* Re: netfilter/iptables and network interface names
From: Patrick McHardy @ 2010-02-04 14:31 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: Thomas Woerner, netdev, Netfilter Developer Mailing List
In-Reply-To: <alpine.LSU.2.01.1002041528300.13435@obet.zrqbmnf.qr>
Jan Engelhardt wrote:
> On Thursday 2010-02-04 13:58, Thomas Woerner wrote:
>
>> Hello,
>>
>> I just fell over network interface definitions in kernel and
>> netfilter/iptables.
>>
>> Interfaces names in the kernel have few limits: Only spaces and slashes are not
>> allowed, but everything else, even Ctrl characters are.
>>
>> In iptables, there are other limits: Colon, exclamation mark and asterisk are
>> not allowed. The plus is treated special for matching. But what will be matched
>> if the interface starts with or contains a plus?
>>
>> iptables allows to use interfaces containing spaces and slashes. iptables-save
>> is not escaping interface names. The interface "+" will be treated as no
>> interface limit at all and will be dropped, therefore all interfaces match.
>>
>> I think there should be some discussion about interface names and limits in
>> kernel and netfilter/iptables.
>>
>> What do you think?
>
> I think we should cc netdev for a start.
I don't think there is a reason for this limitation in iptables,
so why not simply remove it?
^ permalink raw reply
* Re: netfilter/iptables and network interface names
From: Jan Engelhardt @ 2010-02-04 14:29 UTC (permalink / raw)
To: Thomas Woerner; +Cc: netdev, Netfilter Developer Mailing List
In-Reply-To: <4B6AC467.7020209@redhat.com>
On Thursday 2010-02-04 13:58, Thomas Woerner wrote:
> Hello,
>
> I just fell over network interface definitions in kernel and
> netfilter/iptables.
>
> Interfaces names in the kernel have few limits: Only spaces and slashes are not
> allowed, but everything else, even Ctrl characters are.
>
> In iptables, there are other limits: Colon, exclamation mark and asterisk are
> not allowed. The plus is treated special for matching. But what will be matched
> if the interface starts with or contains a plus?
>
> iptables allows to use interfaces containing spaces and slashes. iptables-save
> is not escaping interface names. The interface "+" will be treated as no
> interface limit at all and will be dropped, therefore all interfaces match.
>
> I think there should be some discussion about interface names and limits in
> kernel and netfilter/iptables.
>
> What do you think?
I think we should cc netdev for a start.
^ permalink raw reply
* RE: [PATCH 02/25 v2] mlx4_core: add support for arbitrary bitmap sizes
From: Yevgeny Petrilin @ 2010-02-04 14:15 UTC (permalink / raw)
To: Roland Dreier
Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Liran Liss,
Tziporet Koren
In-Reply-To: <adaaavqgdn8.fsf-BjVyx320WGW9gfZ95n9DRSW4+XlvGpQz@public.gmane.org>
>> +int mlx4_bitmap_init_no_mask(struct mlx4_bitmap *bitmap, u32 num,
>> + u32 reserved_bot, u32 reserved_top)
>> +{
>> + u32 num_rounded = roundup_pow_of_two(num);
>> + return mlx4_bitmap_init(bitmap, num_rounded, num_rounded - 1,
>> + reserved_bot, num_rounded - num + reserved_top);
>> +}
>
> I think I would really prefer things if we got rid of this wrapper. The mlx4_bitmap stuff is really there to handle the case where we want to have a
> mask and have the non-used bits cycle to avoid reusing QPN etc.
> If we have a bitmap with no mask that's no a power of 2 in size, there's really no value in the mlx4 wrapper -- we might as well just allocate a bitmap > directly.
>
> And since this is only used in one place (for the EQ tables) I think it makes sense to just open-code everything in the EQ code.
I am preparing a new set of patches for SRIOV support, this change will be included--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Patrick McHardy @ 2010-02-04 14:00 UTC (permalink / raw)
To: Eric Dumazet
Cc: Alexey Dobriyan, Jon Masters, linux-kernel, netdev,
netfilter-devel, Paul E. McKenney
In-Reply-To: <1265035970.2848.50.camel@edumazet-laptop>
[-- Attachment #1: Type: text/plain, Size: 994 bytes --]
Eric Dumazet wrote:
> [PATCH] netfilter: per netns nf_conntrack_cachep
>
> nf_conntrack_cachep is currently shared by all netns instances, but
> because of SLAB_DESTROY_BY_RCU special semantics, this is wrong.
>
> If we use a shared slab cache, one object can instantly flight between
> one hash table (netns ONE) to another one (netns TWO), and concurrent
> reader (doing a lookup in netns ONE, 'finding' an object of netns TWO)
> can be fooled without notice, because no RCU grace period has to be
> observed between object freeing and its reuse.
>
> We dont have this problem with UDP/TCP slab caches because TCP/UDP
> hashtables are global to the machine (and each object has a pointer to
> its netns).
>
> If we use per netns conntrack hash tables, we also *must* use per netns
> conntrack slab caches, to guarantee an object can not escape from one
> namespace to another one.
Applied with the discussed change to allocate a unique name (attached
again for reference), thanks Eric.
[-- Attachment #2: x --]
[-- Type: text/plain, Size: 5090 bytes --]
commit ab59b19be78aac65cdd599fb5002c9019885e061
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date: Thu Feb 4 14:54:05 2010 +0100
netfilter: nf_conntrack: per netns nf_conntrack_cachep
nf_conntrack_cachep is currently shared by all netns instances, but
because of SLAB_DESTROY_BY_RCU special semantics, this is wrong.
If we use a shared slab cache, one object can instantly flight between
one hash table (netns ONE) to another one (netns TWO), and concurrent
reader (doing a lookup in netns ONE, 'finding' an object of netns TWO)
can be fooled without notice, because no RCU grace period has to be
observed between object freeing and its reuse.
We dont have this problem with UDP/TCP slab caches because TCP/UDP
hashtables are global to the machine (and each object has a pointer to
its netns).
If we use per netns conntrack hash tables, we also *must* use per netns
conntrack slab caches, to guarantee an object can not escape from one
namespace to another one.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
[Patrick: added unique slab name allocation]
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index ba1ba0c..aed23b6 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -11,6 +11,7 @@ struct nf_conntrack_ecache;
struct netns_ct {
atomic_t count;
unsigned int expect_count;
+ struct kmem_cache *nf_conntrack_cachep;
struct hlist_nulls_head *hash;
struct hlist_head *expect_hash;
struct hlist_nulls_head unconfirmed;
@@ -28,5 +29,6 @@ struct netns_ct {
#endif
int hash_vmalloc;
int expect_vmalloc;
+ char *slabname;
};
#endif
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 37e2b88..9de4bd4 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -63,8 +63,6 @@ EXPORT_SYMBOL_GPL(nf_conntrack_max);
struct nf_conn nf_conntrack_untracked __read_mostly;
EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
-static struct kmem_cache *nf_conntrack_cachep __read_mostly;
-
static int nf_conntrack_hash_rnd_initted;
static unsigned int nf_conntrack_hash_rnd;
@@ -572,7 +570,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
* Do not use kmem_cache_zalloc(), as this cache uses
* SLAB_DESTROY_BY_RCU.
*/
- ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
+ ct = kmem_cache_alloc(net->ct.nf_conntrack_cachep, gfp);
if (ct == NULL) {
pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
atomic_dec(&net->ct.count);
@@ -611,7 +609,7 @@ void nf_conntrack_free(struct nf_conn *ct)
nf_ct_ext_destroy(ct);
atomic_dec(&net->ct.count);
nf_ct_ext_free(ct);
- kmem_cache_free(nf_conntrack_cachep, ct);
+ kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
}
EXPORT_SYMBOL_GPL(nf_conntrack_free);
@@ -1119,7 +1117,6 @@ static void nf_conntrack_cleanup_init_net(void)
nf_conntrack_helper_fini();
nf_conntrack_proto_fini();
- kmem_cache_destroy(nf_conntrack_cachep);
}
static void nf_conntrack_cleanup_net(struct net *net)
@@ -1137,6 +1134,8 @@ static void nf_conntrack_cleanup_net(struct net *net)
nf_conntrack_ecache_fini(net);
nf_conntrack_acct_fini(net);
nf_conntrack_expect_fini(net);
+ kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+ kfree(net->ct.slabname);
free_percpu(net->ct.stat);
}
@@ -1272,15 +1271,6 @@ static int nf_conntrack_init_init_net(void)
NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
nf_conntrack_max);
- nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
- sizeof(struct nf_conn),
- 0, SLAB_DESTROY_BY_RCU, NULL);
- if (!nf_conntrack_cachep) {
- printk(KERN_ERR "Unable to create nf_conn slab cache\n");
- ret = -ENOMEM;
- goto err_cache;
- }
-
ret = nf_conntrack_proto_init();
if (ret < 0)
goto err_proto;
@@ -1302,8 +1292,6 @@ static int nf_conntrack_init_init_net(void)
err_helper:
nf_conntrack_proto_fini();
err_proto:
- kmem_cache_destroy(nf_conntrack_cachep);
-err_cache:
return ret;
}
@@ -1325,6 +1313,21 @@ static int nf_conntrack_init_net(struct net *net)
ret = -ENOMEM;
goto err_stat;
}
+
+ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
+ if (!net->ct.slabname) {
+ ret = -ENOMEM;
+ goto err_slabname;
+ }
+
+ net->ct.nf_conntrack_cachep = kmem_cache_create(net->ct.slabname,
+ sizeof(struct nf_conn), 0,
+ SLAB_DESTROY_BY_RCU, NULL);
+ if (!net->ct.nf_conntrack_cachep) {
+ printk(KERN_ERR "Unable to create nf_conn slab cache\n");
+ ret = -ENOMEM;
+ goto err_cache;
+ }
net->ct.hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
&net->ct.hash_vmalloc, 1);
if (!net->ct.hash) {
@@ -1352,6 +1355,10 @@ err_expect:
nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
nf_conntrack_htable_size);
err_hash:
+ kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+err_cache:
+ kfree(net->ct.slabname);
+err_slabname:
free_percpu(net->ct.stat);
err_stat:
return ret;
^ permalink raw reply related
* Re: linux-next: manual merge of the trivial tree with the net tree
From: Giuseppe CAVALLARO @ 2010-02-04 13:52 UTC (permalink / raw)
To: Jiri Kosina
Cc: David Miller, sfr, linux-next, linux-kernel, lsorense, netdev,
daniel
In-Reply-To: <4B6AC28D.6090204@st.com>
[-- Attachment #1: Type: text/plain, Size: 1068 bytes --]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Giuseppe CAVALLARO wrote:
> Hi Jiri,
>
> The stmmac driver included in net-next has been restructured: for this
> reason both gmac.c and mac100.c files do not exist any more.
>
> Let me know if I can help on this; I mean I'm happy to apply this latest
> changes to the stmmac in net-next and send a new patch.
patch attached
I hope it could be useful.
Regards,
Peppe
>
> Peppe
>
>> Daniel, could you please refresh the drivers/net/ and net/ bits of your
>> patch and resent it to netdev/Dave?
>
>> I have already dropped it from my queue.
>
>> Thanks,
>
>
- --
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAktq0R0ACgkQ2Xo3j31MSSKeIgCggHG4aixy7SxkSuaVd/hH3fo/
WZcAoK52FTpJLt/JJqJY2NopN0rFK3G1
=Ur+x
-----END PGP SIGNATURE-----
[-- Attachment #2: 0001-stmmac-fix-lenght-typo-in-comments-and-code.patch --]
[-- Type: text/x-patch, Size: 2815 bytes --]
>From f7c63a1378d30d89a6b1a168b0450afb344e7d6d Mon Sep 17 00:00:00 2001
From: Giuseppe Cavallaro <peppe.cavallaro@st.com>
Date: Thu, 4 Feb 2010 13:58:58 +0100
Subject: [linux-next] stmmac: fix 'lenght' typo in comments and code
Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com>
---
drivers/net/stmmac/common.h | 2 +-
drivers/net/stmmac/dwmac100.c | 2 +-
drivers/net/stmmac/dwmac1000_dma.c | 4 ++--
drivers/net/stmmac/stmmac_ethtool.c | 2 +-
4 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/net/stmmac/common.h b/drivers/net/stmmac/common.h
index 7267bcd..2a58172 100644
--- a/drivers/net/stmmac/common.h
+++ b/drivers/net/stmmac/common.h
@@ -44,7 +44,7 @@ struct stmmac_extra_stats {
unsigned long rx_toolong;
unsigned long rx_collision;
unsigned long rx_crc;
- unsigned long rx_lenght;
+ unsigned long rx_length;
unsigned long rx_mii;
unsigned long rx_multicast;
unsigned long rx_gmac_overflow;
diff --git a/drivers/net/stmmac/dwmac100.c b/drivers/net/stmmac/dwmac100.c
index 82dde77..ac48ed7 100644
--- a/drivers/net/stmmac/dwmac100.c
+++ b/drivers/net/stmmac/dwmac100.c
@@ -265,7 +265,7 @@ static int dwmac100_get_rx_frame_status(void *data,
ret = discard_frame;
if (unlikely(p->des01.rx.length_error)) {
- x->rx_lenght++;
+ x->rx_length++;
ret = discard_frame;
}
if (unlikely(p->des01.rx.mii_error)) {
diff --git a/drivers/net/stmmac/dwmac1000_dma.c b/drivers/net/stmmac/dwmac1000_dma.c
index 6824550..39d436a 100644
--- a/drivers/net/stmmac/dwmac1000_dma.c
+++ b/drivers/net/stmmac/dwmac1000_dma.c
@@ -230,7 +230,7 @@ static int dwmac1000_coe_rdes0(int ipc_err, int type, int payload_err)
/* bits 5 7 0 | Frame status
* ----------------------------------------------------------
- * 0 0 0 | IEEE 802.3 Type frame (lenght < 1536 octects)
+ * 0 0 0 | IEEE 802.3 Type frame (length < 1536 octects)
* 1 0 0 | IPv4/6 No CSUM errorS.
* 1 0 1 | IPv4/6 CSUM PAYLOAD error
* 1 1 0 | IPv4/6 CSUM IP HR error
@@ -331,7 +331,7 @@ static int dwmac1000_get_rx_frame_status(void *data,
}
if (unlikely(p->des01.erx.length_error)) {
DBG(KERN_ERR "GMAC RX: length_error error\n");
- x->rx_lenght++;
+ x->rx_length++;
ret = discard_frame;
}
#ifdef STMMAC_VLAN_TAG_USED
diff --git a/drivers/net/stmmac/stmmac_ethtool.c b/drivers/net/stmmac/stmmac_ethtool.c
index 0abeff6..c021eaa 100644
--- a/drivers/net/stmmac/stmmac_ethtool.c
+++ b/drivers/net/stmmac/stmmac_ethtool.c
@@ -62,7 +62,7 @@ static const struct stmmac_stats stmmac_gstrings_stats[] = {
STMMAC_STAT(rx_toolong),
STMMAC_STAT(rx_collision),
STMMAC_STAT(rx_crc),
- STMMAC_STAT(rx_lenght),
+ STMMAC_STAT(rx_length),
STMMAC_STAT(rx_mii),
STMMAC_STAT(rx_multicast),
STMMAC_STAT(rx_gmac_overflow),
--
1.6.0.4
^ permalink raw reply related
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Jon Masters @ 2010-02-04 13:42 UTC (permalink / raw)
To: Patrick McHardy
Cc: Alexey Dobriyan, Eric Dumazet, linux-kernel, netdev,
netfilter-devel, Paul E. McKenney
In-Reply-To: <4B6ACD9A.1090905@trash.net>
On Thu, 2010-02-04 at 14:37 +0100, Patrick McHardy wrote:
> Jon Masters wrote:
> > On Thu, 2010-02-04 at 14:04 +0100, Patrick McHardy wrote:
> >> In any case, we need a fix for this suitable for 2.6.33. If
> >> you don't like using the pointer, please send a patch to add
> >> an id to the network namespaces.
> >
> > Right. I think the quick solution is fine for 2.6.33. So that makes the
> > hashtable non-resize patch, the crash fix, and the cachep bits. I will
> > try to get involved and help you out with the per-ns hashtable clean
> > rather than just being a whiner :)
>
> This is the patch I'm going to commit unless unless there are further
> objections. Its Eric's patch with a change on top to allocate a unique
> name for the slab.
>
> > Thanks a bunch! Fedora kernels have already been built with this fix,
> > since it will allow us to close a fair number of "KVM goes boom" bugs.
>
> Thanks as well for your help.
Patch looks fine to me for the moment, unless it *really* matters about
the pointer exposure.
Jon.
^ permalink raw reply
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Patrick McHardy @ 2010-02-04 13:37 UTC (permalink / raw)
To: Jon Masters
Cc: Alexey Dobriyan, Eric Dumazet, linux-kernel, netdev,
netfilter-devel, Paul E. McKenney
In-Reply-To: <1265289486.2861.436.camel@tonnant>
[-- Attachment #1: Type: text/plain, Size: 838 bytes --]
Jon Masters wrote:
> On Thu, 2010-02-04 at 14:04 +0100, Patrick McHardy wrote:
>> In any case, we need a fix for this suitable for 2.6.33. If
>> you don't like using the pointer, please send a patch to add
>> an id to the network namespaces.
>
> Right. I think the quick solution is fine for 2.6.33. So that makes the
> hashtable non-resize patch, the crash fix, and the cachep bits. I will
> try to get involved and help you out with the per-ns hashtable clean
> rather than just being a whiner :)
This is the patch I'm going to commit unless unless there are further
objections. Its Eric's patch with a change on top to allocate a unique
name for the slab.
> Thanks a bunch! Fedora kernels have already been built with this fix,
> since it will allow us to close a fair number of "KVM goes boom" bugs.
Thanks as well for your help.
[-- Attachment #2: x --]
[-- Type: text/plain, Size: 3859 bytes --]
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index ba1ba0c..aed23b6 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -11,6 +11,7 @@ struct nf_conntrack_ecache;
struct netns_ct {
atomic_t count;
unsigned int expect_count;
+ struct kmem_cache *nf_conntrack_cachep;
struct hlist_nulls_head *hash;
struct hlist_head *expect_hash;
struct hlist_nulls_head unconfirmed;
@@ -28,5 +29,6 @@ struct netns_ct {
#endif
int hash_vmalloc;
int expect_vmalloc;
+ char *slabname;
};
#endif
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 37e2b88..7ac027a 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -63,8 +63,6 @@ EXPORT_SYMBOL_GPL(nf_conntrack_max);
struct nf_conn nf_conntrack_untracked __read_mostly;
EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
-static struct kmem_cache *nf_conntrack_cachep __read_mostly;
-
static int nf_conntrack_hash_rnd_initted;
static unsigned int nf_conntrack_hash_rnd;
@@ -572,7 +570,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
* Do not use kmem_cache_zalloc(), as this cache uses
* SLAB_DESTROY_BY_RCU.
*/
- ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
+ ct = kmem_cache_alloc(net->ct.nf_conntrack_cachep, gfp);
if (ct == NULL) {
pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
atomic_dec(&net->ct.count);
@@ -611,7 +609,7 @@ void nf_conntrack_free(struct nf_conn *ct)
nf_ct_ext_destroy(ct);
atomic_dec(&net->ct.count);
nf_ct_ext_free(ct);
- kmem_cache_free(nf_conntrack_cachep, ct);
+ kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
}
EXPORT_SYMBOL_GPL(nf_conntrack_free);
@@ -1119,7 +1117,6 @@ static void nf_conntrack_cleanup_init_net(void)
nf_conntrack_helper_fini();
nf_conntrack_proto_fini();
- kmem_cache_destroy(nf_conntrack_cachep);
}
static void nf_conntrack_cleanup_net(struct net *net)
@@ -1137,6 +1134,8 @@ static void nf_conntrack_cleanup_net(struct net *net)
nf_conntrack_ecache_fini(net);
nf_conntrack_acct_fini(net);
nf_conntrack_expect_fini(net);
+ kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+ kfree(net->ct.slabname);
free_percpu(net->ct.stat);
}
@@ -1272,15 +1271,6 @@ static int nf_conntrack_init_init_net(void)
NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
nf_conntrack_max);
- nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
- sizeof(struct nf_conn),
- 0, SLAB_DESTROY_BY_RCU, NULL);
- if (!nf_conntrack_cachep) {
- printk(KERN_ERR "Unable to create nf_conn slab cache\n");
- ret = -ENOMEM;
- goto err_cache;
- }
-
ret = nf_conntrack_proto_init();
if (ret < 0)
goto err_proto;
@@ -1302,8 +1292,6 @@ static int nf_conntrack_init_init_net(void)
err_helper:
nf_conntrack_proto_fini();
err_proto:
- kmem_cache_destroy(nf_conntrack_cachep);
-err_cache:
return ret;
}
@@ -1325,6 +1313,19 @@ static int nf_conntrack_init_net(struct net *net)
ret = -ENOMEM;
goto err_stat;
}
+
+ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
+ if (!net->ct.slabname)
+ goto err_slabname;
+
+ net->ct.nf_conntrack_cachep = kmem_cache_create(net->ct.slabname,
+ sizeof(struct nf_conn), 0,
+ SLAB_DESTROY_BY_RCU, NULL);
+ if (!net->ct.nf_conntrack_cachep) {
+ printk(KERN_ERR "Unable to create nf_conn slab cache\n");
+ ret = -ENOMEM;
+ goto err_cache;
+ }
net->ct.hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
&net->ct.hash_vmalloc, 1);
if (!net->ct.hash) {
@@ -1352,6 +1353,10 @@ err_expect:
nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
nf_conntrack_htable_size);
err_hash:
+ kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+err_cache:
+ kfree(net->ct.slabname);
+err_slabname:
free_percpu(net->ct.stat);
err_stat:
return ret;
^ permalink raw reply related
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Jon Masters @ 2010-02-04 13:18 UTC (permalink / raw)
To: Patrick McHardy
Cc: Alexey Dobriyan, Eric Dumazet, linux-kernel, netdev,
netfilter-devel, Paul E. McKenney
In-Reply-To: <4B6AC5DC.60301@trash.net>
On Thu, 2010-02-04 at 14:04 +0100, Patrick McHardy wrote:
> Alexey Dobriyan wrote:
> > On Thu, Feb 4, 2010 at 2:30 PM, Patrick McHardy <kaber@trash.net> wrote:
> >> Alexey Dobriyan wrote:
> >>> On Thu, Feb 4, 2010 at 2:25 PM, Patrick McHardy <kaber@trash.net> wrote:
> >>>> Jon Masters wrote:
> >>>>> On Wed, 2010-02-03 at 21:09 +0200, Alexey Dobriyan wrote:
> >>>>>> On Wed, Feb 03, 2010 at 01:38:09PM -0500, Jon Masters wrote:
> >>>>>>> *). Per namespace cacheing allocation (the cachep bits). We know it's
> >>>>>>> still possible for weirdness to happen in the SLAB cache here.
> >>>>>> Tiny race, needs reproducer.
> >>>>> Maybe. I think it's worth fixing anyway.
> >>>> Absolutely, I'll also apply Eric's patch with the %p fix for the
> >>>> slab name.
> >>> This would show kernel pointers in userspace ;-)
> >>> So, net->id is required.
> >> I don't see the problem. But yes, it would be nicer to have an ID.
> >
> > This is done (or rather, not done) to not show attackers
> > where data structures are.
>
> That's news to me, my /proc is full of kernel space pointers,
> including data.
And anyway, you can guess it in many cases. I don't think there's a huge
problem, but you could of course just stash a global atomic somewhere to
keep track of how many of these you've made if that's easier for now.
> In any case, we need a fix for this suitable for 2.6.33. If
> you don't like using the pointer, please send a patch to add
> an id to the network namespaces.
Right. I think the quick solution is fine for 2.6.33. So that makes the
hashtable non-resize patch, the crash fix, and the cachep bits. I will
try to get involved and help you out with the per-ns hashtable clean
rather than just being a whiner :)
Thanks a bunch! Fedora kernels have already been built with this fix,
since it will allow us to close a fair number of "KVM goes boom" bugs.
Jon.
^ permalink raw reply
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Patrick McHardy @ 2010-02-04 13:04 UTC (permalink / raw)
To: Alexey Dobriyan
Cc: Jon Masters, Eric Dumazet, linux-kernel, netdev, netfilter-devel,
Paul E. McKenney
In-Reply-To: <b6fcc0a1002040435t150aa7axf2dc0b139ed8f258@mail.gmail.com>
Alexey Dobriyan wrote:
> On Thu, Feb 4, 2010 at 2:30 PM, Patrick McHardy <kaber@trash.net> wrote:
>> Alexey Dobriyan wrote:
>>> On Thu, Feb 4, 2010 at 2:25 PM, Patrick McHardy <kaber@trash.net> wrote:
>>>> Jon Masters wrote:
>>>>> On Wed, 2010-02-03 at 21:09 +0200, Alexey Dobriyan wrote:
>>>>>> On Wed, Feb 03, 2010 at 01:38:09PM -0500, Jon Masters wrote:
>>>>>>> *). Per namespace cacheing allocation (the cachep bits). We know it's
>>>>>>> still possible for weirdness to happen in the SLAB cache here.
>>>>>> Tiny race, needs reproducer.
>>>>> Maybe. I think it's worth fixing anyway.
>>>> Absolutely, I'll also apply Eric's patch with the %p fix for the
>>>> slab name.
>>> This would show kernel pointers in userspace ;-)
>>> So, net->id is required.
>> I don't see the problem. But yes, it would be nicer to have an ID.
>
> This is done (or rather, not done) to not show attackers
> where data structures are.
That's news to me, my /proc is full of kernel space pointers,
including data.
In any case, we need a fix for this suitable for 2.6.33. If
you don't like using the pointer, please send a patch to add
an id to the network namespaces.
^ permalink raw reply
* Re: [PATCH 1/2] e1000: Fix DMA mapping error handling on TX
From: Roel Kluin @ 2010-02-04 13:00 UTC (permalink / raw)
To: Roel Kluin
Cc: Jeff Kirsher, davem, Anton Blanchard, Jesse Brandeburg,
Bruce Allan, PJ Waskiewicz, John Ronciak, Don Skidmore, Yi Zou,
Alexander Duyck, e1000-devel, netdev
In-Reply-To: <4B5F1164.8030102@gmail.com>
These functions have off by one errors in their dma mapping error cleanup
paths. We decrement count and never clean the first successfully mapped
descriptor.
Reported-by: "Anton Blanchard" <anton@samba.org>
Reported-by: "Juha Leppanen" <juha_motorsportcom@luukku.com>
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
drivers/net/e1000e/netdev.c | 4 +---
drivers/net/igbvf/netdev.c | 4 +---
drivers/net/ixgb/ixgb_main.c | 4 +---
drivers/net/ixgbe/ixgbe_main.c | 4 +---
4 files changed, 4 insertions(+), 12 deletions(-)
My previous fix inadvertently introduced this change.
The e1000_tx_map() function in drivers/net/e1000/e1000_main.c is already
fixed by the patch sent by Anton Blanchard that can be found here:
http://www.mail-archive.com/e1000-devel@lists.sourceforge.net/msg02313.html
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 57f149b..57c3d44 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -3967,12 +3967,10 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
dma_error:
dev_err(&pdev->dev, "TX DMA map failed\n");
buffer_info->dma = 0;
- if (count)
- count--;
while (count--) {
if (i==0)
- i += tx_ring->count;
+ i = tx_ring->count;
i--;
buffer_info = &tx_ring->buffer_info[i];
e1000_put_txbuf(adapter, buffer_info);;
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index 2aa71a7..3b12603 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -2164,13 +2164,11 @@ dma_error:
buffer_info->length = 0;
buffer_info->next_to_watch = 0;
buffer_info->mapped_as_page = false;
- if (count)
- count--;
/* clear timestamp and dma mappings for remaining portion of packet */
while (count--) {
if (i==0)
- i += tx_ring->count;
+ i = tx_ring->count;
i--;
buffer_info = &tx_ring->buffer_info[i];
igbvf_put_txbuf(adapter, buffer_info);
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index 593d1a4..de9b36c 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -1363,12 +1363,10 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
dma_error:
dev_err(&pdev->dev, "TX DMA map failed\n");
buffer_info->dma = 0;
- if (count)
- count--;
while (count--) {
if (i==0)
- i += tx_ring->count;
+ i = tx_ring->count;
i--;
buffer_info = &tx_ring->buffer_info[i];
ixgb_unmap_and_free_tx_resource(adapter, buffer_info);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index b5f64ad..1713258 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -5167,13 +5167,11 @@ dma_error:
tx_buffer_info->dma = 0;
tx_buffer_info->time_stamp = 0;
tx_buffer_info->next_to_watch = 0;
- if (count)
- count--;
/* clear timestamp and dma mappings for remaining portion of packet */
while (count--) {
if (i==0)
- i += tx_ring->count;
+ i = tx_ring->count;
i--;
tx_buffer_info = &tx_ring->tx_buffer_info[i];
ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
^ permalink raw reply related
* Re: linux-next: manual merge of the trivial tree with the net tree
From: Giuseppe CAVALLARO @ 2010-02-04 12:50 UTC (permalink / raw)
To: Jiri Kosina
Cc: David Miller, sfr, linux-next, linux-kernel, lsorense, netdev,
daniel
In-Reply-To: <alpine.LNX.2.00.1002041052020.15395@pobox.suse.cz>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Jiri,
Jiri Kosina wrote:
> On Wed, 3 Feb 2010, David Miller wrote:
>
>>> I think the best thing is me dropping the net/ and drivers/net hunks of
>>> this patch and taking it through Davem's tree ... I have already dropped
>>> those hunks from my tree. Dave, the patch is below, please consider
>>> applying.
>> ...
>>> From: Daniel Mack <daniel@caiaq.de>
>>> Subject: [PATCH] net: fix 'lenght' typo in comments and code
>>>
>>> Some misspelled occurences of 'octet' and some comments were also fixed
>>> as I was on it.
>>>
>>> Signed-off-by: Daniel Mack <daniel@caiaq.de>
>>> Cc: Jiri Kosina <trivial@kernel.org>
>>> Cc: Joe Perches <joe@perches.com>
>>> Cc: Junio C Hamano <gitster@pobox.com>
>>> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
>> This doesn't apply to net-next-2.6 at all:
>>
>> error: patch failed: drivers/net/ppp_generic.c:1436
>> error: drivers/net/ppp_generic.c: patch does not apply
>> error: drivers/net/stmmac/gmac.c: does not exist in index
>> error: drivers/net/stmmac/mac100.c: does not exist in index
The stmmac driver included in net-next has been restructured: for this
reason both gmac.c and mac100.c files do not exist any more.
Let me know if I can help on this; I mean I'm happy to apply this latest
changes to the stmmac in net-next and send a new patch.
Peppe
> Daniel, could you please refresh the drivers/net/ and net/ bits of your
> patch and resent it to netdev/Dave?
>
> I have already dropped it from my queue.
>
> Thanks,
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAktqwo0ACgkQ2Xo3j31MSSLr+QCeM4cA87vv6uQoY1rHf4Wl7Ye8
v1wAnAtI6RWt5wNUFJZRTQ2mEOP4EuE9
=G2hJ
-----END PGP SIGNATURE-----
^ permalink raw reply
* Re: [RFC Patch] net: reserve ports for applications using fixed port numbers
From: Octavian Purdila @ 2010-02-04 12:44 UTC (permalink / raw)
To: Cong Wang
Cc: linux-kernel-u79uwXL29TY76Z2rM5mHXA, Eric Dumazet,
linux-rdma-u79uwXL29TY76Z2rM5mHXA, netdev-u79uwXL29TY76Z2rM5mHXA,
Neil Horman, linux-sctp-u79uwXL29TY76Z2rM5mHXA, David Miller
In-Reply-To: <4B6A3DBA.1000706-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
On Thursday 04 February 2010 05:23:38 you wrote:
> > I think it might be useful to allow setting individual ports as reserved,
> > not only ranges, for example by using a bitmap.
>
> This is a good idea, but I am not sure if this will be overkill? :-/
> Also, using bitmap is not friendly to sysctl interface, I am afraid.
>
My concern is that we can have multiple applications that require a fixed port
and if those ports are significantly apart we will decrease the port range
available for connect. And that will hurt the rate of which new connections
can be opened.
As for the sysctl interface I agree, I don't think it is even possible to
cleanly use a bitmap through sysctl.
The options I see are either enhance sysctl to support bitmaps or use a
dedicated /proc/net entry.
I want to give this a try, which one do you people think is better?
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Alexey Dobriyan @ 2010-02-04 12:35 UTC (permalink / raw)
To: Patrick McHardy
Cc: Jon Masters, Eric Dumazet, linux-kernel, netdev, netfilter-devel,
Paul E. McKenney
In-Reply-To: <4B6ABDEF.8090005@trash.net>
On Thu, Feb 4, 2010 at 2:30 PM, Patrick McHardy <kaber@trash.net> wrote:
> Alexey Dobriyan wrote:
>> On Thu, Feb 4, 2010 at 2:25 PM, Patrick McHardy <kaber@trash.net> wrote:
>>> Jon Masters wrote:
>>>> On Wed, 2010-02-03 at 21:09 +0200, Alexey Dobriyan wrote:
>>>>> On Wed, Feb 03, 2010 at 01:38:09PM -0500, Jon Masters wrote:
>>>>>> *). Per namespace cacheing allocation (the cachep bits). We know it's
>>>>>> still possible for weirdness to happen in the SLAB cache here.
>>>>> Tiny race, needs reproducer.
>>>> Maybe. I think it's worth fixing anyway.
>>> Absolutely, I'll also apply Eric's patch with the %p fix for the
>>> slab name.
>>
>> This would show kernel pointers in userspace ;-)
>> So, net->id is required.
>
> I don't see the problem. But yes, it would be nicer to have an ID.
This is done (or rather, not done) to not show attackers
where data structures are.
^ permalink raw reply
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Patrick McHardy @ 2010-02-04 12:30 UTC (permalink / raw)
To: Alexey Dobriyan
Cc: Jon Masters, Eric Dumazet, linux-kernel, netdev, netfilter-devel,
Paul E. McKenney
In-Reply-To: <b6fcc0a1002040427n221da433n755350b4a41bbf9b@mail.gmail.com>
Alexey Dobriyan wrote:
> On Thu, Feb 4, 2010 at 2:25 PM, Patrick McHardy <kaber@trash.net> wrote:
>> Jon Masters wrote:
>>> On Wed, 2010-02-03 at 21:09 +0200, Alexey Dobriyan wrote:
>>>> On Wed, Feb 03, 2010 at 01:38:09PM -0500, Jon Masters wrote:
>>>>> *). Per namespace cacheing allocation (the cachep bits). We know it's
>>>>> still possible for weirdness to happen in the SLAB cache here.
>>>> Tiny race, needs reproducer.
>>> Maybe. I think it's worth fixing anyway.
>> Absolutely, I'll also apply Eric's patch with the %p fix for the
>> slab name.
>
> This would show kernel pointers in userspace ;-)
> So, net->id is required.
I don't see the problem. But yes, it would be nicer to have an ID.
^ permalink raw reply
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Alexey Dobriyan @ 2010-02-04 12:27 UTC (permalink / raw)
To: Patrick McHardy
Cc: Jon Masters, Eric Dumazet, linux-kernel, netdev, netfilter-devel,
Paul E. McKenney
In-Reply-To: <4B6ABCB8.4080904@trash.net>
On Thu, Feb 4, 2010 at 2:25 PM, Patrick McHardy <kaber@trash.net> wrote:
> Jon Masters wrote:
>> On Wed, 2010-02-03 at 21:09 +0200, Alexey Dobriyan wrote:
>>> On Wed, Feb 03, 2010 at 01:38:09PM -0500, Jon Masters wrote:
>>>> *). Per namespace cacheing allocation (the cachep bits). We know it's
>>>> still possible for weirdness to happen in the SLAB cache here.
>>> Tiny race, needs reproducer.
>>
>> Maybe. I think it's worth fixing anyway.
>
> Absolutely, I'll also apply Eric's patch with the %p fix for the
> slab name.
This would show kernel pointers in userspace ;-)
So, net->id is required.
^ permalink raw reply
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Patrick McHardy @ 2010-02-04 12:25 UTC (permalink / raw)
To: Jon Masters
Cc: Alexey Dobriyan, Eric Dumazet, linux-kernel, netdev,
netfilter-devel, Paul E. McKenney
In-Reply-To: <1265226227.2861.302.camel@tonnant>
Jon Masters wrote:
> On Wed, 2010-02-03 at 21:09 +0200, Alexey Dobriyan wrote:
>> On Wed, Feb 03, 2010 at 01:38:09PM -0500, Jon Masters wrote:
>>> *). Per namespace cacheing allocation (the cachep bits). We know it's
>>> still possible for weirdness to happen in the SLAB cache here.
>> Tiny race, needs reproducer.
>
> Maybe. I think it's worth fixing anyway.
Absolutely, I'll also apply Eric's patch with the %p fix for the
slab name.
^ permalink raw reply
* Re: [PATCH] netfilter: per netns nf_conntrack_cachep
From: Patrick McHardy @ 2010-02-04 12:24 UTC (permalink / raw)
To: Jon Masters
Cc: Alexey Dobriyan, Eric Dumazet, linux-kernel, netdev,
netfilter-devel, Paul E. McKenney
In-Reply-To: <1265228479.2861.312.camel@tonnant>
Jon Masters wrote:
> On Wed, 2010-02-03 at 13:10 +0100, Patrick McHardy wrote:
>
>> Jon, could you give this patch a try please?
>> plain text document attachment (x)
>> commit 056ff3e3bd1563969a311697323ff929df94415c
>> Author: Patrick McHardy <kaber@trash.net>
>> Date: Wed Feb 3 12:58:06 2010 +0100
>
> Patrick, can I regard this as the official fix for 2.6.33?
Yes, I'll send it upstream today. Thanks for your help.
^ permalink raw reply
* Re: [RFC Patch v2] net: reserve ports for applications using fixed port numbers
From: Tetsuo Handa @ 2010-02-04 10:59 UTC (permalink / raw)
To: amwang-H+wXaHxf7aLQT0dZR+AlfA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-security-module-u79uwXL29TY76Z2rM5mHXA
Cc: opurdila-+zzKsuq53OdBDgjK7y7TUQ,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w,
linux-rdma-u79uwXL29TY76Z2rM5mHXA, netdev-u79uwXL29TY76Z2rM5mHXA,
nhorman-2XuSBdqkA4R54TAoqtyWWQ, linux-sctp-u79uwXL29TY76Z2rM5mHXA,
davem-fT/PcQaiUtIeIZ0/mPfg9Q
In-Reply-To: <20100204101533.4619.34599.sendpatchset-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org>
Hello.
Amerigo Wang wrote:
> diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
> index 2b79377..d3e160a 100644
> --- a/net/ipv4/inet_hashtables.c
> +++ b/net/ipv4/inet_hashtables.c
> @@ -456,6 +456,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
> local_bh_disable();
> for (i = 1; i <= remaining; i++) {
> port = low + (i + offset) % remaining;
> + if (inet_is_reserved_local_port(port))
> + continue;
> head = &hinfo->bhash[inet_bhashfn(net, port,
> hinfo->bhash_size)];
> spin_lock(&head->lock);
I'm planning to add a LSM hook here.
If root user sets min port value less than 1024 to
/proc/sys/net/ipv4/ip_local_port_range , a process without CAP_NET_BIND_SERVICE
capability can bind to privileged port by "bind() with port == 0" or "connect()
without bind()" because the condition is
err = -EACCES;
if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
goto out;
I consider this is a security problem if MAC is enabled. MAC is used for
dividing root user's privilege. With MAC, somebody doing some part of root
user's jobs may set min port value to less than 1024.
Also, some applications needs fixed local port numbers (e.g. 3128 for Squid,
8080 for Tomcat). The port numbers I want to reserve are more complex than
simple min-max range like /proc/sys/net/ipv4/ip_local_reserved_ports .
Therefore, TOMOYO wants to insert a LSM hook (
http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/net/ipv4/udp.c#L235
http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/net/ipv4/inet_connection_sock.c#L114
http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/net/ipv4/inet_hashtables.c#L459
) and allow reserving local ports like
deny_autobind 0-1023
deny_autobind 3128
deny_autobind 8080
so that
applications which need such ports won't be unexpectedly blocked by
other application's temporary port usage (i.e. "bind() with port == 0" or
"connect() without bind()")
and
MAC guarantees that processes without CAP_NET_BIND_SERVICE can never bind
to privileged port
.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* [RFC Patch v2] net: reserve ports for applications using fixed port numbers
From: Amerigo Wang @ 2010-02-04 10:12 UTC (permalink / raw)
To: linux-kernel
Cc: Octavian Purdila, Eric Dumazet, linux-rdma, netdev, Neil Horman,
linux-sctp, Amerigo Wang, David Miller
V2:
update the documentation
update the changelog
fix the checking code in udp
This patch introduces /proc/sys/net/ipv4/ip_local_reserved_ports,
it can be used like ip_local_port_range, but this is used to
reserve ports for third-party applications which use fixed
port numbers within ip_local_port_range.
This only affects the applications which call socket functions
like bind(2) with port number 0, or connect() etc., to prevent the kernel
getting the ports within the specified range for them. For applications
which use fixed port number, it will have no effects.
Any comments are welcome.
Signed-off-by: WANG Cong <amwang@redhat.com>
Cc: Octavian Purdila <opurdila@ixiacom.com>
Cc: David Miller <davem@davemloft.net>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
---
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 006b39d..0795ac3 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -564,6 +564,14 @@ ip_local_port_range - 2 INTEGERS
(i.e. by default) range 1024-4999 is enough to issue up to
2000 connections per second to systems supporting timestamps.
+ip_local_reserved_ports - 2 INTEGERS
+ Specify the port range which is reserved for known third-party
+ applications, in case the kernel picks those ports for other
+ applications, e.g. when calling connect() or bind() with port
+ number 0. The range shall not go beyond the range specifed in
+ ip_local_port_range. "0 0" means no ports are reserved.
+ Default: 0 0
+
ip_nonlocal_bind - BOOLEAN
If set, allows processes to bind() to non-local IP addresses,
which can be quite useful - but may break some applications.
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index cc9b594..8248fc6 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1979,6 +1979,8 @@ retry:
/* FIXME: add proper port randomization per like inet_csk_get_port */
do {
ret = idr_get_new_above(ps, bind_list, next_port, &port);
+ if (inet_is_reserved_local_port(port))
+ ret = -EAGAIN;
} while ((ret == -EAGAIN) && idr_pre_get(ps, GFP_KERNEL));
if (ret)
@@ -2997,10 +2999,13 @@ static int __init cma_init(void)
{
int ret, low, high, remaining;
- get_random_bytes(&next_port, sizeof next_port);
inet_get_local_port_range(&low, &high);
+again:
+ get_random_bytes(&next_port, sizeof next_port);
remaining = (high - low) + 1;
next_port = ((unsigned int) next_port % remaining) + low;
+ if (inet_is_reserved_local_port(next_port))
+ goto again;
cma_wq = create_singlethread_workqueue("rdma_cm");
if (!cma_wq)
diff --git a/include/net/ip.h b/include/net/ip.h
index fb63371..f70acad 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -181,8 +181,10 @@ extern void snmp_mib_free(void *ptr[2]);
extern struct local_ports {
seqlock_t lock;
int range[2];
-} sysctl_local_ports;
+} sysctl_local_ports, sysctl_local_reserved_ports;
extern void inet_get_local_port_range(int *low, int *high);
+extern void inet_get_local_reserved_ports(int *from, int *to);
+extern int inet_is_reserved_local_port(int port);
extern int sysctl_ip_default_ttl;
extern int sysctl_ip_nonlocal_bind;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index ee16475..ee13e48 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -37,6 +37,11 @@ struct local_ports sysctl_local_ports __read_mostly = {
.range = { 32768, 61000 },
};
+struct local_ports sysctl_local_reserved_ports __read_mostly = {
+ .lock = SEQLOCK_UNLOCKED,
+ .range = { 0, 0 },
+};
+
void inet_get_local_port_range(int *low, int *high)
{
unsigned seq;
@@ -49,6 +54,28 @@ void inet_get_local_port_range(int *low, int *high)
}
EXPORT_SYMBOL(inet_get_local_port_range);
+void inet_get_local_reserved_ports(int *from, int *to)
+{
+ unsigned int seq;
+ do {
+ seq = read_seqbegin(&sysctl_local_reserved_ports.lock);
+
+ *from = sysctl_local_reserved_ports.range[0];
+ *to = sysctl_local_reserved_ports.range[1];
+ } while (read_seqretry(&sysctl_local_reserved_ports.lock, seq));
+}
+
+int inet_is_reserved_local_port(int port)
+{
+ int min, max;
+
+ inet_get_local_reserved_ports(&min, &max);
+ if (min && max)
+ return (port >= min && port <= max);
+ return 0;
+}
+EXPORT_SYMBOL(inet_is_reserved_local_port);
+
int inet_csk_bind_conflict(const struct sock *sk,
const struct inet_bind_bucket *tb)
{
@@ -105,6 +132,8 @@ again:
inet_get_local_port_range(&low, &high);
remaining = (high - low) + 1;
smallest_rover = rover = net_random() % remaining + low;
+ if (inet_is_reserved_local_port(rover))
+ goto again;
smallest_size = -1;
do {
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 2b79377..d3e160a 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -456,6 +456,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
local_bh_disable();
for (i = 1; i <= remaining; i++) {
port = low + (i + offset) % remaining;
+ if (inet_is_reserved_local_port(port))
+ continue;
head = &hinfo->bhash[inet_bhashfn(net, port,
hinfo->bhash_size)];
spin_lock(&head->lock);
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 7e3712c..0791010 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -23,6 +23,7 @@
static int zero;
static int tcp_retr1_max = 255;
+static int ip_local_reserved_ports_min[] = { 0, 0 };
static int ip_local_port_range_min[] = { 1, 1 };
static int ip_local_port_range_max[] = { 65535, 65535 };
@@ -63,6 +64,51 @@ static int ipv4_local_port_range(ctl_table *table, int write,
return ret;
}
+static void set_reserved_port_range(int range[2])
+{
+ write_seqlock(&sysctl_local_reserved_ports.lock);
+ sysctl_local_reserved_ports.range[0] = range[0];
+ sysctl_local_reserved_ports.range[1] = range[1];
+ write_sequnlock(&sysctl_local_reserved_ports.lock);
+}
+
+static int ipv4_local_reserved_ports(ctl_table *table, int write,
+ void __user *buffer,
+ size_t *lenp, loff_t *ppos)
+{
+ int ret;
+ int range[2];
+ int reserved_range[2];
+ ctl_table tmp = {
+ .data = &reserved_range,
+ .maxlen = sizeof(reserved_range),
+ .mode = table->mode,
+ .extra1 = &ip_local_reserved_ports_min,
+ .extra2 = &ip_local_port_range_max,
+ };
+
+ inet_get_local_reserved_ports(reserved_range, reserved_range+1);
+ ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
+
+ if (write && ret == 0) {
+ inet_get_local_port_range(range, range + 1);
+ if (!reserved_range[0] && !reserved_range[1]) {
+ set_reserved_port_range(reserved_range);
+ } else {
+ if (reserved_range[1] < reserved_range[0])
+ ret = -EINVAL;
+ else if (reserved_range[0] < range[0])
+ ret = -EINVAL;
+ else if (reserved_range[1] > range[1])
+ ret = -EINVAL;
+ else
+ set_reserved_port_range(reserved_range);
+ }
+ }
+
+ return ret;
+}
+
static int proc_tcp_congestion_control(ctl_table *ctl, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
@@ -298,6 +344,13 @@ static struct ctl_table ipv4_table[] = {
.mode = 0644,
.proc_handler = ipv4_local_port_range,
},
+ {
+ .procname = "ip_local_reserved_ports",
+ .data = &sysctl_local_reserved_ports.range,
+ .maxlen = sizeof(sysctl_local_reserved_ports.range),
+ .mode = 0644,
+ .proc_handler = ipv4_local_reserved_ports,
+ },
#ifdef CONFIG_IP_MULTICAST
{
.procname = "igmp_max_memberships",
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f0126fd..4bb825e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -203,6 +203,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
if (!snum) {
int low, high, remaining;
+ int min, max;
unsigned rand;
unsigned short first, last;
DECLARE_BITMAP(bitmap, PORTS_PER_CHAIN);
@@ -210,6 +211,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
inet_get_local_port_range(&low, &high);
remaining = (high - low) + 1;
+again:
rand = net_random();
first = (((u64)rand * remaining) >> 32) + low;
/*
@@ -217,6 +219,9 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
*/
rand = (rand | 1) * (udptable->mask + 1);
last = first + udptable->mask + 1;
+ inet_get_local_reserved_ports(&min, &max);
+ if (!(first > max || last < min))
+ goto again;
do {
hslot = udp_hashslot(udptable, net, first);
bitmap_zero(bitmap, PORTS_PER_CHAIN);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 67fdac9..d685141 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5432,6 +5432,8 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr)
rover++;
if ((rover < low) || (rover > high))
rover = low;
+ if (inet_is_reserved_local_port(rover))
+ continue;
index = sctp_phashfn(rover);
head = &sctp_port_hashtable[index];
sctp_spin_lock(&head->lock);
^ permalink raw reply related
* Re: linux-next: manual merge of the trivial tree with the net tree
From: Jiri Kosina @ 2010-02-04 9:52 UTC (permalink / raw)
To: David Miller; +Cc: sfr, linux-next, linux-kernel, lsorense, netdev, daniel
In-Reply-To: <20100203.200402.17600564.davem@davemloft.net>
On Wed, 3 Feb 2010, David Miller wrote:
> > I think the best thing is me dropping the net/ and drivers/net hunks of
> > this patch and taking it through Davem's tree ... I have already dropped
> > those hunks from my tree. Dave, the patch is below, please consider
> > applying.
> ...
> > From: Daniel Mack <daniel@caiaq.de>
> > Subject: [PATCH] net: fix 'lenght' typo in comments and code
> >
> > Some misspelled occurences of 'octet' and some comments were also fixed
> > as I was on it.
> >
> > Signed-off-by: Daniel Mack <daniel@caiaq.de>
> > Cc: Jiri Kosina <trivial@kernel.org>
> > Cc: Joe Perches <joe@perches.com>
> > Cc: Junio C Hamano <gitster@pobox.com>
> > Signed-off-by: Jiri Kosina <jkosina@suse.cz>
>
> This doesn't apply to net-next-2.6 at all:
>
> error: patch failed: drivers/net/ppp_generic.c:1436
> error: drivers/net/ppp_generic.c: patch does not apply
> error: drivers/net/stmmac/gmac.c: does not exist in index
> error: drivers/net/stmmac/mac100.c: does not exist in index
Daniel, could you please refresh the drivers/net/ and net/ bits of your
patch and resent it to netdev/Dave?
I have already dropped it from my queue.
Thanks,
--
Jiri Kosina
SUSE Labs, Novell Inc.
^ permalink raw reply
* Re: [RFC] bonding: better transmit hash
From: Jasper Spaans @ 2010-02-04 9:26 UTC (permalink / raw)
To: Stephen Hemminger
Cc: Jay Vosburgh, David Miller, Jiri Pirko,
bonding-devel@lists.sourceforge.net, netdev@vger.kernel.org
In-Reply-To: <20100203111337.1085b772@nehalam>
On 03/02/10 19:13, Stephen Hemminger wrote:
> This is a prototype of improved bonding link hashing. It adds a couple
> of things:
> * support IPV6 addresses for L3/L4
> * support other protocols beside TCP/UDP
> * use all of mac address (not just last byte)
> * use jhash for better mixing
> * use skb header field access to handle vlan's etc properly
>
> It no longer is a pure xor, does that matter?
>
The goal is to distribute packets when load is high - so a bit of
efficiency would be nice. Looking at jhash, it seems to use ~60
operations per round of hashing instead of just 1 xor.
Besides, it seems jhash (the generic function) hashes your data in
chunks of 12 bytes, and finishes of with another round hashing. You
might want to use the specialized jhash_3words function in those cases,
which only does one round.
> --- a/drivers/net/bonding/bond_main.c 2010-02-03 10:42:50.998328499 -0800
> +++ b/drivers/net/bonding/bond_main.c 2010-02-03 11:08:35.034851960 -0800
> @@ -3587,17 +3587,28 @@ void bond_unregister_arp(struct bonding
> * Hash for the output device based upon layer 2 and layer 3 data. If
> * the packet is not IP mimic bond_xmit_hash_policy_l2()
> */
> -static int bond_xmit_hash_policy_l23(struct sk_buff *skb, int count)
> +static int bond_xmit_hash_policy_l23(const struct sk_buff *skb, int count)
> {
> - struct ethhdr *data = (struct ethhdr *)skb->data;
> - struct iphdr *iph = ip_hdr(skb);
> + u32 h;
>
> - if (skb->protocol == htons(ETH_P_IP)) {
> - return ((ntohl(iph->saddr ^ iph->daddr) & 0xffff) ^
> - (data->h_dest[5] ^ data->h_source[5])) % count;
> + switch (skb->protocol) {
> + case htons(ETH_P_IP):
> + {
> + const struct iphdr *iph = ip_hdr(skb);
> + h = iph->daddr ^ iph->saddr ^ iph->protocol;
> + break;
> + }
> + case htons(ETH_P_IPV6):
> + {
> + const struct ipv6hdr *iph = ipv6_hdr(skb);
> + h = iph->saddr.s6_addr32[3] ^ iph->daddr.s6_addr32[3];
> + break;
> + }
> + default:
> + h = skb->protocol;
> }
>
> - return (data->h_dest[5] ^ data->h_source[5]) % count;
> + return jhash(eth_hdr(skb), 2*ETH_ALEN, h) % count;
> }
>
This breaks stuff - in the layer 3 case, you're suddenly putting layer 2
data into the hash, and in the layer 2 case, you're putting the protocol
into the hash. Especially the first case has the potential to break our
setup, in which related traffic might end up at different interfaces.
> /*
> @@ -3605,35 +3616,55 @@ static int bond_xmit_hash_policy_l23(str
> * the packet is a frag or not TCP or UDP, just use layer 3 data. If it is
> * altogether not IP, mimic bond_xmit_hash_policy_l2()
> */
> -static int bond_xmit_hash_policy_l34(struct sk_buff *skb, int count)
> +static int bond_xmit_hash_policy_l34(const struct sk_buff *skb, int count)
> {
> - struct ethhdr *data = (struct ethhdr *)skb->data;
> - struct iphdr *iph = ip_hdr(skb);
> - __be16 *layer4hdr = (__be16 *)((u32 *)iph + iph->ihl);
> - int layer4_xor = 0;
> + u32 h;
> +
> + switch (skb->protocol) {
> + case htons(ETH_P_IP):
> + {
> + const struct iphdr *iph = ip_hdr(skb);
> + h = iph->saddr ^ iph->daddr;
>
> - if (skb->protocol == htons(ETH_P_IP)) {
> - if (!(iph->frag_off & htons(IP_MF|IP_OFFSET)) &&
> + if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
> (iph->protocol == IPPROTO_TCP ||
> - iph->protocol == IPPROTO_UDP)) {
> - layer4_xor = ntohs((*layer4hdr ^ *(layer4hdr + 1)));
> - }
> - return (layer4_xor ^
> - ((ntohl(iph->saddr ^ iph->daddr)) & 0xffff)) % count;
> + iph->protocol == IPPROTO_UDP ||
> + iph->protocol == IPPROTO_UDPLITE ||
> + iph->protocol == IPPROTO_SCTP ||
> + iph->protocol == IPPROTO_DCCP ||
> + iph->protocol == IPPROTO_ESP))
> + h ^= *(((u32*)iph) + iph->ihl);
>
> + break;
> + }
> + case htons(ETH_P_IPV6):
> + {
> + const struct ipv6hdr *iph = ipv6_hdr(skb);
> + h = iph->daddr.s6_addr32[3] ^
> + iph->saddr.s6_addr32[3] ^ iph->nexthdr;
> + if (iph->nexthdr == IPPROTO_TCP ||
> + iph->nexthdr == IPPROTO_UDP ||
> + iph->nexthdr == IPPROTO_UDPLITE ||
> + iph->nexthdr == IPPROTO_SCTP ||
> + iph->nexthdr == IPPROTO_DCCP ||
> + iph->nexthdr == IPPROTO_ESP)
> + h ^= *(u32*)&iph[1];
> + break;
> + }
> + default:
> + h = ntohs(skb->protocol);
> }
>
> - return (data->h_dest[5] ^ data->h_source[5]) % count;
> + return jhash(eth_hdr(skb), 2*ETH_ALEN, h) % count;
> }
>
I like the support for ipv6 and more protocols - but again, why the
skb->protocol as initializer? Also, why mix in iph->nexthdr into h in
the ipv6 case?
>
> /*
> * Hash for the output device based upon layer 2 data
> */
> -static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
> +static int bond_xmit_hash_policy_l2(const struct sk_buff *skb, int count)
> {
> - struct ethhdr *data = (struct ethhdr *)skb->data;
> -
> - return (data->h_dest[5] ^ data->h_source[5]) % count;
> + return jhash(eth_hdr(skb), 2*ETH_ALEN,
> + ntohs(skb->protocol)) % count;
> }
>
This one also needlessly incorporates the protocol into the hash.
On a meta-level, do you have any measurements showing biased output for
real traffic? My experience is that the normal xor code just works fine,
except for one specific setup in which the traffic itself is rather
biased (tons of ipsec between just two hosts + less normal traffic
between the rest of the network). In that case, it will also be
difficult to distribute this load even using the above changes.
Jasper
--
Ir. Jasper Spaans
Fox-IT Experts in IT Security!
T: +31 (0) 15 284 79 99
KvK Haaglanden 27301624
^ permalink raw reply
* [PATCH] netfilter: Fix a unregister_netdevice hang
From: Krishna Kumar @ 2010-02-04 9:14 UTC (permalink / raw)
To: davem, kaber; +Cc: netdev, netfilter-devel, Krishna Kumar, sri
From: Krishna Kumar <krkumar2@in.ibm.com>
When using ipv6+netfilter on vlan devices, we were getting
this hang consistantly in an internal distribution:
"unregister_netdevice: waiting for eth0.103 to become free. Usage count = 9"
Sometimes the hang is temporary lasting ~45 secs, and at
other times it is permanent. While fixing the internal bug,
I found the same bug exists in the current kernel.
In ip6_route_me_harder, besides dropping dst, I also moved
the check for dst->error up instead of waiting for the
xfrm_lookup result.
(untested since this bug was not reproducible on my system,
but this patch fixes the hang on the internal distro bits)
Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com>
---
net/ipv6/netfilter.c | 13 +++++++------
net/ipv6/netfilter/ip6t_REJECT.c | 6 ++++--
2 files changed, 11 insertions(+), 8 deletions(-)
diff -ruNp org/net/ipv6/netfilter/ip6t_REJECT.c new/net/ipv6/netfilter/ip6t_REJECT.c
--- org/net/ipv6/netfilter/ip6t_REJECT.c 2010-02-04 14:05:26.000000000 +0530
+++ new/net/ipv6/netfilter/ip6t_REJECT.c 2010-02-04 14:23:23.000000000 +0530
@@ -43,7 +43,7 @@ static void send_reset(struct net *net,
int tcphoff, needs_ack;
const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
struct ipv6hdr *ip6h;
- struct dst_entry *dst = NULL;
+ struct dst_entry *dst;
u8 proto;
struct flowi fl;
@@ -97,8 +97,10 @@ static void send_reset(struct net *net,
dst = ip6_route_output(net, NULL, &fl);
if (dst == NULL)
return;
- if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0))
+ if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0)) {
+ dst_release(dst);
return;
+ }
hh_len = (dst->dev->hard_header_len + 15)&~15;
nskb = alloc_skb(hh_len + 15 + dst->header_len + sizeof(struct ipv6hdr)
diff -ruNp org/net/ipv6/netfilter.c new/net/ipv6/netfilter.c
--- org/net/ipv6/netfilter.c 2010-02-04 14:05:16.000000000 +0530
+++ new/net/ipv6/netfilter.c 2010-02-04 14:07:16.000000000 +0530
@@ -25,6 +25,12 @@ int ip6_route_me_harder(struct sk_buff *
};
dst = ip6_route_output(net, skb->sk, &fl);
+ if (dst->error) {
+ IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
+ LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
+ dst_release(dst);
+ return -EINVAL;
+ }
#ifdef CONFIG_XFRM
if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
@@ -32,6 +38,7 @@ int ip6_route_me_harder(struct sk_buff *
struct dst_entry *dst2 = skb_dst(skb);
if (xfrm_lookup(net, &dst2, &fl, skb->sk, 0)) {
+ dst_release(dst);
skb_dst_set(skb, NULL);
return -1;
}
@@ -39,12 +46,6 @@ int ip6_route_me_harder(struct sk_buff *
}
#endif
- if (dst->error) {
- IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
- LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
- dst_release(dst);
- return -EINVAL;
- }
/* Drop old route. */
skb_dst_drop(skb);
^ permalink raw reply
* [net-2.6 PATCH] igb: make certain to reassign legacy interrupt vectors after reset
From: Jeff Kirsher @ 2010-02-04 7:59 UTC (permalink / raw)
To: davem; +Cc: netdev, gospo, Alexander Duyck, Jeff Kirsher
From: Alexander Duyck <alexander.h.duyck@intel.com>
This change corrects an issue that will cause false hangs when using either
82575 or 82580 in legacy interrupt mode. The issue is caused when there is
a slow traffic flow and an "ethtool -r" is executed while using legacy or
MSI interrupts. MSI-X is not affected by this issue due to the fact that
we were already reconfiguring the vectors after reset.
If possible it would be best to push this for net-2.6 since it is resolving
a bug but if that is not possible then net-next-2.6 will be fine.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
---
drivers/net/igb/igb_main.c | 20 +++++---------------
1 files changed, 5 insertions(+), 15 deletions(-)
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 997124d..c881347 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -421,6 +421,8 @@ static void igb_assign_vector(struct igb_q_vector *q_vector, int msix_vector)
msixbm = E1000_EICR_RX_QUEUE0 << rx_queue;
if (tx_queue > IGB_N0_QUEUE)
msixbm |= E1000_EICR_TX_QUEUE0 << tx_queue;
+ if (!adapter->msix_entries && msix_vector == 0)
+ msixbm |= E1000_EIMS_OTHER;
array_wr32(E1000_MSIXBM(0), msix_vector, msixbm);
q_vector->eims_value = msixbm;
break;
@@ -877,7 +879,6 @@ static int igb_request_irq(struct igb_adapter *adapter)
{
struct net_device *netdev = adapter->netdev;
struct pci_dev *pdev = adapter->pdev;
- struct e1000_hw *hw = &adapter->hw;
int err = 0;
if (adapter->msix_entries) {
@@ -909,20 +910,7 @@ static int igb_request_irq(struct igb_adapter *adapter)
igb_setup_all_tx_resources(adapter);
igb_setup_all_rx_resources(adapter);
} else {
- switch (hw->mac.type) {
- case e1000_82575:
- wr32(E1000_MSIXBM(0),
- (E1000_EICR_RX_QUEUE0 |
- E1000_EICR_TX_QUEUE0 |
- E1000_EIMS_OTHER));
- break;
- case e1000_82580:
- case e1000_82576:
- wr32(E1000_IVAR0, E1000_IVAR_VALID);
- break;
- default:
- break;
- }
+ igb_assign_vector(adapter->q_vector[0], 0);
}
if (adapter->flags & IGB_FLAG_HAS_MSI) {
@@ -1140,6 +1128,8 @@ int igb_up(struct igb_adapter *adapter)
}
if (adapter->msix_entries)
igb_configure_msix(adapter);
+ else
+ igb_assign_vector(adapter->q_vector[0], 0);
/* Clear any pending interrupts. */
rd32(E1000_ICR);
^ permalink raw reply related
* [ethtool PATCH] ethtool: Support n-tuple filter programming
From: Jeff Kirsher @ 2010-02-04 7:51 UTC (permalink / raw)
To: jeff, davem; +Cc: netdev, gospo, Peter P Waskiewicz Jr, Jeff Kirsher
From: Peter Waskiewicz <peter.p.waskiewicz.jr@intel.com>
Program underlying ethernet devices with n-tuple flow classification
filters.
This also adds a new flag to ethtool_flags, allowing n-tuple
programming to be toggled using the set_flags call.
Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
---
ethtool-copy.h | 35 +++++++++++++
ethtool.c | 156 ++++++++++++++++++++++++++++++++++++++++++++++++++++++--
2 files changed, 186 insertions(+), 5 deletions(-)
diff --git a/ethtool-copy.h b/ethtool-copy.h
index d366c3a..2681cd8 100644
--- a/ethtool-copy.h
+++ b/ethtool-copy.h
@@ -241,6 +241,7 @@ enum ethtool_stringset {
ETH_SS_TEST = 0,
ETH_SS_STATS,
ETH_SS_PRIV_FLAGS,
+ ETH_SS_NTUPLE_FILTERS,
};
/* for passing string sets for data tagging */
@@ -289,6 +290,7 @@ struct ethtool_perm_addr {
*/
enum ethtool_flags {
ETH_FLAG_LRO = (1 << 15), /* LRO is enabled */
+ ETH_FLAG_NTUPLE = (1 << 27), /* N-tuple filters enabled */
};
/* The following structures are for supporting RX network flow
@@ -374,6 +376,36 @@ struct ethtool_flash {
char data[ETHTOOL_FLASH_MAX_FILENAME];
};
+struct ethtool_rx_ntuple_flow_spec {
+ int flow_type;
+ union {
+ struct ethtool_tcpip4_spec tcp_ip4_spec;
+ struct ethtool_tcpip4_spec udp_ip4_spec;
+ struct ethtool_tcpip4_spec sctp_ip4_spec;
+ struct ethtool_ah_espip4_spec ah_ip4_spec;
+ struct ethtool_ah_espip4_spec esp_ip4_spec;
+ struct ethtool_rawip4_spec raw_ip4_spec;
+ struct ethtool_ether_spec ether_spec;
+ struct ethtool_usrip4_spec usr_ip4_spec;
+ __u8 hdata[64];
+ } h_u, m_u; /* entry, mask */
+
+ __u16 vlan_tag;
+ __u16 vlan_tag_mask;
+ __u64 data; /* user-defined flow spec data */
+ __u64 data_mask; /* user-defined flow spec mask */
+
+ /* signed to distinguish between queue and actions (DROP) */
+ int action;
+#define ETHTOOL_RXNTUPLE_ACTION_DROP -1
+};
+
+#define ETHTOOL_MAX_NTUPLE_LIST_ENTRY 1024
+#define ETHTOOL_MAX_NTUPLE_STRING_PER_ENTRY 14
+struct ethtool_rx_ntuple {
+ __u32 cmd;
+ struct ethtool_rx_ntuple_flow_spec fs;
+};
/* CMDs currently supported */
#define ETHTOOL_GSET 0x00000001 /* Get settings. */
@@ -431,6 +463,9 @@ struct ethtool_flash {
#define ETHTOOL_FLASHDEV 0x00000033 /* Flash firmware to device */
#define ETHTOOL_RESET 0x00000034 /* Reset hardware */
+#define ETHTOOL_SRXNTUPLE 0x00000035 /* Add an n-tuple filter to device */
+#define ETHTOOL_GRXNTUPLE 0x00000036 /* Get n-tuple filters from device */
+
/* compatibility with older code */
#define SPARC_ETH_GSET ETHTOOL_GSET
#define SPARC_ETH_SSET ETHTOOL_SSET
diff --git a/ethtool.c b/ethtool.c
index 10ff1f1..fc9e419 100644
--- a/ethtool.c
+++ b/ethtool.c
@@ -78,6 +78,8 @@ static char *unparse_rxfhashopts(u64 opts);
static int dump_rxfhash(int fhash, u64 val);
static int do_srxclass(int fd, struct ifreq *ifr);
static int do_grxclass(int fd, struct ifreq *ifr);
+static int do_srxntuple(int fd, struct ifreq *ifr);
+static int do_grxntuple(int fd, struct ifreq *ifr);
static int do_flash(int fd, struct ifreq *ifr);
static int send_ioctl(int fd, struct ifreq *ifr);
@@ -103,6 +105,8 @@ static enum {
MODE_GSTATS,
MODE_GNFC,
MODE_SNFC,
+ MODE_SNTUPLE,
+ MODE_GNTUPLE,
MODE_FLASHDEV,
} mode = MODE_GSET;
@@ -168,6 +172,7 @@ static struct option {
" [ gso on|off ]\n"
" [ gro on|off ]\n"
" [ lro on|off ]\n"
+ " [ ntuple on|off ]\n"
},
{ "-i", "--driver", MODE_GDRV, "Show driver information" },
{ "-d", "--register-dump", MODE_GREGS, "Do a register dump",
@@ -199,6 +204,16 @@ static struct option {
"classification options",
" [ rx-flow-hash tcp4|udp4|ah4|sctp4|"
"tcp6|udp6|ah6|sctp6 m|v|t|s|d|f|n|r... ]\n" },
+ { "-U", "--config-ntuple", MODE_SNTUPLE, "Configure Rx ntuple filters "
+ "and actions",
+ " [ flow-type tcp4|udp4|sctp4 src-ip <addr> "
+ "src-ip-mask <mask> dst-ip <addr> dst-ip-mask <mask> "
+ "src-port <port> src-port-mask <mask> dst-port <port> "
+ "dst-port-mask <mask> vlan <VLAN tag> vlan-mask <mask> "
+ "user-def <data> user-def-mask <mask> "
+ "action <queue or drop>\n" },
+ { "-u", "--show-ntuple", MODE_GNTUPLE,
+ "Get Rx ntuple filters and actions\n" },
{ "-h", "--help", MODE_HELP, "Show this help" },
{}
};
@@ -241,6 +256,7 @@ static int off_ufo_wanted = -1;
static int off_gso_wanted = -1;
static int off_lro_wanted = -1;
static int off_gro_wanted = -1;
+static int off_ntuple_wanted = -1;
static struct ethtool_pauseparam epause;
static int gpause_changed = 0;
@@ -312,6 +328,8 @@ static int rx_fhash_get = 0;
static int rx_fhash_set = 0;
static u32 rx_fhash_val = 0;
static int rx_fhash_changed = 0;
+static int sntuple_changed = 0;
+static struct ethtool_rx_ntuple_flow_spec ntuple_fs;
static char *flash_file = NULL;
static int flash = -1;
static int flash_region = -1;
@@ -363,6 +381,7 @@ static struct cmdline_info cmdline_offload[] = {
{ "gso", CMDL_BOOL, &off_gso_wanted, NULL },
{ "lro", CMDL_BOOL, &off_lro_wanted, NULL },
{ "gro", CMDL_BOOL, &off_gro_wanted, NULL },
+ { "ntuple", CMDL_BOOL, &off_ntuple_wanted, NULL },
};
static struct cmdline_info cmdline_pause[] = {
@@ -403,6 +422,22 @@ static struct cmdline_info cmdline_coalesce[] = {
{ "tx-frames-high", CMDL_INT, &coal_tx_frames_high_wanted, &ecoal.tx_max_coalesced_frames_high },
};
+static struct cmdline_info cmdline_ntuple[] = {
+ { "src-ip", CMDL_INT, &ntuple_fs.h_u.tcp_ip4_spec.ip4src, NULL },
+ { "src-ip-mask", CMDL_UINT, &ntuple_fs.m_u.tcp_ip4_spec.ip4src, NULL },
+ { "dst-ip", CMDL_INT, &ntuple_fs.h_u.tcp_ip4_spec.ip4dst, NULL },
+ { "dst-ip-mask", CMDL_UINT, &ntuple_fs.m_u.tcp_ip4_spec.ip4dst, NULL },
+ { "src-port", CMDL_INT, &ntuple_fs.h_u.tcp_ip4_spec.psrc, NULL },
+ { "src-port-mask", CMDL_UINT, &ntuple_fs.m_u.tcp_ip4_spec.psrc, NULL },
+ { "dst-port", CMDL_INT, &ntuple_fs.h_u.tcp_ip4_spec.pdst, NULL },
+ { "dst-port-mask", CMDL_UINT, &ntuple_fs.m_u.tcp_ip4_spec.pdst, NULL },
+ { "vlan", CMDL_INT, &ntuple_fs.vlan_tag, NULL },
+ { "vlan-mask", CMDL_UINT, &ntuple_fs.vlan_tag_mask, NULL },
+ { "user-def", CMDL_INT, &ntuple_fs.data, NULL },
+ { "user-def-mask", CMDL_UINT, &ntuple_fs.data_mask, NULL },
+ { "action", CMDL_INT, &ntuple_fs.action, NULL },
+};
+
static int get_int(char *str, int base)
{
long v;
@@ -544,6 +579,8 @@ static void parse_cmdline(int argc, char **argp)
(mode == MODE_GSTATS) ||
(mode == MODE_GNFC) ||
(mode == MODE_SNFC) ||
+ (mode == MODE_SNTUPLE) ||
+ (mode == MODE_GNTUPLE) ||
(mode == MODE_PHYS_ID) ||
(mode == MODE_FLASHDEV)) {
devname = argp[i];
@@ -626,6 +663,27 @@ static void parse_cmdline(int argc, char **argp)
i = argc;
break;
}
+ if (mode == MODE_SNTUPLE) {
+ if (!strcmp(argp[i], "flow-type")) {
+ i += 1;
+ if (i >= argc) {
+ show_usage(1);
+ break;
+ }
+ ntuple_fs.flow_type =
+ rxflow_str_to_type(argp[i]);
+ i += 1;
+ parse_generic_cmdline(argc, argp, i,
+ &sntuple_changed,
+ cmdline_ntuple,
+ ARRAY_SIZE(cmdline_ntuple));
+ i = argc;
+ break;
+ } else {
+ show_usage(1);
+ }
+ break;
+ }
if (mode == MODE_GNFC) {
if (!strcmp(argp[i], "rx-flow-hash")) {
i += 1;
@@ -1468,7 +1526,7 @@ static int dump_coalesce(void)
}
static int dump_offload(int rx, int tx, int sg, int tso, int ufo, int gso,
- int gro, int lro)
+ int gro, int lro, int ntuple)
{
fprintf(stdout,
"rx-checksumming: %s\n"
@@ -1478,7 +1536,8 @@ static int dump_offload(int rx, int tx, int sg, int tso, int ufo, int gso,
"udp-fragmentation-offload: %s\n"
"generic-segmentation-offload: %s\n"
"generic-receive-offload: %s\n"
- "large-receive-offload: %s\n",
+ "large-receive-offload: %s\n"
+ "ntuple-filters: %s\n",
rx ? "on" : "off",
tx ? "on" : "off",
sg ? "on" : "off",
@@ -1486,7 +1545,8 @@ static int dump_offload(int rx, int tx, int sg, int tso, int ufo, int gso,
ufo ? "on" : "off",
gso ? "on" : "off",
gro ? "on" : "off",
- lro ? "on" : "off");
+ lro ? "on" : "off",
+ ntuple ? "on" : "off");
return 0;
}
@@ -1590,6 +1650,10 @@ static int doit(void)
return do_grxclass(fd, &ifr);
} else if (mode == MODE_SNFC) {
return do_srxclass(fd, &ifr);
+ } else if (mode == MODE_SNTUPLE) {
+ return do_srxntuple(fd, &ifr);
+ } else if (mode == MODE_GNTUPLE) {
+ return do_grxntuple(fd, &ifr);
} else if (mode == MODE_FLASHDEV) {
return do_flash(fd, &ifr);
}
@@ -1799,7 +1863,7 @@ static int do_goffload(int fd, struct ifreq *ifr)
{
struct ethtool_value eval;
int err, allfail = 1, rx = 0, tx = 0, sg = 0;
- int tso = 0, ufo = 0, gso = 0, gro = 0, lro = 0;
+ int tso = 0, ufo = 0, gso = 0, gro = 0, lro = 0, ntuple = 0;
fprintf(stdout, "Offload parameters for %s:\n", devname);
@@ -1870,6 +1934,7 @@ static int do_goffload(int fd, struct ifreq *ifr)
perror("Cannot get device flags");
} else {
lro = (eval.data & ETH_FLAG_LRO) != 0;
+ ntuple = (eval.data & ETH_FLAG_NTUPLE) != 0;
allfail = 0;
}
@@ -1888,7 +1953,7 @@ static int do_goffload(int fd, struct ifreq *ifr)
return 83;
}
- return dump_offload(rx, tx, sg, tso, ufo, gso, gro, lro);
+ return dump_offload(rx, tx, sg, tso, ufo, gso, gro, lro, ntuple);
}
static int do_soffload(int fd, struct ifreq *ifr)
@@ -1999,6 +2064,29 @@ static int do_soffload(int fd, struct ifreq *ifr)
return 93;
}
}
+ if (off_ntuple_wanted >= 0) {
+ changed = 1;
+ eval.cmd = ETHTOOL_GFLAGS;
+ eval.data = 0;
+ ifr->ifr_data = (caddr_t)&eval;
+ err = ioctl(fd, SIOCETHTOOL, ifr);
+ if (err) {
+ perror("Cannot get device flag settings");
+ return 91;
+ }
+
+ eval.cmd = ETHTOOL_SFLAGS;
+ if (off_ntuple_wanted == 1)
+ eval.data |= ETH_FLAG_NTUPLE;
+ else
+ eval.data &= ~ETH_FLAG_NTUPLE;
+
+ err = ioctl(fd, SIOCETHTOOL, ifr);
+ if (err) {
+ perror("Cannot set n-tuple filter settings");
+ return 93;
+ }
+ }
if (!changed) {
fprintf(stdout, "no offload settings changed\n");
@@ -2545,6 +2633,64 @@ static int do_flash(int fd, struct ifreq *ifr)
return err;
}
+static int do_srxntuple(int fd, struct ifreq *ifr)
+{
+ int err;
+
+ if (sntuple_changed) {
+ struct ethtool_rx_ntuple ntuplecmd;
+
+ ntuplecmd.cmd = ETHTOOL_SRXNTUPLE;
+ memcpy(&ntuplecmd.fs, &ntuple_fs,
+ sizeof(struct ethtool_rx_ntuple_flow_spec));
+
+ ifr->ifr_data = (caddr_t)&ntuplecmd;
+ err = ioctl(fd, SIOCETHTOOL, ifr);
+ if (err < 0)
+ perror("Cannot add new RX n-tuple filter");
+ } else {
+ show_usage(1);
+ }
+
+ return 0;
+}
+
+static int do_grxntuple(int fd, struct ifreq *ifr)
+{
+ struct ethtool_gstrings *strings;
+ int sz_str, n_strings, err, i;
+
+ n_strings = ETHTOOL_MAX_NTUPLE_LIST_ENTRY *
+ ETHTOOL_MAX_NTUPLE_STRING_PER_ENTRY;
+ sz_str = n_strings * ETH_GSTRING_LEN;
+
+ strings = calloc(1, sz_str + sizeof(struct ethtool_gstrings));
+ if (!strings) {
+ fprintf(stderr, "no memory available\n");
+ return 95;
+ }
+
+ strings->cmd = ETHTOOL_GRXNTUPLE;
+ strings->string_set = ETH_SS_NTUPLE_FILTERS;
+ strings->len = n_strings;
+ ifr->ifr_data = (caddr_t) strings;
+ err = send_ioctl(fd, ifr);
+ if (err < 0) {
+ perror("Cannot get Rx n-tuple information");
+ free(strings);
+ return 100;
+ }
+
+ n_strings = strings->len;
+ fprintf(stdout, "Rx n-tuple filters:\n");
+ for (i = 0; i < n_strings; i++)
+ fprintf(stdout, "%s", &strings->data[i * ETH_GSTRING_LEN]);
+
+ free(strings);
+
+ return 0;
+}
+
static int send_ioctl(int fd, struct ifreq *ifr)
{
return ioctl(fd, SIOCETHTOOL, ifr);
^ permalink raw reply related
* [net-next-2.6 PATCH v2 3/3] ixgbe: Bump driver version up
From: Jeff Kirsher @ 2010-02-04 7:48 UTC (permalink / raw)
To: davem; +Cc: netdev, gospo, Peter P Waskiewicz Jr, Jeff Kirsher
In-Reply-To: <20100204074811.16559.84676.stgit@localhost.localdomain>
From: Peter Waskiewicz <peter.p.waskiewicz.jr@intel.com>
Driver has gone under significant changes, the version should
reflect that.
Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
---
drivers/net/ixgbe/ixgbe_main.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index ca57e74..c308b59 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -51,7 +51,7 @@ char ixgbe_driver_name[] = "ixgbe";
static const char ixgbe_driver_string[] =
"Intel(R) 10 Gigabit PCI Express Network Driver";
-#define DRV_VERSION "2.0.44-k2"
+#define DRV_VERSION "2.0.62-k2"
const char ixgbe_driver_version[] = DRV_VERSION;
static char ixgbe_copyright[] = "Copyright (c) 1999-2010 Intel Corporation.";
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox