Netdev List
 help / color / mirror / Atom feed
* Re: [PATCH] - Fixes sparse warning in ipv6/ipv6_sockglue.c
From: David S. Miller @ 2005-11-15  5:43 UTC (permalink / raw)
  To: lcapitulino; +Cc: akpm, linux-kernel, netdev
In-Reply-To: <20051114095422.5cc4727f.lcapitulino@mandriva.com.br>

From: Luiz Fernando Capitulino <lcapitulino@mandriva.com.br>
Date: Mon, 14 Nov 2005 09:54:22 -0200

> The patch below fixes the following sparse warning:
> 
> net/ipv6/ipv6_sockglue.c:291:13: warning: Using plain integer as NULL pointer
> 
> Signed-off-by: Luiz Capitulino <lcapitulino@mandriva.com.br>

Applied, thanks.

^ permalink raw reply

* Re: [BUG] netpoll is unable to handle skb's using packet split
From: Matt Mackall @ 2005-11-15  6:29 UTC (permalink / raw)
  To: David S. Miller; +Cc: jeffrey.t.kirsher, linux-kernel, netdev
In-Reply-To: <20051114.214130.57199557.davem@davemloft.net>

On Mon, Nov 14, 2005 at 09:41:30PM -0800, David S. Miller wrote:
> From: "David S. Miller" <davem@davemloft.net>
> Date: Mon, 14 Nov 2005 21:39:22 -0800 (PST)
> 
> > From: Matt Mackall <mpm@selenic.com>
> > Date: Mon, 14 Nov 2005 21:23:58 -0800
> > 
> > > What is "packet split" in this context?
> > 
> > It's a mode of buffering used by the e1000 driver.
> 
> BTW, the issue is that in packet split mode, the e1000 driver is
> feeding paged based non-linear SKBs into the stack on receive which is
> completely legal but aparently netpoll or something parsing netpoll RX
> packets does not handle it properly.

The bug is in netpoll. It's non-linear ignorant. We probably can't
call skb_linearize because it wants to kmalloc, but we probably can
follow the fragment. Or, worst case, we can manually linearize into an
SKB in our private pool.

Can we make any assumptions about the size and position of fragments.
For instance, will the first N data bytes of a UDP packet all be in
the same fragment?

-- 
Mathematics is the supreme nostalgia of our time.

^ permalink raw reply

* Re: [BUG] netpoll is unable to handle skb's using packet split
From: David S. Miller @ 2005-11-15  6:45 UTC (permalink / raw)
  To: mpm; +Cc: jeffrey.t.kirsher, linux-kernel, netdev
In-Reply-To: <20051115062947.GI31287@waste.org>

From: Matt Mackall <mpm@selenic.com>
Date: Mon, 14 Nov 2005 22:29:47 -0800

> Can we make any assumptions about the size and position of fragments.
> For instance, will the first N data bytes of a UDP packet all be in
> the same fragment?

Nope, they can be fragmented any way possible.

For packet parsing, you don't need any of this anyways.
Just use the things that the normal network input stack
uses, for example you could use something like
skb_header_pointer(), or pskb_may_pull().

For example, a clean way to parse a UDP header at the
front of an SKB is:

	struct udphdr *uh, _tmp;

	uh = skb_header_pointer(skb, 0, sizeof(_tmp), &_tmp);
	if (uh->sport = foo && uh->dport == bar)
		...

The UDP input path uses:

	struct udphdr *uh;

	if (!pskb_may_pull(skb, sizeof(struct udphdr)))
		goto header_error;

	uh = skb->h.uh;

Unfortunately, pskb_may_pull() may need to call __pskb_pull_tail()
which in turn might do a pskb_expand_head() and thus a GFP_ATOMIC
memory allocation.

^ permalink raw reply

* TCPXM
From: Alan Menegotto @ 2005-11-15  8:29 UTC (permalink / raw)
  To: netdev

Hi.

I'm doing a graduation research where the goal is create a new protocol
in the linux kernel. The protocol choosen was TCPXM, an hybrid reliable
sender-initiated multicast/unicast aimed for small environment such as
grids.

In the last two months I studied the network subsystem, thinking about
how is the best way to struct the code, best structs, etc....

The source code will be based on source code of some other protocol
(like appletalk or ipx, for example).

Is this the right way to start the implementation? Do you have any
advices to me?


-- 
Thanks

Alan Menegotto

^ permalink raw reply

* Re: [PATCH 02/10]: [NETFILTER]: Defer fragmentation in ip_output when connection tracking is used
From: Herbert Xu @ 2005-11-15 10:44 UTC (permalink / raw)
  To: Patrick McHardy
  Cc: Kernel Netdev Mailing List, Netfilter Development Mailinglist
In-Reply-To: <43740DB5.9070206@trash.net>

On Fri, Nov 11, 2005 at 03:19:17AM +0000, Patrick McHardy wrote:

> [NETFILTER]: Defer fragmentation in ip_output when connection tracking is used
> 
> This allows to get rid of the okfn use in ip_refrag and save the useless
> fragmentation/defragmentation step when NAT is used.

I'm slightly uneasy about this change because for POST_ROUTING, the
defragmentation occurs in the middle of the hook, NF_IP_PRI_NAT_SRC.

This means that things like the mangle table currently sees the
fragments as opposed to the whole packet.  This patch will change
that.

Now I'm not saying that this is necessarily a bad thing.  In fact,
for all I know it might make more sense to do this.  But we should
consider the possible implications before embarking on it.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

^ permalink raw reply

* Re: [PATCH 00/10]: Netfilter IPsec support
From: Marco Berizzi @ 2005-11-15 15:50 UTC (permalink / raw)
  To: kaber; +Cc: netdev, netfilter-devel
In-Reply-To: <Pine.LNX.4.62.0511111243310.32138@kaber.coreworks.de>

How are handled NAT-T packets (udp/4500) with these patches?

Patrick McHardy wrote:

>
>On Fri, 11 Nov 2005, Gerd v. Egidy wrote:
>
>>Hi,
>>
>>>This is the latest set patches for netfilter IPsec support.
>>>The use of netif_rx for the innermost SA if it used transport
>>>mode has been replaced by explicit NF_HOOK calls in
>>>xfrm{4,6}_input.c.
>>
>>Could you please describe the solution you implemented a bit more? There 
>>was
>>just so many back and forth that I'm confused now.
>
>OK, some explanation. In tunnel mode, packets go through the stack
>again after decapsulation and hit the PRE_ROUTING and LOCAL_IN or FORWARD
>hook, depending on if it is a local packet or is forwarded. For symetry,
>there are now some additional hooks on the output path which pass the
>packet through LOCAL_OUT and POST_ROUTING after tunnel mode transforms.
>This part behaves just as any other tunnel. Transport mode is special,
>we usually don't want to see packets before or after transport mode
>transforms except if it was the plain text packet (the transport
>mode SA is the innermost SA of the bundle). On the output path this
>already works because packets always hit netfilter before reaching
>the transforms, on the input path packets are manually passed through
>PRE_ROUTING and INPUT in this case. For NAT we do two things:
>when a packet is NATed after already beeing routed (including
>the xfrm lookup), it is routed again. If an incoming packet is NATed
>before the policy check, the policy check reconstructs how the packet
>looked before NAT.
>
>>
>>If I use it with iptables, do the transport mode packets go through INPUT 
>>and
>>OUTPUT twice, decrypted and encrypted?
>
>Yes, if the transport mode transform in the innermost transform
>of the bundle (or the only one).
>
>>
>>If I use it with iptables, do the tunnel mode packets go through FORWARD 
>>or
>>INPUT and OUTPUT twice, decrypted and encrypted?
>
>Yes.
>
>>Can I do NAT in tunnel and transport mode?
>
>Yes, even NATing forwarded packets and protecting them using a transport
>mode SA works.
>
>>what about the policy match patches, why are they only posted "for
>>completeness" and as 11/12 of 10? Aren't they ready yet?
>
>They should be fine.
>

^ permalink raw reply

* [PATCH] ebtables: port ebt*[u]log.c to nf[netlink]_log
From: Bart De Schuymer @ 2005-11-15 18:21 UTC (permalink / raw)
  To: David S. Miller
  Cc: Harald Welte, netdev-u79uwXL29TY76Z2rM5mHXA,
	ebtables-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f

Hi Dave,

Below is a patch from Harald, slightly altered by me to merge some
printk's.

Please apply,
Bart


[NETFILTER] ebtables: Support nf_log API from ebt_log and ebt_ulog

This makes ebt_log and ebt_ulog use the new nf_log api.  This enables
the bridging packet filter to log packets e.g. via nfnetlink_log.

Signed-off-by: Bart De Schuymer <bdschuym-LPO8gxj9N8aZIoH1IeqzKA@public.gmane.org>
Signed-off-by: Harald Welte <laforge-Cap9r6Oaw4JrovVCs/uTlw@public.gmane.org>


--- linux-2.6.14.2/net/bridge/netfilter/Kconfig.old	2005-11-15 18:00:10.000000000 +0000
+++ linux-2.6.14.2/net/bridge/netfilter/Kconfig	2005-11-15 18:00:24.891607224 +0000
@@ -196,9 +196,13 @@ config BRIDGE_EBT_LOG
 	  To compile it as a module, choose M here.  If unsure, say N.
 
 config BRIDGE_EBT_ULOG
-	tristate "ebt: ulog support"
+	tristate "ebt: ulog support (OBSOLETE)"
 	depends on BRIDGE_NF_EBTABLES
 	help
+	  This option enables the old bridge-specific "ebt_ulog" implementation
+	  which has been obsoleted by the new "nfnetlink_log" code (see
+	  CONFIG_NETFILTER_NETLINK_LOG).
+
 	  This option adds the ulog watcher, that you can use in any rule
 	  in any ebtables table. The packet is passed to a userspace
 	  logging daemon using netlink multicast sockets. This differs
--- linux-2.6.14.2/net/bridge/netfilter/ebt_log.c.old	2005-11-15 18:00:04.000000000 +0000
+++ linux-2.6.14.2/net/bridge/netfilter/ebt_log.c	2005-11-15 18:05:38.000000000 +0000
@@ -3,6 +3,7 @@
  *
  *	Authors:
  *	Bart De Schuymer <bdschuym-LPO8gxj9N8aZIoH1IeqzKA@public.gmane.org>
+ *	Harald Welte <laforge-Cap9r6Oaw4JrovVCs/uTlw@public.gmane.org>
  *
  *  April, 2002
  *
@@ -10,6 +11,7 @@
 
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_log.h>
+#include <linux/netfilter.h>
 #include <linux/module.h>
 #include <linux/ip.h>
 #include <linux/if_arp.h>
@@ -55,27 +57,30 @@ static void print_MAC(unsigned char *p)
 }
 
 #define myNIPQUAD(a) a[0], a[1], a[2], a[3]
-static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
-   const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+static void
+ebt_log_packet(unsigned int pf, unsigned int hooknum,
+   const struct sk_buff *skb, const struct net_device *in,
+   const struct net_device *out, const struct nf_loginfo *loginfo,
+   const char *prefix)
 {
-	struct ebt_log_info *info = (struct ebt_log_info *)data;
-	char level_string[4] = "< >";
+	unsigned int bitmask;
 
-	level_string[1] = '0' + info->loglevel;
 	spin_lock_bh(&ebt_log_lock);
-	printk(level_string);
-	printk("%s IN=%s OUT=%s ", info->prefix, in ? in->name : "",
-	   out ? out->name : "");
+	printk("<%c>%s IN=%s OUT=%s MAC source = ", '0' + loginfo->u.log.level,
+	       prefix, in ? in->name : "", out ? out->name : "");
 
-	printk("MAC source = ");
 	print_MAC(eth_hdr(skb)->h_source);
 	printk("MAC dest = ");
 	print_MAC(eth_hdr(skb)->h_dest);
 
 	printk("proto = 0x%04x", ntohs(eth_hdr(skb)->h_proto));
 
-	if ((info->bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto ==
+	if (loginfo->type == NF_LOG_TYPE_LOG)
+		bitmask = loginfo->u.log.logflags;
+	else
+		bitmask = NF_LOG_MASK;
+
+	if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto ==
 	   htons(ETH_P_IP)){
 		struct iphdr _iph, *ih;
 
@@ -84,10 +89,9 @@ static void ebt_log(const struct sk_buff
 			printk(" INCOMPLETE IP header");
 			goto out;
 		}
-		printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u,",
-		   NIPQUAD(ih->saddr), NIPQUAD(ih->daddr));
-		printk(" IP tos=0x%02X, IP proto=%d", ih->tos,
-		       ih->protocol);
+		printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u, IP "
+		       "tos=0x%02X, IP proto=%d", NIPQUAD(ih->saddr),
+		       NIPQUAD(ih->daddr), ih->tos, ih->protocol);
 		if (ih->protocol == IPPROTO_TCP ||
 		    ih->protocol == IPPROTO_UDP) {
 			struct tcpudphdr _ports, *pptr;
@@ -104,7 +108,7 @@ static void ebt_log(const struct sk_buff
 		goto out;
 	}
 
-	if ((info->bitmask & EBT_LOG_ARP) &&
+	if ((bitmask & EBT_LOG_ARP) &&
 	    ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) ||
 	     (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) {
 		struct arphdr _arph, *ah;
@@ -144,6 +148,21 @@ static void ebt_log(const struct sk_buff
 out:
 	printk("\n");
 	spin_unlock_bh(&ebt_log_lock);
+
+}
+
+static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
+   const struct net_device *in, const struct net_device *out,
+   const void *data, unsigned int datalen)
+{
+	struct ebt_log_info *info = (struct ebt_log_info *)data;
+	struct nf_loginfo li;
+
+	li.type = NF_LOG_TYPE_LOG;
+	li.u.log.level = info->loglevel;
+	li.u.log.logflags = info->bitmask;
+
+	nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li, info->prefix);
 }
 
 static struct ebt_watcher log =
@@ -154,13 +173,32 @@ static struct ebt_watcher log =
 	.me		= THIS_MODULE,
 };
 
+static struct nf_logger ebt_log_logger = {
+	.name 		= "ebt_log",
+	.logfn		= &ebt_log_packet,
+	.me		= THIS_MODULE,
+};
+
 static int __init init(void)
 {
-	return ebt_register_watcher(&log);
+	int ret;
+
+	ret = ebt_register_watcher(&log);
+	if (ret < 0)
+		return ret;
+	if (nf_log_register(PF_BRIDGE, &ebt_log_logger) < 0) {
+		printk(KERN_WARNING "ebt_log: not logging via system console "
+		       "since somebody else already registered for PF_INET\n");
+		/* we cannot make module load fail here, since otherwise 
+		 * ebtables userspace would abort */
+	}
+
+	return 0;
 }
 
 static void __exit fini(void)
 {
+	nf_log_unregister_logger(&ebt_log_logger);
 	ebt_unregister_watcher(&log);
 }
 
--- linux-2.6.14.2/net/bridge/netfilter/ebt_ulog.c.old	2005-11-15 18:00:02.000000000 +0000
+++ linux-2.6.14.2/net/bridge/netfilter/ebt_ulog.c	2005-11-15 18:00:24.000000000 +0000
@@ -3,6 +3,7 @@
  *
  *	Authors:
  *	Bart De Schuymer <bdschuym-LPO8gxj9N8aZIoH1IeqzKA@public.gmane.org>
+ *	Harald Welte <laforge-Cap9r6Oaw4JrovVCs/uTlw@public.gmane.org>
  *
  *  November, 2004
  *
@@ -115,14 +116,13 @@ static struct sk_buff *ulog_alloc_skb(un
 	return skb;
 }
 
-static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
+static void ebt_ulog_packet(unsigned int hooknr, const struct sk_buff *skb,
    const struct net_device *in, const struct net_device *out,
-   const void *data, unsigned int datalen)
+   const struct ebt_ulog_info *uloginfo, const char *prefix)
 {
 	ebt_ulog_packet_msg_t *pm;
 	size_t size, copy_len;
 	struct nlmsghdr *nlh;
-	struct ebt_ulog_info *uloginfo = (struct ebt_ulog_info *)data;
 	unsigned int group = uloginfo->nlgroup;
 	ebt_ulog_buff_t *ub = &ulog_buffers[group];
 	spinlock_t *lock = &ub->lock;
@@ -216,6 +216,39 @@ alloc_failure:
 	goto unlock;
 }
 
+/* this function is registered with the netfilter core */
+static void ebt_log_packet(unsigned int pf, unsigned int hooknum,
+   const struct sk_buff *skb, const struct net_device *in,
+   const struct net_device *out, const struct nf_loginfo *li,
+   const char *prefix)
+{
+	struct ebt_ulog_info loginfo;
+
+	if (!li || li->type != NF_LOG_TYPE_ULOG) {
+		loginfo.nlgroup = EBT_ULOG_DEFAULT_NLGROUP;
+		loginfo.cprange = 0;
+		loginfo.qthreshold = EBT_ULOG_DEFAULT_QTHRESHOLD;
+		loginfo.prefix[0] = '\0';
+	} else {
+		loginfo.nlgroup = li->u.ulog.group;
+		loginfo.cprange = li->u.ulog.copy_len;
+		loginfo.qthreshold = li->u.ulog.qthreshold;
+		strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
+	}
+
+	ebt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
+}
+
+static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
+   const struct net_device *in, const struct net_device *out,
+   const void *data, unsigned int datalen)
+{
+	struct ebt_ulog_info *uloginfo = (struct ebt_ulog_info *)data;
+
+	ebt_ulog_packet(hooknr, skb, in, out, uloginfo, NULL);
+}
+
+
 static int ebt_ulog_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
@@ -240,6 +273,12 @@ static struct ebt_watcher ulog = {
 	.me		= THIS_MODULE,
 };
 
+static struct nf_logger ebt_ulog_logger = {
+	.name		= EBT_ULOG_WATCHER,
+	.logfn		= &ebt_log_packet,
+	.me		= THIS_MODULE,
+};
+
 static int __init init(void)
 {
 	int i, ret = 0;
@@ -265,6 +304,13 @@ static int __init init(void)
 	else if ((ret = ebt_register_watcher(&ulog)))
 		sock_release(ebtulognl->sk_socket);
 
+	if (nf_log_register(PF_BRIDGE, &ebt_ulog_logger) < 0) {
+		printk(KERN_WARNING "ebt_ulog: not logging via ulog "
+		       "since somebody else already registered for PF_BRIDGE\n");
+		/* we cannot make module load fail here, since otherwise
+		 * ebtables userspace would abort */
+	}
+
 	return ret;
 }
 
@@ -273,6 +319,7 @@ static void __exit fini(void)
 	ebt_ulog_buff_t *ub;
 	int i;
 
+	nf_log_unregister_logger(&ebt_ulog_logger);
 	ebt_unregister_watcher(&ulog);
 	for (i = 0; i < EBT_ULOG_MAXNLGROUPS; i++) {
 		ub = &ulog_buffers[i];




-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click

^ permalink raw reply

* Re: [PATCH]small fix for __ipv6_addr_type(...)
From: Vlad Yasevich @ 2005-11-15 22:20 UTC (permalink / raw)
  To: Yan Zheng; +Cc: netdev, linux-kernel, yoshfuji
In-Reply-To: <4376F2CE.4050003@21cn.com>

No, according to RFC 4007, loopback is considered a link-local
address.

-vlad

Yan Zheng wrote:
> Hi.
> 
> I think the scope for loopback address should be node local.
> 
> Regards
> 
> Signed-off-by: Yan Zheng <yanzheng@21cn.com>
> 
> ========================================================================
> --- linux-2.6.15-rc1/net/ipv6/addrconf.c    2005-11-13
> 12:23:06.000000000 +0800
> +++ linux/net/ipv6/addrconf.c    2005-11-13 15:50:03.000000000 +0800
> @@ -249,7 +249,7 @@ int __ipv6_addr_type(const struct in6_ad
> 
>             if (addr->s6_addr32[3] == htonl(0x00000001))
>                 return (IPV6_ADDR_LOOPBACK | IPV6_ADDR_UNICAST |
> -                   
> IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_LINKLOCAL));    /* addr-select 3.4 */
> +                   
> IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_NODELOCAL));    /* addr-select 3.4 */
> 
>             return (IPV6_ADDR_COMPATv4 | IPV6_ADDR_UNICAST |
>                 IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));    /*
> addr-select 3.3 */
> -
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

^ permalink raw reply

* Re: [PATCH]small fix for __ipv6_addr_type(...)
From: YOSHIFUJI Hideaki / 吉藤英明 @ 2005-11-16  1:10 UTC (permalink / raw)
  To: vladislav.yasevich; +Cc: yanzheng, netdev, linux-kernel, yoshfuji
In-Reply-To: <437A5F42.3080100@hp.com>

In article <437A5F42.3080100@hp.com> (at Tue, 15 Nov 2005 17:20:50 -0500), Vlad Yasevich <vladislav.yasevich@hp.com> says:

> No, according to RFC 4007, loopback is considered a link-local
> address.

Agreed. RFC3484 also explicitly says that loopback is treated as link-local.

--yoshfuji

^ permalink raw reply

* Re: [RFC: 2.6 patch] remove ISA legacy functions
From: Al Viro @ 2005-11-16  3:56 UTC (permalink / raw)
  To: Matthew Wilcox
  Cc: Jeff Garzik, Adrian Bunk, Andrew Morton, linux-kernel, linux-scsi,
	netdev, jonathan, tlinux-users, Jaroslav Kysela
In-Reply-To: <20051112134820.GG7992@ftp.linux.org.uk>

On Sat, Nov 12, 2005 at 01:48:20PM +0000, Al Viro wrote:
> On Fri, Nov 11, 2005 at 10:29:18PM -0700, Matthew Wilcox wrote:
> > I think they work fine everywhere.  Adrian wants to remove the API they
> > use.
> > 
> > I think this is a bad idea.  The drivers should be converted.
> 
> They are - I'll send patches later today...

NB: never say these words on a Friday night or you'll get a visit from
Murphy.

Apologies for delay, patches sent.

^ permalink raw reply

* fedora-netdev.1 IPv6 freeze [Re: [ANNOUNCE] fedora-netdev kernel repository]
From: Pekka Savola @ 2005-11-16 10:46 UTC (permalink / raw)
  To: linville, linville,
	Development discussions related to Fedora Core; +Cc: netdev
In-Reply-To: <20051114205110.GK25755@redhat.com>

On Mon, 14 Nov 2005, John W. Linville wrote:
> 	http://people.redhat.com/linville/kernels/fedora-netdev/

I guess the test can be termed a 'success' because after updating from 
2.6.14-1.1637_FC4 to 2.6.14-1.1637_FC4.netdev.1, I get 100% 
reproducible kernel hang (everything just freezes as it is, no message 
to /var/log/messages or anywhere) after I run '/sbin/ip -6 r l' or try 
to use IPv6 in basically any other way on my ThinkPad laptop with 
external orinoco_cs WLAN card.

Any thoughts for the next steps?

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

-- 
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

^ permalink raw reply

* Re: fedora-netdev.1 IPv6 freeze [Re: [ANNOUNCE] fedora-netdev kernel repository]
From: John W. Linville @ 2005-11-16 14:25 UTC (permalink / raw)
  To: Thomas Graf
  Cc: Development discussions related to Fedora Core, netdev,
	Pekka Savola, linville
In-Reply-To: <20051116114224.GB20395@postel.suug.ch>

On Wed, Nov 16, 2005 at 12:42:24PM +0100, Thomas Graf wrote:
> * Pekka Savola <pekkas@netcore.fi> 2005-11-16 12:46
> > On Mon, 14 Nov 2005, John W. Linville wrote:
> > >	http://people.redhat.com/linville/kernels/fedora-netdev/
> > 
> > I guess the test can be termed a 'success' because after updating from 
> > 2.6.14-1.1637_FC4 to 2.6.14-1.1637_FC4.netdev.1, I get 100% 
> > reproducible kernel hang (everything just freezes as it is, no message 
> > to /var/log/messages or anywhere) after I run '/sbin/ip -6 r l' or try 
> > to use IPv6 in basically any other way on my ThinkPad laptop with 
> > external orinoco_cs WLAN card.
> > 
> > Any thoughts for the next steps?
> 
> It's probably missing this patch:

It was...

Pekka, I have included the patch Thomas identified as part of the
FC4.netdev.2 build.  You may want to do a 'yum update' and try it out.

Thanks!

John
-- 
John W. Linville
linville@redhat.com

-- 
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

^ permalink raw reply

* kernel-2.6.14-1.1637_FC4.netdev.2 now available
From: John W. Linville @ 2005-11-16 14:33 UTC (permalink / raw)
  To: fedora-list, fedora-devel-list, netdev
In-Reply-To: <20051114205110.GK25755@redhat.com>

The second FC4 fedora-netdev kernel is now available.  If you are
already a fedora-netdev user, a simple 'yum update' should retrieve
the new kernels for you.

I now have a fedora-netdev-release package available.  This simplifies
the process of configuring yum for the fedora-netdev repository.
The FC4 fedora-netdev-release package is available here:

	http://people.redhat.com/linville/kernels/fedora-netdev/4/fedora-netdev-release-4-0.noarch.rpm

Download and install that, then you will be able to use yum to get
the FC4 fedora-netdev kernels.

Thanks, and good luck! :-)

John

P.S.  What is fedora-netdev?

The purpose of this repository is two-fold: 1) to make bleeding-edge
linux kernel networking developments available to Fedora users who
need or want access to them; and, 2) to open-up the Fedora user
base as a better testing resource for the kernel netdev community.
I hope this will prove to be a win-win situation for both camps.

If you are a Fedora user with an interest or need for the latest
developments in Linux kernel networking, then _please_ try the
kernels from this repository.  Your testing and feedback is greatly
appreciated, desperately requested, and graciously accepted.
Thanks in advance!

P.P.S.  What netdev patches are in it?

- sky2: new experimental Marvell Yukon2 driver
- 8139cp: support ETHTOOL_GPERMADDR
- 8139too: support ETHTOOL_GPERMADDR
- b44: support ETHTOOL_GPERMADDR
- e1000: support ETHTOOL_GPERMADDR
- e100: support ETHTOOL_GPERMADDR
- forcedeth: support ETHTOOL_GPERMADDR
- ixgb: support ETHTOOL_GPERMADDR
- ne2k-pci: support ETHTOOL_GPERMADDR
- pcnet32: support ETHTOOL_GPERMADDR
- r8169: support ETHTOOL_GPERMADDR
- skge: support ETHTOOL_GPERMADDR
- sundance: support ETHTOOL_GPERMADDR
- via-rhine: support ETHTOOL_GPERMADDR
- drivers/net: fix-up schedule_timeout() usage
- Replace drivers/net/wan custom ctype macros with standard ones
- drivers/net/wan/: possible cleanups
- lne390 bogus casts
- C99 initializers in ray_cs.c
- mii: Add test for GigE support
- Add rapidio net driver
- pcnet32: set_ringparam implementation
- pcnet32: set min ring size to 4
- sky2: driver update.
- orinoco: Remove conditionals that are useless in the kernel drivers.
- orinoco: Don't include <net/ieee80211.h> twice.
- orinoco: Update PCMCIA ID's.
- Fixed some endian issues with 802.11 header usage in ieee80211_rx.c
- ieee80211 quality scaling algorithm extension handler
- ieee80211 Added wireless spy support
- Changed 802.11 headers to use ieee80211_info_element[0]
- ieee80211 Removed ieee80211_info_element_hdr
- ieee80211 Cleanup memcpy parameters.
- ieee80211 Switched to sscanf in store_debug_level
- ieee80211 Fixed type-o of abg_ture -> abg_true
- Updated ipw2200 to compile with ieee80211 abg_ture to abg_true change
- sky2: fix FIFO DMA alignment problems
- sky2: allow ethtool debug access to all of PCI space
- sky2: version 0.5
- ieee80211: Updated ipw2100 to be compatible with ieee80211_hdr changes
- ieee80211: Updated ipw2100 to be compatible with ieee80211's hard_start_xmit change
- ieee80211: Updated ipw2200 to be compatible with ieee80211_hdr changes
- ieee80211: Updated ipw2200 to be compatible with ieee80211's hard_start_xmit change.
- ieee80211: Updated atmel to be compatible with ieee80211_hdr changes
- ieee80211: Fixed a kernel oops on module unload
- ieee80211: Hardware crypto and fragmentation offload support
- ieee80211: Fix time calculation, switching to use jiffies_to_msecs
- ieee80211: Fix kernel Oops when module unload
- ieee80211: Allow drivers to fix an issue when using wpa_supplicant with WEP
- ieee82011: Added WE-18 support to default wireless extension handler
- ieee80211: Renamed ieee80211_hdr to ieee80211_hdr_3addr
- ieee80211: adds support for the creation of RTS packets
- ieee82011: Added ieee80211_tx_frame to convert generic 802.11 data frames, and callbacks
- ieee80211: Fix TKIP, repeated fragmentation problem, and payload_size reporting
- ieee80211: Return NETDEV_TX_BUSY when QoS buffer full
- ieee80211: Add QoS (WME) support to the ieee80211 subsystem
- ieee80211: Added ieee80211_geo to provide helper functions
- ieee80211: Added ieee80211_radiotap.h
- ieee80211: Additional fixes for endian-aware types
- ieee80211: "extern inline" to "static inline"
- ieee80211: Type-o, capbility definition for QoS, and ERP parsing
- ieee80211: Mixed PTK/GTK CCMP/TKIP support
- ieee80211: Keep auth mode unchanged after iwconfig key off/on cycle
- ieee80211: Updated copyright dates
- ieee80211: Updated hostap to be compatible with ieee80211_hdr changes
- ieee80211: Updated hostap to be compatible with extra_prefix_len changes
- ieee82011: Remove WIRELESS_EXT ifdefs
- forcedeth: add hardware tx checksumming
- ieee80211: Added subsystem version string and reporting via MODULE_VERSION
- ieee80211: Added handle_deauth() callback, enhanced tkip/ccmp support of varying hw/sw offload
- ieee80211: added IE comments, reason_code to reason, removed info_element from ieee80211_disassoc
- ieee80211: in-tree driver updates to sync with latest ieee80211 series
- ieee80211: update orinoco, wl3501 drivers for latest struct naming
- orinoco: Remove inneeded system includes.
- orinoco: Make nortel_pci_hw_init() static.
- orinoco: Fix memory leak and unneeded unlock in orinoco_join_ap()
- orinoco: orinoco_send_wevents() could return without unlocking.
- orinoco: Remove unneeded forward declarations.
- orinoco: Annotate endianess of variables and structure members.
- orinoco: Read only needed data in __orinoco_ev_txexc().
- orinoco: Bump version to 0.15rc3.
- RPC: Report connection errors properly when mounting with "soft"
- RPC: proper soft timeout behavior for rpcbind
- NFS: use a constant value for TCP retransmit timeouts
- RPC: portmapper doesn't need a reserved port
- RPC: extract socket logic common to both client and server
- RPC: introduce client-side transport switch
- RPC: transport switch function naming
- RPC: Reduce stack utilization in xs_sendpages
- RPC: Rename sock_lock
- RPC: Rename xprt_lock
- RPC: rename the sockstate field
- RPC: Eliminate socket.h includes in RPC client
- RPC: Add helper for waking tasks pending on a transport
- RPC: client-side transport switch cleanup
- RPC: separate TCP and UDP write space callbacks
- RPC: separate TCP and UDP transport connection logic
- RPC: separate TCP and UDP socket write paths
- RPC: skip over transport-specific heads automatically
- RPC: get rid of xprt->stream
- RPC: add API to set transport-specific timeouts
- RPC: expose API for serializing access to RPC transports
- RPC: expose API for serializing access to RPC transports
- RPC: separate xprt_timer implementations
- RPC: add generic interface for adjusting the congestion window
- RPC: add a release_rqst callout to the RPC transport switch
- RPC: remove xprt->nocong
- RPC: clean up after nocong was removed
- RPC: allow RPC client's port range to be adjustable
- RPC: make sure to get the same local port number when reconnecting
- RPC: parametrize various transport connect timeouts
- RPC: rationalize set_buffer_size
- RPC,NFS: new rpc_pipefs patch
- Revert "[PATCH] RPC,NFS: new rpc_pipefs patch"
- SUNRPC: fix bug in patch "portmapper doesn't need a reserved port"
- [netdrvr gianfar] use new phy layer
- [netdrvr] delete CONFIG_PHYCONTROL
- hostap: Fix pci_driver name for hostap_plx and hostap_pci
- hostap: Add support for WE-19
- hostap: Use GFP_ATOMIC to get rid of weird might_sleep issue
- hostap: Remove iwe_stream_add_event kludge
- Remove WIRELESS_EXT ifdefs from several wireless drivers.
- [wireless airo] remove needed dma_addr_t obfuscation
- sky2: changing mtu doesn't have to reset link
- sky2: cleanup interrupt processing
- sky2: add hardware VLAN acceleration support
- sky2: explicit set power state
- sky2: version 0.6
- sky2: nway reset (BONUS FEATURE)
- This patch fixes a typo in ieee80211.h: ieee82011_deauth -> ieee80211_deauth
- This will move the ieee80211_is_ofdm_rate function to the ieee80211.h
- Currently the info_element is parsed by 2 seperate functions, this
- When an assoc_resp is received the network structure is not completely
- Lindent and trailing whitespace script executed ieee80211 subsystem
- hostap: Remove hw specific dev_open/close handlers
- hostap: Fix hostap_pci build with PRISM2_IO_DEBUG
- hostap: Do not free local->hw_priv before unregistering netdev
- hostap: Unregister netdevs before freeing local data
- S2io: MSI/MSI-X support (runtime configurable)
- e1000: Support for 82571 and 82572 controllers
- e1000: multi-queue defines/modification to data structures
- e1000: implementation of the multi-queue feature
- e1000: Enable custom configuration bits for 82571/2 controllers
- e1000: Fixes for packet split related issues
- e1000: Added msleep_interruptible delay
- e1000: Flush shadow RAM
- e1000: fix warnings
- AX.25: Delete debug printk from mkiss driver
- AX.25: Convert mkiss.c to DEFINE_RWLOCK
- airo: fix resume
- s2io: change strncpy length arg to use size of target
- [netdrvr s2io] Add a MODULE_VERSION entry
- bonding: replicate IGMP traffic in activebackup mode
- sky2: add permanent address support.
- [wireless ipw2200] remove redundant return statement
- S2io: Offline diagnostics fixes
- rcu in bpqether driver.
- SMACK support for mkiss
- Initialize the .owner field the tty_ldisc structure.
- SUNRPC: Retry rpcbind requests if the server's portmapper isn't up
- RPC: allow call_encode() to delay transmission of an RPC call.
- ieee80211: division by zero fix
- sb1250-mac: Check the actual setting for reporting hw checksumming.
- sb1250-mac: Ensure 16-byte alignment of the descriptor ring.
- au1000_eth: Misc Au1000 net driver fixes.
- de2104x: Resurrect Cobalt support for 2.6.
- sgiseeq: Fix resource handling.
- sgiseeq: Configure PIO and DMA timing requests.
- declance: Convert to irqreturn_t.
- declance: Fix mapping of device.
- declance: Deal with the bloody KSEG vs CKSEG horror...
- declance: Use physical addresses at the interface level.
- ne: Support for RBHMA4500 eval board.
- mipsnet: Virtual ethernet driver for MIPSsim.
- e1000_intr build fix
- s2io build fix
- via-rhine: change mdelay to msleep and remove from ISR path
- epic100: fix counting of work_done in epic_poll
- bonding: cleanup comment for mode 1 IGMP xmit hack
- b44: alternate allocation option for DMA descriptors
- orinoco: remove redundance skb length check before padding
- sundance: remove if (1) { ... } block in sundance_probe1
- sundance: expand reset mask
- e1000 build fix
- RPC: stops the release_pipe() funtion from being called twice
- SUNRPC: Add support for privacy to generic gss-api code.
- SUNRPC: Provide a callback to allow free pages allocated during xdr encoding
- SUNRPC: Retry wrap in case of memory allocation failure.
- RPCSEC_GSS: cleanup au_rslack calculation
- RPCSEC_GSS: client-side privacy support
- RPCSEC_GSS: Simplify rpcsec_gss crypto code
- RPCSEC_GSS: krb5 pre-privacy cleanup
- RPCSEC_GSS: Add support for privacy to krb5 rpcsec_gss mechanism.
- RPCSEC_GSS remove all qop parameters
- RPCSEC_GSS: krb5 cleanup
- Fixed problem with not being able to decrypt/encrypt broadcast packets.
- sb1250-mac: Get rid of all the funny SBMAC_WRITECSR and SBMAC_READCSR macros.
- sb1250-mac: Whitespace cleanup.
- sundance: include MII address 0 in PHY probe
- e1000: Driver version, white space, comments, device id & other
- Fixed oops if an uninitialized key is used for encryption.
- sb1250-mac: PHY probing fixes.
- ieee80211 subsystem:
- Update version ieee80211 stamp to 1.1.6
- [PARISC] Change the driver names so /sys/bus/parisc/drivers/ looks better
- [PARISC] Convert parisc_device to use struct resource for hpa
- [PARISC] Add NETPOLL support to lasi_82596
- [DECNET]: Remove some redundant ifdeffed code
- [NET]: Wider use of for_each_*cpu()
- [PKTGEN]: Sleeping function called under lock
- [PKTGEN]: Use kzalloc
- [PKTGEN]: Spelling and white space
- [PKTGEN]: proc interface revision
- [NETFILTER] ip_conntrack: Make "hashsize" conntrack parameter writable
- [IPV4]: Kill redundant rcu_dereference on fa_info
- [IPSEC]: Kill obsolete get_mss function
- [NETLINK]: Remove dead code in af_netlink.c
- [IPV4]: Remove dead code from ip_output.c
- [SK_BUFF] kernel-doc: fix skbuff warnings
- [AX.25]: Use constant instead of magic number
- [IPV4]: Fix setting broadcast for SIOCSIFNETMASK
- [netdrvr forcedeth] scatter gather and segmentation offload support
- ieee80211 build fix
- Revert "RPC: stops the release_pipe() funtion from being called twice"
- RPC: Ensure that nobody can queue up new upcalls after rpc_close_pipes()
- gfp_t: net/*
- gfp_t: drivers/net
- [ARM] 2919/1: CS8900A ethernet driver modifications for the Comdial MP1000
- [ARM] 2897/2: PXA2xx IRDA support
- sky2: remove unused definitions
- sky2: use kzalloc
- sky2: spelling fixes
- sky2: fix NAPI and receive handling
- sky2: version 0.7
- DRIVER MODEL: Get rid of the obsolete tri-level suspend/resume callbacks
- [Bluetooth] Make more functions static
- [Bluetooth] Update security filter for Extended Inquiry Response
- [IPv4/IPv6]: UFO Scatter-gather approach
- [MCAST] IPv6: Fix algorithm to compute Querier's Query Interval
- tg3: add 5714/5715 support
- tg3: fix ASF heartbeat
- tg3: update version and minor fixes
- ibmveth fix bonding
- ibmveth fix buffer pool management
- ibmveth fix buffer replenishing
- ibmveth lockless TX
- ibmveth fix failed addbuf
- pcnet_cs: fix mii init code for older DL10019 based cards
- s2io: kconfig help fix
- b44 reports wrong advertised flags
- sis190.c: fix multicast MAC filter
- smc91x: shut down power after probing
- starfire: free_irq() on error path of netdev_open()
- [netdrvr b44] include linux/dma-mapping.h to eliminate warning
- sundance: fix DFE-580TX Tx Underrun
- New PowerPC 4xx on-chip ethernet controller driver
- sis900: come alive after temporary memory shortage
- Add Wake on LAN support to sis900 (2)
- drivers/net: Remove pointless checks for NULL prior to calling kfree()
- [netdrvr] ne2k-pci based card does not support bus-mastering.
- ipw2200: Missing kmalloc check
- [SCTP] Rename SCTP specific control message flags.
- [SCTP] Fix SCTP_SETADAPTION sockopt to use the correct structure.
- [SCTP] Allow SCTP_MAXSEG to revert to default frag point with a '0' value.
- [SCTP] Do not allow unprivileged programs initiating new associations on
- e1000: remove warning about e1000_suspend
- eepro.c: module_param_array cleanup
- b44: fix suspend/resume
- e1000: use vmalloc_node()
- revert "orinoco: Information leakage due to incorrect padding"
- Better fixup for the orinoco driver
- e1000: Fixes e1000_suspend warning when CONFIG_PM is not enabled
- [ETH]: ether address compare
- Add modalias for pmac network drivers
- mv643xx_eth_showsram: Added information message when using the SRAM
- [IPV4]: Fix issue reported by Coverity in ipv4/fib_frontend.c
- s2io iomem annotations
- bluetooth hidp is broken on s390
- drivers/net/tg3: Use the DMA_{32,64}BIT_MASK constants
- prism54: Free skb after disabling interrupts
- [DRIVER MODEL] Add missing platform_device.h header.
- PPC 44x EMAC driver: add 440SPe support
- PPC 44x EMAC driver: add 440GR support
- PPC 4xx EMAC driver: fix VSC8201 PHY initialization
- fec_8xx: Remove dependency on NETTA & NETPHONE
- fec_8xx: Add support for Intel PHY LX971
- vmalloc_node
- [ARM] 3066/1: Fix PXA irda driver suspend/resume functions
- m32r: SMC91x driver update
- smsc-ircc2: PM cleanup - do not close device when suspending
- remove some more check_region stuff
- Typo fix: dot after newline in printk strings
- sparse cleanups: NULL pointers, C99 struct init.
- [netdrvr 8139too] replace hand-crafted kernel thread with workqueue
- [BRIDGE]: Use ether_compare
- [NETFILTER]: Add "revision" support to arp_tables and ip6_tables
- [ROSE]: rose_heartbeat_expiry() locking fix
- [IPV6]: Fix behavior of ip6_route_input() for link local address
- [DCCP]: Simplify skb_set_owner_w semantics
- [DCCP]: Set socket owner iff packet is not data
- [MCAST] IPv6: Check packet size when process Multicast
- ibmveth fix panic in initial replenish cycle
- [MCAST]: ip[6]_mc_add_src should be called when number of sources is zero
- [IPV6]: inet6_ifinfo_notify should use RTM_DELLINK in addrconf_ifdown
- [PKT_SCHED]: Rework QoS and/or fair queueing configuration
- ARM: Reverted 2919/1: CS8900A ethernet driver modifications for the Comdial MP1000
- SUNRPC: allow sunrpc.o to link when CONFIG_SYSCTL is disabled
- NFS,SUNRPC,NLM: fix unused variable warnings when CONFIG_SYSCTL is disabled
- [NETFILTER] PPTP helper: Fix compilation of conntrack helper without NAT
- [NETFILTER] PPTP helper: Fix endianness bug in GRE key / CallID NAT
- [NETFILTER] NAT: Fix module refcount dropping too far
- [netdrvr 8139too] use cancel_rearming_delayed_work() to cancel thread
- [netdrvr 8139too] use rtnl_shlock_nowait() rather than rtnl_lock_interruptible()
- [NETFILTER]: Fix double free after netlink_unicast() in ctnetlink
- [NETFILTER] nfnetlink: Use kzalloc
- [NETFILTER]: CONNMARK target needs ip_conntrack
- [NETFILTER] nf_queue: Fix Ooops when no queue handler registered
- [NETEM]: use PSCHED_LESS
- drivers/net/wireless/airo.c unsigned comparason
- S2io: Multi buffer mode support
- pcnet32: show name of failing device
- pcnet32: AT2700/2701 and Bugzilla 2699 & 4551
- pcnet32: Prevent hang with 79c976
- phy address mask support for generic phy layer
- [PKT_SCHED]: Generic RED layer
- [NET]: Introduce INET_ECN_set_ce() function
- [PKT_SCHED]: RED: Use new generic red interface
- [PKT_SCHED]: RED: Use generic queue management interface
- [PKT_SCHED]: RED: Dont start idle periods while already idling
- [PKT_SCHED]: RED: Cleanup and remove unnecessary code
- [PKT_SCHED]: GRED: Cleanup equalize flag and add new WRED mode detection
- [PKT_SCHED]: GRED: Transform grio to GRED_RIO_MODE
- [PKT_SCHED]: GRED: Cleanup dumping
- [PKT_SCHED]: GRED: Dump table definition
- [PKT_SCHED]: GRED: Use a central table definition change procedure
- [PKT_SCHED]: GRED: Report out-of-bound DPs as illegal
- [PKT_SCHED]: GRED: Use central VQ change procedure
- [PKT_SCHED]: GRED: Use new generic red interface
- [PKT_SCHED]: GRED: Do not reset statistics in gred_reset/gred_change
- [PKT_SCHED]: GRED: Report congestion related drops as NET_XMIT_CN
- [PKT_SCHED]: GRED: Use generic queue management interface
- [PKT_SCHED]: GRED: Introduce tc_index_to_dp()
- [PKT_SCHED]: GRED: Improve error handling and messages
- [PKT_SCHED]: GRED: Remove initd flag
- [PKT_SCHED]: GRED: Dont abuse default VQ for equalizing
- [PKT_SCHED]: GRED: Remove auto-creation of default VQ
- [PKT_SCHED]: GRED: Cleanup and remove unnecessary code
- [PKT_SCHED]: GRED: Fix restart of idle period in WRED mode upon dequeue and drop
- [PKT_SCHED]: GRED: Support ECN marking
- [PKT_SCHED]: (G)RED: Introduce hard dropping
- [DRIVER MODEL] Improved dynamically allocated platform_device interface
- [DRIVER MODEL] Fix depca
- [DRIVER MODEL] Fix jazzsonic
- [DRIVER MODEL] Fix macsonic
- [NETEM]: Support time based reordering
- [NETEM]: Add version string
- [NET]: Fix race condition in sk_stream_wait_connect
- [TCP/DCCP]: Randomize port selection
- drivers/net/ixgb/: make some code static
- drivers/net/e1000/: possible cleanups
- drivers/net/hamradio/dmascc.c: remove dmascc_setup()
- prism54: Remove redundant assignment
- bnx2: add 5708 support
- bnx2: update firmware for 5708
- bnx2: update nvram code for 5708
- bnx2: update firmware handshake for 5708
- bnx2: refine bnx2_poll
- bnx2: update version and minor fixes
- Remove linux/version.h include from drivers/net/phy/* and net/ieee80211/*.
- [netdrvr] fac_8xx build fix
- [netdrvr s2io] warning fixes
- b44: b44_start_xmit returns with a lock held when it fails allocating
- b44: miscellaneous cleanup
- b44: expose counters through ethtool
- b44: s/spin_lock_irqsave/spin_lock/ in b44_interrupt
- b44: late request_irq in b44_open
- 3c59x: convert to use of pci_iomap API
- 3c59x: cleanup of mdio_read routines to use MII_* macros
- 3c59x: avoid blindly reading link status twice
- 3c59x: bounds checking for hw_checksums
- 3c59x: cleanup init of module parameter arrays
- 3c59x: fix some grammar in module parameter descriptions
- 3c59x: support ETHTOOL_GPERMADDR
- 3c59x: correct rx_dropped counting
- 3c59x: enable use of memory-mapped PCI I/O
- 3c59x: don't enable scatter/gather w/o checksum support
- knfsd: make sure svc_process call the correct pg_authenticate for multi-service port
- kernel-doc: fix warnings in vmalloc.c
- m68knommu: FEC ethernet header support for the ColdFire 5208
- m68knommu: FEC ethernet support for the ColdFire 5208
- scripts/Lindent on ieee80211 subsystem.
- Fix problem with WEP unicast key > index 0
- Update version ieee80211 stamp to 1.1.7
- Ran scripts/Lindent on drivers/net/wireless/ipw2{1,2}00.{c,h}
- IPW_DEBUG has already included DRV_NAME, remove double prefix print.
- Catch ipw2200 up to equivelancy with v1.0.1
- Catch ipw2200 up to equivelancy with v1.0.2
- Catch ipw2200 up to equivelancy with v1.0.3
- Catch ipw2200 up to equivelancy with v1.0.4
- Catch ipw2100 up to equivelancy with v1.1.1
- Fixed WEP on ipw2100 (priv->sec was being used instead of
- [Bug 339] Fix ipw2100 iwconfig set/get txpower.
- Move code from ipw2100_wpa_enable to IPW2100_PARAM_DROP_UNENCRYPTED to
- Catch ipw2200 up to equivelancy with v1.0.5
- Fix hardware encryption (both WEP and AES) doesn't work with fragmentation.
- Fix is_duplicate_packet() bug for fragmentation number setting.
- [bug 667] Fix the notorious "No space for Tx" bug.
- [Bug 637] Set tx power for A band.
- Changed default # of missed beacons to miss before disassociation to 24
- Updated to support ieee80211 callback to is_queue_full for 802.11e
- Fixed some compiler issues if CONFIG_IPW2200_QOS is enabled.
- Added more useful geography encoding so people's experience with
- Workaround kernel BUG_ON panic caused by unexpected duplicate packets.
- Disable host fragmentation in open mode since IPW2200/2915 hardware
- [Bug 792] Fix WPA-PSK AES both for -Dipw and -Dwext.
- Fixes the ad-hoc network WEP key list issue.
- [Bug 701] Fix a misuse of ieee->mode with ieee->iw_mode.
- Fix ipw_wx_get_txpow shows wrong disabled value.
- Fix firmware error when setting tx_power.
- Modified ipw_config and STATUS_INIT setting to correct race condition
- Switched firmware error dumping so that it will capture a log available
- Changed all of the ipw_send_cmd() calls to return any ipw_send_cmd error
- Added cmdlog in non-debug systems.
- Migrated some of the channel verification code back into the driver to
- Updated ipw2200 to use the new ieee80211 callbacks
- Added wait_state wakeup on scan completion.
- [Bug 455] Fix frequent channel change generates firmware fatal error.
- [Bug 760] Fix setting WEP key in monitor mode causes IV lost.
- Don't set hardware WEP if we are actually using TKIP/AES.
- Make all the places the firmware fails to load showerrors (in decimal,
- Adds radiotap support to ipw2200 in monitor mode..
- Fixed is_network_packet() to include checking for broadcast packets.
- Mixed PTK/GTK CCMP/TKIP support.
- Card with WEP enabled and using shared-key auth will have firmware
- Fixed problem with get_cmd_string not existing if CONFIG_IPW_DEBUG disabled.
- Removed PF_SYNCTHREAD legacy.
- Fixes problem with WEP not working (association succeeds, but no Tx/Rx)
- [Fix bug# 771] Too many (8) bytes recieved when using AES/hwcrypto
- Fixes WEP firmware error condition.
- Updated driver version stamps for ipw2100 (1.1.3) and ipw2200 (1.0.7)
- Pulled out a stray KERNEL_VERSION check around the suspend handler.
- Fix 'Driver using old /proc/net/wireless support, please fix driver !' message.
- Removed legacy WIRELESS_EXT checks from ipw2200.c
- Fixes missed beacon logic in relation to on-network AP roaming.
- Removed warning about TKIP not being configured if countermeasures are
- Added channel support for ipw2200 cards identified as 'ZZR'
- Fixed problem with not being able to send broadcast packets.
- Fixed parameter reordering in firmware log routine.
- Updated firmware version stamp to 2.4 from 2.3 so it will use the latest firmware.
- Update version ipw2200 stamp to 1.0.8
- fix NET_RADIO=n, IEEE80211=y compile
- bonding: fix feature consolidation
- kill include/linux/eeprom.h
- drivers/net/s2io.c: make functions static
- prism54 : Unused variable / extraneous udelay
- prism54 : Transmit stats updated in wrong place
- Fix sparse warning in e100 driver.
- atmel: memset correct range
- [IPV6]: Put addr_diff() into common header for future use.
- [IPV6]: Make ipv6_addr_type() more generic so that we can use it for source address selection.
- [IPV6]: RFC3484 compliant source address selection
- [PKT_SCHED]: Correctly handle empty ematch trees
- [NET]: sk_add_backlog convert from macro to inline
- [PPP]: handle misaligned accesses
- [PPP]: add PPP MPPE encryption module
- [IRDA] donauboe: locking fix
- [NET]: kfree cleanup
- [IPV4]: Fix ip_queue_xmit identity increment for TSO packets
- [Bluetooth]: Add endian annotations to the core
- [Bluetooth]: Remove the usage of /proc completely
- [SERIAL] IOC3: Update 8250 driver bits
- skge: clear PCI PHY COMA mode on boot
- skge: use kzalloc
- skge: add mii ioctl support
- skge: goto low power mode on shutdown
- skge: use prefetch on receive
- skge: spelling fixes
- skge: increase version number
- [wireless ipw2100] kill unused-var warnings for debug-disabled code
- ieee80211: cleanup crypto list handling, other minor cleanups.
- b44: replace B44_FLAG_INIT_COMPLETE with netif_running()
- b44: race on device closing
- b44: increase version number
- dgrs: fix warnings when CONFIG_ISA and CONFIG_PCI are not enabled
- IOC: And don't mark the things as broken Cowboy.
- add a vfs_permission helper
- sanitize lookup_hash prototype
- [NETFILTER]: packet counter of conntrack is 32bits
- [NETFILTER]: refcount leak of proto when ctnetlink dumping tuple
- [NETFILTER] nfnetlink: nfattr_parse() can never fail, make it void
- [NETFILTER] ctnetlink: check if protoinfo is present
- [NETFILTER] ctnetlink: add marking support from userspace
- [NETFILTER] ctnetlink: add module alias to fix autoloading
- [NETFILTER] ctnetlink: kill unused includes
- [NETFILTER] ctnetlink: get_conntrack can use GFP_KERNEL
- [NETFILTER] PPTP helper: fix PNS-PAC expectation call id
- [NETFILTER] nfnetlink: only load subsystems if CAP_NET_ADMIN is set
- [NETFILTER]: stop tracking ICMP error at early point
- [NETFILTER] ctnetlink: return -EINVAL if size is wrong
- [NETFILTER] ctnetlink: propagate error instaed of returning -EPERM
- [NETFILTER] ctnetlink: Add support to identify expectations by ID's
- [NETFILTER] ctnetlink: Fix oops when no ICMP ID info in message
- [NETFILTER] ctnetlink: ICMP_ID is u_int16_t not u_int8_t.
- [IPV6]: Fix fallout from CONFIG_IPV6_PRIVACY
- [IPV6]: ip6ip6_lock is not unlocked in error path.
- [NETFILTER]: Add nf_conntrack subsystem.
- [NETLINK]: Type-safe netlink messages/attributes interface
- [NETLINK]: Make netlink_callback->done() optional
- [NETLINK]: Generic netlink receive queue processor
- [XFRM]: Use generic netlink receive queue processor
- [RTNETLINK]: Use generic netlink receive queue processor
- [NETLINK]: Generic netlink family
- SUNRPC: don't reencode when looping in call transmit.
- [netdrvr 8139too] fast poll for thread, if an unlikely race occurs
- [BNX2]: output driver name as prefix in error message
- [BNX2]: check return of dev_alloc_skb in bnx2_test_loopback
- [BNX2]: simplify parameter checks in bnx2_{get,set}_eeprom
- [NET]: Detect hardware rx checksum faults correctly
- [TCP]: fix congestion window update when using TSO deferal
- [TCP]: simplify microsecond rtt sampling
- [TCP]: add tcp_slow_start helper
- [TCP]: Appropriate Byte Count support
- [TCP]: receive buffer growth limiting with mixed MTU
- [TCP]: spelling fixes
- [TCP]: speed up SACK processing
- disable DEBUG in ibmveth
- sky2 needs dma_mapping.h
- gianfar mii needs to zero out the mii_bus structure
- [netdrvr forcedeth] remove superfluous rx engine stop/start
- [netdrvr forcedeth] support for irq mitigation
- [netdrvr forcedeth] phy address scan range
- SAA9730: Whitespace cleanup.
- SAA9730: Driver overhaul
- smc91x: DB1200 support.
- gt96100eth.c: Don't concatenate __FUNCTION__ with strings.
- TCP: fix vegas build
- [DECNET]: fix SIGPIPE
- [IPV6]: Fix inet6_init missing unregister.
- [SCTP]: Fix potential NULL pointer dereference in sctp_v4_get_saddr
- [SCTP]: Remove timeouts[] array from sctp_endpoint.
- [SCTP]: Fix ia64 NaT consumption fault with sctp_sideffect commands.
- [SCTP]: Include ulpevents in socket receive buffer accounting.
-- 
John W. Linville
linville@redhat.com

-- 
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

^ permalink raw reply

* Re: [PATCH] [IPV4] Fix secondary IP addresses after promotion
From: Brian Pomerantz @ 2005-11-16 19:21 UTC (permalink / raw)
  To: Patrick McHardy
  Cc: Thomas Graf, netdev, davem, kuznet, pekkas, jmorris, yoshfuji,
	kaber, linux-kernel
In-Reply-To: <4370B203.8070501@trash.net>

On Tue, Nov 08, 2005 at 03:11:15PM +0100, Patrick McHardy wrote:
> 
> Yes, fixing it correctly looks very hard. Just changing the routes
> doesn't seem right to me, someone might have added it with exactly
> this prefsrc and doesn't want it to change, its also not clear how
> to notify on this. Taking care of correct ordering of the ifa_list
> is also more complicated without just deleting and readding them.
> 
> I have a patch to do this, but it needs some debugging, for some
> unknown reason it crashes sometimes if I remove addresses without
> specifying the mask.

Looks like I'm back on this one because just sending the NETDEV_UP for
the secondaries didn't work if a primary other than the first one is
removed.  If you have anything that you need help testing/debugging,
I'm stuck with this until it is fixed.  I'd prefer not to duplicate
effort on this if you're close to a fix.  If not, then I'll try to
come up with something and toss it out for comment.


BAPper

^ permalink raw reply

* Re: 2.6.15-rc1: NET_CLS_U32 not working?
From: Adrian Bunk @ 2005-11-16 23:58 UTC (permalink / raw)
  To: Christian; +Cc: linux-kernel, netdev
In-Reply-To: <437BBC59.70301@g-house.de>

On Thu, Nov 17, 2005 at 12:10:17AM +0100, Christian wrote:
> hi,
> 
> i noticed that some of my QoS rules are not working any more. oh, i 
> forgot to enable CONFIG_NET_CLS_U32. but when enabled, i got the 
> following errors when compiling / installing the module:
> 
> * Warning: "unregister_tcf_proto_ops" [net/sched/cls_u32.ko] undefined!
> * Warning: "register_tcf_proto_ops" [net/sched/cls_u32.ko] undefined!
> * Warning: "tcf_exts_dump" [net/sched/cls_u32.ko] undefined!
> * Warning: "tcf_exts_dump_stats" [net/sched/cls_u32.ko] undefined!
> * Warning: "tcf_exts_change" [net/sched/cls_u32.ko] undefined!
> * Warning: "tcf_exts_validate" [net/sched/cls_u32.ko] undefined!
> * Warning: "tcf_exts_destroy" [net/sched/cls_u32.ko] undefined!
>...
> when i disabled CONFIG_NET_CLS_U32, everything compiles fine, but 
> cls_u32 is missing of course :-(
> 
> all the missing symbols seem to be defined in include/net/pkt_cls.h. but 
>  this file is #included by net/sched/cls_u32.c and other too, so i 
> don't really know, why it doesn't work.
> 
> FWIW, i see EXPORT_SYMBOLs at the very end of net/sched/cls_api.c, but i 
> can't see if/when cls_api.c is used (included?) at all.
>...


I'm assuming you are trying to insert the new module in your old kernel?

This is one of the unfortunate but hardly avoidable cases where adding a 
module requires installing a new kernel.


But there's a change in 2.6.15-rc1 that makes this issue much worse:
It is no longer user-visible.

tristate's select'ing bool's that do not change parts of the (modular) 
driver but compile additional code into the kernel are simply wrong.


> thanks for looking into that,
> Christian.
>...


cu
Adrian

BTW: Please Cc netdev@vger.kernel.org on networking issues.

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

^ permalink raw reply

* Re: 2.6.15-rc1: NET_CLS_U32 not working?
From: Christian @ 2005-11-17  0:06 UTC (permalink / raw)
  To: linux-kernel; +Cc: netdev
In-Reply-To: <20051116235813.GS5735@stusta.de>

Adrian Bunk schrieb:
> 
> I'm assuming you are trying to insert the new module in your old kernel?

yes, i tried to "modprobe" the compiled cls_u32 module. but the "make 
modules" errors are there anyway. i tried to compile a fresh 2.6.15-rc1 
on a different machine (where i can't do "modprobe") and the errors were 
there too: http://nerdbynature.de/bits/sheep/2.6.15-rc1/make-modules.log

> This is one of the unfortunate but hardly avoidable cases where adding a 
> module requires installing a new kernel.

despite of the errors on "make modules" i'll reboot with the "new" 
kernel asap.

> BTW: Please Cc netdev@vger.kernel.org on networking issues.

ok, will do that.


thank you,
Christian.
-- 
BOFH excuse #442:

Trojan horse ran out of hay

^ permalink raw reply

* [PATCH]IPv6: Acquire addrconf_hash_lock for reading instead of writing in addrconf_verify(...)
From: Yan Zheng @ 2005-11-17  2:14 UTC (permalink / raw)
  To: netdev; +Cc: linux-kernel, yoshfuji

Hi.

addrconf_verify(...) only traverse address hash table when addrconf_hash_lock is held
for writing, and it may hold addrconf_hash_lock for a long time. So I think it's better
to acquire addrconf_hash_lock for reading instead of  writing

Signed-off-by: Yan Zheng <yanzheng@21cn.com>

============================================================
--- a/net/ipv6/addrconf.c	2005-11-17 09:27:54.000000000 +0800
+++ b/net/ipv6/addrconf.c	2005-11-17 09:25:42.000000000 +0800
@@ -2627,7 +2627,7 @@ static void addrconf_verify(unsigned lon
 	for (i=0; i < IN6_ADDR_HSIZE; i++) {
 
 restart:
-		write_lock(&addrconf_hash_lock);
+		read_lock(&addrconf_hash_lock);
 		for (ifp=inet6_addr_lst[i]; ifp; ifp=ifp->lst_next) {
 			unsigned long age;
 #ifdef CONFIG_IPV6_PRIVACY
@@ -2649,7 +2649,7 @@ restart:
 			if (age >= ifp->valid_lft) {
 				spin_unlock(&ifp->lock);
 				in6_ifa_hold(ifp);
-				write_unlock(&addrconf_hash_lock);
+				read_unlock(&addrconf_hash_lock);
 				ipv6_del_addr(ifp);
 				goto restart;
 			} else if (age >= ifp->prefered_lft) {
@@ -2668,7 +2668,7 @@ restart:
 
 				if (deprecate) {
 					in6_ifa_hold(ifp);
-					write_unlock(&addrconf_hash_lock);
+					read_unlock(&addrconf_hash_lock);
 
 					ipv6_ifa_notify(0, ifp);
 					in6_ifa_put(ifp);
@@ -2686,7 +2686,7 @@ restart:
 						in6_ifa_hold(ifp);
 						in6_ifa_hold(ifpub);
 						spin_unlock(&ifp->lock);
-						write_unlock(&addrconf_hash_lock);
+						read_unlock(&addrconf_hash_lock);
 						ipv6_create_tempaddr(ifpub, ifp);
 						in6_ifa_put(ifpub);
 						in6_ifa_put(ifp);
@@ -2703,7 +2703,7 @@ restart:
 				spin_unlock(&ifp->lock);
 			}
 		}
-		write_unlock(&addrconf_hash_lock);
+		read_unlock(&addrconf_hash_lock);
 	}
 
 	addr_chk_timer.expires = time_before(next, jiffies + HZ) ? jiffies + HZ : next;

^ permalink raw reply

* Re: [PATCH 02/10]: [NETFILTER]: Defer fragmentation in ip_output when connection tracking is used
From: Patrick McHardy @ 2005-11-17  2:28 UTC (permalink / raw)
  To: Herbert Xu
  Cc: Kernel Netdev Mailing List, Netfilter Development Mailinglist,
	Harald Welte
In-Reply-To: <20051115104425.GA31719@gondor.apana.org.au>

Herbert Xu wrote:
> On Fri, Nov 11, 2005 at 03:19:17AM +0000, Patrick McHardy wrote:
> 
>>[NETFILTER]: Defer fragmentation in ip_output when connection tracking is used
>>
>>This allows to get rid of the okfn use in ip_refrag and save the useless
>>fragmentation/defragmentation step when NAT is used.
> 
 >
> I'm slightly uneasy about this change because for POST_ROUTING, the
> defragmentation occurs in the middle of the hook, NF_IP_PRI_NAT_SRC.
> 
> This means that things like the mangle table currently sees the
> fragments as opposed to the whole packet.  This patch will change
> that.
> 
> Now I'm not saying that this is necessarily a bad thing.  In fact,
> for all I know it might make more sense to do this.  But we should
> consider the possible implications before embarking on it.

Good point. I would also prefer to have fragmentation occur after
POST_ROUTING in all cases. Looking at the in-tree targets, it means
loosing the ability to do a couple of things:

- CLASSIFY fragments differently
- MARK fragments differently
- DSCP/ECN/TOS mark fragments differently
- Change TTLs of fragments to differently values

None of them seems very important. The DSCP and ECN targets were
broken until not long ago without anyone noticing, the TTL target is
relatively new. So it comes down to loosing the ability to classify
fragments of one packet differently using iptables, which doesn't
make much sense too me. In fact I think it would make classification
easier if mangle would see the whole packet.

I've CCed Harald for his opinion in case I missed something.

Regards
Patrick

^ permalink raw reply

* Re: [PATCH 00/10]: Netfilter IPsec support
From: Patrick McHardy @ 2005-11-17  2:35 UTC (permalink / raw)
  To: Marco Berizzi; +Cc: netdev, netfilter-devel
In-Reply-To: <BAY103-F240FCD8D8AE36A95868233B25D0@phx.gbl>

Marco Berizzi wrote:
> How are handled NAT-T packets (udp/4500) with these patches?

Instead of ESP packets you see the encapsulated UDP packets
on the netfilter hooks:

(none):~# ping 10.0.0.1 -c 1
PING 10.0.0.1 (10.0.0.1): 56 data bytes
OUTPUT      IN= OUT=eth0 SRC=10.0.0.2 DST=10.0.0.1 LEN=84 TOS=0x00 
PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=16899 SEQ=0
POSTROUTING IN= OUT=eth0 SRC=10.0.0.2 DST=10.0.0.1 LEN=84 TOS=0x00 
PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=16899 SEQ=0

OUTPUT      IN= OUT=eth0 SRC=10.0.0.2 DST=10.0.0.1 LEN=160 TOS=0x00 
PREC=0x00 TTL=64 ID=256 DF PROTO=UDP SPT=4500 DPT=4500 LEN=140
POSTROUTING IN= OUT=eth0 SRC=10.0.0.2 DST=10.0.0.1 LEN=160 TOS=0x00 
PREC=0x00 TTL=64 ID=256 DF PROTO=UDP SPT=4500 DPT=4500 LEN=140

PREROUTING  IN=eth0 OUT= MAC=fe:fd:0a:00:00:02:36:ec:4f:25:dc:68:08:00 
SRC=10.0.0.1 DST=10.0.0.2 LEN=160 TOS=0x00 PREC=0x00 TTL=64 ID=19709 
PROTO=UDP SPT=4500 DPT=4500 LEN=140
INPUT       IN=eth0 OUT= MAC=fe:fd:0a:00:00:02:36:ec:4f:25:dc:68:08:00 
SRC=10.0.0.1 DST=10.0.0.2 LEN=160 TOS=0x00 PREC=0x00 TTL=64 ID=19709 
PROTO=UDP SPT=4500 DPT=4500 LEN=140

PREROUTING  IN=eth0 OUT= MAC=fe:fd:0a:00:00:02:36:ec:4f:25:dc:68:08:00 
SRC=10.0.0.1 DST=10.0.0.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=19708 
PROTO=ICMP TYPE=0 CODE=0 ID=16899 SEQ=0
INPUT       IN=eth0 OUT= MAC=fe:fd:0a:00:00:02:36:ec:4f:25:dc:68:08:00 
SRC=10.0.0.1 DST=10.0.0.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=19708 
PROTO=ICMP TYPE=0 CODE=0 ID=16899 SEQ=0

64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=25.9 ms

^ permalink raw reply

* Do away with everything you are indebted for with out sending an other cent
From: reva bradley @ 2005-11-17  9:05 UTC (permalink / raw)
  To: Elin Lewis

End their harassment and tell them no more calls.
We have pioneered an advanced system of proven strategies 
that will get the creditors and debt collectors off your back for good

Our debt termination program has legally stopped millions of dollars worth
of debt from being collected.


check out our Elimination Program here
http://it.geocities.com/henrys_chrissy/?s=d



take us out, po box above in site




You are right, and I must wait--wait--wait--patiently and silently--until
my bonds are loosed by intelligence rather than chance! It is a dreary fate.
But I must wait--I must wait--I must wait! I'm glad you've come to your
senses, remarked Rob, drily
So, if you've nothing more to say-- No! I have nothing more to say

^ permalink raw reply

* [PATCH] [RFT] ip_tables NUMA optimization
From: Harald Welte @ 2005-11-17 14:43 UTC (permalink / raw)
  To: Netfilter Development Mailinglist; +Cc: Linux Netdev List, Eric dumazet


[-- Attachment #1.1: Type: text/plain, Size: 670 bytes --]

I've hand-merged Eric Dumazet's original ip_tables numa optimization
patch to current git head.  Also, I've ported it to ip6_tables and
arp_tables.

Since this is 2.6.16 stuff, I don't want to have it applied at this
time, but merely request testers (esp. for the non-ipv4 part).

Thanks,

-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #1.2: vmalloc_node.patch --]
[-- Type: text/plain, Size: 41093 bytes --]

[NETFILTER] ip_tables: NUMA-aware allocation

Part of a performance problem with ip_tables is that memory allocation is not
NUMA aware, but 'only' SMP aware (ie each CPU normally touch separate cache
lines)                                                                        

Even with small iptables rules, the cost of this misplacement can be high on
common workloads.  Instead of using one vmalloc() area (located in the node of
the iptables process), we now allocate an area for each possible CPU, using
vmalloc_node() so that memory should be allocated in the CPU's node if
possible.

Port to arp_tables and ip6_tables by Harald Welte.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
---
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -68,19 +68,14 @@ struct arpt_table_info {
 	unsigned int initial_entries;
 	unsigned int hook_entry[NF_ARP_NUMHOOKS];
 	unsigned int underflow[NF_ARP_NUMHOOKS];
-	char entries[0] __attribute__((aligned(SMP_CACHE_BYTES)));
+	void *entries[NR_CPUS];
 };
 
 static LIST_HEAD(arpt_target);
 static LIST_HEAD(arpt_tables);
+#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
 #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
 
-#ifdef CONFIG_SMP
-#define TABLE_OFFSET(t,p) (SMP_ALIGN((t)->size)*(p))
-#else
-#define TABLE_OFFSET(t,p) 0
-#endif
-
 static inline int arp_devaddr_compare(const struct arpt_devaddr_info *ap,
 				      char *hdr_addr, int len)
 {
@@ -269,9 +264,7 @@ unsigned int arpt_do_table(struct sk_buf
 	outdev = out ? out->name : nulldevname;
 
 	read_lock_bh(&table->lock);
-	table_base = (void *)table->private->entries
-		+ TABLE_OFFSET(table->private,
-			       smp_processor_id());
+	table_base = (void *)table->private->entries[smp_processor_id()];
 	e = get_entry(table_base, table->private->hook_entry[hook]);
 	back = get_entry(table_base, table->private->underflow[hook]);
 
@@ -462,7 +455,8 @@ static inline int unconditional(const st
 /* Figures out from what hook each rule can be called: returns 0 if
  * there are loops.  Puts hook bitmask in comefrom.
  */
-static int mark_source_chains(struct arpt_table_info *newinfo, unsigned int valid_hooks)
+static int mark_source_chains(struct arpt_table_info *newinfo,
+			      unsigned int valid_hooks, void *entry0)
 {
 	unsigned int hook;
 
@@ -472,7 +466,7 @@ static int mark_source_chains(struct arp
 	for (hook = 0; hook < NF_ARP_NUMHOOKS; hook++) {
 		unsigned int pos = newinfo->hook_entry[hook];
 		struct arpt_entry *e
-			= (struct arpt_entry *)(newinfo->entries + pos);
+			= (struct arpt_entry *)(entry0 + pos);
 
 		if (!(valid_hooks & (1 << hook)))
 			continue;
@@ -514,13 +508,13 @@ static int mark_source_chains(struct arp
 						goto next;
 
 					e = (struct arpt_entry *)
-						(newinfo->entries + pos);
+						(entry0 + pos);
 				} while (oldpos == pos + e->next_offset);
 
 				/* Move along one */
 				size = e->next_offset;
 				e = (struct arpt_entry *)
-					(newinfo->entries + pos + size);
+					(entry0 + pos + size);
 				e->counters.pcnt = pos;
 				pos += size;
 			} else {
@@ -537,7 +531,7 @@ static int mark_source_chains(struct arp
 					newpos = pos + e->next_offset;
 				}
 				e = (struct arpt_entry *)
-					(newinfo->entries + newpos);
+					(entry0 + newpos);
 				e->counters.pcnt = pos;
 				pos = newpos;
 			}
@@ -689,6 +683,7 @@ static inline int cleanup_entry(struct a
 static int translate_table(const char *name,
 			   unsigned int valid_hooks,
 			   struct arpt_table_info *newinfo,
+			   void *entry0,
 			   unsigned int size,
 			   unsigned int number,
 			   const unsigned int *hook_entries,
@@ -713,8 +708,8 @@ static int translate_table(const char *n
 	ret = ARPT_ENTRY_ITERATE(newinfo->entries, newinfo->size,
 				 check_entry_size_and_hooks,
 				 newinfo,
-				 newinfo->entries,
-				 newinfo->entries + size,
+				 entry0,
+				 entry0 + size,
 				 hook_entries, underflows, &i);
 	duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
 	if (ret != 0)
@@ -743,29 +738,26 @@ static int translate_table(const char *n
 		}
 	}
 
-	if (!mark_source_chains(newinfo, valid_hooks)) {
+	if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
 		duprintf("Looping hook\n");
 		return -ELOOP;
 	}
 
 	/* Finally, each sanity check must pass */
 	i = 0;
-	ret = ARPT_ENTRY_ITERATE(newinfo->entries, newinfo->size,
+	ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
 				 check_entry, name, size, &i);
 
 	if (ret != 0) {
-		ARPT_ENTRY_ITERATE(newinfo->entries, newinfo->size,
+		ARPT_ENTRY_ITERATE(entry0, newinfo->size,
 				   cleanup_entry, &i);
 		return ret;
 	}
 
 	/* And one copy for every other CPU */
 	for_each_cpu(i) {
-		if (i == 0)
-			continue;
-		memcpy(newinfo->entries + SMP_ALIGN(newinfo->size) * i,
-		       newinfo->entries,
-		       SMP_ALIGN(newinfo->size));
+		if (newinfo->entries[i] && newinfo->entries[i] != entry0)
+			memcpy(newinfo->entries[smp_processor_id()], entry0, newinfo->size);
 	}
 
 	return ret;
@@ -807,20 +799,45 @@ static inline int add_entry_to_counter(c
 	return 0;
 }
 
+static inline int set_entry_to_counter(const struct arpt_entry *e,
+				       struct arpt_counters total[],
+				       unsigned int *i)
+{
+	SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
+
+	(*i)++;
+	return 0;
+}
+
 static void get_counters(const struct arpt_table_info *t,
 			 struct arpt_counters counters[])
 {
 	unsigned int cpu;
 	unsigned int i;
+	unsigned int curcpu = get_cpu();
+
+	/* Instead of clearing (by a previous call to memset())
+	 * the counters and using adds, we set the counters
+	 * with data used by current CPU */
+
+	i = 0;
+	ARPT_ENTRY_ITERATE(t->entries[curcpu],
+			   t->size,
+			   set_entry_to_counter,
+			   counters,
+			   &i);
 
 	for_each_cpu(cpu) {
+		if (cpu == curcpu)
+			continue;
 		i = 0;
-		ARPT_ENTRY_ITERATE(t->entries + TABLE_OFFSET(t, cpu),
+		ARPT_ENTRY_ITERATE(t->entries[cpu],
 				   t->size,
 				   add_entry_to_counter,
 				   counters,
 				   &i);
 	}
+	put_cpu();
 }
 
 static int copy_entries_to_user(unsigned int total_size,
@@ -831,6 +848,7 @@ static int copy_entries_to_user(unsigned
 	struct arpt_entry *e;
 	struct arpt_counters *counters;
 	int ret = 0;
+	void *loc_cpu_entry;
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	 * (other than comefrom, which userspace doesn't care
@@ -843,13 +861,13 @@ static int copy_entries_to_user(unsigned
 		return -ENOMEM;
 
 	/* First, sum counters... */
-	memset(counters, 0, countersize);
 	write_lock_bh(&table->lock);
 	get_counters(table->private, counters);
 	write_unlock_bh(&table->lock);
 
-	/* ... then copy entire thing from CPU 0... */
-	if (copy_to_user(userptr, table->private->entries, total_size) != 0) {
+	loc_cpu_entry = table->private->entries[get_cpu()];
+	/* ... then copy entire thing ... */
+	if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 		ret = -EFAULT;
 		goto free_counters;
 	}
@@ -859,7 +877,7 @@ static int copy_entries_to_user(unsigned
 	for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 		struct arpt_entry_target *t;
 
-		e = (struct arpt_entry *)(table->private->entries + off);
+		e = (struct arpt_entry *)(loc_cpu_entry + off);
 		if (copy_to_user(userptr + off
 				 + offsetof(struct arpt_entry, counters),
 				 &counters[num],
@@ -880,6 +898,7 @@ static int copy_entries_to_user(unsigned
 	}
 
  free_counters:
+	put_cpu();
 	vfree(counters);
 	return ret;
 }
@@ -911,6 +930,47 @@ static int get_entries(const struct arpt
 	return ret;
 }
 
+static void free_table_info(struct arpt_table_info *info)
+{
+	int cpu;
+	for_each_cpu(cpu) {
+		if (info->size <= PAGE_SIZE)
+			kfree(info->entries[cpu]);
+		else
+			kfree(info->entries[cpu]);
+	}
+	kfree(info);
+}
+
+static struct arpt_table_info *alloc_table_info(unsigned int size)
+{
+	struct arpt_table_info *newinfo;
+	int cpu;
+	
+	newinfo = kzalloc(sizeof(struct arpt_table_info), GFP_KERNEL);
+	if (!newinfo)
+		return NULL;
+
+	newinfo->size = size;
+
+	for_each_cpu(cpu) {
+		if (size <= PAGE_SIZE)
+			newinfo->entries[cpu] = kmalloc_node(size,
+							GFP_KERNEL,
+							cpu_to_node(cpu));
+		else
+			newinfo->entries[cpu] = vmalloc_node(size,
+							     cpu_to_node(cpu));
+
+		if (newinfo->entries[cpu] == NULL) {
+			free_table_info(newinfo);
+			return NULL;
+		}
+	}
+
+	return newinfo;
+}
+
 static int do_replace(void __user *user, unsigned int len)
 {
 	int ret;
@@ -918,6 +978,7 @@ static int do_replace(void __user *user,
 	struct arpt_table *t;
 	struct arpt_table_info *newinfo, *oldinfo;
 	struct arpt_counters *counters;
+	void *loc_cpu_entry, *loc_cpu_old_entry;
 
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
@@ -930,13 +991,13 @@ static int do_replace(void __user *user,
 	if ((SMP_ALIGN(tmp.size) >> PAGE_SHIFT) + 2 > num_physpages)
 		return -ENOMEM;
 
-	newinfo = vmalloc(sizeof(struct arpt_table_info)
-			  + SMP_ALIGN(tmp.size) *
-			  		(highest_possible_processor_id()+1));
+	newinfo = alloc_table_info(tmp.size);
 	if (!newinfo)
 		return -ENOMEM;
 
-	if (copy_from_user(newinfo->entries, user + sizeof(tmp),
+	/* choose the copy that is on our node/cpu */
+	loc_cpu_entry = newinfo->entries[get_cpu()];
+	if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
 			   tmp.size) != 0) {
 		ret = -EFAULT;
 		goto free_newinfo;
@@ -947,10 +1008,9 @@ static int do_replace(void __user *user,
 		ret = -ENOMEM;
 		goto free_newinfo;
 	}
-	memset(counters, 0, tmp.num_counters * sizeof(struct arpt_counters));
 
 	ret = translate_table(tmp.name, tmp.valid_hooks,
-			      newinfo, tmp.size, tmp.num_entries,
+			      newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
 			      tmp.hook_entry, tmp.underflow);
 	if (ret != 0)
 		goto free_newinfo_counters;
@@ -989,8 +1049,10 @@ static int do_replace(void __user *user,
 	/* Get the old counters. */
 	get_counters(oldinfo, counters);
 	/* Decrease module usage counts and free resource */
-	ARPT_ENTRY_ITERATE(oldinfo->entries, oldinfo->size, cleanup_entry,NULL);
-	vfree(oldinfo);
+	loc_cpu_old_entry = oldinfo->entries[smp_processor_id()];
+	ARPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
+	put_cpu();
+	free_table_info(oldinfo);
 	if (copy_to_user(tmp.counters, counters,
 			 sizeof(struct arpt_counters) * tmp.num_counters) != 0)
 		ret = -EFAULT;
@@ -1002,11 +1064,12 @@ static int do_replace(void __user *user,
 	module_put(t->me);
 	up(&arpt_mutex);
  free_newinfo_counters_untrans:
-	ARPT_ENTRY_ITERATE(newinfo->entries, newinfo->size, cleanup_entry, NULL);
+	ARPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
  free_newinfo_counters:
 	vfree(counters);
  free_newinfo:
-	vfree(newinfo);
+	put_cpu();
+	free_table_info(newinfo);
 	return ret;
 }
 
@@ -1030,6 +1093,7 @@ static int do_add_counters(void __user *
 	struct arpt_counters_info tmp, *paddc;
 	struct arpt_table *t;
 	int ret = 0;
+	void *loc_cpu_entry;
 
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
@@ -1059,7 +1123,9 @@ static int do_add_counters(void __user *
 	}
 
 	i = 0;
-	ARPT_ENTRY_ITERATE(t->private->entries,
+	/* Choose the copy that is on our node */
+	loc_cpu_entry = t->private->entries[smp_processor_id()];
+	ARPT_ENTRY_ITERATE(loc_cpu_entry,
 			   t->private->size,
 			   add_counter_to_entry,
 			   paddc->counters,
@@ -1220,30 +1286,33 @@ int arpt_register_table(struct arpt_tabl
 	struct arpt_table_info *newinfo;
 	static struct arpt_table_info bootstrap
 		= { 0, 0, 0, { 0 }, { 0 }, { } };
+	void *loc_cpu_entry;
 
-	newinfo = vmalloc(sizeof(struct arpt_table_info)
-			  + SMP_ALIGN(repl->size) *
-			  		(highest_possible_processor_id()+1));
+	newinfo = alloc_table_info(repl->size);
 	if (!newinfo) {
 		ret = -ENOMEM;
 		return ret;
 	}
-	memcpy(newinfo->entries, repl->entries, repl->size);
+
+	/* choose the copy on our node/cpu */
+	loc_cpu_entry = newinfo->entries[get_cpu()];
+	memcpy(loc_cpu_entry, repl->entries, repl->size);
 
 	ret = translate_table(table->name, table->valid_hooks,
-			      newinfo, repl->size,
+			      newinfo, loc_cpu_entry, repl->size,
 			      repl->num_entries,
 			      repl->hook_entry,
 			      repl->underflow);
+	put_cpu();
 	duprintf("arpt_register_table: translate table gives %d\n", ret);
 	if (ret != 0) {
-		vfree(newinfo);
+		free_table_info(newinfo);
 		return ret;
 	}
 
 	ret = down_interruptible(&arpt_mutex);
 	if (ret != 0) {
-		vfree(newinfo);
+		free_table_info(newinfo);
 		return ret;
 	}
 
@@ -1272,20 +1341,24 @@ int arpt_register_table(struct arpt_tabl
 	return ret;
 
  free_unlock:
-	vfree(newinfo);
+	free_table_info(newinfo);
 	goto unlock;
 }
 
 void arpt_unregister_table(struct arpt_table *table)
 {
+	void *loc_cpu_entry;
+
 	down(&arpt_mutex);
 	LIST_DELETE(&arpt_tables, table);
 	up(&arpt_mutex);
 
 	/* Decrease module usage counts and free resources */
-	ARPT_ENTRY_ITERATE(table->private->entries, table->private->size,
+	loc_cpu_entry = table->private->entries[get_cpu()];
+	ARPT_ENTRY_ITERATE(loc_cpu_entry, table->private->size,
 			   cleanup_entry, NULL);
-	vfree(table->private);
+	put_cpu();
+	free_table_info(table->private);
 }
 
 /* The built-in targets: standard (NULL) and error. */
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -83,11 +83,6 @@ static DECLARE_MUTEX(ipt_mutex);
    context stops packets coming through and allows user context to read
    the counters or update the rules.
 
-   To be cache friendly on SMP, we arrange them like so:
-   [ n-entries ]
-   ... cache-align padding ...
-   [ n-entries ]
-
    Hence the start of any table is given by get_table() below.  */
 
 /* The table itself */
@@ -105,20 +100,15 @@ struct ipt_table_info
 	unsigned int underflow[NF_IP_NUMHOOKS];
 
 	/* ipt_entry tables: one per CPU */
-	char entries[0] ____cacheline_aligned;
+	void *entries[NR_CPUS];
 };
 
 static LIST_HEAD(ipt_target);
 static LIST_HEAD(ipt_match);
 static LIST_HEAD(ipt_tables);
+#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
 #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
 
-#ifdef CONFIG_SMP
-#define TABLE_OFFSET(t,p) (SMP_ALIGN((t)->size)*(p))
-#else
-#define TABLE_OFFSET(t,p) 0
-#endif
-
 #if 0
 #define down(x) do { printk("DOWN:%u:" #x "\n", __LINE__); down(x); } while(0)
 #define down_interruptible(x) ({ int __r; printk("DOWNi:%u:" #x "\n", __LINE__); __r = down_interruptible(x); if (__r != 0) printk("ABORT-DOWNi:%u\n", __LINE__); __r; })
@@ -290,8 +280,7 @@ ipt_do_table(struct sk_buff **pskb,
 
 	read_lock_bh(&table->lock);
 	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
-	table_base = (void *)table->private->entries
-		+ TABLE_OFFSET(table->private, smp_processor_id());
+	table_base = (void *)table->private->entries[smp_processor_id()];
 	e = get_entry(table_base, table->private->hook_entry[hook]);
 
 #ifdef CONFIG_NETFILTER_DEBUG
@@ -563,7 +552,8 @@ unconditional(const struct ipt_ip *ip)
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
-mark_source_chains(struct ipt_table_info *newinfo, unsigned int valid_hooks)
+mark_source_chains(struct ipt_table_info *newinfo,
+		   unsigned int valid_hooks, void *entry0)
 {
 	unsigned int hook;
 
@@ -572,7 +562,7 @@ mark_source_chains(struct ipt_table_info
 	for (hook = 0; hook < NF_IP_NUMHOOKS; hook++) {
 		unsigned int pos = newinfo->hook_entry[hook];
 		struct ipt_entry *e
-			= (struct ipt_entry *)(newinfo->entries + pos);
+			= (struct ipt_entry *)(entry0 + pos);
 
 		if (!(valid_hooks & (1 << hook)))
 			continue;
@@ -622,13 +612,13 @@ mark_source_chains(struct ipt_table_info
 						goto next;
 
 					e = (struct ipt_entry *)
-						(newinfo->entries + pos);
+						(entry0 + pos);
 				} while (oldpos == pos + e->next_offset);
 
 				/* Move along one */
 				size = e->next_offset;
 				e = (struct ipt_entry *)
-					(newinfo->entries + pos + size);
+					(entry0 + pos + size);
 				e->counters.pcnt = pos;
 				pos += size;
 			} else {
@@ -645,7 +635,7 @@ mark_source_chains(struct ipt_table_info
 					newpos = pos + e->next_offset;
 				}
 				e = (struct ipt_entry *)
-					(newinfo->entries + newpos);
+					(entry0 + newpos);
 				e->counters.pcnt = pos;
 				pos = newpos;
 			}
@@ -855,6 +845,7 @@ static int
 translate_table(const char *name,
 		unsigned int valid_hooks,
 		struct ipt_table_info *newinfo,
+		void *entry0,
 		unsigned int size,
 		unsigned int number,
 		const unsigned int *hook_entries,
@@ -875,11 +866,11 @@ translate_table(const char *name,
 	duprintf("translate_table: size %u\n", newinfo->size);
 	i = 0;
 	/* Walk through entries, checking offsets. */
-	ret = IPT_ENTRY_ITERATE(newinfo->entries, newinfo->size,
+	ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
 				check_entry_size_and_hooks,
 				newinfo,
-				newinfo->entries,
-				newinfo->entries + size,
+				entry0,
+				entry0 + size,
 				hook_entries, underflows, &i);
 	if (ret != 0)
 		return ret;
@@ -907,27 +898,24 @@ translate_table(const char *name,
 		}
 	}
 
-	if (!mark_source_chains(newinfo, valid_hooks))
+	if (!mark_source_chains(newinfo, valid_hooks, entry0))
 		return -ELOOP;
 
 	/* Finally, each sanity check must pass */
 	i = 0;
-	ret = IPT_ENTRY_ITERATE(newinfo->entries, newinfo->size,
+	ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
 				check_entry, name, size, &i);
 
 	if (ret != 0) {
-		IPT_ENTRY_ITERATE(newinfo->entries, newinfo->size,
+		IPT_ENTRY_ITERATE(entry0, newinfo->size,
 				  cleanup_entry, &i);
 		return ret;
 	}
 
 	/* And one copy for every other CPU */
 	for_each_cpu(i) {
-		if (i == 0)
-			continue;
-		memcpy(newinfo->entries + SMP_ALIGN(newinfo->size) * i,
-		       newinfo->entries,
-		       SMP_ALIGN(newinfo->size));
+		if (newinfo->entries[i] && newinfo->entries[i] != entry0)
+			memcpy(newinfo->entries[i], entry0, newinfo->size);
 	}
 
 	return ret;
@@ -943,15 +931,12 @@ replace_table(struct ipt_table *table,
 
 #ifdef CONFIG_NETFILTER_DEBUG
 	{
-		struct ipt_entry *table_base;
-		unsigned int i;
+		int cpu;
 
-		for_each_cpu(i) {
-			table_base =
-				(void *)newinfo->entries
-				+ TABLE_OFFSET(newinfo, i);
-
-			table_base->comefrom = 0xdead57ac;
+		for_each_cpu(cpu) {
+			struct ipt_entry *table_base = newinfo->entries[cpu];
+			if (table_base)
+				table_base->comefrom = 0xdead57ac;
 		}
 	}
 #endif
@@ -986,21 +971,47 @@ add_entry_to_counter(const struct ipt_en
 	return 0;
 }
 
+static inline int
+set_entry_to_counter(const struct ipt_entry *e,
+		     struct ipt_counters total[],
+		     unsigned int *i)
+{
+	SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
+
+	(*i)++;
+	return 0;
+}
+
 static void
 get_counters(const struct ipt_table_info *t,
 	     struct ipt_counters counters[])
 {
 	unsigned int cpu;
 	unsigned int i;
+	unsigned int curcpu = get_cpu();
+
+	/* Instead of clearing (by a previous call to memset())
+	 * the counters and using adds, we set the counters
+	 * with data used by current CPU */
+
+	i = 0;
+	IPT_ENTRY_ITERATE(t->entries[curcpu],
+			  t->size,
+			  set_entry_to_counter,
+			  counters,
+			  &i);
 
 	for_each_cpu(cpu) {
+		if (cpu == curcpu)
+			continue;
 		i = 0;
-		IPT_ENTRY_ITERATE(t->entries + TABLE_OFFSET(t, cpu),
+		IPT_ENTRY_ITERATE(t->entries[cpu],
 				  t->size,
 				  add_entry_to_counter,
 				  counters,
 				  &i);
 	}
+	put_cpu();
 }
 
 static int
@@ -1012,6 +1023,7 @@ copy_entries_to_user(unsigned int total_
 	struct ipt_entry *e;
 	struct ipt_counters *counters;
 	int ret = 0;
+	void *loc_cpu_entry;
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
@@ -1023,13 +1035,14 @@ copy_entries_to_user(unsigned int total_
 		return -ENOMEM;
 
 	/* First, sum counters... */
-	memset(counters, 0, countersize);
 	write_lock_bh(&table->lock);
 	get_counters(table->private, counters);
 	write_unlock_bh(&table->lock);
 
-	/* ... then copy entire thing from CPU 0... */
-	if (copy_to_user(userptr, table->private->entries, total_size) != 0) {
+	/* choose the copy that is on our node/cpu, ... */
+	loc_cpu_entry = table->private->entries[get_cpu()];
+	/* ... then copy entire thing ... */
+	if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 		ret = -EFAULT;
 		goto free_counters;
 	}
@@ -1041,7 +1054,7 @@ copy_entries_to_user(unsigned int total_
 		struct ipt_entry_match *m;
 		struct ipt_entry_target *t;
 
-		e = (struct ipt_entry *)(table->private->entries + off);
+		e = (struct ipt_entry *)(loc_cpu_entry + off);
 		if (copy_to_user(userptr + off
 				 + offsetof(struct ipt_entry, counters),
 				 &counters[num],
@@ -1078,6 +1091,7 @@ copy_entries_to_user(unsigned int total_
 	}
 
  free_counters:
+	put_cpu();
 	vfree(counters);
 	return ret;
 }
@@ -1110,6 +1124,45 @@ get_entries(const struct ipt_get_entries
 	return ret;
 }
 
+static void free_table_info(struct ipt_table_info *info)
+{
+	int cpu;
+	for_each_cpu(cpu) {
+		if (info->size <= PAGE_SIZE)
+			kfree(info->entries[cpu]);
+		else
+			vfree(info->entries[cpu]);
+	}
+	kfree(info);
+}
+
+static struct ipt_table_info *alloc_table_info(unsigned int size)
+{
+	struct ipt_table_info *newinfo;
+	int cpu;
+
+	newinfo = kzalloc(sizeof(struct ipt_table_info), GFP_KERNEL);
+	if (!newinfo)
+		return NULL;
+
+	newinfo->size = size;
+
+	for_each_cpu(cpu) {
+		if (size <= PAGE_SIZE)
+			newinfo->entries[cpu] = kmalloc_node(size,
+				GFP_KERNEL,
+				cpu_to_node(cpu));
+		else
+			newinfo->entries[cpu] = vmalloc_node(size, cpu_to_node(cpu));
+		if (newinfo->entries[cpu] == 0) {
+			free_table_info(newinfo);
+			return NULL;
+		}
+	}
+
+	return newinfo;
+}
+
 static int
 do_replace(void __user *user, unsigned int len)
 {
@@ -1118,6 +1171,7 @@ do_replace(void __user *user, unsigned i
 	struct ipt_table *t;
 	struct ipt_table_info *newinfo, *oldinfo;
 	struct ipt_counters *counters;
+	void *loc_cpu_entry, *loc_cpu_old_entry;
 
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
@@ -1130,13 +1184,13 @@ do_replace(void __user *user, unsigned i
 	if ((SMP_ALIGN(tmp.size) >> PAGE_SHIFT) + 2 > num_physpages)
 		return -ENOMEM;
 
-	newinfo = vmalloc(sizeof(struct ipt_table_info)
-			  + SMP_ALIGN(tmp.size) * 
-			  	(highest_possible_processor_id()+1));
+	newinfo = alloc_table_info(tmp.size);
 	if (!newinfo)
 		return -ENOMEM;
 
-	if (copy_from_user(newinfo->entries, user + sizeof(tmp),
+	/* choose the copy that is our node/cpu */
+	loc_cpu_entry = newinfo->entries[get_cpu()];
+	if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
 			   tmp.size) != 0) {
 		ret = -EFAULT;
 		goto free_newinfo;
@@ -1147,10 +1201,9 @@ do_replace(void __user *user, unsigned i
 		ret = -ENOMEM;
 		goto free_newinfo;
 	}
-	memset(counters, 0, tmp.num_counters * sizeof(struct ipt_counters));
 
 	ret = translate_table(tmp.name, tmp.valid_hooks,
-			      newinfo, tmp.size, tmp.num_entries,
+			      newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
 			      tmp.hook_entry, tmp.underflow);
 	if (ret != 0)
 		goto free_newinfo_counters;
@@ -1189,8 +1242,10 @@ do_replace(void __user *user, unsigned i
 	/* Get the old counters. */
 	get_counters(oldinfo, counters);
 	/* Decrease module usage counts and free resource */
-	IPT_ENTRY_ITERATE(oldinfo->entries, oldinfo->size, cleanup_entry,NULL);
-	vfree(oldinfo);
+	loc_cpu_old_entry = oldinfo->entries[smp_processor_id()];
+	IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
+	put_cpu();
+	free_table_info(oldinfo);
 	if (copy_to_user(tmp.counters, counters,
 			 sizeof(struct ipt_counters) * tmp.num_counters) != 0)
 		ret = -EFAULT;
@@ -1202,11 +1257,12 @@ do_replace(void __user *user, unsigned i
 	module_put(t->me);
 	up(&ipt_mutex);
  free_newinfo_counters_untrans:
-	IPT_ENTRY_ITERATE(newinfo->entries, newinfo->size, cleanup_entry,NULL);
+	IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
  free_newinfo_counters:
 	vfree(counters);
  free_newinfo:
-	vfree(newinfo);
+	put_cpu();
+	free_table_info(newinfo);
 	return ret;
 }
 
@@ -1239,6 +1295,7 @@ do_add_counters(void __user *user, unsig
 	struct ipt_counters_info tmp, *paddc;
 	struct ipt_table *t;
 	int ret = 0;
+	void *loc_cpu_entry;
 
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
@@ -1268,7 +1325,9 @@ do_add_counters(void __user *user, unsig
 	}
 
 	i = 0;
-	IPT_ENTRY_ITERATE(t->private->entries,
+	/* Choose the copy that is on our node */
+	loc_cpu_entry = t->private->entries[smp_processor_id()];
+	IPT_ENTRY_ITERATE(loc_cpu_entry,
 			  t->private->size,
 			  add_counter_to_entry,
 			  paddc->counters,
@@ -1460,28 +1519,30 @@ int ipt_register_table(struct ipt_table 
 	struct ipt_table_info *newinfo;
 	static struct ipt_table_info bootstrap
 		= { 0, 0, 0, { 0 }, { 0 }, { } };
+	void *loc_cpu_entry;
 
-	newinfo = vmalloc(sizeof(struct ipt_table_info)
-			  + SMP_ALIGN(repl->size) * 
-			  		(highest_possible_processor_id()+1));
+	newinfo = alloc_table_info(repl->size);
 	if (!newinfo)
 		return -ENOMEM;
 
-	memcpy(newinfo->entries, repl->entries, repl->size);
+	/* choose the copy on our node/cpu */
+	loc_cpu_entry = newinfo->entries[get_cpu()];
+	memcpy(loc_cpu_entry, repl->entries, repl->size);
 
 	ret = translate_table(table->name, table->valid_hooks,
-			      newinfo, repl->size,
+			      newinfo, loc_cpu_entry, repl->size,
 			      repl->num_entries,
 			      repl->hook_entry,
 			      repl->underflow);
+	put_cpu();
 	if (ret != 0) {
-		vfree(newinfo);
+		free_table_info(newinfo);
 		return ret;
 	}
 
 	ret = down_interruptible(&ipt_mutex);
 	if (ret != 0) {
-		vfree(newinfo);
+		free_table_info(newinfo);
 		return ret;
 	}
 
@@ -1510,20 +1571,24 @@ int ipt_register_table(struct ipt_table 
 	return ret;
 
  free_unlock:
-	vfree(newinfo);
+	free_table_info(newinfo);
 	goto unlock;
 }
 
 void ipt_unregister_table(struct ipt_table *table)
 {
+	void *loc_cpu_entry;
+
 	down(&ipt_mutex);
 	LIST_DELETE(&ipt_tables, table);
 	up(&ipt_mutex);
 
 	/* Decrease module usage counts and free resources */
-	IPT_ENTRY_ITERATE(table->private->entries, table->private->size,
+	loc_cpu_entry = table->private->entries[get_cpu()];
+	IPT_ENTRY_ITERATE(loc_cpu_entry, table->private->size,
 			  cleanup_entry, NULL);
-	vfree(table->private);
+	put_cpu();
+	free_table_info(table->private);
 }
 
 /* Returns 1 if the port is matched by the range, 0 otherwise */
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -86,11 +86,6 @@ static DECLARE_MUTEX(ip6t_mutex);
    context stops packets coming through and allows user context to read
    the counters or update the rules.
 
-   To be cache friendly on SMP, we arrange them like so:
-   [ n-entries ]
-   ... cache-align padding ...
-   [ n-entries ]
-
    Hence the start of any table is given by get_table() below.  */
 
 /* The table itself */
@@ -108,20 +103,15 @@ struct ip6t_table_info
 	unsigned int underflow[NF_IP6_NUMHOOKS];
 
 	/* ip6t_entry tables: one per CPU */
-	char entries[0] ____cacheline_aligned;
+	void *entries[NR_CPUS];
 };
 
 static LIST_HEAD(ip6t_target);
 static LIST_HEAD(ip6t_match);
 static LIST_HEAD(ip6t_tables);
+#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
 #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
 
-#ifdef CONFIG_SMP
-#define TABLE_OFFSET(t,p) (SMP_ALIGN((t)->size)*(p))
-#else
-#define TABLE_OFFSET(t,p) 0
-#endif
-
 #if 0
 #define down(x) do { printk("DOWN:%u:" #x "\n", __LINE__); down(x); } while(0)
 #define down_interruptible(x) ({ int __r; printk("DOWNi:%u:" #x "\n", __LINE__); __r = down_interruptible(x); if (__r != 0) printk("ABORT-DOWNi:%u\n", __LINE__); __r; })
@@ -376,8 +366,7 @@ ip6t_do_table(struct sk_buff **pskb,
 
 	read_lock_bh(&table->lock);
 	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
-	table_base = (void *)table->private->entries
-		+ TABLE_OFFSET(table->private, smp_processor_id());
+	table_base = (void *)table->private->entries[smp_processor_id()];
 	e = get_entry(table_base, table->private->hook_entry[hook]);
 
 #ifdef CONFIG_NETFILTER_DEBUG
@@ -649,7 +638,8 @@ unconditional(const struct ip6t_ip6 *ipv
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
-mark_source_chains(struct ip6t_table_info *newinfo, unsigned int valid_hooks)
+mark_source_chains(struct ip6t_table_info *newinfo,
+		   unsigned int valid_hooks, void *entry0)
 {
 	unsigned int hook;
 
@@ -658,7 +648,7 @@ mark_source_chains(struct ip6t_table_inf
 	for (hook = 0; hook < NF_IP6_NUMHOOKS; hook++) {
 		unsigned int pos = newinfo->hook_entry[hook];
 		struct ip6t_entry *e
-			= (struct ip6t_entry *)(newinfo->entries + pos);
+			= (struct ip6t_entry *)(entry0 + pos);
 
 		if (!(valid_hooks & (1 << hook)))
 			continue;
@@ -708,13 +698,13 @@ mark_source_chains(struct ip6t_table_inf
 						goto next;
 
 					e = (struct ip6t_entry *)
-						(newinfo->entries + pos);
+						(entry0 + pos);
 				} while (oldpos == pos + e->next_offset);
 
 				/* Move along one */
 				size = e->next_offset;
 				e = (struct ip6t_entry *)
-					(newinfo->entries + pos + size);
+					(entry0 + pos + size);
 				e->counters.pcnt = pos;
 				pos += size;
 			} else {
@@ -731,7 +721,7 @@ mark_source_chains(struct ip6t_table_inf
 					newpos = pos + e->next_offset;
 				}
 				e = (struct ip6t_entry *)
-					(newinfo->entries + newpos);
+					(entry0 + newpos);
 				e->counters.pcnt = pos;
 				pos = newpos;
 			}
@@ -941,6 +931,7 @@ static int
 translate_table(const char *name,
 		unsigned int valid_hooks,
 		struct ip6t_table_info *newinfo,
+		void *entry0,
 		unsigned int size,
 		unsigned int number,
 		const unsigned int *hook_entries,
@@ -964,8 +955,8 @@ translate_table(const char *name,
 	ret = IP6T_ENTRY_ITERATE(newinfo->entries, newinfo->size,
 				check_entry_size_and_hooks,
 				newinfo,
-				newinfo->entries,
-				newinfo->entries + size,
+				entry0,
+				entry0 + size,
 				hook_entries, underflows, &i);
 	if (ret != 0)
 		return ret;
@@ -993,27 +984,24 @@ translate_table(const char *name,
 		}
 	}
 
-	if (!mark_source_chains(newinfo, valid_hooks))
+	if (!mark_source_chains(newinfo, valid_hooks, entry0))
 		return -ELOOP;
 
 	/* Finally, each sanity check must pass */
 	i = 0;
-	ret = IP6T_ENTRY_ITERATE(newinfo->entries, newinfo->size,
+	ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 				check_entry, name, size, &i);
 
 	if (ret != 0) {
-		IP6T_ENTRY_ITERATE(newinfo->entries, newinfo->size,
+		IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 				  cleanup_entry, &i);
 		return ret;
 	}
 
 	/* And one copy for every other CPU */
 	for_each_cpu(i) {
-		if (i == 0)
-			continue;
-		memcpy(newinfo->entries + SMP_ALIGN(newinfo->size) * i,
-		       newinfo->entries,
-		       SMP_ALIGN(newinfo->size));
+		if (newinfo->entries[i] && newinfo->entries[i] != entry0)
+			memcpy(newinfo->entries[i], entry0, newinfo->size);
 	}
 
 	return ret;
@@ -1029,15 +1017,12 @@ replace_table(struct ip6t_table *table,
 
 #ifdef CONFIG_NETFILTER_DEBUG
 	{
-		struct ip6t_entry *table_base;
-		unsigned int i;
-
-		for_each_cpu(i) {
-			table_base =
-				(void *)newinfo->entries
-				+ TABLE_OFFSET(newinfo, i);
+		int cpu;
 
-			table_base->comefrom = 0xdead57ac;
+		for_each_cpu(cpu) {
+			struct ip6t_entry *table_base = newinfo->entries[cpu];
+			if (table_base)
+				table_base->comefrom = 0xdead57ac;
 		}
 	}
 #endif
@@ -1072,21 +1057,47 @@ add_entry_to_counter(const struct ip6t_e
 	return 0;
 }
 
+static inline int
+set_entry_to_counter(const struct ip6t_entry *e,
+		     struct ip6t_counters total[],
+		     unsigned int *i)
+{
+	SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
+
+	(*i)++;
+	return 0;
+}
+
 static void
 get_counters(const struct ip6t_table_info *t,
 	     struct ip6t_counters counters[])
 {
 	unsigned int cpu;
 	unsigned int i;
+	unsigned int curcpu = get_cpu();
+
+	/* Instead of clearing (by a previous call to memset())
+	 * the counters and using adds, we set the counters
+	 * with data used by current CPU */
+
+	i = 0;
+	IP6T_ENTRY_ITERATE(t->entries[curcpu],
+			   t->size,
+			   set_entry_to_counter,
+			   counters,
+			   &i);
 
 	for_each_cpu(cpu) {
+		if (cpu == curcpu)
+			continue;
 		i = 0;
-		IP6T_ENTRY_ITERATE(t->entries + TABLE_OFFSET(t, cpu),
+		IP6T_ENTRY_ITERATE(t->entries[cpu],
 				  t->size,
 				  add_entry_to_counter,
 				  counters,
 				  &i);
 	}
+	put_cpu();
 }
 
 static int
@@ -1098,6 +1109,7 @@ copy_entries_to_user(unsigned int total_
 	struct ip6t_entry *e;
 	struct ip6t_counters *counters;
 	int ret = 0;
+	void *loc_cpu_entry;
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
@@ -1109,13 +1121,13 @@ copy_entries_to_user(unsigned int total_
 		return -ENOMEM;
 
 	/* First, sum counters... */
-	memset(counters, 0, countersize);
 	write_lock_bh(&table->lock);
 	get_counters(table->private, counters);
 	write_unlock_bh(&table->lock);
 
-	/* ... then copy entire thing from CPU 0... */
-	if (copy_to_user(userptr, table->private->entries, total_size) != 0) {
+	/* choose the copy that is on ourc node/cpu */
+	loc_cpu_entry = table->private->entries[get_cpu()];
+	if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 		ret = -EFAULT;
 		goto free_counters;
 	}
@@ -1127,7 +1139,7 @@ copy_entries_to_user(unsigned int total_
 		struct ip6t_entry_match *m;
 		struct ip6t_entry_target *t;
 
-		e = (struct ip6t_entry *)(table->private->entries + off);
+		e = (struct ip6t_entry *)(loc_cpu_entry + off);
 		if (copy_to_user(userptr + off
 				 + offsetof(struct ip6t_entry, counters),
 				 &counters[num],
@@ -1164,6 +1176,7 @@ copy_entries_to_user(unsigned int total_
 	}
 
  free_counters:
+	put_cpu();
 	vfree(counters);
 	return ret;
 }
@@ -1196,6 +1209,46 @@ get_entries(const struct ip6t_get_entrie
 	return ret;
 }
 
+static void free_table_info(struct ip6t_table_info *info)
+{
+	int cpu;
+	for_each_cpu(cpu) {
+		if (info->size <= PAGE_SIZE)
+			kfree(info->entries[cpu]);
+		else
+			vfree(info->entries[cpu]);
+	}
+	kfree(info);
+}
+
+static struct ip6t_table_info *alloc_table_info(unsigned int size)
+{
+	struct ip6t_table_info *newinfo;
+	int cpu;
+
+	newinfo = kzalloc(sizeof(struct ip6t_table_info), GFP_KERNEL);
+	if (!newinfo)
+		return NULL;
+
+	newinfo->size = size;
+
+	for_each_cpu(cpu) {
+		if (size <= PAGE_SIZE)
+			newinfo->entries[cpu] = kmalloc_node(size,
+							GFP_KERNEL,
+							cpu_to_node(cpu));
+		else
+			newinfo->entries[cpu] = vmalloc_node(size,
+							     cpu_to_node(cpu));
+		if (newinfo->entries[cpu] == NULL) {
+			free_table_info(newinfo);
+			return NULL;
+		}
+	}
+
+	return newinfo;
+}
+
 static int
 do_replace(void __user *user, unsigned int len)
 {
@@ -1204,6 +1257,7 @@ do_replace(void __user *user, unsigned i
 	struct ip6t_table *t;
 	struct ip6t_table_info *newinfo, *oldinfo;
 	struct ip6t_counters *counters;
+	void *loc_cpu_entry, *loc_cpu_old_entry;
 
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
@@ -1212,13 +1266,13 @@ do_replace(void __user *user, unsigned i
 	if ((SMP_ALIGN(tmp.size) >> PAGE_SHIFT) + 2 > num_physpages)
 		return -ENOMEM;
 
-	newinfo = vmalloc(sizeof(struct ip6t_table_info)
-			  + SMP_ALIGN(tmp.size) *
-			  		(highest_possible_processor_id()+1));
+	newinfo = alloc_table_info(tmp.size);
 	if (!newinfo)
 		return -ENOMEM;
 
-	if (copy_from_user(newinfo->entries, user + sizeof(tmp),
+	/* choose the copy that is on our node/cpu */
+	loc_cpu_entry = newinfo->entries[get_cpu()];
+	if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
 			   tmp.size) != 0) {
 		ret = -EFAULT;
 		goto free_newinfo;
@@ -1229,10 +1283,9 @@ do_replace(void __user *user, unsigned i
 		ret = -ENOMEM;
 		goto free_newinfo;
 	}
-	memset(counters, 0, tmp.num_counters * sizeof(struct ip6t_counters));
 
 	ret = translate_table(tmp.name, tmp.valid_hooks,
-			      newinfo, tmp.size, tmp.num_entries,
+			      newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
 			      tmp.hook_entry, tmp.underflow);
 	if (ret != 0)
 		goto free_newinfo_counters;
@@ -1271,8 +1324,10 @@ do_replace(void __user *user, unsigned i
 	/* Get the old counters. */
 	get_counters(oldinfo, counters);
 	/* Decrease module usage counts and free resource */
-	IP6T_ENTRY_ITERATE(oldinfo->entries, oldinfo->size, cleanup_entry,NULL);
-	vfree(oldinfo);
+	loc_cpu_old_entry = oldinfo->entries[smp_processor_id()];
+	IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
+	put_cpu();
+	free_table_info(oldinfo);
 	if (copy_to_user(tmp.counters, counters,
 			 sizeof(struct ip6t_counters) * tmp.num_counters) != 0)
 		ret = -EFAULT;
@@ -1284,11 +1339,12 @@ do_replace(void __user *user, unsigned i
 	module_put(t->me);
 	up(&ip6t_mutex);
  free_newinfo_counters_untrans:
-	IP6T_ENTRY_ITERATE(newinfo->entries, newinfo->size, cleanup_entry,NULL);
+	IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
  free_newinfo_counters:
 	vfree(counters);
  free_newinfo:
-	vfree(newinfo);
+	put_cpu();
+	free_table_info(newinfo);
 	return ret;
 }
 
@@ -1321,6 +1377,7 @@ do_add_counters(void __user *user, unsig
 	struct ip6t_counters_info tmp, *paddc;
 	struct ip6t_table *t;
 	int ret = 0;
+	void *loc_cpu_entry;
 
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
@@ -1350,7 +1407,9 @@ do_add_counters(void __user *user, unsig
 	}
 
 	i = 0;
-	IP6T_ENTRY_ITERATE(t->private->entries,
+	/* Choose the copy that is on our node */
+	loc_cpu_entry = t->private->entries[smp_processor_id()];
+	IP6T_ENTRY_ITERATE(loc_cpu_entry,
 			  t->private->size,
 			  add_counter_to_entry,
 			  paddc->counters,
@@ -1543,28 +1602,30 @@ int ip6t_register_table(struct ip6t_tabl
 	struct ip6t_table_info *newinfo;
 	static struct ip6t_table_info bootstrap
 		= { 0, 0, 0, { 0 }, { 0 }, { } };
+	void *loc_cpu_entry;
 
-	newinfo = vmalloc(sizeof(struct ip6t_table_info)
-			  + SMP_ALIGN(repl->size) *
-			  		(highest_possible_processor_id()+1));
+	newinfo = alloc_table_info(repl->size);
 	if (!newinfo)
 		return -ENOMEM;
 
-	memcpy(newinfo->entries, repl->entries, repl->size);
+	/* choose the copy on our node/cpu */
+	loc_cpu_entry = newinfo->entries[get_cpu()];
+	memcpy(loc_cpu_entry, repl->entries, repl->size);
 
 	ret = translate_table(table->name, table->valid_hooks,
-			      newinfo, repl->size,
+			      newinfo, loc_cpu_entry, repl->size,
 			      repl->num_entries,
 			      repl->hook_entry,
 			      repl->underflow);
+	put_cpu();
 	if (ret != 0) {
-		vfree(newinfo);
+		free_table_info(newinfo);
 		return ret;
 	}
 
 	ret = down_interruptible(&ip6t_mutex);
 	if (ret != 0) {
-		vfree(newinfo);
+		free_table_info(newinfo);
 		return ret;
 	}
 
@@ -1593,20 +1654,24 @@ int ip6t_register_table(struct ip6t_tabl
 	return ret;
 
  free_unlock:
-	vfree(newinfo);
+	free_table_info(newinfo);
 	goto unlock;
 }
 
 void ip6t_unregister_table(struct ip6t_table *table)
 {
+	void *loc_cpu_entry;
+
 	down(&ip6t_mutex);
 	LIST_DELETE(&ip6t_tables, table);
 	up(&ip6t_mutex);
 
 	/* Decrease module usage counts and free resources */
-	IP6T_ENTRY_ITERATE(table->private->entries, table->private->size,
+	loc_cpu_entry = table->private->entries[get_cpu()];
+	IP6T_ENTRY_ITERATE(loc_cpu_entry, table->private->size,
 			  cleanup_entry, NULL);
-	vfree(table->private);
+	put_cpu();
+	free_table_info(table->private);
 }
 
 /* Returns 1 if the port is matched by the range, 0 otherwise */

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

^ permalink raw reply

* Re: [PATCH] [RFT] ip_tables NUMA optimization
From: Eric Dumazet @ 2005-11-17 15:21 UTC (permalink / raw)
  To: Harald Welte; +Cc: Linux Netdev List, Netfilter Development Mailinglist
In-Reply-To: <20051117144328.GG14201@sunbeam.de.gnumonks.org>

Harald Welte a écrit :
> I've hand-merged Eric Dumazet's original ip_tables numa optimization
> patch to current git head.  Also, I've ported it to ip6_tables and
> arp_tables.
> 
> Since this is 2.6.16 stuff, I don't want to have it applied at this
> time, but merely request testers (esp. for the non-ipv4 part).
> 
> Thanks,
> 

Hi Harald

Thank you for doing this, since I'm currently too busy with my day job to 
update the patch myself.

However I did read your patch and caught one vfree() call wrongly replaced by 
a kfree() call in arp_tables.c


>
> @@ -911,6 +930,47 @@ static int get_entries(const struct arpt
>  	return ret;
>  }
>  
> +static void free_table_info(struct arpt_table_info *info)
> +{
> +	int cpu;
> +	for_each_cpu(cpu) {
> +		if (info->size <= PAGE_SIZE)
> +			kfree(info->entries[cpu]);
> +		else
> +			kfree(info->entries[cpu]);   !!!!
> +	}
> +	kfree(info);


It should probably use vfree() like :

 > +	for_each_cpu(cpu) {
 > +		if (info->size <= PAGE_SIZE)
 > +			kfree(info->entries[cpu]);
 > +		else
 > +			vfree(info->entries[cpu]);
 > +	}


See you

Eric Dumazet

^ permalink raw reply

* Re: 2.6.15-rc1: NET_CLS_U32 not working?
From: Christian @ 2005-11-17 15:57 UTC (permalink / raw)
  To: linux-kernel; +Cc: netdev
In-Reply-To: <437BC98E.9020002@g-house.de>

Christian schrieb:
> Adrian Bunk schrieb:
>>
>> I'm assuming you are trying to insert the new module in your old kernel?

yes, rebuilding the whole kernel (after just enabling NET_CLS_U32 as a 
module) makes the warnings go away.

>> This is one of the unfortunate but hardly avoidable cases where adding 
>> a module requires installing a new kernel.

i wonder why/if this is really needed. although not critical, this 
behaviour is pretty annoying....

thanks,
Christian.
-- 
BOFH excuse #24:

network packets travelling uphill (use a carrier pigeon)

^ permalink raw reply

* [DEBUG INFO]IPv6: sleeping function called from invalid context.
From: Yan Zheng @ 2005-11-18  0:44 UTC (permalink / raw)
  To: netdev; +Cc: linux-kernel, yoshfuji

I get follow message when switch to single user mode and the kernel version is 2.6.15-rc1-git5.

Regards

Nov 18 08:26:23 localhost kernel: Debug: sleeping function called from invalid context at mm/slab.c:2472
Nov 18 08:26:23 localhost kernel: in_atomic():1, irqs_disabled():0
Nov 18 08:26:23 localhost kernel:  [<c0149d5a>] kmem_cache_alloc+0x5a/0x70
Nov 18 08:26:23 localhost kernel:  [<e0f47336>] inet6_dump_fib+0xb6/0x110 [ipv6]
Nov 18 08:26:23 localhost kernel:  [<c02e129c>] netlink_dump+0x4c/0x1e0
Nov 18 08:26:23 localhost kernel:  [<c02e150a>] netlink_dump_start+0xda/0x170
Nov 18 08:26:23 localhost kernel:  [<c02d2d05>] rtnetlink_rcv_msg+0x1d5/0x250
Nov 18 08:26:23 localhost kernel:  [<e0f47280>] inet6_dump_fib+0x0/0x110 [ipv6]
Nov 18 08:26:23 localhost kernel:  [<c02d2b30>] rtnetlink_rcv_msg+0x0/0x250
Nov 18 08:26:23 localhost kernel:  [<c02e17ed>] netlink_rcv_skb+0x4d/0x90
Nov 18 08:26:23 localhost kernel:  [<c02d2b30>] rtnetlink_rcv_msg+0x0/0x250
Nov 18 08:26:23 localhost kernel:  [<c02e1860>] netlink_run_queue+0x30/0xc0
Nov 18 08:26:23 localhost kernel:  [<c02d2b03>] rtnetlink_rcv+0x23/0x50
Nov 18 08:26:23 localhost kernel:  [<c02e1092>] netlink_data_ready+0x12/0x60
Nov 18 08:26:23 localhost kernel:  [<c0335414>] _spin_unlock_irqrestore+0x14/0x30
Nov 18 08:26:23 localhost kernel:  [<c02e0284>] netlink_sendskb+0x24/0x50
Nov 18 08:26:23 localhost kernel:  [<c02e0d3c>] netlink_sendmsg+0x29c/0x350
Nov 18 08:26:23 localhost kernel:  [<c02be551>] sock_sendmsg+0x111/0x150
Nov 18 08:26:23 localhost kernel:  [<c01c56f0>] avc_lookup+0xc0/0x120
Nov 18 08:26:23 localhost kernel:  [<c0131f10>] autoremove_wake_function+0x0/0x50
Nov 18 08:26:23 localhost kernel:  [<c02bdfff>] move_addr_to_user+0x5f/0x70
Nov 18 08:26:23 localhost kernel:  [<c02c0628>] sys_recvmsg+0x1b8/0x230
Nov 18 08:26:23 localhost kernel:  [<c013ef94>] audit_sockaddr+0x54/0xc0
Nov 18 08:26:23 localhost kernel:  [<c02bfded>] sys_sendto+0x10d/0x150
Nov 18 08:26:23 localhost kernel:  [<c0141b6d>] filemap_nopage+0x30d/0x3e0
Nov 18 08:26:23 localhost kernel:  [<c0145424>] __alloc_pages+0x64/0x310
Nov 18 08:26:23 localhost kernel:  [<c013db8e>] audit_filter_syscall+0x4e/0x130
Nov 18 08:26:23 localhost kernel:  [<c013db8e>] audit_filter_syscall+0x4e/0x130
Nov 18 08:26:23 localhost kernel:  [<c02c0865>] sys_socketcall+0x1c5/0x2a0
Nov 18 08:26:23 localhost kernel:  [<c0103261>] syscall_call+0x7/0xb
Nov 18 08:26:23 localhost kernel: Removing netfilter NETLINK layer.

^ permalink raw reply

* Re: [DEBUG INFO]IPv6: sleeping function called from invalid context.
From: YOSHIFUJI Hideaki / 吉藤英明 @ 2005-11-18  0:47 UTC (permalink / raw)
  To: yanzheng; +Cc: netdev, linux-kernel, yoshfuji
In-Reply-To: <437D23EB.4020204@21cn.com>

In article <437D23EB.4020204@21cn.com> (at Fri, 18 Nov 2005 08:44:27 +0800), Yan Zheng <yanzheng@21cn.com> says:

> I get follow message when switch to single user mode and the kernel version is 2.6.15-rc1-git5.
:
> Nov 18 08:26:23 localhost kernel: Debug: sleeping function called from invalid context at mm/slab.c:2472
> Nov 18 08:26:23 localhost kernel: in_atomic():1, irqs_disabled():0
> Nov 18 08:26:23 localhost kernel:  [<c0149d5a>] kmem_cache_alloc+0x5a/0x70
> Nov 18 08:26:23 localhost kernel:  [<e0f47336>] inet6_dump_fib+0xb6/0x110 [ipv6]

I remember someone replaced GFP_ATOMIC with GFP_KERNEL...

--yoshfuji

^ permalink raw reply


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox