysctl_table(vserver_table_header);
22398+ vserver_table_header = NULL;
22399+ }
22400+}
22401+
22402+
22403+static int proc_dodebug(struct ctl_table *table, int write,
22404+ void __user *buffer, size_t *lenp, loff_t *ppos)
22405+{
22406+ char tmpbuf[20], *p, c;
22407+ unsigned int value;
22408+ size_t left, len;
22409+
22410+ if ((*ppos && !write) || !*lenp) {
22411+ *lenp = 0;
22412+ return 0;
22413+ }
22414+
22415+ left = *lenp;
22416+
22417+ if (write) {
22418+ if (!access_ok(VERIFY_READ, buffer, left))
22419+ return -EFAULT;
22420+ p = (char *)buffer;
22421+ while (left && __get_user(c, p) >= 0 && isspace(c))
22422+ left--, p++;
22423+ if (!left)
22424+ goto done;
22425+
22426+ if (left > sizeof(tmpbuf) - 1)
22427+ return -EINVAL;
22428+ if (copy_from_user(tmpbuf, p, left))
22429+ return -EFAULT;
22430+ tmpbuf[left] = '\0';
22431+
22432+ for (p = tmpbuf, value = 0; '0' <= *p && *p <= '9'; p++, left--)
22433+ value = 10 * value + (*p - '0');
22434+ if (*p && !isspace(*p))
22435+ return -EINVAL;
22436+ while (left && isspace(*p))
22437+ left--, p++;
22438+ *(unsigned int *)table->data = value;
22439+ } else {
22440+ if (!access_ok(VERIFY_WRITE, buffer, left))
22441+ return -EFAULT;
22442+ len = sprintf(tmpbuf, "%d", *(unsigned int *)table->data);
22443+ if (len > left)
22444+ len = left;
22445+ if (__copy_to_user(buffer, tmpbuf, len))
22446+ return -EFAULT;
22447+ if ((left -= len) > 0) {
22448+ if (put_user('\n', (char *)buffer + len))
22449+ return -EFAULT;
22450+ left--;
22451+ }
22452+ }
22453+
22454+done:
22455+ *lenp -= left;
22456+ *ppos += *lenp;
22457+ return 0;
22458+}
22459+
22460+static int zero;
22461+
22462+#define CTL_ENTRY(ctl, name) \
22463+ { \
22464+ .procname = #name, \
22465+ .data = &vs_ ## name, \
22466+ .maxlen = sizeof(int), \
22467+ .mode = 0644, \
22468+ .proc_handler = &proc_dodebug, \
22469+ .extra1 = &zero, \
22470+ .extra2 = &zero, \
22471+ }
22472+
22473+static struct ctl_table vserver_debug_table[] = {
22474+ CTL_ENTRY(CTL_DEBUG_SWITCH, debug_switch),
22475+ CTL_ENTRY(CTL_DEBUG_XID, debug_xid),
22476+ CTL_ENTRY(CTL_DEBUG_NID, debug_nid),
22477+ CTL_ENTRY(CTL_DEBUG_TAG, debug_tag),
22478+ CTL_ENTRY(CTL_DEBUG_NET, debug_net),
22479+ CTL_ENTRY(CTL_DEBUG_LIMIT, debug_limit),
22480+ CTL_ENTRY(CTL_DEBUG_CRES, debug_cres),
22481+ CTL_ENTRY(CTL_DEBUG_DLIM, debug_dlim),
22482+ CTL_ENTRY(CTL_DEBUG_QUOTA, debug_quota),
22483+ CTL_ENTRY(CTL_DEBUG_CVIRT, debug_cvirt),
22484+ CTL_ENTRY(CTL_DEBUG_SPACE, debug_space),
22485+ CTL_ENTRY(CTL_DEBUG_PERM, debug_perm),
22486+ CTL_ENTRY(CTL_DEBUG_MISC, debug_misc),
22487+ { 0 }
22488+};
22489+
22490+static struct ctl_table vserver_root_table[] = {
22491+ {
22492+ .procname = "vserver",
22493+ .mode = 0555,
22494+ .child = vserver_debug_table
22495+ },
22496+ { 0 }
22497+};
22498+
22499+
22500+static match_table_t tokens = {
22501+ { CTL_DEBUG_SWITCH, "switch=%x" },
22502+ { CTL_DEBUG_XID, "xid=%x" },
22503+ { CTL_DEBUG_NID, "nid=%x" },
22504+ { CTL_DEBUG_TAG, "tag=%x" },
22505+ { CTL_DEBUG_NET, "net=%x" },
22506+ { CTL_DEBUG_LIMIT, "limit=%x" },
22507+ { CTL_DEBUG_CRES, "cres=%x" },
22508+ { CTL_DEBUG_DLIM, "dlim=%x" },
22509+ { CTL_DEBUG_QUOTA, "quota=%x" },
22510+ { CTL_DEBUG_CVIRT, "cvirt=%x" },
22511+ { CTL_DEBUG_SPACE, "space=%x" },
22512+ { CTL_DEBUG_PERM, "perm=%x" },
22513+ { CTL_DEBUG_MISC, "misc=%x" },
22514+ { CTL_DEBUG_ERROR, NULL }
22515+};
22516+
22517+#define HANDLE_CASE(id, name, val) \
22518+ case CTL_DEBUG_ ## id: \
22519+ vs_debug_ ## name = val; \
22520+ printk("vs_debug_" #name "=0x%x\n", val); \
22521+ break
22522+
22523+
22524+static int __init vs_debug_setup(char *str)
22525+{
22526+ char *p;
22527+ int token;
22528+
22529+ printk("vs_debug_setup(%s)\n", str);
22530+ while ((p = strsep(&str, ",")) != NULL) {
22531+ substring_t args[MAX_OPT_ARGS];
22532+ unsigned int value;
22533+
22534+ if (!*p)
22535+ continue;
22536+
22537+ token = match_token(p, tokens, args);
22538+ value = (token > 0) ? simple_strtoul(args[0].from, NULL, 0) : 0;
22539+
22540+ switch (token) {
22541+ HANDLE_CASE(SWITCH, switch, value);
22542+ HANDLE_CASE(XID, xid, value);
22543+ HANDLE_CASE(NID, nid, value);
22544+ HANDLE_CASE(TAG, tag, value);
22545+ HANDLE_CASE(NET, net, value);
22546+ HANDLE_CASE(LIMIT, limit, value);
22547+ HANDLE_CASE(CRES, cres, value);
22548+ HANDLE_CASE(DLIM, dlim, value);
22549+ HANDLE_CASE(QUOTA, quota, value);
22550+ HANDLE_CASE(CVIRT, cvirt, value);
22551+ HANDLE_CASE(SPACE, space, value);
22552+ HANDLE_CASE(PERM, perm, value);
22553+ HANDLE_CASE(MISC, misc, value);
22554+ default:
22555+ return -EINVAL;
22556+ break;
22557+ }
22558+ }
22559+ return 1;
22560+}
22561+
22562+__setup("vsdebug=", vs_debug_setup);
22563+
22564+
22565+
22566+EXPORT_SYMBOL_GPL(vs_debug_switch);
22567+EXPORT_SYMBOL_GPL(vs_debug_xid);
22568+EXPORT_SYMBOL_GPL(vs_debug_nid);
22569+EXPORT_SYMBOL_GPL(vs_debug_net);
22570+EXPORT_SYMBOL_GPL(vs_debug_limit);
22571+EXPORT_SYMBOL_GPL(vs_debug_cres);
22572+EXPORT_SYMBOL_GPL(vs_debug_dlim);
22573+EXPORT_SYMBOL_GPL(vs_debug_quota);
22574+EXPORT_SYMBOL_GPL(vs_debug_cvirt);
22575+EXPORT_SYMBOL_GPL(vs_debug_space);
22576+EXPORT_SYMBOL_GPL(vs_debug_perm);
22577+EXPORT_SYMBOL_GPL(vs_debug_misc);
22578+
22579diff -NurpP --minimal linux-4.4.116/kernel/vserver/tag.c linux-4.4.116-vs2.3.9.7/kernel/vserver/tag.c
22580--- linux-4.4.116/kernel/vserver/tag.c 1970-01-01 00:00:00.000000000 +0000
22581+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/tag.c 2018-01-09 16:36:34.000000000 +0000
22582@@ -0,0 +1,63 @@
22583+/*
22584+ * linux/kernel/vserver/tag.c
22585+ *
22586+ * Virtual Server: Shallow Tag Space
22587+ *
22588+ * Copyright (C) 2007 Herbert P?tzl
22589+ *
22590+ * V0.01 basic implementation
22591+ *
22592+ */
22593+
22594+#include <linux/sched.h>
22595+#include <linux/vserver/debug.h>
22596+#include <linux/vs_pid.h>
22597+#include <linux/vs_tag.h>
22598+
22599+#include <linux/vserver/tag_cmd.h>
22600+
22601+
22602+int dx_migrate_task(struct task_struct *p, vtag_t tag)
22603+{
22604+ if (!p)
22605+ BUG();
22606+
22607+ vxdprintk(VXD_CBIT(tag, 5),
22608+ "dx_migrate_task(%p[#%d],#%d)", p, p->tag, tag);
22609+
22610+ task_lock(p);
22611+ p->tag = tag;
22612+ task_unlock(p);
22613+
22614+ vxdprintk(VXD_CBIT(tag, 5),
22615+ "moved task %p into [#%d]", p, tag);
22616+ return 0;
22617+}
22618+
22619+/* vserver syscall commands below here */
22620+
22621+/* taks xid and vx_info functions */
22622+
22623+
22624+int vc_task_tag(uint32_t id)
22625+{
22626+ vtag_t tag;
22627+
22628+ if (id) {
22629+ struct task_struct *tsk;
22630+ rcu_read_lock();
22631+ tsk = find_task_by_real_pid(id);
22632+ tag = (tsk) ? tsk->tag : -ESRCH;
22633+ rcu_read_unlock();
22634+ } else
22635+ tag = dx_current_tag();
22636+ return tag;
22637+}
22638+
22639+
22640+int vc_tag_migrate(uint32_t tag)
22641+{
22642+ return dx_migrate_task(current, tag & 0xFFFF);
22643+}
22644+
22645+
22646diff -NurpP --minimal linux-4.4.116/kernel/vserver/vci_config.h linux-4.4.116-vs2.3.9.7/kernel/vserver/vci_config.h
22647--- linux-4.4.116/kernel/vserver/vci_config.h 1970-01-01 00:00:00.000000000 +0000
22648+++ linux-4.4.116-vs2.3.9.7/kernel/vserver/vci_config.h 2018-01-09 16:36:34.000000000 +0000
22649@@ -0,0 +1,80 @@
22650+
22651+/* interface version */
22652+
22653+#define VCI_VERSION 0x00020308
22654+
22655+
22656+enum {
22657+ VCI_KCBIT_NO_DYNAMIC = 0,
22658+
22659+ VCI_KCBIT_PROC_SECURE = 4,
22660+ /* VCI_KCBIT_HARDCPU = 5, */
22661+ /* VCI_KCBIT_IDLELIMIT = 6, */
22662+ /* VCI_KCBIT_IDLETIME = 7, */
22663+
22664+ VCI_KCBIT_COWBL = 8,
22665+ VCI_KCBIT_FULLCOWBL = 9,
22666+ VCI_KCBIT_SPACES = 10,
22667+ VCI_KCBIT_NETV2 = 11,
22668+ VCI_KCBIT_MEMCG = 12,
22669+ VCI_KCBIT_MEMCG_SWAP = 13,
22670+
22671+ VCI_KCBIT_DEBUG = 16,
22672+ VCI_KCBIT_HISTORY = 20,
22673+ VCI_KCBIT_TAGGED = 24,
22674+ VCI_KCBIT_PPTAG = 28,
22675+
22676+ VCI_KCBIT_MORE = 31,
22677+};
22678+
22679+
22680+static inline uint32_t vci_kernel_config(void)
22681+{
22682+ return
22683+ (1 << VCI_KCBIT_NO_DYNAMIC) |
22684+
22685+ /* configured features */
22686+#ifdef CONFIG_VSERVER_PROC_SECURE
22687+ (1 << VCI_KCBIT_PROC_SECURE) |
22688+#endif
22689+#ifdef CONFIG_VSERVER_COWBL
22690+ (1 << VCI_KCBIT_COWBL) |
22691+ (1 << VCI_KCBIT_FULLCOWBL) |
22692+#endif
22693+ (1 << VCI_KCBIT_SPACES) |
22694+ (1 << VCI_KCBIT_NETV2) |
22695+#ifdef CONFIG_MEMCG
22696+ (1 << VCI_KCBIT_MEMCG) |
22697+#endif
22698+#ifdef CONFIG_MEMCG_SWAP
22699+ (1 << VCI_KCBIT_MEMCG_SWAP) |
22700+#endif
22701+
22702+ /* debug options */
22703+#ifdef CONFIG_VSERVER_DEBUG
22704+ (1 << VCI_KCBIT_DEBUG) |
22705+#endif
22706+#ifdef CONFIG_VSERVER_HISTORY
22707+ (1 << VCI_KCBIT_HISTORY) |
22708+#endif
22709+
22710+ /* inode context tagging */
22711+#if defined(CONFIG_TAGGING_NONE)
22712+ (0 << VCI_KCBIT_TAGGED) |
22713+#elif defined(CONFIG_TAGGING_UID16)
22714+ (1 << VCI_KCBIT_TAGGED) |
22715+#elif defined(CONFIG_TAGGING_GID16)
22716+ (2 << VCI_KCBIT_TAGGED) |
22717+#elif defined(CONFIG_TAGGING_ID24)
22718+ (3 << VCI_KCBIT_TAGGED) |
22719+#elif defined(CONFIG_TAGGING_INTERN)
22720+ (4 << VCI_KCBIT_TAGGED) |
22721+#elif defined(CONFIG_TAGGING_RUNTIME)
22722+ (5 << VCI_KCBIT_TAGGED) |
22723+#else
22724+ (7 << VCI_KCBIT_TAGGED) |
22725+#endif
22726+ (1 << VCI_KCBIT_PPTAG) |
22727+ 0;
22728+}
22729+
22730diff -NurpP --minimal linux-4.4.116/mm/memcontrol.c linux-4.4.116-vs2.3.9.7/mm/memcontrol.c
22731--- linux-4.4.116/mm/memcontrol.c 2018-02-22 21:20:01.000000000 +0000
22732+++ linux-4.4.116-vs2.3.9.7/mm/memcontrol.c 2018-02-10 15:16:50.000000000 +0000
22733@@ -2888,6 +2888,42 @@ static u64 mem_cgroup_read_u64(struct cg
22734 }
22735 }
22736
22737+unsigned long mem_cgroup_mem_usage_pages(struct mem_cgroup *memcg)
22738+{
22739+ return mem_cgroup_usage(memcg, false);
22740+}
22741+
22742+unsigned long mem_cgroup_mem_limit_pages(struct mem_cgroup *memcg)
22743+{
22744+ return (u64)memcg->memory.limit;
22745+}
22746+
22747+unsigned long mem_cgroup_memsw_usage_pages(struct mem_cgroup *memcg)
22748+{
22749+ return mem_cgroup_usage(memcg, true);
22750+}
22751+
22752+unsigned long mem_cgroup_memsw_limit_pages(struct mem_cgroup *memcg)
22753+{
22754+ return (u64)memcg->memsw.limit;
22755+}
22756+
22757+void dump_mem_cgroup(struct mem_cgroup *memcg)
22758+{
22759+ printk(KERN_INFO "memcg: %p/%d:\n"
22760+ "\tmemory:\t%lu/%lu %lu/%lu\n"
22761+ "\tmemsw:\t%lu/%lu %lu/%lu\n"
22762+ "\tkmem:\t%lu/%lu %lu/%lu\n",
22763+ memcg, memcg->id.id,
22764+ page_counter_read(&memcg->memory), memcg->memory.limit,
22765+ memcg->memory.watermark, memcg->memory.failcnt,
22766+ page_counter_read(&memcg->memsw), memcg->memsw.limit,
22767+ memcg->memsw.watermark, memcg->memsw.failcnt,
22768+ page_counter_read(&memcg->kmem), memcg->kmem.limit,
22769+ memcg->kmem.watermark, memcg->kmem.failcnt);
22770+}
22771+
22772+
22773 #ifdef CONFIG_MEMCG_KMEM
22774 static int memcg_activate_kmem(struct mem_cgroup *memcg,
22775 unsigned long nr_pages)
22776diff -NurpP --minimal linux-4.4.116/mm/oom_kill.c linux-4.4.116-vs2.3.9.7/mm/oom_kill.c
22777--- linux-4.4.116/mm/oom_kill.c 2016-07-05 04:15:13.000000000 +0000
22778+++ linux-4.4.116-vs2.3.9.7/mm/oom_kill.c 2018-01-09 16:56:23.000000000 +0000
22779@@ -35,6 +35,8 @@
22780 #include <linux/freezer.h>
22781 #include <linux/ftrace.h>
22782 #include <linux/ratelimit.h>
22783+#include <linux/reboot.h>
22784+#include <linux/vs_context.h>
22785
22786 #define CREATE_TRACE_POINTS
22787 #include <trace/events/oom.h>
22788@@ -131,11 +133,18 @@ static inline bool is_sysrq_oom(struct o
22789 static bool oom_unkillable_task(struct task_struct *p,
22790 struct mem_cgroup *memcg, const nodemask_t *nodemask)
22791 {
22792- if (is_global_init(p))
22793+ unsigned xid = vx_current_xid();
22794+
22795+ /* skip the init task, global and per guest */
22796+ if (task_is_init(p))
22797 return true;
22798 if (p->flags & PF_KTHREAD)
22799 return true;
22800
22801+ /* skip other guest and host processes if oom in guest */
22802+ if (xid && vx_task_xid(p) != xid)
22803+ return true;
22804+
22805 /* When mem_cgroup_out_of_memory() and p is not member of the group */
22806 if (memcg && !task_in_mem_cgroup(p, memcg))
22807 return true;
22808@@ -534,8 +543,8 @@ void oom_kill_process(struct oom_control
22809 if (__ratelimit(&oom_rs))
22810 dump_header(oc, p, memcg);
22811
22812- pr_err("%s: Kill process %d (%s) score %u or sacrifice child\n",
22813- message, task_pid_nr(p), p->comm, points);
22814+ pr_err("%s: Kill process %d:#%u (%s) score %d or sacrifice child\n",
22815+ message, task_pid_nr(p), p->xid, p->comm, points);
22816
22817 /*
22818 * If any of p's children has a different mm and is eligible for kill,
22819@@ -585,8 +594,8 @@ void oom_kill_process(struct oom_control
22820 */
22821 do_send_sig_info(SIGKILL, SEND_SIG_FORCED, victim, true);
22822 mark_oom_victim(victim);
22823- pr_err("Killed process %d (%s) total-vm:%lukB, anon-rss:%lukB, file-rss:%lukB\n",
22824- task_pid_nr(victim), victim->comm, K(victim->mm->total_vm),
22825+ pr_err("Killed process %d:%u (%s) total-vm:%lukB, anon-rss:%lukB, file-rss:%lukB\n",
22826+ task_pid_nr(victim), victim->xid, victim->comm, K(victim->mm->total_vm),
22827 K(get_mm_counter(victim->mm, MM_ANONPAGES)),
22828 K(get_mm_counter(victim->mm, MM_FILEPAGES)));
22829 task_unlock(victim);
22830@@ -622,6 +631,8 @@ void oom_kill_process(struct oom_control
22831 }
22832 #undef K
22833
22834+long vs_oom_action(unsigned int);
22835+
22836 /*
22837 * Determines whether the kernel must panic because of the panic_on_oom sysctl.
22838 */
22839@@ -722,7 +733,12 @@ bool out_of_memory(struct oom_control *o
22840 /* Found nothing?!?! Either we hang forever, or we panic. */
22841 if (!p && !is_sysrq_oom(oc)) {
22842 dump_header(oc, NULL, NULL);
22843- panic("Out of memory and no killable processes...\n");
22844+
22845+ /* avoid panic for guest OOM */
22846+ if (vx_current_xid())
22847+ vs_oom_action(LINUX_REBOOT_CMD_OOM);
22848+ else
22849+ panic("Out of memory and no killable processes...\n");
22850 }
22851 if (p && p != (void *)-1UL) {
22852 oom_kill_process(oc, p, points, totalpages, NULL,
22853diff -NurpP --minimal linux-4.4.116/mm/page_alloc.c linux-4.4.116-vs2.3.9.7/mm/page_alloc.c
22854--- linux-4.4.116/mm/page_alloc.c 2018-02-22 21:20:01.000000000 +0000
22855+++ linux-4.4.116-vs2.3.9.7/mm/page_alloc.c 2018-02-10 15:16:50.000000000 +0000
22856@@ -62,6 +62,8 @@
22857 #include <linux/sched/rt.h>
22858 #include <linux/page_owner.h>
22859 #include <linux/kthread.h>
22860+#include <linux/vs_base.h>
22861+#include <linux/vs_limit.h>
22862
22863 #include <asm/sections.h>
22864 #include <asm/tlbflush.h>
22865@@ -3661,6 +3663,9 @@ void si_meminfo(struct sysinfo *val)
22866 val->totalhigh = totalhigh_pages;
22867 val->freehigh = nr_free_highpages();
22868 val->mem_unit = PAGE_SIZE;
22869+
22870+ if (vx_flags(VXF_VIRT_MEM, 0))
22871+ vx_vsi_meminfo(val);
22872 }
22873
22874 EXPORT_SYMBOL(si_meminfo);
22875@@ -3686,6 +3691,9 @@ void si_meminfo_node(struct sysinfo *val
22876 val->freehigh = 0;
22877 #endif
22878 val->mem_unit = PAGE_SIZE;
22879+
22880+ if (vx_flags(VXF_VIRT_MEM, 0))
22881+ vx_vsi_meminfo(val);
22882 }
22883 #endif
22884
22885diff -NurpP --minimal linux-4.4.116/mm/pgtable-generic.c linux-4.4.116-vs2.3.9.7/mm/pgtable-generic.c
22886--- linux-4.4.116/mm/pgtable-generic.c 2018-02-22 21:20:01.000000000 +0000
22887+++ linux-4.4.116-vs2.3.9.7/mm/pgtable-generic.c 2018-01-09 16:36:34.000000000 +0000
22888@@ -6,6 +6,8 @@
22889 * Copyright (C) 2010 Linus Torvalds
22890 */
22891
22892+#include <linux/mm.h>
22893+
22894 #include <linux/pagemap.h>
22895 #include <asm/tlb.h>
22896 #include <asm-generic/pgtable.h>
22897diff -NurpP --minimal linux-4.4.116/mm/shmem.c linux-4.4.116-vs2.3.9.7/mm/shmem.c
22898--- linux-4.4.116/mm/shmem.c 2018-02-22 21:20:01.000000000 +0000
22899+++ linux-4.4.116-vs2.3.9.7/mm/shmem.c 2018-01-09 16:36:34.000000000 +0000
22900@@ -2198,7 +2198,7 @@ static int shmem_statfs(struct dentry *d
22901 {
22902 struct shmem_sb_info *sbinfo = SHMEM_SB(dentry->d_sb);
22903
22904- buf->f_type = TMPFS_MAGIC;
22905+ buf->f_type = TMPFS_SUPER_MAGIC;
22906 buf->f_bsize = PAGE_CACHE_SIZE;
22907 buf->f_namelen = NAME_MAX;
22908 if (sbinfo->max_blocks) {
22909@@ -3044,7 +3044,7 @@ int shmem_fill_super(struct super_block
22910 sb->s_maxbytes = MAX_LFS_FILESIZE;
22911 sb->s_blocksize = PAGE_CACHE_SIZE;
22912 sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
22913- sb->s_magic = TMPFS_MAGIC;
22914+ sb->s_magic = TMPFS_SUPER_MAGIC;
22915 sb->s_op = &shmem_ops;
22916 sb->s_time_gran = 1;
22917 #ifdef CONFIG_TMPFS_XATTR
22918diff -NurpP --minimal linux-4.4.116/mm/slab.c linux-4.4.116-vs2.3.9.7/mm/slab.c
22919--- linux-4.4.116/mm/slab.c 2016-07-05 04:15:13.000000000 +0000
22920+++ linux-4.4.116-vs2.3.9.7/mm/slab.c 2018-01-09 16:36:34.000000000 +0000
22921@@ -337,6 +337,8 @@ static void kmem_cache_node_init(struct
22922 #define STATS_INC_FREEMISS(x) do { } while (0)
22923 #endif
22924
22925+#include "slab_vs.h"
22926+
22927 #if DEBUG
22928
22929 /*
22930@@ -3183,6 +3185,7 @@ slab_alloc_node(struct kmem_cache *cache
22931 /* ___cache_alloc_node can fall back to other nodes */
22932 ptr = ____cache_alloc_node(cachep, flags, nodeid);
22933 out:
22934+ vx_slab_alloc(cachep, flags);
22935 local_irq_restore(save_flags);
22936 ptr = cache_alloc_debugcheck_after(cachep, flags, ptr, caller);
22937 kmemleak_alloc_recursive(ptr, cachep->object_size, 1, cachep->flags,
22938@@ -3371,6 +3374,7 @@ static inline void __cache_free(struct k
22939 check_irq_off();
22940 kmemleak_free_recursive(objp, cachep->flags);
22941 objp = cache_free_debugcheck(cachep, objp, caller);
22942+ vx_slab_free(cachep);
22943
22944 kmemcheck_slab_free(cachep, objp, cachep->object_size);
22945
22946diff -NurpP --minimal linux-4.4.116/mm/slab_vs.h linux-4.4.116-vs2.3.9.7/mm/slab_vs.h
22947--- linux-4.4.116/mm/slab_vs.h 1970-01-01 00:00:00.000000000 +0000
22948+++ linux-4.4.116-vs2.3.9.7/mm/slab_vs.h 2018-01-09 16:36:34.000000000 +0000
22949@@ -0,0 +1,29 @@
22950+
22951+#include <linux/vserver/context.h>
22952+
22953+#include <linux/vs_context.h>
22954+
22955+static inline
22956+void vx_slab_alloc(struct kmem_cache *cachep, gfp_t flags)
22957+{
22958+ int what = gfp_zone(cachep->allocflags);
22959+ struct vx_info *vxi = current_vx_info();
22960+
22961+ if (!vxi)
22962+ return;
22963+
22964+ atomic_add(cachep->size, &vxi->cacct.slab[what]);
22965+}
22966+
22967+static inline
22968+void vx_slab_free(struct kmem_cache *cachep)
22969+{
22970+ int what = gfp_zone(cachep->allocflags);
22971+ struct vx_info *vxi = current_vx_info();
22972+
22973+ if (!vxi)
22974+ return;
22975+
22976+ atomic_sub(cachep->size, &vxi->cacct.slab[what]);
22977+}
22978+
22979diff -NurpP --minimal linux-4.4.116/mm/swapfile.c linux-4.4.116-vs2.3.9.7/mm/swapfile.c
22980--- linux-4.4.116/mm/swapfile.c 2018-02-22 21:20:01.000000000 +0000
22981+++ linux-4.4.116-vs2.3.9.7/mm/swapfile.c 2018-01-09 16:36:34.000000000 +0000
22982@@ -39,6 +39,7 @@
22983 #include <asm/tlbflush.h>
22984 #include <linux/swapops.h>
22985 #include <linux/swap_cgroup.h>
22986+#include <linux/vs_base.h>
22987
22988 static bool swap_count_continued(struct swap_info_struct *, pgoff_t,
22989 unsigned char);
22990@@ -2070,6 +2071,16 @@ static int swap_show(struct seq_file *sw
22991
22992 if (si == SEQ_START_TOKEN) {
22993 seq_puts(swap,"Filename\t\t\t\tType\t\tSize\tUsed\tPriority\n");
22994+ if (vx_flags(VXF_VIRT_MEM, 0)) {
22995+ struct sysinfo si = { 0 };
22996+
22997+ vx_vsi_swapinfo(&si);
22998+ if (si.totalswap < (1 << 10))
22999+ return 0;
23000+ seq_printf(swap, "%s\t\t\t\t\t%s\t%lu\t%lu\t%d\n",
23001+ "hdv0", "partition", si.totalswap >> 10,
23002+ (si.totalswap - si.freeswap) >> 10, -1);
23003+ }
23004 return 0;
23005 }
23006
23007@@ -2609,6 +2620,8 @@ void si_swapinfo(struct sysinfo *val)
23008 val->freeswap = atomic_long_read(&nr_swap_pages) + nr_to_be_unused;
23009 val->totalswap = total_swap_pages + nr_to_be_unused;
23010 spin_unlock(&swap_lock);
23011+ if (vx_flags(VXF_VIRT_MEM, 0))
23012+ vx_vsi_swapinfo(val);
23013 }
23014
23015 /*
23016diff -NurpP --minimal linux-4.4.116/net/bridge/br_multicast.c linux-4.4.116-vs2.3.9.7/net/bridge/br_multicast.c
23017--- linux-4.4.116/net/bridge/br_multicast.c 2018-02-22 21:20:02.000000000 +0000
23018+++ linux-4.4.116-vs2.3.9.7/net/bridge/br_multicast.c 2018-01-09 16:36:34.000000000 +0000
23019@@ -462,7 +462,7 @@ static struct sk_buff *br_ip6_multicast_
23020 ip6h->hop_limit = 1;
23021 ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
23022 if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
23023- &ip6h->saddr)) {
23024+ &ip6h->saddr, NULL)) {
23025 kfree_skb(skb);
23026 br->has_ipv6_addr = 0;
23027 return NULL;
23028diff -NurpP --minimal linux-4.4.116/net/core/dev.c linux-4.4.116-vs2.3.9.7/net/core/dev.c
23029--- linux-4.4.116/net/core/dev.c 2018-02-22 21:20:02.000000000 +0000
23030+++ linux-4.4.116-vs2.3.9.7/net/core/dev.c 2018-02-10 15:16:50.000000000 +0000
23031@@ -124,6 +124,7 @@
23032 #include <linux/in.h>
23033 #include <linux/jhash.h>
23034 #include <linux/random.h>
23035+#include <linux/vs_inet.h>
23036 #include <trace/events/napi.h>
23037 #include <trace/events/net.h>
23038 #include <trace/events/skb.h>
23039@@ -726,7 +727,8 @@ struct net_device *__dev_get_by_name(str
23040 struct hlist_head *head = dev_name_hash(net, name);
23041
23042 hlist_for_each_entry(dev, head, name_hlist)
23043- if (!strncmp(dev->name, name, IFNAMSIZ))
23044+ if (!strncmp(dev->name, name, IFNAMSIZ) &&
23045+ nx_dev_visible(current_nx_info(), dev))
23046 return dev;
23047
23048 return NULL;
23049@@ -751,7 +753,8 @@ struct net_device *dev_get_by_name_rcu(s
23050 struct hlist_head *head = dev_name_hash(net, name);
23051
23052 hlist_for_each_entry_rcu(dev, head, name_hlist)
23053- if (!strncmp(dev->name, name, IFNAMSIZ))
23054+ if (!strncmp(dev->name, name, IFNAMSIZ) &&
23055+ nx_dev_visible(current_nx_info(), dev))
23056 return dev;
23057
23058 return NULL;
23059@@ -801,7 +804,8 @@ struct net_device *__dev_get_by_index(st
23060 struct hlist_head *head = dev_index_hash(net, ifindex);
23061
23062 hlist_for_each_entry(dev, head, index_hlist)
23063- if (dev->ifindex == ifindex)
23064+ if ((dev->ifindex == ifindex) &&
23065+ nx_dev_visible(current_nx_info(), dev))
23066 return dev;
23067
23068 return NULL;
23069@@ -819,7 +823,7 @@ EXPORT_SYMBOL(__dev_get_by_index);
23070 * about locking. The caller must hold RCU lock.
23071 */
23072
23073-struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex)
23074+struct net_device *dev_get_by_index_real_rcu(struct net *net, int ifindex)
23075 {
23076 struct net_device *dev;
23077 struct hlist_head *head = dev_index_hash(net, ifindex);
23078@@ -830,6 +834,16 @@ struct net_device *dev_get_by_index_rcu(
23079
23080 return NULL;
23081 }
23082+EXPORT_SYMBOL(dev_get_by_index_real_rcu);
23083+
23084+struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex)
23085+{
23086+ struct net_device *dev = dev_get_by_index_real_rcu(net, ifindex);
23087+
23088+ if (nx_dev_visible(current_nx_info(), dev))
23089+ return dev;
23090+ return NULL;
23091+}
23092 EXPORT_SYMBOL(dev_get_by_index_rcu);
23093
23094
23095@@ -912,7 +926,8 @@ struct net_device *dev_getbyhwaddr_rcu(s
23096
23097 for_each_netdev_rcu(net, dev)
23098 if (dev->type == type &&
23099- !memcmp(dev->dev_addr, ha, dev->addr_len))
23100+ !memcmp(dev->dev_addr, ha, dev->addr_len) &&
23101+ nx_dev_visible(current_nx_info(), dev))
23102 return dev;
23103
23104 return NULL;
23105@@ -924,9 +939,11 @@ struct net_device *__dev_getfirstbyhwtyp
23106 struct net_device *dev;
23107
23108 ASSERT_RTNL();
23109- for_each_netdev(net, dev)
23110- if (dev->type == type)
23111+ for_each_netdev(net, dev) {
23112+ if ((dev->type == type) &&
23113+ nx_dev_visible(current_nx_info(), dev))
23114 return dev;
23115+ }
23116
23117 return NULL;
23118 }
23119@@ -938,7 +955,8 @@ struct net_device *dev_getfirstbyhwtype(
23120
23121 rcu_read_lock();
23122 for_each_netdev_rcu(net, dev)
23123- if (dev->type == type) {
23124+ if ((dev->type == type) &&
23125+ nx_dev_visible(current_nx_info(), dev)) {
23126 dev_hold(dev);
23127 ret = dev;
23128 break;
23129@@ -968,7 +986,8 @@ struct net_device *__dev_get_by_flags(st
23130
23131 ret = NULL;
23132 for_each_netdev(net, dev) {
23133- if (((dev->flags ^ if_flags) & mask) == 0) {
23134+ if ((((dev->flags ^ if_flags) & mask) == 0) &&
23135+ nx_dev_visible(current_nx_info(), dev)) {
23136 ret = dev;
23137 break;
23138 }
23139@@ -1046,6 +1065,8 @@ static int __dev_alloc_name(struct net *
23140 continue;
23141 if (i < 0 || i >= max_netdevices)
23142 continue;
23143+ if (!nx_dev_visible(current_nx_info(), d))
23144+ continue;
23145
23146 /* avoid cases where sscanf is not exact inverse of printf */
23147 snprintf(buf, IFNAMSIZ, name, i);
23148diff -NurpP --minimal linux-4.4.116/net/core/net-procfs.c linux-4.4.116-vs2.3.9.7/net/core/net-procfs.c
23149--- linux-4.4.116/net/core/net-procfs.c 2015-04-12 22:12:50.000000000 +0000
23150+++ linux-4.4.116-vs2.3.9.7/net/core/net-procfs.c 2018-01-09 16:36:34.000000000 +0000
23151@@ -1,6 +1,7 @@
23152 #include <linux/netdevice.h>
23153 #include <linux/proc_fs.h>
23154 #include <linux/seq_file.h>
23155+#include <linux/vs_inet.h>
23156 #include <net/wext.h>
23157
23158 #define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
23159@@ -77,8 +78,13 @@ static void dev_seq_stop(struct seq_file
23160 static void dev_seq_printf_stats(struct seq_file *seq, struct net_device *dev)
23161 {
23162 struct rtnl_link_stats64 temp;
23163- const struct rtnl_link_stats64 *stats = dev_get_stats(dev, &temp);
23164+ const struct rtnl_link_stats64 *stats;
23165+
23166+ /* device visible inside network context? */
23167+ if (!nx_dev_visible(current_nx_info(), dev))
23168+ return;
23169
23170+ stats = dev_get_stats(dev, &temp);
23171 seq_printf(seq, "%6s: %7llu %7llu %4llu %4llu %4llu %5llu %10llu %9llu "
23172 "%8llu %7llu %4llu %4llu %4llu %5llu %7llu %10llu\n",
23173 dev->name, stats->rx_bytes, stats->rx_packets,
23174diff -NurpP --minimal linux-4.4.116/net/core/rtnetlink.c linux-4.4.116-vs2.3.9.7/net/core/rtnetlink.c
23175--- linux-4.4.116/net/core/rtnetlink.c 2018-02-22 21:20:02.000000000 +0000
23176+++ linux-4.4.116-vs2.3.9.7/net/core/rtnetlink.c 2018-01-09 16:36:34.000000000 +0000
23177@@ -1456,6 +1456,8 @@ static int rtnl_dump_ifinfo(struct sk_bu
23178 hlist_for_each_entry(dev, head, index_hlist) {
23179 if (idx < s_idx)
23180 goto cont;
23181+ if (!nx_dev_visible(skb->sk->sk_nx_info, dev))
23182+ continue;
23183 err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
23184 NETLINK_CB(cb->skb).portid,
23185 cb->nlh->nlmsg_seq, 0,
23186@@ -2559,6 +2561,9 @@ void rtmsg_ifinfo(int type, struct net_d
23187 {
23188 struct sk_buff *skb;
23189
23190+ if (!nx_dev_visible(current_nx_info(), dev))
23191+ return;
23192+
23193 if (dev->reg_state != NETREG_REGISTERED)
23194 return;
23195
23196diff -NurpP --minimal linux-4.4.116/net/core/sock.c linux-4.4.116-vs2.3.9.7/net/core/sock.c
23197--- linux-4.4.116/net/core/sock.c 2018-02-22 21:20:02.000000000 +0000
23198+++ linux-4.4.116-vs2.3.9.7/net/core/sock.c 2018-01-09 17:15:58.000000000 +0000
23199@@ -134,6 +134,10 @@
23200 #include <linux/sock_diag.h>
23201
23202 #include <linux/filter.h>
23203+#include <linux/vs_socket.h>
23204+#include <linux/vs_limit.h>
23205+#include <linux/vs_context.h>
23206+#include <linux/vs_network.h>
23207
23208 #include <trace/events/sock.h>
23209
23210@@ -1363,6 +1367,8 @@ static struct sock *sk_prot_alloc(struct
23211 goto out_free_sec;
23212 sk_tx_queue_clear(sk);
23213 }
23214+ sock_vx_init(sk);
23215+ sock_nx_init(sk);
23216
23217 return sk;
23218
23219@@ -1469,6 +1475,11 @@ void sk_destruct(struct sock *sk)
23220 put_pid(sk->sk_peer_pid);
23221 if (likely(sk->sk_net_refcnt))
23222 put_net(sock_net(sk));
23223+ vx_sock_dec(sk);
23224+ clr_vx_info(&sk->sk_vx_info);
23225+ sk->sk_xid = -1;
23226+ clr_nx_info(&sk->sk_nx_info);
23227+ sk->sk_nid = -1;
23228 sk_prot_free(sk->sk_prot_creator, sk);
23229 }
23230
23231@@ -1521,6 +1532,8 @@ struct sock *sk_clone_lock(const struct
23232 /* SANITY */
23233 if (likely(newsk->sk_net_refcnt))
23234 get_net(sock_net(newsk));
23235+ sock_vx_init(newsk);
23236+ sock_nx_init(newsk);
23237 sk_node_init(&newsk->sk_node);
23238 sock_lock_init(newsk);
23239 bh_lock_sock(newsk);
23240@@ -1586,6 +1599,12 @@ struct sock *sk_clone_lock(const struct
23241 smp_wmb();
23242 atomic_set(&newsk->sk_refcnt, 2);
23243
23244+ set_vx_info(&newsk->sk_vx_info, sk->sk_vx_info);
23245+ newsk->sk_xid = sk->sk_xid;
23246+ vx_sock_inc(newsk);
23247+ set_nx_info(&newsk->sk_nx_info, sk->sk_nx_info);
23248+ newsk->sk_nid = sk->sk_nid;
23249+
23250 /*
23251 * Increment the counter in the same struct proto as the master
23252 * sock (sk_refcnt_debug_inc uses newsk->sk_prot->socks, that
23253@@ -2424,6 +2443,12 @@ void sock_init_data(struct socket *sock,
23254
23255 sk->sk_stamp = ktime_set(-1L, 0);
23256
23257+ set_vx_info(&sk->sk_vx_info, current_vx_info());
23258+ sk->sk_xid = vx_current_xid();
23259+ vx_sock_inc(sk);
23260+ set_nx_info(&sk->sk_nx_info, current_nx_info());
23261+ sk->sk_nid = nx_current_nid();
23262+
23263 #ifdef CONFIG_NET_RX_BUSY_POLL
23264 sk->sk_napi_id = 0;
23265 sk->sk_ll_usec = sysctl_net_busy_read;
23266diff -NurpP --minimal linux-4.4.116/net/ipv4/af_inet.c linux-4.4.116-vs2.3.9.7/net/ipv4/af_inet.c
23267--- linux-4.4.116/net/ipv4/af_inet.c 2018-02-22 21:20:03.000000000 +0000
23268+++ linux-4.4.116-vs2.3.9.7/net/ipv4/af_inet.c 2018-01-09 17:11:11.000000000 +0000
23269@@ -308,10 +308,15 @@ lookup_protocol:
23270 }
23271
23272 err = -EPERM;
23273+ if ((protocol == IPPROTO_ICMP) &&
23274+ nx_capable(CAP_NET_RAW, NXC_RAW_ICMP))
23275+ goto override;
23276+
23277 if (sock->type == SOCK_RAW && !kern &&
23278 !ns_capable(net->user_ns, CAP_NET_RAW))
23279 goto out_rcu_unlock;
23280
23281+override:
23282 sock->ops = answer->ops;
23283 answer_prot = answer->prot;
23284 answer_flags = answer->flags;
23285@@ -425,6 +430,7 @@ int inet_bind(struct socket *sock, struc
23286 struct sock *sk = sock->sk;
23287 struct inet_sock *inet = inet_sk(sk);
23288 struct net *net = sock_net(sk);
23289+ struct nx_v4_sock_addr nsa;
23290 unsigned short snum;
23291 int chk_addr_ret;
23292 u32 tb_id = RT_TABLE_LOCAL;
23293@@ -450,7 +456,11 @@ int inet_bind(struct socket *sock, struc
23294 }
23295
23296 tb_id = l3mdev_fib_table_by_index(net, sk->sk_bound_dev_if) ? : tb_id;
23297- chk_addr_ret = inet_addr_type_table(net, addr->sin_addr.s_addr, tb_id);
23298+ err = v4_map_sock_addr(inet, addr, &nsa);
23299+ if (err)
23300+ goto out;
23301+
23302+ chk_addr_ret = inet_addr_type_table(net, nsa.saddr, tb_id);
23303
23304 /* Not specified by any standard per-se, however it breaks too
23305 * many applications when removed. It is unfortunate since
23306@@ -462,7 +472,7 @@ int inet_bind(struct socket *sock, struc
23307 err = -EADDRNOTAVAIL;
23308 if (!net->ipv4.sysctl_ip_nonlocal_bind &&
23309 !(inet->freebind || inet->transparent) &&
23310- addr->sin_addr.s_addr != htonl(INADDR_ANY) &&
23311+ nsa.saddr != htonl(INADDR_ANY) &&
23312 chk_addr_ret != RTN_LOCAL &&
23313 chk_addr_ret != RTN_MULTICAST &&
23314 chk_addr_ret != RTN_BROADCAST)
23315@@ -488,7 +498,7 @@ int inet_bind(struct socket *sock, struc
23316 if (sk->sk_state != TCP_CLOSE || inet->inet_num)
23317 goto out_release_sock;
23318
23319- inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
23320+ v4_set_sock_addr(inet, &nsa);
23321 if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
23322 inet->inet_saddr = 0; /* Use device */
23323
23324@@ -708,11 +718,13 @@ int inet_getname(struct socket *sock, st
23325 peer == 1))
23326 return -ENOTCONN;
23327 sin->sin_port = inet->inet_dport;
23328- sin->sin_addr.s_addr = inet->inet_daddr;
23329+ sin->sin_addr.s_addr =
23330+ nx_map_sock_lback(sk->sk_nx_info, inet->inet_daddr);
23331 } else {
23332 __be32 addr = inet->inet_rcv_saddr;
23333 if (!addr)
23334 addr = inet->inet_saddr;
23335+ addr = nx_map_sock_lback(sk->sk_nx_info, addr);
23336 sin->sin_port = inet->inet_sport;
23337 sin->sin_addr.s_addr = addr;
23338 }
23339@@ -896,6 +908,7 @@ static int inet_compat_ioctl(struct sock
23340 return err;
23341 }
23342 #endif
23343+#include <linux/vs_limit.h>
23344
23345 const struct proto_ops inet_stream_ops = {
23346 .family = PF_INET,
23347diff -NurpP --minimal linux-4.4.116/net/ipv4/arp.c linux-4.4.116-vs2.3.9.7/net/ipv4/arp.c
23348--- linux-4.4.116/net/ipv4/arp.c 2018-02-22 21:20:03.000000000 +0000
23349+++ linux-4.4.116-vs2.3.9.7/net/ipv4/arp.c 2018-02-10 15:16:50.000000000 +0000
23350@@ -1295,6 +1295,7 @@ static void arp_format_neigh_entry(struc
23351 struct net_device *dev = n->dev;
23352 int hatype = dev->type;
23353
23354+ /* FIXME: check for network context */
23355 read_lock(&n->lock);
23356 /* Convert hardware address to XX:XX:XX:XX ... form. */
23357 #if IS_ENABLED(CONFIG_AX25)
23358@@ -1326,6 +1327,7 @@ static void arp_format_pneigh_entry(stru
23359 int hatype = dev ? dev->type : 0;
23360 char tbuf[16];
23361
23362+ /* FIXME: check for network context */
23363 sprintf(tbuf, "%pI4", n->key);
23364 seq_printf(seq, "%-16s 0x%-10x0x%-10x%s * %s\n",
23365 tbuf, hatype, ATF_PUBL | ATF_PERM, "00:00:00:00:00:00",
23366diff -NurpP --minimal linux-4.4.116/net/ipv4/devinet.c linux-4.4.116-vs2.3.9.7/net/ipv4/devinet.c
23367--- linux-4.4.116/net/ipv4/devinet.c 2018-02-22 21:20:03.000000000 +0000
23368+++ linux-4.4.116-vs2.3.9.7/net/ipv4/devinet.c 2018-01-09 16:36:34.000000000 +0000
23369@@ -538,6 +538,7 @@ struct in_device *inetdev_by_index(struc
23370 }
23371 EXPORT_SYMBOL(inetdev_by_index);
23372
23373+
23374 /* Called only from RTNL semaphored context. No locks. */
23375
23376 struct in_ifaddr *inet_ifa_byprefix(struct in_device *in_dev, __be32 prefix,
23377@@ -992,6 +993,8 @@ int devinet_ioctl(struct net *net, unsig
23378
23379 in_dev = __in_dev_get_rtnl(dev);
23380 if (in_dev) {
23381+ struct nx_info *nxi = current_nx_info();
23382+
23383 if (tryaddrmatch) {
23384 /* Matthias Andree */
23385 /* compare label and address (4.4BSD style) */
23386@@ -1000,6 +1003,8 @@ int devinet_ioctl(struct net *net, unsig
23387 This is checked above. */
23388 for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
23389 ifap = &ifa->ifa_next) {
23390+ if (!nx_v4_ifa_visible(nxi, ifa))
23391+ continue;
23392 if (!strcmp(ifr.ifr_name, ifa->ifa_label) &&
23393 sin_orig.sin_addr.s_addr ==
23394 ifa->ifa_local) {
23395@@ -1012,9 +1017,12 @@ int devinet_ioctl(struct net *net, unsig
23396 comparing just the label */
23397 if (!ifa) {
23398 for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
23399- ifap = &ifa->ifa_next)
23400+ ifap = &ifa->ifa_next) {
23401+ if (!nx_v4_ifa_visible(nxi, ifa))
23402+ continue;
23403 if (!strcmp(ifr.ifr_name, ifa->ifa_label))
23404 break;
23405+ }
23406 }
23407 }
23408
23409@@ -1168,6 +1176,8 @@ static int inet_gifconf(struct net_devic
23410 goto out;
23411
23412 for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
23413+ if (!nx_v4_ifa_visible(current_nx_info(), ifa))
23414+ continue;
23415 if (!buf) {
23416 done += sizeof(ifr);
23417 continue;
23418@@ -1573,6 +1583,7 @@ static int inet_dump_ifaddr(struct sk_bu
23419 struct net_device *dev;
23420 struct in_device *in_dev;
23421 struct in_ifaddr *ifa;
23422+ struct sock *sk = skb->sk;
23423 struct hlist_head *head;
23424
23425 s_h = cb->args[0];
23426@@ -1596,6 +1607,8 @@ static int inet_dump_ifaddr(struct sk_bu
23427
23428 for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
23429 ifa = ifa->ifa_next, ip_idx++) {
23430+ if (sk && !nx_v4_ifa_visible(sk->sk_nx_info, ifa))
23431+ continue;
23432 if (ip_idx < s_ip_idx)
23433 continue;
23434 if (inet_fill_ifaddr(skb, ifa,
23435diff -NurpP --minimal linux-4.4.116/net/ipv4/fib_trie.c linux-4.4.116-vs2.3.9.7/net/ipv4/fib_trie.c
23436--- linux-4.4.116/net/ipv4/fib_trie.c 2018-02-22 21:20:03.000000000 +0000
23437+++ linux-4.4.116-vs2.3.9.7/net/ipv4/fib_trie.c 2018-01-09 16:36:34.000000000 +0000
23438@@ -2591,6 +2591,7 @@ static int fib_route_seq_show(struct seq
23439
23440 seq_setwidth(seq, 127);
23441
23442+ /* FIXME: check for network context? */
23443 if (fi)
23444 seq_printf(seq,
23445 "%s\t%08X\t%08X\t%04X\t%d\t%u\t"
23446diff -NurpP --minimal linux-4.4.116/net/ipv4/inet_connection_sock.c linux-4.4.116-vs2.3.9.7/net/ipv4/inet_connection_sock.c
23447--- linux-4.4.116/net/ipv4/inet_connection_sock.c 2018-02-22 21:20:03.000000000 +0000
23448+++ linux-4.4.116-vs2.3.9.7/net/ipv4/inet_connection_sock.c 2018-01-09 16:36:34.000000000 +0000
23449@@ -43,6 +43,37 @@ void inet_get_local_port_range(struct ne
23450 }
23451 EXPORT_SYMBOL(inet_get_local_port_range);
23452
23453+int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
23454+{
23455+ __be32 sk1_rcv_saddr = sk1->sk_rcv_saddr,
23456+ sk2_rcv_saddr = sk2->sk_rcv_saddr;
23457+
23458+ if (inet_v6_ipv6only(sk2))
23459+ return 0;
23460+
23461+ if (sk1_rcv_saddr &&
23462+ sk2_rcv_saddr &&
23463+ sk1_rcv_saddr == sk2_rcv_saddr)
23464+ return 1;
23465+
23466+ if (sk1_rcv_saddr &&
23467+ !sk2_rcv_saddr &&
23468+ v4_addr_in_nx_info(sk2->sk_nx_info, sk1_rcv_saddr, NXA_MASK_BIND))
23469+ return 1;
23470+
23471+ if (sk2_rcv_saddr &&
23472+ !sk1_rcv_saddr &&
23473+ v4_addr_in_nx_info(sk1->sk_nx_info, sk2_rcv_saddr, NXA_MASK_BIND))
23474+ return 1;
23475+
23476+ if (!sk1_rcv_saddr &&
23477+ !sk2_rcv_saddr &&
23478+ nx_v4_addr_conflict(sk1->sk_nx_info, sk2->sk_nx_info))
23479+ return 1;
23480+
23481+ return 0;
23482+}
23483+
23484 int inet_csk_bind_conflict(const struct sock *sk,
23485 const struct inet_bind_bucket *tb, bool relax)
23486 {
23487@@ -70,15 +101,13 @@ int inet_csk_bind_conflict(const struct
23488 (sk2->sk_state != TCP_TIME_WAIT &&
23489 !uid_eq(uid, sock_i_uid(sk2))))) {
23490
23491- if (!sk2->sk_rcv_saddr || !sk->sk_rcv_saddr ||
23492- sk2->sk_rcv_saddr == sk->sk_rcv_saddr)
23493+ if (ipv4_rcv_saddr_equal(sk, sk2))
23494 break;
23495 }
23496 if (!relax && reuse && sk2->sk_reuse &&
23497 sk2->sk_state != TCP_LISTEN) {
23498
23499- if (!sk2->sk_rcv_saddr || !sk->sk_rcv_saddr ||
23500- sk2->sk_rcv_saddr == sk->sk_rcv_saddr)
23501+ if (ipv4_rcv_saddr_equal(sk, sk2))
23502 break;
23503 }
23504 }
23505diff -NurpP --minimal linux-4.4.116/net/ipv4/inet_diag.c linux-4.4.116-vs2.3.9.7/net/ipv4/inet_diag.c
23506--- linux-4.4.116/net/ipv4/inet_diag.c 2016-07-05 04:15:14.000000000 +0000
23507+++ linux-4.4.116-vs2.3.9.7/net/ipv4/inet_diag.c 2018-01-09 16:36:34.000000000 +0000
23508@@ -31,6 +31,8 @@
23509
23510 #include <linux/inet.h>
23511 #include <linux/stddef.h>
23512+#include <linux/vs_network.h>
23513+#include <linux/vs_inet.h>
23514
23515 #include <linux/inet_diag.h>
23516 #include <linux/sock_diag.h>
23517@@ -761,6 +763,8 @@ void inet_diag_dump_icsk(struct inet_has
23518 if (!net_eq(sock_net(sk), net))
23519 continue;
23520
23521+ if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
23522+ continue;
23523 if (num < s_num) {
23524 num++;
23525 continue;
23526@@ -822,6 +826,8 @@ skip_listen_ht:
23527
23528 if (!net_eq(sock_net(sk), net))
23529 continue;
23530+ if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
23531+ continue;
23532 if (num < s_num)
23533 goto next_normal;
23534 state = (sk->sk_state == TCP_TIME_WAIT) ?
23535diff -NurpP --minimal linux-4.4.116/net/ipv4/inet_hashtables.c linux-4.4.116-vs2.3.9.7/net/ipv4/inet_hashtables.c
23536--- linux-4.4.116/net/ipv4/inet_hashtables.c 2016-07-05 04:15:14.000000000 +0000
23537+++ linux-4.4.116-vs2.3.9.7/net/ipv4/inet_hashtables.c 2018-01-09 16:36:34.000000000 +0000
23538@@ -23,6 +23,7 @@
23539 #include <net/inet_connection_sock.h>
23540 #include <net/inet_hashtables.h>
23541 #include <net/secure_seq.h>
23542+#include <net/route.h>
23543 #include <net/ip.h>
23544
23545 static u32 inet_ehashfn(const struct net *net, const __be32 laddr,
23546@@ -183,6 +184,11 @@ static inline int compute_score(struct s
23547 if (rcv_saddr != daddr)
23548 return -1;
23549 score += 4;
23550+ } else {
23551+ /* block non nx_info ips */
23552+ if (!v4_addr_in_nx_info(sk->sk_nx_info,
23553+ daddr, NXA_MASK_BIND))
23554+ return -1;
23555 }
23556 if (sk->sk_bound_dev_if) {
23557 if (sk->sk_bound_dev_if != dif)
23558@@ -202,7 +208,6 @@ static inline int compute_score(struct s
23559 * wildcarded during the search since they can never be otherwise.
23560 */
23561
23562-
23563 struct sock *__inet_lookup_listener(struct net *net,
23564 struct inet_hashinfo *hashinfo,
23565 const __be32 saddr, __be16 sport,
23566@@ -238,6 +243,7 @@ begin:
23567 phash = next_pseudo_random32(phash);
23568 }
23569 }
23570+
23571 /*
23572 * if the nulls value we got at the end of this lookup is
23573 * not the expected one, we must restart lookup.
23574diff -NurpP --minimal linux-4.4.116/net/ipv4/netfilter.c linux-4.4.116-vs2.3.9.7/net/ipv4/netfilter.c
23575--- linux-4.4.116/net/ipv4/netfilter.c 2016-07-05 04:15:14.000000000 +0000
23576+++ linux-4.4.116-vs2.3.9.7/net/ipv4/netfilter.c 2018-01-09 16:36:34.000000000 +0000
23577@@ -11,7 +11,7 @@
23578 #include <linux/skbuff.h>
23579 #include <linux/gfp.h>
23580 #include <linux/export.h>
23581-#include <net/route.h>
23582+// #include <net/route.h>
23583 #include <net/xfrm.h>
23584 #include <net/ip.h>
23585 #include <net/netfilter/nf_queue.h>
23586diff -NurpP --minimal linux-4.4.116/net/ipv4/raw.c linux-4.4.116-vs2.3.9.7/net/ipv4/raw.c
23587--- linux-4.4.116/net/ipv4/raw.c 2018-02-22 21:20:03.000000000 +0000
23588+++ linux-4.4.116-vs2.3.9.7/net/ipv4/raw.c 2018-01-09 17:06:10.000000000 +0000
23589@@ -126,7 +126,7 @@ static struct sock *__raw_v4_lookup(stru
23590
23591 if (net_eq(sock_net(sk), net) && inet->inet_num == num &&
23592 !(inet->inet_daddr && inet->inet_daddr != raddr) &&
23593- !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
23594+ v4_sock_addr_match(sk->sk_nx_info, inet, laddr) &&
23595 !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
23596 goto found; /* gotcha */
23597 }
23598@@ -416,6 +416,12 @@ static int raw_send_hdrinc(struct sock *
23599 skb_transport_header(skb))->type);
23600 }
23601
23602+ err = -EPERM;
23603+ if (!nx_check(0, VS_ADMIN) && !capable(CAP_NET_RAW) &&
23604+ sk->sk_nx_info &&
23605+ !v4_addr_in_nx_info(sk->sk_nx_info, iph->saddr, NXA_MASK_BIND))
23606+ goto error_free;
23607+
23608 err = NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
23609 net, sk, skb, NULL, rt->dst.dev,
23610 dst_output);
23611@@ -626,6 +632,16 @@ static int raw_sendmsg(struct sock *sk,
23612 goto done;
23613 }
23614
23615+ if (sk->sk_nx_info) {
23616+ rt = ip_v4_find_src(sock_net(sk), sk->sk_nx_info, &fl4);
23617+ if (IS_ERR(rt)) {
23618+ err = PTR_ERR(rt);
23619+ rt = NULL;
23620+ goto done;
23621+ }
23622+ ip_rt_put(rt);
23623+ }
23624+
23625 security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
23626 rt = ip_route_output_flow(net, &fl4, sk);
23627 if (IS_ERR(rt)) {
23628@@ -704,17 +720,19 @@ static int raw_bind(struct sock *sk, str
23629 {
23630 struct inet_sock *inet = inet_sk(sk);
23631 struct sockaddr_in *addr = (struct sockaddr_in *) uaddr;
23632+ struct nx_v4_sock_addr nsa = { 0 };
23633 int ret = -EINVAL;
23634 int chk_addr_ret;
23635
23636 if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in))
23637 goto out;
23638- chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
23639+ v4_map_sock_addr(inet, addr, &nsa);
23640+ chk_addr_ret = inet_addr_type(sock_net(sk), nsa.saddr);
23641 ret = -EADDRNOTAVAIL;
23642- if (addr->sin_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
23643+ if (nsa.saddr && chk_addr_ret != RTN_LOCAL &&
23644 chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
23645 goto out;
23646- inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
23647+ v4_set_sock_addr(inet, &nsa);
23648 if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
23649 inet->inet_saddr = 0; /* Use device */
23650 sk_dst_reset(sk);
23651@@ -763,7 +781,8 @@ static int raw_recvmsg(struct sock *sk,
23652 /* Copy the address. */
23653 if (sin) {
23654 sin->sin_family = AF_INET;
23655- sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
23656+ sin->sin_addr.s_addr =
23657+ nx_map_sock_lback(sk->sk_nx_info, ip_hdr(skb)->saddr);
23658 sin->sin_port = 0;
23659 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
23660 *addr_len = sizeof(*sin);
23661@@ -959,7 +978,8 @@ static struct sock *raw_get_first(struct
23662 for (state->bucket = 0; state->bucket < RAW_HTABLE_SIZE;
23663 ++state->bucket) {
23664 sk_for_each(sk, &state->h->ht[state->bucket])
23665- if (sock_net(sk) == seq_file_net(seq))
23666+ if ((sock_net(sk) == seq_file_net(seq)) &&
23667+ nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
23668 goto found;
23669 }
23670 sk = NULL;
23671@@ -975,7 +995,8 @@ static struct sock *raw_get_next(struct
23672 sk = sk_next(sk);
23673 try_again:
23674 ;
23675- } while (sk && sock_net(sk) != seq_file_net(seq));
23676+ } while (sk && ((sock_net(sk) != seq_file_net(seq)) ||
23677+ !nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT)));
23678
23679 if (!sk && ++state->bucket < RAW_HTABLE_SIZE) {
23680 sk = sk_head(&state->h->ht[state->bucket]);
23681diff -NurpP --minimal linux-4.4.116/net/ipv4/route.c linux-4.4.116-vs2.3.9.7/net/ipv4/route.c
23682--- linux-4.4.116/net/ipv4/route.c 2018-02-22 21:20:03.000000000 +0000
23683+++ linux-4.4.116-vs2.3.9.7/net/ipv4/route.c 2018-01-09 16:36:34.000000000 +0000
23684@@ -2226,7 +2226,7 @@ struct rtable *__ip_route_output_key_has
23685
23686
23687 if (fl4->flowi4_oif) {
23688- dev_out = dev_get_by_index_rcu(net, fl4->flowi4_oif);
23689+ dev_out = dev_get_by_index_real_rcu(net, fl4->flowi4_oif);
23690 rth = ERR_PTR(-ENODEV);
23691 if (!dev_out)
23692 goto out;
23693diff -NurpP --minimal linux-4.4.116/net/ipv4/tcp.c linux-4.4.116-vs2.3.9.7/net/ipv4/tcp.c
23694--- linux-4.4.116/net/ipv4/tcp.c 2018-02-22 21:20:03.000000000 +0000
23695+++ linux-4.4.116-vs2.3.9.7/net/ipv4/tcp.c 2018-02-22 21:30:19.000000000 +0000
23696@@ -269,6 +269,7 @@
23697 #include <linux/crypto.h>
23698 #include <linux/time.h>
23699 #include <linux/slab.h>
23700+#include <linux/in.h>
23701
23702 #include <net/icmp.h>
23703 #include <net/inet_common.h>
23704diff -NurpP --minimal linux-4.4.116/net/ipv4/tcp_ipv4.c linux-4.4.116-vs2.3.9.7/net/ipv4/tcp_ipv4.c
23705--- linux-4.4.116/net/ipv4/tcp_ipv4.c 2018-02-22 21:20:03.000000000 +0000
23706+++ linux-4.4.116-vs2.3.9.7/net/ipv4/tcp_ipv4.c 2018-01-09 17:13:45.000000000 +0000
23707@@ -1885,6 +1885,10 @@ static void *listening_get_next(struct s
23708 sk = sk_nulls_next(sk);
23709 get_sk:
23710 sk_nulls_for_each_from(sk, node) {
23711+ vxdprintk(VXD_CBIT(net, 6), "sk: %p [#%d] (from %d)",
23712+ sk, sk->sk_nid, nx_current_nid());
23713+ if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
23714+ continue;
23715 if (!net_eq(sock_net(sk), net))
23716 continue;
23717 if (sk->sk_family == st->family) {
23718@@ -1949,6 +1953,11 @@ static void *established_get_first(struc
23719
23720 spin_lock_bh(lock);
23721 sk_nulls_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) {
23722+ vxdprintk(VXD_CBIT(net, 6),
23723+ "sk,egf: %p [#%d] (from %d)",
23724+ sk, sk->sk_nid, nx_current_nid());
23725+ if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
23726+ continue;
23727 if (sk->sk_family != st->family ||
23728 !net_eq(sock_net(sk), net)) {
23729 continue;
23730@@ -1975,6 +1984,11 @@ static void *established_get_next(struct
23731 sk = sk_nulls_next(sk);
23732
23733 sk_nulls_for_each_from(sk, node) {
23734+ vxdprintk(VXD_CBIT(net, 6),
23735+ "sk,egn: %p [#%d] (from %d)",
23736+ sk, sk->sk_nid, nx_current_nid());
23737+ if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
23738+ continue;
23739 if (sk->sk_family == st->family && net_eq(sock_net(sk), net))
23740 return sk;
23741 }
23742@@ -2166,9 +2180,9 @@ static void get_openreq4(const struct re
23743 seq_printf(f, "%4d: %08X:%04X %08X:%04X"
23744 " %02X %08X:%08X %02X:%08lX %08X %5u %8d %u %d %pK",
23745 i,
23746- ireq->ir_loc_addr,
23747+ nx_map_sock_lback(current_nx_info(), ireq->ir_loc_addr),
23748 ireq->ir_num,
23749- ireq->ir_rmt_addr,
23750+ nx_map_sock_lback(current_nx_info(), ireq->ir_rmt_addr),
23751 ntohs(ireq->ir_rmt_port),
23752 TCP_SYN_RECV,
23753 0, 0, /* could print option size, but that is af dependent. */
23754@@ -2191,8 +2205,8 @@ static void get_tcp4_sock(struct sock *s
23755 const struct inet_connection_sock *icsk = inet_csk(sk);
23756 const struct inet_sock *inet = inet_sk(sk);
23757 const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
23758- __be32 dest = inet->inet_daddr;
23759- __be32 src = inet->inet_rcv_saddr;
23760+ __be32 dest = nx_map_sock_lback(current_nx_info(), inet->inet_daddr);
23761+ __be32 src = nx_map_sock_lback(current_nx_info(), inet->inet_rcv_saddr);
23762 __u16 destp = ntohs(inet->inet_dport);
23763 __u16 srcp = ntohs(inet->inet_sport);
23764 int rx_queue;
23765@@ -2251,8 +2265,8 @@ static void get_timewait4_sock(const str
23766 __be32 dest, src;
23767 __u16 destp, srcp;
23768
23769- dest = tw->tw_daddr;
23770- src = tw->tw_rcv_saddr;
23771+ dest = nx_map_sock_lback(current_nx_info(), tw->tw_daddr);
23772+ src = nx_map_sock_lback(current_nx_info(), tw->tw_rcv_saddr);
23773 destp = ntohs(tw->tw_dport);
23774 srcp = ntohs(tw->tw_sport);
23775
23776diff -NurpP --minimal linux-4.4.116/net/ipv4/tcp_minisocks.c linux-4.4.116-vs2.3.9.7/net/ipv4/tcp_minisocks.c
23777--- linux-4.4.116/net/ipv4/tcp_minisocks.c 2018-02-22 21:20:03.000000000 +0000
23778+++ linux-4.4.116-vs2.3.9.7/net/ipv4/tcp_minisocks.c 2018-01-09 16:36:34.000000000 +0000
23779@@ -23,6 +23,9 @@
23780 #include <linux/slab.h>
23781 #include <linux/sysctl.h>
23782 #include <linux/workqueue.h>
23783+#include <linux/vs_limit.h>
23784+#include <linux/vs_socket.h>
23785+#include <linux/vs_context.h>
23786 #include <net/tcp.h>
23787 #include <net/inet_common.h>
23788 #include <net/xfrm.h>
23789@@ -291,6 +294,11 @@ void tcp_time_wait(struct sock *sk, int
23790 tcptw->tw_ts_offset = tp->tsoffset;
23791 tcptw->tw_last_oow_ack_time = 0;
23792
23793+ tw->tw_xid = sk->sk_xid;
23794+ tw->tw_vx_info = NULL;
23795+ tw->tw_nid = sk->sk_nid;
23796+ tw->tw_nx_info = NULL;
23797+
23798 #if IS_ENABLED(CONFIG_IPV6)
23799 if (tw->tw_family == PF_INET6) {
23800 struct ipv6_pinfo *np = inet6_sk(sk);
23801diff -NurpP --minimal linux-4.4.116/net/ipv4/udp.c linux-4.4.116-vs2.3.9.7/net/ipv4/udp.c
23802--- linux-4.4.116/net/ipv4/udp.c 2018-02-22 21:20:03.000000000 +0000
23803+++ linux-4.4.116-vs2.3.9.7/net/ipv4/udp.c 2018-01-09 16:36:34.000000000 +0000
23804@@ -309,14 +309,7 @@ fail:
23805 }
23806 EXPORT_SYMBOL(udp_lib_get_port);
23807
23808-static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
23809-{
23810- struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
23811-
23812- return (!ipv6_only_sock(sk2) &&
23813- (!inet1->inet_rcv_saddr || !inet2->inet_rcv_saddr ||
23814- inet1->inet_rcv_saddr == inet2->inet_rcv_saddr));
23815-}
23816+extern int ipv4_rcv_saddr_equal(const struct sock *, const struct sock *);
23817
23818 static u32 udp4_portaddr_hash(const struct net *net, __be32 saddr,
23819 unsigned int port)
23820@@ -355,6 +348,11 @@ static inline int compute_score(struct s
23821 if (inet->inet_rcv_saddr != daddr)
23822 return -1;
23823 score += 4;
23824+ } else {
23825+ /* block non nx_info ips */
23826+ if (!v4_addr_in_nx_info(sk->sk_nx_info,
23827+ daddr, NXA_MASK_BIND))
23828+ return -1;
23829 }
23830
23831 if (inet->inet_daddr) {
23832@@ -489,6 +487,7 @@ begin:
23833 return result;
23834 }
23835
23836+
23837 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
23838 * harder than this. -DaveM
23839 */
23840@@ -535,6 +534,11 @@ begin:
23841 sk_nulls_for_each_rcu(sk, node, &hslot->head) {
23842 score = compute_score(sk, net, saddr, hnum, sport,
23843 daddr, dport, dif);
23844+ /* FIXME: disabled?
23845+ if (score == 9) {
23846+ result = sk;
23847+ break;
23848+ } else */
23849 if (score > badness) {
23850 result = sk;
23851 badness = score;
23852@@ -559,6 +563,7 @@ begin:
23853 if (get_nulls_value(node) != slot)
23854 goto begin;
23855
23856+
23857 if (result) {
23858 if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
23859 result = NULL;
23860@@ -568,6 +573,7 @@ begin:
23861 goto begin;
23862 }
23863 }
23864+
23865 rcu_read_unlock();
23866 return result;
23867 }
23868@@ -602,7 +608,7 @@ static inline bool __udp_is_mcast_sock(s
23869 udp_sk(sk)->udp_port_hash != hnum ||
23870 (inet->inet_daddr && inet->inet_daddr != rmt_addr) ||
23871 (inet->inet_dport != rmt_port && inet->inet_dport) ||
23872- (inet->inet_rcv_saddr && inet->inet_rcv_saddr != loc_addr) ||
23873+ !v4_sock_addr_match(sk->sk_nx_info, inet, loc_addr) ||
23874 ipv6_only_sock(sk) ||
23875 (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
23876 return false;
23877@@ -1033,6 +1039,16 @@ int udp_sendmsg(struct sock *sk, struct
23878 goto out;
23879 }
23880
23881+ if (sk->sk_nx_info) {
23882+ rt = ip_v4_find_src(net, sk->sk_nx_info, fl4);
23883+ if (IS_ERR(rt)) {
23884+ err = PTR_ERR(rt);
23885+ rt = NULL;
23886+ goto out;
23887+ }
23888+ ip_rt_put(rt);
23889+ }
23890+
23891 security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
23892 rt = ip_route_output_flow(net, fl4, sk);
23893 if (IS_ERR(rt)) {
23894@@ -1337,7 +1353,8 @@ try_again:
23895 if (sin) {
23896 sin->sin_family = AF_INET;
23897 sin->sin_port = udp_hdr(skb)->source;
23898- sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
23899+ sin->sin_addr.s_addr = nx_map_sock_lback(
23900+ skb->sk->sk_nx_info, ip_hdr(skb)->saddr);
23901 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
23902 *addr_len = sizeof(*sin);
23903 }
23904@@ -2319,6 +2336,8 @@ static struct sock *udp_get_first(struct
23905 sk_nulls_for_each(sk, node, &hslot->head) {
23906 if (!net_eq(sock_net(sk), net))
23907 continue;
23908+ if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
23909+ continue;
23910 if (sk->sk_family == state->family)
23911 goto found;
23912 }
23913@@ -2336,7 +2355,9 @@ static struct sock *udp_get_next(struct
23914
23915 do {
23916 sk = sk_nulls_next(sk);
23917- } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
23918+ } while (sk && (!net_eq(sock_net(sk), net) ||
23919+ sk->sk_family != state->family ||
23920+ !nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT)));
23921
23922 if (!sk) {
23923 if (state->bucket <= state->udp_table->mask)
23924@@ -2432,8 +2453,8 @@ static void udp4_format_sock(struct sock
23925 int bucket)
23926 {
23927 struct inet_sock *inet = inet_sk(sp);
23928- __be32 dest = inet->inet_daddr;
23929- __be32 src = inet->inet_rcv_saddr;
23930+ __be32 dest = nx_map_sock_lback(current_nx_info(), inet->inet_daddr);
23931+ __be32 src = nx_map_sock_lback(current_nx_info(), inet->inet_rcv_saddr);
23932 __u16 destp = ntohs(inet->inet_dport);
23933 __u16 srcp = ntohs(inet->inet_sport);
23934
23935diff -NurpP --minimal linux-4.4.116/net/ipv6/addrconf.c linux-4.4.116-vs2.3.9.7/net/ipv6/addrconf.c
23936--- linux-4.4.116/net/ipv6/addrconf.c 2018-02-22 21:20:03.000000000 +0000
23937+++ linux-4.4.116-vs2.3.9.7/net/ipv6/addrconf.c 2018-01-09 23:41:55.000000000 +0000
23938@@ -92,6 +92,8 @@
23939 #include <linux/proc_fs.h>
23940 #include <linux/seq_file.h>
23941 #include <linux/export.h>
23942+#include <linux/vs_network.h>
23943+#include <linux/vs_inet6.h>
23944
23945 /* Set to 3 to get tracing... */
23946 #define ACONF_DEBUG 2
23947@@ -1442,7 +1444,8 @@ static int __ipv6_dev_get_saddr(struct n
23948 struct ipv6_saddr_dst *dst,
23949 struct inet6_dev *idev,
23950 struct ipv6_saddr_score *scores,
23951- int hiscore_idx)
23952+ int hiscore_idx,
23953+ struct nx_info *nxi)
23954 {
23955 struct ipv6_saddr_score *score = &scores[1 - hiscore_idx], *hiscore = &scores[hiscore_idx];
23956
23957@@ -1472,6 +1475,8 @@ static int __ipv6_dev_get_saddr(struct n
23958 idev->dev->name);
23959 continue;
23960 }
23961+ if (!v6_addr_in_nx_info(nxi, &score->ifa->addr, -1))
23962+ continue;
23963
23964 score->rule = -1;
23965 bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
23966@@ -1519,7 +1524,7 @@ out:
23967
23968 int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
23969 const struct in6_addr *daddr, unsigned int prefs,
23970- struct in6_addr *saddr)
23971+ struct in6_addr *saddr, struct nx_info *nxi)
23972 {
23973 struct ipv6_saddr_score scores[2], *hiscore;
23974 struct ipv6_saddr_dst dst;
23975@@ -1568,13 +1573,15 @@ int ipv6_dev_get_saddr(struct net *net,
23976
23977 if (use_oif_addr) {
23978 if (idev)
23979- hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
23980+ hiscore_idx = __ipv6_dev_get_saddr(net, &dst,
23981+ idev, scores, hiscore_idx, nxi);
23982 } else {
23983 for_each_netdev_rcu(net, dev) {
23984 idev = __in6_dev_get(dev);
23985 if (!idev)
23986 continue;
23987- hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
23988+ hiscore_idx = __ipv6_dev_get_saddr(net, &dst,
23989+ idev, scores, hiscore_idx, nxi);
23990 }
23991 }
23992 rcu_read_unlock();
23993@@ -3846,7 +3853,10 @@ static void if6_seq_stop(struct seq_file
23994 static int if6_seq_show(struct seq_file *seq, void *v)
23995 {
23996 struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
23997- seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
23998+
23999+ if (nx_check(0, VS_ADMIN|VS_WATCH) ||
24000+ v6_addr_in_nx_info(current_nx_info(), &ifp->addr, -1))
24001+ seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
24002 &ifp->addr,
24003 ifp->idev->dev->ifindex,
24004 ifp->prefix_len,
24005@@ -4430,6 +4440,11 @@ static int in6_dump_addrs(struct inet6_d
24006 struct ifacaddr6 *ifaca;
24007 int err = 1;
24008 int ip_idx = *p_ip_idx;
24009+ struct nx_info *nxi = skb->sk ? skb->sk->sk_nx_info : NULL;
24010+
24011+ /* disable ipv6 on non v6 guests */
24012+ if (nxi && !nx_info_has_v6(nxi))
24013+ return skb->len;
24014
24015 read_lock_bh(&idev->lock);
24016 switch (type) {
24017@@ -4440,6 +4455,8 @@ static int in6_dump_addrs(struct inet6_d
24018 list_for_each_entry(ifa, &idev->addr_list, if_list) {
24019 if (++ip_idx < s_ip_idx)
24020 continue;
24021+ if (!v6_addr_in_nx_info(nxi, &ifa->addr, -1))
24022+ continue;
24023 err = inet6_fill_ifaddr(skb, ifa,
24024 NETLINK_CB(cb->skb).portid,
24025 cb->nlh->nlmsg_seq,
24026@@ -4457,6 +4474,8 @@ static int in6_dump_addrs(struct inet6_d
24027 ifmca = ifmca->next, ip_idx++) {
24028 if (ip_idx < s_ip_idx)
24029 continue;
24030+ if (!v6_addr_in_nx_info(nxi, &ifmca->mca_addr, -1))
24031+ continue;
24032 err = inet6_fill_ifmcaddr(skb, ifmca,
24033 NETLINK_CB(cb->skb).portid,
24034 cb->nlh->nlmsg_seq,
24035@@ -4472,6 +4491,8 @@ static int in6_dump_addrs(struct inet6_d
24036 ifaca = ifaca->aca_next, ip_idx++) {
24037 if (ip_idx < s_ip_idx)
24038 continue;
24039+ if (!v6_addr_in_nx_info(nxi, &ifaca->aca_addr, -1))
24040+ continue;
24041 err = inet6_fill_ifacaddr(skb, ifaca,
24042 NETLINK_CB(cb->skb).portid,
24043 cb->nlh->nlmsg_seq,
24044@@ -4500,6 +4521,10 @@ static int inet6_dump_addr(struct sk_buf
24045 struct inet6_dev *idev;
24046 struct hlist_head *head;
24047
24048+ /* FIXME: maybe disable ipv6 on non v6 guests?
24049+ if (skb->sk && skb->sk->sk_vx_info)
24050+ return skb->len; */
24051+
24052 s_h = cb->args[0];
24053 s_idx = idx = cb->args[1];
24054 s_ip_idx = ip_idx = cb->args[2];
24055@@ -5008,6 +5033,7 @@ static int inet6_dump_ifinfo(struct sk_b
24056 struct net_device *dev;
24057 struct inet6_dev *idev;
24058 struct hlist_head *head;
24059+ struct nx_info *nxi = skb->sk ? skb->sk->sk_nx_info : NULL;
24060
24061 s_h = cb->args[0];
24062 s_idx = cb->args[1];
24063@@ -5019,6 +5045,8 @@ static int inet6_dump_ifinfo(struct sk_b
24064 hlist_for_each_entry_rcu(dev, head, index_hlist) {
24065 if (idx < s_idx)
24066 goto cont;
24067+ if (!v6_dev_in_nx_info(dev, nxi))
24068+ goto cont;
24069 idev = __in6_dev_get(dev);
24070 if (!idev)
24071 goto cont;
24072diff -NurpP --minimal linux-4.4.116/net/ipv6/af_inet6.c linux-4.4.116-vs2.3.9.7/net/ipv6/af_inet6.c
24073--- linux-4.4.116/net/ipv6/af_inet6.c 2018-02-22 21:20:03.000000000 +0000
24074+++ linux-4.4.116-vs2.3.9.7/net/ipv6/af_inet6.c 2018-01-09 16:36:34.000000000 +0000
24075@@ -43,6 +43,8 @@
24076 #include <linux/netdevice.h>
24077 #include <linux/icmpv6.h>
24078 #include <linux/netfilter_ipv6.h>
24079+#include <linux/vs_inet.h>
24080+#include <linux/vs_inet6.h>
24081
24082 #include <net/ip.h>
24083 #include <net/ipv6.h>
24084@@ -158,10 +160,13 @@ lookup_protocol:
24085 }
24086
24087 err = -EPERM;
24088+ if ((protocol == IPPROTO_ICMPV6) &&
24089+ nx_capable(CAP_NET_RAW, NXC_RAW_ICMP))
24090+ goto override;
24091 if (sock->type == SOCK_RAW && !kern &&
24092 !ns_capable(net->user_ns, CAP_NET_RAW))
24093 goto out_rcu_unlock;
24094-
24095+override:
24096 sock->ops = answer->ops;
24097 answer_prot = answer->prot;
24098 answer_flags = answer->flags;
24099@@ -259,6 +264,7 @@ int inet6_bind(struct socket *sock, stru
24100 struct inet_sock *inet = inet_sk(sk);
24101 struct ipv6_pinfo *np = inet6_sk(sk);
24102 struct net *net = sock_net(sk);
24103+ struct nx_v6_sock_addr nsa;
24104 __be32 v4addr = 0;
24105 unsigned short snum;
24106 int addr_type = 0;
24107@@ -274,6 +280,10 @@ int inet6_bind(struct socket *sock, stru
24108 if (addr->sin6_family != AF_INET6)
24109 return -EAFNOSUPPORT;
24110
24111+ err = v6_map_sock_addr(inet, addr, &nsa);
24112+ if (err)
24113+ return err;
24114+
24115 addr_type = ipv6_addr_type(&addr->sin6_addr);
24116 if ((addr_type & IPV6_ADDR_MULTICAST) && sock->type == SOCK_STREAM)
24117 return -EINVAL;
24118@@ -314,6 +324,10 @@ int inet6_bind(struct socket *sock, stru
24119 err = -EADDRNOTAVAIL;
24120 goto out;
24121 }
24122+ if (!v4_addr_in_nx_info(sk->sk_nx_info, v4addr, NXA_MASK_BIND)) {
24123+ err = -EADDRNOTAVAIL;
24124+ goto out;
24125+ }
24126 } else {
24127 if (addr_type != IPV6_ADDR_ANY) {
24128 struct net_device *dev = NULL;
24129@@ -340,6 +354,11 @@ int inet6_bind(struct socket *sock, stru
24130 }
24131 }
24132
24133+ if (!v6_addr_in_nx_info(sk->sk_nx_info, &addr->sin6_addr, -1)) {
24134+ err = -EADDRNOTAVAIL;
24135+ goto out_unlock;
24136+ }
24137+
24138 /* ipv4 addr of the socket is invalid. Only the
24139 * unspecified and mapped address have a v4 equivalent.
24140 */
24141@@ -357,6 +376,9 @@ int inet6_bind(struct socket *sock, stru
24142 }
24143 }
24144
24145+ /* what's that for? */
24146+ v6_set_sock_addr(inet, &nsa);
24147+
24148 inet->inet_rcv_saddr = v4addr;
24149 inet->inet_saddr = v4addr;
24150
24151@@ -461,9 +483,11 @@ int inet6_getname(struct socket *sock, s
24152 return -ENOTCONN;
24153 sin->sin6_port = inet->inet_dport;
24154 sin->sin6_addr = sk->sk_v6_daddr;
24155+ /* FIXME: remap lback? */
24156 if (np->sndflow)
24157 sin->sin6_flowinfo = np->flow_label;
24158 } else {
24159+ /* FIXME: remap lback? */
24160 if (ipv6_addr_any(&sk->sk_v6_rcv_saddr))
24161 sin->sin6_addr = np->saddr;
24162 else
24163diff -NurpP --minimal linux-4.4.116/net/ipv6/datagram.c linux-4.4.116-vs2.3.9.7/net/ipv6/datagram.c
24164--- linux-4.4.116/net/ipv6/datagram.c 2018-02-22 21:20:03.000000000 +0000
24165+++ linux-4.4.116-vs2.3.9.7/net/ipv6/datagram.c 2018-01-09 16:36:34.000000000 +0000
24166@@ -733,7 +733,7 @@ int ip6_datagram_send_ctl(struct net *ne
24167
24168 rcu_read_lock();
24169 if (fl6->flowi6_oif) {
24170- dev = dev_get_by_index_rcu(net, fl6->flowi6_oif);
24171+ dev = dev_get_by_index_real_rcu(net, fl6->flowi6_oif);
24172 if (!dev) {
24173 rcu_read_unlock();
24174 return -ENODEV;
24175diff -NurpP --minimal linux-4.4.116/net/ipv6/fib6_rules.c linux-4.4.116-vs2.3.9.7/net/ipv6/fib6_rules.c
24176--- linux-4.4.116/net/ipv6/fib6_rules.c 2018-02-22 21:20:03.000000000 +0000
24177+++ linux-4.4.116-vs2.3.9.7/net/ipv6/fib6_rules.c 2018-01-09 16:36:34.000000000 +0000
24178@@ -97,7 +97,7 @@ static int fib6_rule_action(struct fib_r
24179 ip6_dst_idev(&rt->dst)->dev,
24180 &flp6->daddr,
24181 rt6_flags2srcprefs(flags),
24182- &saddr))
24183+ &saddr, NULL))
24184 goto again;
24185 if (!ipv6_prefix_equal(&saddr, &r->src.addr,
24186 r->src.plen))
24187diff -NurpP --minimal linux-4.4.116/net/ipv6/inet6_hashtables.c linux-4.4.116-vs2.3.9.7/net/ipv6/inet6_hashtables.c
24188--- linux-4.4.116/net/ipv6/inet6_hashtables.c 2016-07-05 04:15:14.000000000 +0000
24189+++ linux-4.4.116-vs2.3.9.7/net/ipv6/inet6_hashtables.c 2018-01-09 16:36:34.000000000 +0000
24190@@ -16,6 +16,7 @@
24191
24192 #include <linux/module.h>
24193 #include <linux/random.h>
24194+#include <linux/vs_inet6.h>
24195
24196 #include <net/inet_connection_sock.h>
24197 #include <net/inet_hashtables.h>
24198@@ -66,7 +67,6 @@ struct sock *__inet6_lookup_established(
24199 unsigned int slot = hash & hashinfo->ehash_mask;
24200 struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
24201
24202-
24203 rcu_read_lock();
24204 begin:
24205 sk_nulls_for_each_rcu(sk, node, &head->chain) {
24206@@ -108,6 +108,9 @@ static inline int compute_score(struct s
24207 if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, daddr))
24208 return -1;
24209 score++;
24210+ } else {
24211+ if (!v6_addr_in_nx_info(sk->sk_nx_info, daddr, -1))
24212+ return -1;
24213 }
24214 if (sk->sk_bound_dev_if) {
24215 if (sk->sk_bound_dev_if != dif)
24216diff -NurpP --minimal linux-4.4.116/net/ipv6/ip6_fib.c linux-4.4.116-vs2.3.9.7/net/ipv6/ip6_fib.c
24217--- linux-4.4.116/net/ipv6/ip6_fib.c 2018-02-22 21:20:03.000000000 +0000
24218+++ linux-4.4.116-vs2.3.9.7/net/ipv6/ip6_fib.c 2018-01-09 16:36:34.000000000 +0000
24219@@ -1968,6 +1968,7 @@ static int ipv6_route_seq_show(struct se
24220 struct rt6_info *rt = v;
24221 struct ipv6_route_iter *iter = seq->private;
24222
24223+ /* FIXME: check for network context? */
24224 seq_printf(seq, "%pi6 %02x ", &rt->rt6i_dst.addr, rt->rt6i_dst.plen);
24225
24226 #ifdef CONFIG_IPV6_SUBTREES
24227diff -NurpP --minimal linux-4.4.116/net/ipv6/ip6_output.c linux-4.4.116-vs2.3.9.7/net/ipv6/ip6_output.c
24228--- linux-4.4.116/net/ipv6/ip6_output.c 2018-02-22 21:20:03.000000000 +0000
24229+++ linux-4.4.116-vs2.3.9.7/net/ipv6/ip6_output.c 2018-02-10 15:16:50.000000000 +0000
24230@@ -941,7 +941,8 @@ static int ip6_dst_lookup_tail(struct ne
24231 rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
24232 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
24233 sk ? inet6_sk(sk)->srcprefs : 0,
24234- &fl6->saddr);
24235+ &fl6->saddr,
24236+ sk ? sk->sk_nx_info : NULL);
24237 if (err)
24238 goto out_err_release;
24239
24240diff -NurpP --minimal linux-4.4.116/net/ipv6/ndisc.c linux-4.4.116-vs2.3.9.7/net/ipv6/ndisc.c
24241--- linux-4.4.116/net/ipv6/ndisc.c 2016-07-05 04:15:14.000000000 +0000
24242+++ linux-4.4.116-vs2.3.9.7/net/ipv6/ndisc.c 2018-01-09 16:36:34.000000000 +0000
24243@@ -501,7 +501,7 @@ void ndisc_send_na(struct net_device *de
24244 } else {
24245 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
24246 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
24247- &tmpaddr))
24248+ &tmpaddr, NULL))
24249 return;
24250 src_addr = &tmpaddr;
24251 }
24252diff -NurpP --minimal linux-4.4.116/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c linux-4.4.116-vs2.3.9.7/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
24253--- linux-4.4.116/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c 2016-07-05 04:15:14.000000000 +0000
24254+++ linux-4.4.116-vs2.3.9.7/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c 2018-01-09 17:04:44.000000000 +0000
24255@@ -35,7 +35,7 @@ nf_nat_masquerade_ipv6(struct sk_buff *s
24256 ctinfo == IP_CT_RELATED_REPLY));
24257
24258 if (ipv6_dev_get_saddr(nf_ct_net(ct), out,
24259- &ipv6_hdr(skb)->daddr, 0, &src) < 0)
24260+ &ipv6_hdr(skb)->daddr, 0, &src, NULL) < 0)
24261 return NF_DROP;
24262
24263 nfct_nat(ct)->masq_index = out->ifindex;
24264diff -NurpP --minimal linux-4.4.116/net/ipv6/raw.c linux-4.4.116-vs2.3.9.7/net/ipv6/raw.c
24265--- linux-4.4.116/net/ipv6/raw.c 2018-02-22 21:20:03.000000000 +0000
24266+++ linux-4.4.116-vs2.3.9.7/net/ipv6/raw.c 2018-01-09 16:36:34.000000000 +0000
24267@@ -30,6 +30,7 @@
24268 #include <linux/icmpv6.h>
24269 #include <linux/netfilter.h>
24270 #include <linux/netfilter_ipv6.h>
24271+#include <linux/vs_inet6.h>
24272 #include <linux/skbuff.h>
24273 #include <linux/compat.h>
24274 #include <linux/uaccess.h>
24275@@ -291,6 +292,13 @@ static int rawv6_bind(struct sock *sk, s
24276 goto out_unlock;
24277 }
24278
24279+ if (!v6_addr_in_nx_info(sk->sk_nx_info, &addr->sin6_addr, -1)) {
24280+ err = -EADDRNOTAVAIL;
24281+ if (dev)
24282+ dev_put(dev);
24283+ goto out;
24284+ }
24285+
24286 /* ipv4 addr of the socket is invalid. Only the
24287 * unspecified and mapped address have a v4 equivalent.
24288 */
24289diff -NurpP --minimal linux-4.4.116/net/ipv6/route.c linux-4.4.116-vs2.3.9.7/net/ipv6/route.c
24290--- linux-4.4.116/net/ipv6/route.c 2018-02-22 21:20:03.000000000 +0000
24291+++ linux-4.4.116-vs2.3.9.7/net/ipv6/route.c 2018-01-09 17:03:24.000000000 +0000
24292@@ -62,6 +62,7 @@
24293 #include <net/lwtunnel.h>
24294 #include <net/ip_tunnels.h>
24295 #include <net/l3mdev.h>
24296+#include <linux/vs_inet6.h>
24297
24298 #include <asm/uaccess.h>
24299
24300@@ -2545,16 +2546,18 @@ int ip6_route_get_saddr(struct net *net,
24301 struct rt6_info *rt,
24302 const struct in6_addr *daddr,
24303 unsigned int prefs,
24304- struct in6_addr *saddr)
24305+ struct in6_addr *saddr,
24306+ struct nx_info *nxi)
24307 {
24308 struct inet6_dev *idev =
24309 rt ? ip6_dst_idev((struct dst_entry *)rt) : NULL;
24310 int err = 0;
24311- if (rt && rt->rt6i_prefsrc.plen)
24312+ if (rt && rt->rt6i_prefsrc.plen && (!nxi ||
24313+ v6_addr_in_nx_info(nxi, &rt->rt6i_prefsrc.addr, NXA_TYPE_ADDR)))
24314 *saddr = rt->rt6i_prefsrc.addr;
24315 else
24316 err = ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
24317- daddr, prefs, saddr);
24318+ daddr, prefs, saddr, nxi);
24319 return err;
24320 }
24321
24322@@ -3168,7 +3171,8 @@ static int rt6_fill_node(struct net *net
24323 goto nla_put_failure;
24324 } else if (dst) {
24325 struct in6_addr saddr_buf;
24326- if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0 &&
24327+ if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf,
24328+ (skb->sk ? skb->sk->sk_nx_info : NULL)) == 0 &&
24329 nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
24330 goto nla_put_failure;
24331 }
24332diff -NurpP --minimal linux-4.4.116/net/ipv6/tcp_ipv6.c linux-4.4.116-vs2.3.9.7/net/ipv6/tcp_ipv6.c
24333--- linux-4.4.116/net/ipv6/tcp_ipv6.c 2018-02-22 21:20:04.000000000 +0000
24334+++ linux-4.4.116-vs2.3.9.7/net/ipv6/tcp_ipv6.c 2018-01-09 16:36:34.000000000 +0000
24335@@ -69,6 +69,7 @@
24336
24337 #include <linux/crypto.h>
24338 #include <linux/scatterlist.h>
24339+#include <linux/vs_inet6.h>
24340
24341 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
24342 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
24343@@ -150,11 +151,18 @@ static int tcp_v6_connect(struct sock *s
24344 */
24345
24346 if (ipv6_addr_any(&usin->sin6_addr)) {
24347- if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
24348- ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
24349- &usin->sin6_addr);
24350- else
24351- usin->sin6_addr = in6addr_loopback;
24352+ struct nx_info *nxi = sk->sk_nx_info;
24353+
24354+ if (nxi && nx_info_has_v6(nxi))
24355+ /* FIXME: remap lback? */
24356+ usin->sin6_addr = nxi->v6.ip;
24357+ else {
24358+ if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
24359+ ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
24360+ &usin->sin6_addr);
24361+ else
24362+ usin->sin6_addr = in6addr_loopback;
24363+ }
24364 }
24365
24366 addr_type = ipv6_addr_type(&usin->sin6_addr);
24367diff -NurpP --minimal linux-4.4.116/net/ipv6/udp.c linux-4.4.116-vs2.3.9.7/net/ipv6/udp.c
24368--- linux-4.4.116/net/ipv6/udp.c 2018-02-22 21:20:04.000000000 +0000
24369+++ linux-4.4.116-vs2.3.9.7/net/ipv6/udp.c 2018-01-09 16:36:34.000000000 +0000
24370@@ -47,6 +47,7 @@
24371 #include <net/xfrm.h>
24372 #include <net/inet6_hashtables.h>
24373 #include <net/busy_poll.h>
24374+#include <linux/vs_inet6.h>
24375
24376 #include <linux/proc_fs.h>
24377 #include <linux/seq_file.h>
24378@@ -76,32 +77,60 @@ static u32 udp6_ehashfn(const struct net
24379 udp_ipv6_hash_secret + net_hash_mix(net));
24380 }
24381
24382-int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
24383+int ipv6_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
24384 {
24385+ const struct in6_addr *sk1_rcv_saddr6 = inet6_rcv_saddr(sk1);
24386 const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
24387+ __be32 sk1_rcv_saddr = sk1->sk_rcv_saddr;
24388+ __be32 sk2_rcv_saddr = sk2->sk_rcv_saddr;
24389 int sk2_ipv6only = inet_v6_ipv6only(sk2);
24390- int addr_type = ipv6_addr_type(&sk->sk_v6_rcv_saddr);
24391+ int addr_type1 = ipv6_addr_type(sk1_rcv_saddr6);
24392 int addr_type2 = sk2_rcv_saddr6 ? ipv6_addr_type(sk2_rcv_saddr6) : IPV6_ADDR_MAPPED;
24393
24394 /* if both are mapped, treat as IPv4 */
24395- if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED)
24396- return (!sk2_ipv6only &&
24397- (!sk->sk_rcv_saddr || !sk2->sk_rcv_saddr ||
24398- sk->sk_rcv_saddr == sk2->sk_rcv_saddr));
24399+ if (addr_type1 == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED) {
24400+ if (!sk2_ipv6only &&
24401+ (!sk1->sk_rcv_saddr || !sk2->sk_rcv_saddr ||
24402+ sk1->sk_rcv_saddr == sk2->sk_rcv_saddr))
24403+ goto vs_v4;
24404+ else
24405+ return 0;
24406+ }
24407
24408 if (addr_type2 == IPV6_ADDR_ANY &&
24409- !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
24410- return 1;
24411+ !(sk2_ipv6only && addr_type1 == IPV6_ADDR_MAPPED))
24412+ goto vs;
24413
24414- if (addr_type == IPV6_ADDR_ANY &&
24415- !(ipv6_only_sock(sk) && addr_type2 == IPV6_ADDR_MAPPED))
24416- return 1;
24417+ if (addr_type1 == IPV6_ADDR_ANY &&
24418+ !(ipv6_only_sock(sk1) && addr_type2 == IPV6_ADDR_MAPPED))
24419+ goto vs;
24420
24421 if (sk2_rcv_saddr6 &&
24422- ipv6_addr_equal(&sk->sk_v6_rcv_saddr, sk2_rcv_saddr6))
24423- return 1;
24424+ ipv6_addr_equal(&sk1->sk_v6_rcv_saddr, sk2_rcv_saddr6))
24425+ goto vs;
24426
24427 return 0;
24428+
24429+vs_v4:
24430+ if (!sk1_rcv_saddr && !sk2_rcv_saddr)
24431+ return nx_v4_addr_conflict(sk1->sk_nx_info, sk2->sk_nx_info);
24432+ if (!sk2_rcv_saddr)
24433+ return v4_addr_in_nx_info(sk1->sk_nx_info, sk2_rcv_saddr, -1);
24434+ if (!sk1_rcv_saddr)
24435+ return v4_addr_in_nx_info(sk2->sk_nx_info, sk1_rcv_saddr, -1);
24436+ return 1;
24437+vs:
24438+ if (addr_type2 == IPV6_ADDR_ANY && addr_type1 == IPV6_ADDR_ANY)
24439+ return nx_v6_addr_conflict(sk1->sk_nx_info, sk2->sk_nx_info);
24440+ else if (addr_type2 == IPV6_ADDR_ANY)
24441+ return v6_addr_in_nx_info(sk2->sk_nx_info, sk1_rcv_saddr6, -1);
24442+ else if (addr_type1 == IPV6_ADDR_ANY) {
24443+ if (addr_type2 == IPV6_ADDR_MAPPED)
24444+ return nx_v4_addr_conflict(sk1->sk_nx_info, sk2->sk_nx_info);
24445+ else
24446+ return v6_addr_in_nx_info(sk1->sk_nx_info, sk2_rcv_saddr6, -1);
24447+ }
24448+ return 1;
24449 }
24450
24451 static u32 udp6_portaddr_hash(const struct net *net,
24452@@ -162,6 +191,10 @@ static inline int compute_score(struct s
24453 if (inet->inet_dport != sport)
24454 return -1;
24455 score++;
24456+ } else {
24457+ /* block non nx_info ips */
24458+ if (!v6_addr_in_nx_info(sk->sk_nx_info, daddr, -1))
24459+ return -1;
24460 }
24461
24462 if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
24463diff -NurpP --minimal linux-4.4.116/net/ipv6/xfrm6_policy.c linux-4.4.116-vs2.3.9.7/net/ipv6/xfrm6_policy.c
24464--- linux-4.4.116/net/ipv6/xfrm6_policy.c 2016-07-05 04:15:14.000000000 +0000
24465+++ linux-4.4.116-vs2.3.9.7/net/ipv6/xfrm6_policy.c 2018-01-09 16:36:34.000000000 +0000
24466@@ -64,7 +64,8 @@ static int xfrm6_get_saddr(struct net *n
24467 return -EHOSTUNREACH;
24468
24469 dev = ip6_dst_idev(dst)->dev;
24470- ipv6_dev_get_saddr(dev_net(dev), dev, &daddr->in6, 0, &saddr->in6);
24471+ ipv6_dev_get_saddr(dev_net(dev), dev, &daddr->in6,
24472+ 0, &saddr->in6, NULL);
24473 dst_release(dst);
24474 return 0;
24475 }
24476diff -NurpP --minimal linux-4.4.116/net/netfilter/ipvs/ip_vs_xmit.c linux-4.4.116-vs2.3.9.7/net/netfilter/ipvs/ip_vs_xmit.c
24477--- linux-4.4.116/net/netfilter/ipvs/ip_vs_xmit.c 2016-07-05 04:15:15.000000000 +0000
24478+++ linux-4.4.116-vs2.3.9.7/net/netfilter/ipvs/ip_vs_xmit.c 2018-01-09 16:36:34.000000000 +0000
24479@@ -381,7 +381,7 @@ __ip_vs_route_output_v6(struct net *net,
24480 return dst;
24481 if (ipv6_addr_any(&fl6.saddr) &&
24482 ipv6_dev_get_saddr(net, ip6_dst_idev(dst)->dev,
24483- &fl6.daddr, 0, &fl6.saddr) < 0)
24484+ &fl6.daddr, 0, &fl6.saddr, NULL) < 0)
24485 goto out_err;
24486 if (do_xfrm) {
24487 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
24488diff -NurpP --minimal linux-4.4.116/net/netlink/af_netlink.c linux-4.4.116-vs2.3.9.7/net/netlink/af_netlink.c
24489--- linux-4.4.116/net/netlink/af_netlink.c 2018-02-22 21:20:06.000000000 +0000
24490+++ linux-4.4.116-vs2.3.9.7/net/netlink/af_netlink.c 2018-01-09 16:36:34.000000000 +0000
24491@@ -62,6 +62,8 @@
24492 #include <asm/cacheflush.h>
24493 #include <linux/hash.h>
24494 #include <linux/genetlink.h>
24495+#include <linux/vs_context.h>
24496+#include <linux/vs_network.h>
24497
24498 #include <net/net_namespace.h>
24499 #include <net/sock.h>
24500@@ -2460,7 +2462,8 @@ static void *__netlink_seq_next(struct s
24501 if (err)
24502 return ERR_PTR(err);
24503 }
24504- } while (sock_net(&nlk->sk) != seq_file_net(seq));
24505+ } while ((sock_net(&nlk->sk) != seq_file_net(seq)) ||
24506+ !nx_check(nlk->sk.sk_nid, VS_WATCH_P | VS_IDENT));
24507
24508 return nlk;
24509 }
24510diff -NurpP --minimal linux-4.4.116/net/socket.c linux-4.4.116-vs2.3.9.7/net/socket.c
24511--- linux-4.4.116/net/socket.c 2018-02-22 21:20:07.000000000 +0000
24512+++ linux-4.4.116-vs2.3.9.7/net/socket.c 2018-02-10 15:16:50.000000000 +0000
24513@@ -99,10 +99,12 @@
24514
24515 #include <net/sock.h>
24516 #include <linux/netfilter.h>
24517+#include <linux/vs_socket.h>
24518+#include <linux/vs_inet.h>
24519+#include <linux/vs_inet6.h>
24520
24521 #include <linux/if_tun.h>
24522 #include <linux/ipv6_route.h>
24523-#include <linux/route.h>
24524 #include <linux/sockios.h>
24525 #include <linux/atalk.h>
24526 #include <net/busy_poll.h>
24527@@ -608,8 +610,24 @@ EXPORT_SYMBOL(__sock_tx_timestamp);
24528
24529 static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg)
24530 {
24531- int ret = sock->ops->sendmsg(sock, msg, msg_data_left(msg));
24532- BUG_ON(ret == -EIOCBQUEUED);
24533+ size_t size = msg_data_left(msg);
24534+ int ret = sock->ops->sendmsg(sock, msg, size);
24535+#if 0
24536+ if (sock->sk) {
24537+ if (!ret)
24538+ vx_sock_fail(sock->sk, size);
24539+ else
24540+ vx_sock_send(sock->sk, size);
24541+ }
24542+#endif
24543+ vxdprintk(VXD_CBIT(net, 7),
24544+ "sock_sendmsg_nosec: %p[%p,%p,%p;%d/%d]:%zu/%zu",
24545+ sock, sock->sk,
24546+ (sock->sk)?sock->sk->sk_nx_info:0,
24547+ (sock->sk)?sock->sk->sk_vx_info:0,
24548+ (sock->sk)?sock->sk->sk_xid:0,
24549+ (sock->sk)?sock->sk->sk_nid:0,
24550+ size, msg_data_left(msg));
24551 return ret;
24552 }
24553
24554@@ -1100,6 +1118,13 @@ int __sock_create(struct net *net, int f
24555 if (type < 0 || type >= SOCK_MAX)
24556 return -EINVAL;
24557
24558+ if (!nx_check(0, VS_ADMIN)) {
24559+ if (family == PF_INET && !current_nx_info_has_v4())
24560+ return -EAFNOSUPPORT;
24561+ if (family == PF_INET6 && !current_nx_info_has_v6())
24562+ return -EAFNOSUPPORT;
24563+ }
24564+
24565 /* Compatibility.
24566
24567 This uglymoron is moved from INET layer to here to avoid
24568@@ -1234,6 +1259,7 @@ SYSCALL_DEFINE3(socket, int, family, int
24569 if (retval < 0)
24570 goto out;
24571
24572+ set_bit(SOCK_USER_SOCKET, &sock->flags);
24573 retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
24574 if (retval < 0)
24575 goto out_release;
24576@@ -1275,10 +1301,12 @@ SYSCALL_DEFINE4(socketpair, int, family,
24577 err = sock_create(family, type, protocol, &sock1);
24578 if (err < 0)
24579 goto out;
24580+ set_bit(SOCK_USER_SOCKET, &sock1->flags);
24581
24582 err = sock_create(family, type, protocol, &sock2);
24583 if (err < 0)
24584 goto out_release_1;
24585+ set_bit(SOCK_USER_SOCKET, &sock2->flags);
24586
24587 err = sock1->ops->socketpair(sock1, sock2);
24588 if (err < 0)
24589diff -NurpP --minimal linux-4.4.116/net/sunrpc/auth.c linux-4.4.116-vs2.3.9.7/net/sunrpc/auth.c
24590--- linux-4.4.116/net/sunrpc/auth.c 2015-10-29 09:21:46.000000000 +0000
24591+++ linux-4.4.116-vs2.3.9.7/net/sunrpc/auth.c 2018-01-09 16:36:34.000000000 +0000
24592@@ -15,6 +15,7 @@
24593 #include <linux/sunrpc/clnt.h>
24594 #include <linux/sunrpc/gss_api.h>
24595 #include <linux/spinlock.h>
24596+#include <linux/vs_tag.h>
24597
24598 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
24599 # define RPCDBG_FACILITY RPCDBG_AUTH
24600@@ -630,6 +631,7 @@ rpcauth_lookupcred(struct rpc_auth *auth
24601 memset(&acred, 0, sizeof(acred));
24602 acred.uid = cred->fsuid;
24603 acred.gid = cred->fsgid;
24604+ acred.tag = make_ktag(&init_user_ns, dx_current_tag());
24605 acred.group_info = cred->group_info;
24606 ret = auth->au_ops->lookup_cred(auth, &acred, flags);
24607 return ret;
24608@@ -669,6 +671,7 @@ rpcauth_bind_root_cred(struct rpc_task *
24609 struct auth_cred acred = {
24610 .uid = GLOBAL_ROOT_UID,
24611 .gid = GLOBAL_ROOT_GID,
24612+ .tag = KTAGT_INIT(dx_current_tag()),
24613 };
24614
24615 dprintk("RPC: %5u looking up %s cred\n",
24616diff -NurpP --minimal linux-4.4.116/net/sunrpc/auth_unix.c linux-4.4.116-vs2.3.9.7/net/sunrpc/auth_unix.c
24617--- linux-4.4.116/net/sunrpc/auth_unix.c 2016-07-05 04:12:45.000000000 +0000
24618+++ linux-4.4.116-vs2.3.9.7/net/sunrpc/auth_unix.c 2018-01-09 16:36:34.000000000 +0000
24619@@ -13,11 +13,13 @@
24620 #include <linux/sunrpc/clnt.h>
24621 #include <linux/sunrpc/auth.h>
24622 #include <linux/user_namespace.h>
24623+#include <linux/vs_tag.h>
24624
24625 #define NFS_NGROUPS 16
24626
24627 struct unx_cred {
24628 struct rpc_cred uc_base;
24629+ ktag_t uc_tag;
24630 kgid_t uc_gid;
24631 kgid_t uc_gids[NFS_NGROUPS];
24632 };
24633@@ -80,6 +82,7 @@ unx_create_cred(struct rpc_auth *auth, s
24634 groups = NFS_NGROUPS;
24635
24636 cred->uc_gid = acred->gid;
24637+ cred->uc_tag = acred->tag;
24638 for (i = 0; i < groups; i++)
24639 cred->uc_gids[i] = GROUP_AT(acred->group_info, i);
24640 if (i < NFS_NGROUPS)
24641@@ -121,7 +124,9 @@ unx_match(struct auth_cred *acred, struc
24642 unsigned int i;
24643
24644
24645- if (!uid_eq(cred->uc_uid, acred->uid) || !gid_eq(cred->uc_gid, acred->gid))
24646+ if (!uid_eq(cred->uc_uid, acred->uid) ||
24647+ !gid_eq(cred->uc_gid, acred->gid) ||
24648+ !tag_eq(cred->uc_tag, acred->tag))
24649 return 0;
24650
24651 if (acred->group_info != NULL)
24652@@ -146,7 +151,7 @@ unx_marshal(struct rpc_task *task, __be3
24653 struct rpc_clnt *clnt = task->tk_client;
24654 struct unx_cred *cred = container_of(task->tk_rqstp->rq_cred, struct unx_cred, uc_base);
24655 __be32 *base, *hold;
24656- int i;
24657+ int i, tag;
24658
24659 *p++ = htonl(RPC_AUTH_UNIX);
24660 base = p++;
24661@@ -157,8 +162,11 @@ unx_marshal(struct rpc_task *task, __be3
24662 */
24663 p = xdr_encode_array(p, clnt->cl_nodename, clnt->cl_nodelen);
24664
24665- *p++ = htonl((u32) from_kuid(&init_user_ns, cred->uc_uid));
24666- *p++ = htonl((u32) from_kgid(&init_user_ns, cred->uc_gid));
24667+ tag = task->tk_client->cl_tag;
24668+ *p++ = htonl((u32) from_kuid(&init_user_ns,
24669+ TAGINO_KUID(tag, cred->uc_uid, cred->uc_tag)));
24670+ *p++ = htonl((u32) from_kgid(&init_user_ns,
24671+ TAGINO_KGID(tag, cred->uc_gid, cred->uc_tag)));
24672 hold = p++;
24673 for (i = 0; i < 16 && gid_valid(cred->uc_gids[i]); i++)
24674 *p++ = htonl((u32) from_kgid(&init_user_ns, cred->uc_gids[i]));
24675diff -NurpP --minimal linux-4.4.116/net/sunrpc/clnt.c linux-4.4.116-vs2.3.9.7/net/sunrpc/clnt.c
24676--- linux-4.4.116/net/sunrpc/clnt.c 2018-02-22 21:20:07.000000000 +0000
24677+++ linux-4.4.116-vs2.3.9.7/net/sunrpc/clnt.c 2018-01-09 16:36:34.000000000 +0000
24678@@ -31,6 +31,7 @@
24679 #include <linux/in.h>
24680 #include <linux/in6.h>
24681 #include <linux/un.h>
24682+#include <linux/vs_cvirt.h>
24683
24684 #include <linux/sunrpc/clnt.h>
24685 #include <linux/sunrpc/addr.h>
24686@@ -477,6 +478,9 @@ static struct rpc_clnt *rpc_create_xprt(
24687 if (!(args->flags & RPC_CLNT_CREATE_QUIET))
24688 clnt->cl_chatty = 1;
24689
24690+ /* TODO: handle RPC_CLNT_CREATE_TAGGED
24691+ if (args->flags & RPC_CLNT_CREATE_TAGGED)
24692+ clnt->cl_tag = 1; */
24693 return clnt;
24694 }
24695
24696diff -NurpP --minimal linux-4.4.116/net/unix/af_unix.c linux-4.4.116-vs2.3.9.7/net/unix/af_unix.c
24697--- linux-4.4.116/net/unix/af_unix.c 2018-02-22 21:20:07.000000000 +0000
24698+++ linux-4.4.116-vs2.3.9.7/net/unix/af_unix.c 2018-01-09 16:36:34.000000000 +0000
24699@@ -117,6 +117,8 @@
24700 #include <net/checksum.h>
24701 #include <linux/security.h>
24702 #include <linux/freezer.h>
24703+#include <linux/vs_context.h>
24704+#include <linux/vs_limit.h>
24705
24706 struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE];
24707 EXPORT_SYMBOL_GPL(unix_socket_table);
24708@@ -282,6 +284,8 @@ static struct sock *__unix_find_socket_b
24709 if (!net_eq(sock_net(s), net))
24710 continue;
24711
24712+ if (!nx_check(s->sk_nid, VS_WATCH_P | VS_IDENT))
24713+ continue;
24714 if (u->addr->len == len &&
24715 !memcmp(u->addr->name, sunname, len))
24716 goto found;
24717@@ -2741,6 +2745,8 @@ static struct sock *unix_from_bucket(str
24718 for (sk = sk_head(&unix_socket_table[bucket]); sk; sk = sk_next(sk)) {
24719 if (sock_net(sk) != seq_file_net(seq))
24720 continue;
24721+ if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
24722+ continue;
24723 if (++count == offset)
24724 break;
24725 }
24726@@ -2758,6 +2764,8 @@ static struct sock *unix_next_socket(str
24727 sk = sk_next(sk);
24728 if (!sk)
24729 goto next_bucket;
24730+ if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
24731+ continue;
24732 if (sock_net(sk) == seq_file_net(seq))
24733 return sk;
24734 }
24735diff -NurpP --minimal linux-4.4.116/scripts/checksyscalls.sh linux-4.4.116-vs2.3.9.7/scripts/checksyscalls.sh
24736--- linux-4.4.116/scripts/checksyscalls.sh 2015-10-29 09:21:46.000000000 +0000
24737+++ linux-4.4.116-vs2.3.9.7/scripts/checksyscalls.sh 2018-01-09 16:36:34.000000000 +0000
24738@@ -196,7 +196,6 @@ cat << EOF
24739 #define __IGNORE_afs_syscall
24740 #define __IGNORE_getpmsg
24741 #define __IGNORE_putpmsg
24742-#define __IGNORE_vserver
24743 EOF
24744 }
24745
24746diff -NurpP --minimal linux-4.4.116/security/commoncap.c linux-4.4.116-vs2.3.9.7/security/commoncap.c
24747--- linux-4.4.116/security/commoncap.c 2018-02-22 21:20:08.000000000 +0000
24748+++ linux-4.4.116-vs2.3.9.7/security/commoncap.c 2018-01-09 16:36:34.000000000 +0000
24749@@ -71,6 +71,7 @@ static void warn_setuid_and_fcaps_mixed(
24750 int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
24751 int cap, int audit)
24752 {
24753+ struct vx_info *vxi = current_vx_info(); /* FIXME: get vxi from cred? */
24754 struct user_namespace *ns = targ_ns;
24755
24756 /* See if cred has the capability in the target user namespace
24757@@ -79,8 +80,12 @@ int cap_capable(const struct cred *cred,
24758 */
24759 for (;;) {
24760 /* Do we have the necessary capabilities? */
24761- if (ns == cred->user_ns)
24762- return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
24763+ if (ns == cred->user_ns) {
24764+ if (vx_info_flags(vxi, VXF_STATE_SETUP, 0) &&
24765+ cap_raised(cred->cap_effective, cap))
24766+ return 0;
24767+ return vx_cap_raised(vxi, cred->cap_effective, cap) ? 0 : -EPERM;
24768+ }
24769
24770 /* Have we tried all of the parent namespaces? */
24771 if (ns == &init_user_ns)
24772@@ -664,7 +669,7 @@ int cap_inode_setxattr(struct dentry *de
24773
24774 if (!strncmp(name, XATTR_SECURITY_PREFIX,
24775 sizeof(XATTR_SECURITY_PREFIX) - 1) &&
24776- !capable(CAP_SYS_ADMIN))
24777+ !vx_capable(CAP_SYS_ADMIN, VXC_FS_SECURITY))
24778 return -EPERM;
24779 return 0;
24780 }
24781@@ -690,7 +695,7 @@ int cap_inode_removexattr(struct dentry
24782
24783 if (!strncmp(name, XATTR_SECURITY_PREFIX,
24784 sizeof(XATTR_SECURITY_PREFIX) - 1) &&
24785- !capable(CAP_SYS_ADMIN))
24786+ !vx_capable(CAP_SYS_ADMIN, VXC_FS_SECURITY))
24787 return -EPERM;
24788 return 0;
24789 }
24790diff -NurpP --minimal linux-4.4.116/security/selinux/hooks.c linux-4.4.116-vs2.3.9.7/security/selinux/hooks.c
24791--- linux-4.4.116/security/selinux/hooks.c 2018-02-22 21:20:08.000000000 +0000
24792+++ linux-4.4.116-vs2.3.9.7/security/selinux/hooks.c 2018-02-10 15:16:50.000000000 +0000
24793@@ -67,7 +67,6 @@
24794 #include <linux/dccp.h>
24795 #include <linux/quota.h>
24796 #include <linux/un.h> /* for Unix socket types */
24797-#include <net/af_unix.h> /* for Unix socket types */
24798 #include <linux/parser.h>
24799 #include <linux/nfs_mount.h>
24800 #include <net/ipv6.h>
The Linux kernel (the core of the Linux operating system)
This page took 0.349887 seconds and 4 git commands to generate.