* [patch v2.3 3/4] IPVS: make FTP work with full NAT support
From: Simon Horman @ 2010-07-04 11:32 UTC (permalink / raw)
To: lvs-devel, netdev, linux-kernel, netfilter, netfilter-devel
Cc: Malcolm Turnbull, Wensong Zhang, Julius Volz, Patrick McHardy,
David S. Miller, Hannes Eder
In-Reply-To: <20100704113246.562399500@vergenet.net>
[-- Attachment #1: IPVS-make-FTP-work-with-full-NAT-support.patch --]
[-- Type: text/plain, Size: 11854 bytes --]
From: Hannes Eder <heder@google.com>
Use nf_conntrack/nf_nat code to do the packet mangling and the TCP
sequence adjusting. The function 'ip_vs_skb_replace' is now dead
code, so it is removed.
To SNAT FTP, use something like:
% iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \
> --vport 21 -j SNAT --to-source 192.168.10.10
and for the data connections in passive mode:
% iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \
> --vportctl 21 -j SNAT --to-source 192.168.10.10
using '-m state --state RELATED' would also works.
Make sure the kernel modules ip_vs_ftp, nf_conntrack_ftp, and
nf_nat_ftp are loaded.
[ up-port and minor fixes by Simon Horman <horms@verge.net.au> ]
Signed-off-by: Hannes Eder <heder@google.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
include/net/ip_vs.h | 2
net/netfilter/ipvs/Kconfig | 2
net/netfilter/ipvs/ip_vs_app.c | 43 ----------
net/netfilter/ipvs/ip_vs_core.c | 1
net/netfilter/ipvs/ip_vs_ftp.c | 164 ++++++++++++++++++++++++++++++++++++---
5 files changed, 153 insertions(+), 59 deletions(-)
v2.1
* Up-port
v2.2
* No change
v2.3
* Up-port
* Use %pI4 instead of NIPQUAD
* Drop buf_len = snprintf() change - its a separate, cosmetic, fix
Index: nf-next-2.6/include/net/ip_vs.h
===================================================================
--- nf-next-2.6.orig/include/net/ip_vs.h 2010-07-04 20:30:19.000000000 +0900
+++ nf-next-2.6/include/net/ip_vs.h 2010-07-04 20:32:06.000000000 +0900
@@ -736,8 +736,6 @@ extern void ip_vs_app_inc_put(struct ip_
extern int ip_vs_app_pkt_out(struct ip_vs_conn *, struct sk_buff *skb);
extern int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff *skb);
-extern int ip_vs_skb_replace(struct sk_buff *skb, gfp_t pri,
- char *o_buf, int o_len, char *n_buf, int n_len);
extern int ip_vs_app_init(void);
extern void ip_vs_app_cleanup(void);
Index: nf-next-2.6/net/netfilter/ipvs/Kconfig
===================================================================
--- nf-next-2.6.orig/net/netfilter/ipvs/Kconfig 2010-07-04 20:32:05.000000000 +0900
+++ nf-next-2.6/net/netfilter/ipvs/Kconfig 2010-07-04 20:32:06.000000000 +0900
@@ -238,7 +238,7 @@ comment 'IPVS application helper'
config IP_VS_FTP
tristate "FTP protocol helper"
- depends on IP_VS_PROTO_TCP
+ depends on IP_VS_PROTO_TCP && NF_NAT
---help---
FTP is a protocol that transfers IP address and/or port number in
the payload. In the virtual server via Network Address Translation,
Index: nf-next-2.6/net/netfilter/ipvs/ip_vs_app.c
===================================================================
--- nf-next-2.6.orig/net/netfilter/ipvs/ip_vs_app.c 2010-07-04 20:30:19.000000000 +0900
+++ nf-next-2.6/net/netfilter/ipvs/ip_vs_app.c 2010-07-04 20:32:06.000000000 +0900
@@ -569,49 +569,6 @@ static const struct file_operations ip_v
};
#endif
-
-/*
- * Replace a segment of data with a new segment
- */
-int ip_vs_skb_replace(struct sk_buff *skb, gfp_t pri,
- char *o_buf, int o_len, char *n_buf, int n_len)
-{
- int diff;
- int o_offset;
- int o_left;
-
- EnterFunction(9);
-
- diff = n_len - o_len;
- o_offset = o_buf - (char *)skb->data;
- /* The length of left data after o_buf+o_len in the skb data */
- o_left = skb->len - (o_offset + o_len);
-
- if (diff <= 0) {
- memmove(o_buf + n_len, o_buf + o_len, o_left);
- memcpy(o_buf, n_buf, n_len);
- skb_trim(skb, skb->len + diff);
- } else if (diff <= skb_tailroom(skb)) {
- skb_put(skb, diff);
- memmove(o_buf + n_len, o_buf + o_len, o_left);
- memcpy(o_buf, n_buf, n_len);
- } else {
- if (pskb_expand_head(skb, skb_headroom(skb), diff, pri))
- return -ENOMEM;
- skb_put(skb, diff);
- memmove(skb->data + o_offset + n_len,
- skb->data + o_offset + o_len, o_left);
- skb_copy_to_linear_data_offset(skb, o_offset, n_buf, n_len);
- }
-
- /* must update the iph total length here */
- ip_hdr(skb)->tot_len = htons(skb->len);
-
- LeaveFunction(9);
- return 0;
-}
-
-
int __init ip_vs_app_init(void)
{
/* we will replace it with proc_net_ipvs_create() soon */
Index: nf-next-2.6/net/netfilter/ipvs/ip_vs_core.c
===================================================================
--- nf-next-2.6.orig/net/netfilter/ipvs/ip_vs_core.c 2010-07-04 20:32:05.000000000 +0900
+++ nf-next-2.6/net/netfilter/ipvs/ip_vs_core.c 2010-07-04 20:32:06.000000000 +0900
@@ -54,7 +54,6 @@
EXPORT_SYMBOL(register_ip_vs_scheduler);
EXPORT_SYMBOL(unregister_ip_vs_scheduler);
-EXPORT_SYMBOL(ip_vs_skb_replace);
EXPORT_SYMBOL(ip_vs_proto_name);
EXPORT_SYMBOL(ip_vs_conn_new);
EXPORT_SYMBOL(ip_vs_conn_in_get);
Index: nf-next-2.6/net/netfilter/ipvs/ip_vs_ftp.c
===================================================================
--- nf-next-2.6.orig/net/netfilter/ipvs/ip_vs_ftp.c 2010-07-04 20:30:19.000000000 +0900
+++ nf-next-2.6/net/netfilter/ipvs/ip_vs_ftp.c 2010-07-04 20:32:06.000000000 +0900
@@ -20,6 +20,17 @@
*
* Author: Wouter Gadeyne
*
+ *
+ * Code for ip_vs_expect_related and ip_vs_expect_callback is taken from
+ * http://www.ssi.bg/~ja/nfct/:
+ *
+ * ip_vs_nfct.c: Netfilter connection tracking support for IPVS
+ *
+ * Portions Copyright (C) 2001-2002
+ * Antefacto Ltd, 181 Parnell St, Dublin 1, Ireland.
+ *
+ * Portions Copyright (C) 2003-2008
+ * Julian Anastasov
*/
#define KMSG_COMPONENT "IPVS"
@@ -32,6 +43,9 @@
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_nat_helper.h>
#include <linux/gfp.h>
#include <net/protocol.h>
#include <net/tcp.h>
@@ -43,6 +57,16 @@
#define SERVER_STRING "227 Entering Passive Mode ("
#define CLIENT_STRING "PORT "
+#define FMT_TUPLE "%pI4:%u->%pI4:%u/%u"
+#define ARG_TUPLE(T) (T)->src.u3.ip, ntohs((T)->src.u.all), \
+ (T)->dst.u3.ip, ntohs((T)->dst.u.all), \
+ (T)->dst.protonum
+
+#define FMT_CONN "%pI4:%u->%pI4:%u->%pI4:%u/%u:%u"
+#define ARG_CONN(C) (C)->caddr, ntohs((C)->cport), \
+ (C)->vaddr, ntohs((C)->vport), \
+ (C)->daddr, ntohs((C)->dport), \
+ (C)->protocol, (C)->state
/*
* List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
@@ -123,6 +147,119 @@ static int ip_vs_ftp_get_addrport(char *
return 1;
}
+/*
+ * Called from init_conntrack() as expectfn handler.
+ */
+static void
+ip_vs_expect_callback(struct nf_conn *ct,
+ struct nf_conntrack_expect *exp)
+{
+ struct nf_conntrack_tuple *orig, new_reply;
+ struct ip_vs_conn *cp;
+
+ if (exp->tuple.src.l3num != PF_INET)
+ return;
+
+ /*
+ * We assume that no NF locks are held before this callback.
+ * ip_vs_conn_out_get and ip_vs_conn_in_get should match their
+ * expectations even if they use wildcard values, now we provide the
+ * actual values from the newly created original conntrack direction.
+ * The conntrack is confirmed when packet reaches IPVS hooks.
+ */
+
+ /* RS->CLIENT */
+ orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+ cp = ip_vs_conn_out_get(exp->tuple.src.l3num, orig->dst.protonum,
+ &orig->src.u3, orig->src.u.tcp.port,
+ &orig->dst.u3, orig->dst.u.tcp.port);
+ if (cp) {
+ /* Change reply CLIENT->RS to CLIENT->VS */
+ new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+ IP_VS_DBG(7, "%s(): ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "
+ FMT_TUPLE ", found inout cp=" FMT_CONN "\n",
+ __func__, ct, ct->status,
+ ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
+ ARG_CONN(cp));
+ new_reply.dst.u3 = cp->vaddr;
+ new_reply.dst.u.tcp.port = cp->vport;
+ IP_VS_DBG(7, "%s(): ct=%p, new tuples=" FMT_TUPLE ", " FMT_TUPLE
+ ", inout cp=" FMT_CONN "\n",
+ __func__, ct,
+ ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
+ ARG_CONN(cp));
+ goto alter;
+ }
+
+ /* CLIENT->VS */
+ cp = ip_vs_conn_in_get(exp->tuple.src.l3num, orig->dst.protonum,
+ &orig->src.u3, orig->src.u.tcp.port,
+ &orig->dst.u3, orig->dst.u.tcp.port);
+ if (cp) {
+ /* Change reply VS->CLIENT to RS->CLIENT */
+ new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+ IP_VS_DBG(7, "%s(): ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "
+ FMT_TUPLE ", found outin cp=" FMT_CONN "\n",
+ __func__, ct, ct->status,
+ ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
+ ARG_CONN(cp));
+ new_reply.src.u3 = cp->daddr;
+ new_reply.src.u.tcp.port = cp->dport;
+ IP_VS_DBG(7, "%s(): ct=%p, new tuples=" FMT_TUPLE ", "
+ FMT_TUPLE ", outin cp=" FMT_CONN "\n",
+ __func__, ct,
+ ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
+ ARG_CONN(cp));
+ goto alter;
+ }
+
+ IP_VS_DBG(7, "%s(): ct=%p, status=0x%lX, tuple=" FMT_TUPLE
+ " - unknown expect\n",
+ __func__, ct, ct->status, ARG_TUPLE(orig));
+ return;
+
+alter:
+ /* Never alter conntrack for non-NAT conns */
+ if (IP_VS_FWD_METHOD(cp) == IP_VS_CONN_F_MASQ)
+ nf_conntrack_alter_reply(ct, &new_reply);
+ ip_vs_conn_put(cp);
+ return;
+}
+
+/*
+ * Create NF conntrack expectation with wildcard (optional) source port.
+ * Then the default callback function will alter the reply and will confirm
+ * the conntrack entry when the first packet comes.
+ */
+static void
+ip_vs_expect_related(struct sk_buff *skb, struct nf_conn *ct,
+ struct ip_vs_conn *cp, u_int8_t proto,
+ const __be16 *port, int from_rs)
+{
+ struct nf_conntrack_expect *exp;
+
+ BUG_ON(!ct || ct == &nf_conntrack_untracked);
+
+ exp = nf_ct_expect_alloc(ct);
+ if (!exp)
+ return;
+
+ if (from_rs)
+ nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
+ nf_ct_l3num(ct), &cp->daddr, &cp->caddr,
+ proto, port, &cp->cport);
+ else
+ nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT,
+ nf_ct_l3num(ct), &cp->caddr, &cp->vaddr,
+ proto, port, &cp->vport);
+
+ exp->expectfn = ip_vs_expect_callback;
+
+ IP_VS_DBG(7, "%s(): ct=%p, expect tuple=" FMT_TUPLE "\n",
+ __func__, ct, ARG_TUPLE(&exp->tuple));
+ nf_ct_expect_related(exp);
+ nf_ct_expect_put(exp);
+}
/*
* Look at outgoing ftp packets to catch the response to a PASV command
@@ -147,9 +284,11 @@ static int ip_vs_ftp_out(struct ip_vs_ap
union nf_inet_addr from;
__be16 port;
struct ip_vs_conn *n_cp;
- char buf[24]; /* xxx.xxx.xxx.xxx,ppp,ppp\000 */
+ char buf[sizeof("xxx,xxx,xxx,xxx,ppp,ppp")];
unsigned buf_len;
int ret;
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn *ct;
#ifdef CONFIG_IP_VS_IPV6
/* This application helper doesn't work with IPv6 yet,
@@ -219,19 +358,23 @@ static int ip_vs_ftp_out(struct ip_vs_ap
buf_len = strlen(buf);
+ ct = nf_ct_get(skb, &ctinfo);
+ ret = nf_nat_mangle_tcp_packet(skb,
+ ct,
+ ctinfo,
+ start-data,
+ end-start,
+ buf,
+ buf_len);
+
+ if (ct && ct != &nf_conntrack_untracked)
+ ip_vs_expect_related(skb, ct, n_cp,
+ IPPROTO_TCP, NULL, 0);
+
/*
- * Calculate required delta-offset to keep TCP happy
+ * Not setting 'diff' is intentional, otherwise the sequence
+ * would be adjusted twice.
*/
- *diff = buf_len - (end-start);
-
- if (*diff == 0) {
- /* simply replace it with new passive address */
- memcpy(start, buf, buf_len);
- ret = 1;
- } else {
- ret = !ip_vs_skb_replace(skb, GFP_ATOMIC, start,
- end-start, buf, buf_len);
- }
cp->app_data = NULL;
ip_vs_tcp_conn_listen(n_cp);
@@ -263,6 +406,7 @@ static int ip_vs_ftp_in(struct ip_vs_app
union nf_inet_addr to;
__be16 port;
struct ip_vs_conn *n_cp;
+ struct nf_conn *ct;
#ifdef CONFIG_IP_VS_IPV6
/* This application helper doesn't work with IPv6 yet,
@@ -349,6 +493,11 @@ static int ip_vs_ftp_in(struct ip_vs_app
ip_vs_control_add(n_cp, cp);
}
+ ct = (struct nf_conn *)skb->nfct;
+ if (ct && ct != &nf_conntrack_untracked)
+ ip_vs_expect_related(skb, ct, n_cp,
+ IPPROTO_TCP, &n_cp->dport, 1);
+
/*
* Move tunnel to listen state
*/
^ permalink raw reply
* [patch v2.3 2/4] IPVS: make friends with nf_conntrack
From: Simon Horman @ 2010-07-04 11:32 UTC (permalink / raw)
To: lvs-devel, netdev, linux-kernel, netfilter, netfilter-devel
Cc: Malcolm Turnbull, Wensong Zhang, Julius Volz, Patrick McHardy,
David S. Miller, Hannes Eder
In-Reply-To: <20100704113246.562399500@vergenet.net>
[-- Attachment #1: IPVS-make-friends-with-nf_conntrack.patch --]
[-- Type: text/plain, Size: 5504 bytes --]
From: Hannes Eder <heder@google.com>
Update the nf_conntrack tuple in reply direction, as we will see
traffic from the real server (RIP) to the client (CIP). Once this is
done we can use netfilters SNAT in POSTROUTING, especially with
xt_ipvs, to do source NAT, e.g.:
% iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 --vport 80 \
> -j SNAT --to-source 192.168.10.10
Signed-off-by: Hannes Eder <heder@google.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
net/netfilter/ipvs/Kconfig | 2 +-
net/netfilter/ipvs/ip_vs_core.c | 36 ------------------------------------
net/netfilter/ipvs/ip_vs_xmit.c | 30 ++++++++++++++++++++++++++++++
3 files changed, 31 insertions(+), 37 deletions(-)
v2.1, v2.2, v2.3
No change
Index: nf-next-2.6/net/netfilter/ipvs/Kconfig
===================================================================
--- nf-next-2.6.orig/net/netfilter/ipvs/Kconfig 2010-07-04 20:18:12.000000000 +0900
+++ nf-next-2.6/net/netfilter/ipvs/Kconfig 2010-07-04 20:18:33.000000000 +0900
@@ -3,7 +3,7 @@
#
menuconfig IP_VS
tristate "IP virtual server support"
- depends on NET && INET && NETFILTER
+ depends on NET && INET && NETFILTER && NF_CONNTRACK
---help---
IP Virtual Server support will let you build a high-performance
virtual server based on cluster of two or more real servers. This
Index: nf-next-2.6/net/netfilter/ipvs/ip_vs_core.c
===================================================================
--- nf-next-2.6.orig/net/netfilter/ipvs/ip_vs_core.c 2010-07-04 20:18:12.000000000 +0900
+++ nf-next-2.6/net/netfilter/ipvs/ip_vs_core.c 2010-07-04 20:18:33.000000000 +0900
@@ -536,26 +536,6 @@ int ip_vs_leave(struct ip_vs_service *sv
return NF_DROP;
}
-
-/*
- * It is hooked before NF_IP_PRI_NAT_SRC at the NF_INET_POST_ROUTING
- * chain, and is used for VS/NAT.
- * It detects packets for VS/NAT connections and sends the packets
- * immediately. This can avoid that iptable_nat mangles the packets
- * for VS/NAT.
- */
-static unsigned int ip_vs_post_routing(unsigned int hooknum,
- struct sk_buff *skb,
- const struct net_device *in,
- const struct net_device *out,
- int (*okfn)(struct sk_buff *))
-{
- if (!skb->ipvs_property)
- return NF_ACCEPT;
- /* The packet was sent from IPVS, exit this chain */
- return NF_STOP;
-}
-
__sum16 ip_vs_checksum_complete(struct sk_buff *skb, int offset)
{
return csum_fold(skb_checksum(skb, offset, skb->len - offset, 0));
@@ -1499,14 +1479,6 @@ static struct nf_hook_ops ip_vs_ops[] __
.hooknum = NF_INET_FORWARD,
.priority = 99,
},
- /* Before the netfilter connection tracking, exit from POST_ROUTING */
- {
- .hook = ip_vs_post_routing,
- .owner = THIS_MODULE,
- .pf = PF_INET,
- .hooknum = NF_INET_POST_ROUTING,
- .priority = NF_IP_PRI_NAT_SRC-1,
- },
#ifdef CONFIG_IP_VS_IPV6
/* After packet filtering, forward packet through VS/DR, VS/TUN,
* or VS/NAT(change destination), so that filtering rules can be
@@ -1535,14 +1507,6 @@ static struct nf_hook_ops ip_vs_ops[] __
.hooknum = NF_INET_FORWARD,
.priority = 99,
},
- /* Before the netfilter connection tracking, exit from POST_ROUTING */
- {
- .hook = ip_vs_post_routing,
- .owner = THIS_MODULE,
- .pf = PF_INET6,
- .hooknum = NF_INET_POST_ROUTING,
- .priority = NF_IP6_PRI_NAT_SRC-1,
- },
#endif
};
Index: nf-next-2.6/net/netfilter/ipvs/ip_vs_xmit.c
===================================================================
--- nf-next-2.6.orig/net/netfilter/ipvs/ip_vs_xmit.c 2010-07-04 16:15:59.000000000 +0900
+++ nf-next-2.6/net/netfilter/ipvs/ip_vs_xmit.c 2010-07-04 20:18:33.000000000 +0900
@@ -28,6 +28,7 @@
#include <net/ip6_route.h>
#include <linux/icmpv6.h>
#include <linux/netfilter.h>
+#include <net/netfilter/nf_conntrack.h>
#include <linux/netfilter_ipv4.h>
#include <net/ip_vs.h>
@@ -348,6 +349,31 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb
}
#endif
+static void
+ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp)
+{
+ struct nf_conn *ct = (struct nf_conn *)skb->nfct;
+ struct nf_conntrack_tuple new_tuple;
+
+ if (ct == NULL || ct == &nf_conntrack_untracked ||
+ nf_ct_is_confirmed(ct))
+ return;
+
+ /*
+ * The connection is not yet in the hashtable, so we update it.
+ * CIP->VIP will remain the same, so leave the tuple in
+ * IP_CT_DIR_ORIGINAL untouched. When the reply comes back from the
+ * real-server we will see RIP->DIP.
+ */
+ new_tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+ new_tuple.src.u3 = cp->daddr;
+ /*
+ * This will also take care of UDP and other protocols.
+ */
+ new_tuple.src.u.tcp.port = cp->dport;
+ nf_conntrack_alter_reply(ct, &new_tuple);
+}
+
/*
* NAT transmitter (only for outside-to-inside nat forwarding)
* Not used for related ICMP
@@ -403,6 +429,8 @@ ip_vs_nat_xmit(struct sk_buff *skb, stru
IP_VS_DBG_PKT(10, pp, skb, 0, "After DNAT");
+ ip_vs_update_conntrack(skb, cp);
+
/* FIXME: when application helper enlarges the packet and the length
is larger than the MTU of outgoing device, there will be still
MTU problem. */
@@ -479,6 +507,8 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, s
IP_VS_DBG_PKT(10, pp, skb, 0, "After DNAT");
+ ip_vs_update_conntrack(skb, cp);
+
/* FIXME: when application helper enlarges the packet and the length
is larger than the MTU of outgoing device, there will be still
MTU problem. */
^ permalink raw reply
* [patch v2.3 1/4] netfilter: xt_ipvs (netfilter matcher for IPVS)
From: Simon Horman @ 2010-07-04 11:32 UTC (permalink / raw)
To: lvs-devel, netdev, linux-kernel, netfilter, netfilter-devel
Cc: Malcolm Turnbull, Wensong Zhang, Julius Volz, Patrick McHardy,
David S. Miller, Hannes Eder
In-Reply-To: <20100704113246.562399500@vergenet.net>
[-- Attachment #1: netfilter-xt_ipvs-netfilter-matcher-for-IPVS.patch --]
[-- Type: text/plain, Size: 8570 bytes --]
From: Hannes Eder <heder@google.com>
This implements the kernel-space side of the netfilter matcher xt_ipvs.
[ minor fixes by Simon Horman <horms@verge.net.au> ]
Signed-off-by: Hannes Eder <heder@google.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
include/linux/netfilter/xt_ipvs.h | 25 ++++
net/netfilter/Kconfig | 10 +
net/netfilter/Makefile | 1
net/netfilter/ipvs/ip_vs_proto.c | 1
net/netfilter/xt_ipvs.c | 187 +++++++++++++++++++++++++++++++++++++
5 files changed, 224 insertions(+), 0 deletions(-)
create mode 100644 include/linux/netfilter/xt_ipvs.h
create mode 100644 net/netfilter/xt_ipvs.c
v2.1, v2.2
No Change
v2.3
As per advice from Patrick McHardy
* Don't define a value for _XT_IPVS_H in xt_ipvs.h
* Depend on NF_CONNTRACK
* Update to new API
- ipvs_mt_check() should return an int rather than a bool
- Change type of ipvs_mt()'s par parameter from
struct xt_action_param to struct xt_match_param
- Make ipvs_mt()'s par parameter non-const
Index: nf-next-2.6/include/linux/netfilter/xt_ipvs.h
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ nf-next-2.6/include/linux/netfilter/xt_ipvs.h 2010-07-04 16:22:19.000000000 +0900
@@ -0,0 +1,25 @@
+#ifndef _XT_IPVS_H
+#define _XT_IPVS_H
+
+#define XT_IPVS_IPVS_PROPERTY (1 << 0) /* all other options imply this one */
+#define XT_IPVS_PROTO (1 << 1)
+#define XT_IPVS_VADDR (1 << 2)
+#define XT_IPVS_VPORT (1 << 3)
+#define XT_IPVS_DIR (1 << 4)
+#define XT_IPVS_METHOD (1 << 5)
+#define XT_IPVS_VPORTCTL (1 << 6)
+#define XT_IPVS_MASK ((1 << 7) - 1)
+#define XT_IPVS_ONCE_MASK (XT_IPVS_MASK & ~XT_IPVS_IPVS_PROPERTY)
+
+struct xt_ipvs_mtinfo {
+ union nf_inet_addr vaddr, vmask;
+ __be16 vport;
+ __u16 l4proto;
+ __u16 fwd_method;
+ __be16 vportctl;
+
+ __u8 invert;
+ __u8 bitmask;
+};
+
+#endif /* _XT_IPVS_H */
Index: nf-next-2.6/net/netfilter/Kconfig
===================================================================
--- nf-next-2.6.orig/net/netfilter/Kconfig 2010-07-04 16:21:28.000000000 +0900
+++ nf-next-2.6/net/netfilter/Kconfig 2010-07-04 16:22:19.000000000 +0900
@@ -726,6 +726,16 @@ config NETFILTER_XT_MATCH_IPRANGE
If unsure, say M.
+config NETFILTER_XT_MATCH_IPVS
+ tristate '"ipvs" match support'
+ depends on IP_VS
+ depends on NETFILTER_ADVANCED
+ depends on NF_CONNTRACK
+ help
+ This option allows you to match against IPVS properties of a packet.
+
+ If unsure, say N.
+
config NETFILTER_XT_MATCH_LENGTH
tristate '"length" match support'
depends on NETFILTER_ADVANCED
Index: nf-next-2.6/net/netfilter/Makefile
===================================================================
--- nf-next-2.6.orig/net/netfilter/Makefile 2010-07-04 16:21:28.000000000 +0900
+++ nf-next-2.6/net/netfilter/Makefile 2010-07-04 16:22:19.000000000 +0900
@@ -76,6 +76,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMI
obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
obj-$(CONFIG_NETFILTER_XT_MATCH_IPRANGE) += xt_iprange.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_IPVS) += xt_ipvs.o
obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
obj-$(CONFIG_NETFILTER_XT_MATCH_LIMIT) += xt_limit.o
obj-$(CONFIG_NETFILTER_XT_MATCH_MAC) += xt_mac.o
Index: nf-next-2.6/net/netfilter/ipvs/ip_vs_proto.c
===================================================================
--- nf-next-2.6.orig/net/netfilter/ipvs/ip_vs_proto.c 2010-07-04 16:21:28.000000000 +0900
+++ nf-next-2.6/net/netfilter/ipvs/ip_vs_proto.c 2010-07-04 16:22:19.000000000 +0900
@@ -98,6 +98,7 @@ struct ip_vs_protocol * ip_vs_proto_get(
return NULL;
}
+EXPORT_SYMBOL(ip_vs_proto_get);
/*
Index: nf-next-2.6/net/netfilter/xt_ipvs.c
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ nf-next-2.6/net/netfilter/xt_ipvs.c 2010-07-04 16:43:17.000000000 +0900
@@ -0,0 +1,189 @@
+/*
+ * xt_ipvs - kernel module to match IPVS connection properties
+ *
+ * Author: Hannes Eder <heder@google.com>
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/spinlock.h>
+#include <linux/skbuff.h>
+#ifdef CONFIG_IP_VS_IPV6
+#include <net/ipv6.h>
+#endif
+#include <linux/ip_vs.h>
+#include <linux/types.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_ipvs.h>
+#include <net/netfilter/nf_conntrack.h>
+
+#include <net/ip_vs.h>
+
+MODULE_AUTHOR("Hannes Eder <heder@google.com>");
+MODULE_DESCRIPTION("Xtables: match IPVS connection properties");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_ipvs");
+MODULE_ALIAS("ip6t_ipvs");
+
+/* borrowed from xt_conntrack */
+static bool ipvs_mt_addrcmp(const union nf_inet_addr *kaddr,
+ const union nf_inet_addr *uaddr,
+ const union nf_inet_addr *umask,
+ unsigned int l3proto)
+{
+ if (l3proto == NFPROTO_IPV4)
+ return ((kaddr->ip ^ uaddr->ip) & umask->ip) == 0;
+#ifdef CONFIG_IP_VS_IPV6
+ else if (l3proto == NFPROTO_IPV6)
+ return ipv6_masked_addr_cmp(&kaddr->in6, &umask->in6,
+ &uaddr->in6) == 0;
+#endif
+ else
+ return false;
+}
+
+static bool
+ipvs_mt(const struct sk_buff *skb, struct xt_action_param *par)
+{
+ const struct xt_ipvs_mtinfo *data = par->matchinfo;
+ /* ipvs_mt_check ensures that family is only NFPROTO_IPV[46]. */
+ const u_int8_t family = par->family;
+ struct ip_vs_iphdr iph;
+ struct ip_vs_protocol *pp;
+ struct ip_vs_conn *cp;
+ bool match = true;
+
+ if (data->bitmask == XT_IPVS_IPVS_PROPERTY) {
+ match = skb->ipvs_property ^
+ !!(data->invert & XT_IPVS_IPVS_PROPERTY);
+ goto out;
+ }
+
+ /* other flags than XT_IPVS_IPVS_PROPERTY are set */
+ if (!skb->ipvs_property) {
+ match = false;
+ goto out;
+ }
+
+ ip_vs_fill_iphdr(family, skb_network_header(skb), &iph);
+
+ if (data->bitmask & XT_IPVS_PROTO)
+ if ((iph.protocol == data->l4proto) ^
+ !(data->invert & XT_IPVS_PROTO)) {
+ match = false;
+ goto out;
+ }
+
+ pp = ip_vs_proto_get(iph.protocol);
+ if (unlikely(!pp)) {
+ match = false;
+ goto out;
+ }
+
+ /*
+ * Check if the packet belongs to an existing entry
+ */
+ cp = pp->conn_out_get(family, skb, pp, &iph, iph.len, 1 /* inverse */);
+ if (unlikely(cp == NULL)) {
+ match = false;
+ goto out;
+ }
+
+ /*
+ * We found a connection, i.e. ct != 0, make sure to call
+ * __ip_vs_conn_put before returning. In our case jump to out_put_con.
+ */
+
+ if (data->bitmask & XT_IPVS_VPORT)
+ if ((cp->vport == data->vport) ^
+ !(data->invert & XT_IPVS_VPORT)) {
+ match = false;
+ goto out_put_cp;
+ }
+
+ if (data->bitmask & XT_IPVS_VPORTCTL)
+ if ((cp->control != NULL &&
+ cp->control->vport == data->vportctl) ^
+ !(data->invert & XT_IPVS_VPORTCTL)) {
+ match = false;
+ goto out_put_cp;
+ }
+
+ if (data->bitmask & XT_IPVS_DIR) {
+ enum ip_conntrack_info ctinfo;
+ struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+
+ if (ct == NULL || ct == &nf_conntrack_untracked) {
+ match = false;
+ goto out_put_cp;
+ }
+
+ if ((ctinfo >= IP_CT_IS_REPLY) ^
+ !!(data->invert & XT_IPVS_DIR)) {
+ match = false;
+ goto out_put_cp;
+ }
+ }
+
+ if (data->bitmask & XT_IPVS_METHOD)
+ if (((cp->flags & IP_VS_CONN_F_FWD_MASK) == data->fwd_method) ^
+ !(data->invert & XT_IPVS_METHOD)) {
+ match = false;
+ goto out_put_cp;
+ }
+
+ if (data->bitmask & XT_IPVS_VADDR) {
+ if (ipvs_mt_addrcmp(&cp->vaddr, &data->vaddr,
+ &data->vmask, family) ^
+ !(data->invert & XT_IPVS_VADDR)) {
+ match = false;
+ goto out_put_cp;
+ }
+ }
+
+out_put_cp:
+ __ip_vs_conn_put(cp);
+out:
+ pr_debug("match=%d\n", match);
+ return match;
+}
+
+static int ipvs_mt_check(const struct xt_mtchk_param *par)
+{
+ if (par->family != NFPROTO_IPV4
+#ifdef CONFIG_IP_VS_IPV6
+ && par->family != NFPROTO_IPV6
+#endif
+ ) {
+ pr_info("protocol family %u not supported\n", par->family);
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+static struct xt_match xt_ipvs_mt_reg __read_mostly = {
+ .name = "ipvs",
+ .revision = 0,
+ .family = NFPROTO_UNSPEC,
+ .match = ipvs_mt,
+ .checkentry = ipvs_mt_check,
+ .matchsize = XT_ALIGN(sizeof(struct xt_ipvs_mtinfo)),
+ .me = THIS_MODULE,
+};
+
+static int __init ipvs_mt_init(void)
+{
+ return xt_register_match(&xt_ipvs_mt_reg);
+}
+
+static void __exit ipvs_mt_exit(void)
+{
+ xt_unregister_match(&xt_ipvs_mt_reg);
+}
+
+module_init(ipvs_mt_init);
+module_exit(ipvs_mt_exit);
^ permalink raw reply
* [patch v2.3 0/4], [patch v2.3 0/4] IPVS full NAT support + netfilter 'ipvs' match support
From: Simon Horman @ 2010-07-04 11:32 UTC (permalink / raw)
To: lvs-devel, netdev, linux-kernel, netfilter, netfilter-devel
Cc: Malcolm Turnbull, Wensong Zhang, Julius Volz, Patrick McHardy,
David S. Miller, Hannes Eder
This is a repost of a patch-series posted by Hannes Eder last September.
This is v2 of the patch series and I don't see any outstanding objections to
it in the mailing list archives.
After I posted v2.2 of this series in May several concerns were raised
by Patrick McHardy. This series should address all of those concerns.
Malcolm Turnbull has offered to test this code so I'd like to get
a Reviewed-by from him before the code gets merged. In other words,
at this stage these patches are for review not merging.
The original cover-email from Hannes follows.
The diffstat output has been updated to reflect minor up-porting by me.
From: Hannes Eder <heder@google.com>
The following series implements full NAT support for IPVS. The
approach is via a minimal change to IPVS (make friends with
nf_conntrack) and adding a netfilter matcher, kernel- and user-space
part, i.e. xt_ipvs and libxt_ipvs.
Example usage:
% ipvsadm -A -t 192.168.100.30:80 -s rr
% ipvsadm -a -t 192.168.100.30:80 -r 192.168.10.20:80 -m
# ...
# Source NAT for VIP 192.168.100.30:80
% iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \
> --vport 80 -j SNAT --to-source 192.168.10.10
or SNAT-ing only a specific real server:
% iptables -t nat -A POSTROUTING --dst 192.168.11.20 \
> -m ipvs --vaddr 192.168.100.30/32 -j SNAT --to-source 192.168.10.10
First of all, thanks for all the feedback. This is the changelog for v2:
- Make ip_vs_ftp work again. Setup nf_conntrack expectations for
related data connections (based on Julian's patch see
http://www.ssi.bg/~ja/nfct/) and let nf_conntrack/nf_nat do the
packet mangling and the TCP sequence adjusting.
This change rises the question how to deal with ip_vs_sync? Does it
work together with conntrackd? Wild idea: what about getting rid of
ip_vs_sync and piggy packing all on nf_conntrack and use conntrackd?
Any comments on this?
- xt_ipvs: add new rule '--vportctl port' to match the VIP port of the
controlling connection, e.g. port 21 for FTP. Can be used to match
a related data connection for FTP:
# SNAT FTP control connection
% iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \
> --vport 21 -j SNAT --to-source 192.168.10.10
# SNAT FTP passive data connection
% iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \
> --vportctl 21 -j SNAT --to-source 192.168.10.10
- xt_ipvs: use 'par->family' instead of 'skb->protocol'
- xt_ipvs: add ipvs_mt_check and restrict to NFPROTO_IPV4 and NFPROTO_IPV6
- Call nf_conntrack_alter_reply(), so helper lookup is performed based
on the changed tuple.
Changes to the linux kernel
(nf-next-2.6, "bridge: add per bridge device controls for invoking iptables")
Hannes Eder (3):
netfilter: xt_ipvs (netfilter matcher for IPVS)
IPVS: make friends with nf_conntrack
IPVS: make FTP work with full NAT support
include/linux/netfilter/xt_ipvs.h | 25 +++++
include/net/ip_vs.h | 2
net/netfilter/Kconfig | 10 ++
net/netfilter/Makefile | 1
net/netfilter/ipvs/Kconfig | 4
net/netfilter/ipvs/ip_vs_app.c | 43 ---------
net/netfilter/ipvs/ip_vs_core.c | 37 --------
net/netfilter/ipvs/ip_vs_ftp.c | 173 +++++++++++++++++++++++++++++++++++---
net/netfilter/ipvs/ip_vs_proto.c | 1
net/netfilter/ipvs/ip_vs_xmit.c | 30 ++++++
net/netfilter/xt_ipvs.c | 189 +++++++++++++++++++++++++++++++++++++
11 files changed, 419 insertions(+), 96 deletions(-)
create mode 100644 include/linux/netfilter/xt_ipvs.h
create mode 100644 net/netfilter/xt_ipvs.c
Changes to iptables
(iptables.git, "xt_quota: also document negation")
Hannes Eder (1):
libxt_ipvs: user-space lib for netfilter matcher xt_ipvs
configure.ac | 10 1
extensions/libxt_ipvs.c | 365 +++++++++++++++++++++++++++++++++++++
extensions/libxt_ipvs.man | 24 ++
include/linux/netfilter/xt_ipvs.h | 25 +++
4 files changed, 422 insertions(+), 2 deletions(-)
create mode 100644 extensions/libxt_ipvs.c
create mode 100644 extensions/libxt_ipvs.man
create mode 100644 include/linux/netfilter/xt_ipvs.h
^ permalink raw reply
* Re: [PATCH repost] sched: export sched_set/getaffinity to modules
From: Michael S. Tsirkin @ 2010-07-04 9:00 UTC (permalink / raw)
To: Oleg Nesterov
Cc: Peter Zijlstra, Sridhar Samudrala, Tejun Heo, Ingo Molnar, netdev,
lkml, kvm@vger.kernel.org, Andrew Morton, Dmitri Vorobiev,
Jiri Kosina, Thomas Gleixner, Andi Kleen
In-Reply-To: <20100702210637.GA12433@redhat.com>
On Fri, Jul 02, 2010 at 11:06:37PM +0200, Oleg Nesterov wrote:
> On 07/02, Peter Zijlstra wrote:
> >
> > On Fri, 2010-07-02 at 11:01 -0700, Sridhar Samudrala wrote:
> > >
> > > Does it (Tejun's kthread_clone() patch) also inherit the
> > > cgroup of the caller?
> >
> > Of course, its a simple do_fork() which inherits everything just as you
> > would expect from a similar sys_clone()/sys_fork() call.
>
> Yes. And I'm afraid it can inherit more than we want. IIUC, this is called
> from ioctl(), right?
>
> Then the new thread becomes the natural child of the caller, and it shares
> ->mm with the parent. And files, dup_fd() without CLONE_FS.
>
> Signals. Say, if you send SIGKILL to this new thread, it can't sleep in
> TASK_INTERRUPTIBLE or KILLABLE after that. And this SIGKILL can be sent
> just because the parent gets SIGQUIT or abother coredumpable signal.
> Or the new thread can recieve SIGSTOP via ^Z.
>
> Perhaps this is OK, I do not know. Just to remind that kernel_thread()
> is merely clone(CLONE_VM).
>
> Oleg.
Right. Doing this might break things like flush. The signal and exit
behaviour needs to be examined carefully. I am also unsure whether
using such threads might be more expensive than inheriting kthreadd.
--
MST
^ permalink raw reply
* How to detect ethernet cable plug in event when ethernet card is in D3hot power state?
From: LionSky @ 2010-07-04 8:50 UTC (permalink / raw)
To: netdev
Just as the title.
A scenario is as follows:
When the cable is unplug-in, the ethernet card is placed into D3hot
power state for power saving.
When the cable is plug in later, it will be resumed back to D0 for user usage.
But I do not know whether the ethernet driver/OS can detect the cable
plug-in event when ethernet card is at D3hot power state?
If it can do that, OS can resume it from D3 to D0. Thanks
^ permalink raw reply
* Re: [PATCH] ipvs: Kconfig cleanup
From: Simon Horman @ 2010-07-04 7:13 UTC (permalink / raw)
To: Michal Marek
Cc: lvs-devel, netdev, Julian Anastasov, Wensong Zhang, linux-kernel,
Patrick McHardy
In-Reply-To: <20100704070516.GA9437@verge.net.au>
[ Added Patrick McHardy to CC ]
On Sun, Jul 04, 2010 at 04:05:16PM +0900, Simon Horman wrote:
> On Fri, Jul 02, 2010 at 10:32:08PM +0200, Michal Marek wrote:
> > IP_VS_PROTO_AH_ESP should be set iff either of IP_VS_PROTO_{AH,ESP} is
> > selected. Express this with standard kconfig syntax.
> >
> > Signed-off-by: Michal Marek <mmarek@suse.cz>
>
> Acked-by: Simon Horman <horms@verge.net.au>
>
> > ---
> > net/netfilter/ipvs/Kconfig | 5 +----
> > 1 files changed, 1 insertions(+), 4 deletions(-)
> >
> > diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
> > index f2d7623..91e7373 100644
> > --- a/net/netfilter/ipvs/Kconfig
> > +++ b/net/netfilter/ipvs/Kconfig
> > @@ -83,19 +83,16 @@ config IP_VS_PROTO_UDP
> > protocol. Say Y if unsure.
> >
> > config IP_VS_PROTO_AH_ESP
> > - bool
> > - depends on UNDEFINED
> > + def_bool IP_VS_PROTO_ESP || IP_VS_PROTO_AH
> >
> > config IP_VS_PROTO_ESP
> > bool "ESP load balancing support"
> > - select IP_VS_PROTO_AH_ESP
> > ---help---
> > This option enables support for load balancing ESP (Encapsulation
> > Security Payload) transport protocol. Say Y if unsure.
> >
> > config IP_VS_PROTO_AH
> > bool "AH load balancing support"
> > - select IP_VS_PROTO_AH_ESP
> > ---help---
> > This option enables support for load balancing AH (Authentication
> > Header) transport protocol. Say Y if unsure.
> > --
> > 1.7.1
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH] ipvs: Kconfig cleanup
From: Simon Horman @ 2010-07-04 7:05 UTC (permalink / raw)
To: Michal Marek
Cc: lvs-devel, netdev, Julian Anastasov, Wensong Zhang, linux-kernel
In-Reply-To: <1278102728-20217-1-git-send-email-mmarek@suse.cz>
On Fri, Jul 02, 2010 at 10:32:08PM +0200, Michal Marek wrote:
> IP_VS_PROTO_AH_ESP should be set iff either of IP_VS_PROTO_{AH,ESP} is
> selected. Express this with standard kconfig syntax.
>
> Signed-off-by: Michal Marek <mmarek@suse.cz>
Acked-by: Simon Horman <horms@verge.net.au>
> ---
> net/netfilter/ipvs/Kconfig | 5 +----
> 1 files changed, 1 insertions(+), 4 deletions(-)
>
> diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
> index f2d7623..91e7373 100644
> --- a/net/netfilter/ipvs/Kconfig
> +++ b/net/netfilter/ipvs/Kconfig
> @@ -83,19 +83,16 @@ config IP_VS_PROTO_UDP
> protocol. Say Y if unsure.
>
> config IP_VS_PROTO_AH_ESP
> - bool
> - depends on UNDEFINED
> + def_bool IP_VS_PROTO_ESP || IP_VS_PROTO_AH
>
> config IP_VS_PROTO_ESP
> bool "ESP load balancing support"
> - select IP_VS_PROTO_AH_ESP
> ---help---
> This option enables support for load balancing ESP (Encapsulation
> Security Payload) transport protocol. Say Y if unsure.
>
> config IP_VS_PROTO_AH
> bool "AH load balancing support"
> - select IP_VS_PROTO_AH_ESP
> ---help---
> This option enables support for load balancing AH (Authentication
> Header) transport protocol. Say Y if unsure.
> --
> 1.7.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* [PATCH net-next 1/4] bnx2: Always enable MSI-X on 5709.
From: Michael Chan @ 2010-07-04 6:42 UTC (permalink / raw)
To: davem; +Cc: netdev
Minor change to use MSI-X even if there is only one CPU. This allows
the CNIC driver to always have a dedicated MSI-X vector to handle
iSCSI events, instead of sharing the MSI vector.
Signed-off-by: Michael Chan <mchan@broadcom.com>
---
drivers/net/bnx2.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index a5dd81f..0614ca0 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -6185,7 +6185,7 @@ bnx2_setup_int_mode(struct bnx2 *bp, int dis_msi)
bp->irq_nvecs = 1;
bp->irq_tbl[0].vector = bp->pdev->irq;
- if ((bp->flags & BNX2_FLAG_MSIX_CAP) && !dis_msi && cpus > 1)
+ if ((bp->flags & BNX2_FLAG_MSIX_CAP) && !dis_msi)
bnx2_enable_msix(bp, msix_vecs);
if ((bp->flags & BNX2_FLAG_MSI_CAP) && !dis_msi &&
--
1.6.4.GIT
^ permalink raw reply related
* [PATCH net-next 2/4] bnx2: Add support for skb->rxhash.
From: Michael Chan @ 2010-07-04 6:42 UTC (permalink / raw)
To: davem; +Cc: netdev
In-Reply-To: <1278225738-7795-1-git-send-email-mchan@broadcom.com>
Add skb->rxhash support for TCP packets only because the bnx2 RSS hash
does not hash UDP ports.
Signed-off-by: Michael Chan <mchan@broadcom.com>
---
drivers/net/bnx2.c | 15 ++++++++++++++-
drivers/net/bnx2.h | 3 +++
2 files changed, 17 insertions(+), 1 deletions(-)
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 0614ca0..1450c75 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -3219,6 +3219,10 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
L2_FHDR_ERRORS_UDP_XSUM)) == 0))
skb->ip_summed = CHECKSUM_UNNECESSARY;
}
+ if ((bp->dev->features & NETIF_F_RXHASH) &&
+ ((status & L2_FHDR_STATUS_USE_RXHASH) ==
+ L2_FHDR_STATUS_USE_RXHASH))
+ skb->rxhash = rx_hdr->l2_fhdr_hash;
skb_record_rx_queue(skb, bnapi - &bp->bnx2_napi[0]);
@@ -7558,6 +7562,12 @@ bnx2_set_tx_csum(struct net_device *dev, u32 data)
return (ethtool_op_set_tx_csum(dev, data));
}
+static int
+bnx2_set_flags(struct net_device *dev, u32 data)
+{
+ return ethtool_op_set_flags(dev, data, ETH_FLAG_RXHASH);
+}
+
static const struct ethtool_ops bnx2_ethtool_ops = {
.get_settings = bnx2_get_settings,
.set_settings = bnx2_set_settings,
@@ -7587,6 +7597,8 @@ static const struct ethtool_ops bnx2_ethtool_ops = {
.phys_id = bnx2_phys_id,
.get_ethtool_stats = bnx2_get_ethtool_stats,
.get_sset_count = bnx2_get_sset_count,
+ .set_flags = bnx2_set_flags,
+ .get_flags = ethtool_op_get_flags,
};
/* Called with rtnl_lock */
@@ -8333,7 +8345,8 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
memcpy(dev->dev_addr, bp->mac_addr, 6);
memcpy(dev->perm_addr, bp->mac_addr, 6);
- dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG | NETIF_F_GRO;
+ dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG | NETIF_F_GRO |
+ NETIF_F_RXHASH;
vlan_features_add(dev, NETIF_F_IP_CSUM | NETIF_F_SG);
if (CHIP_NUM(bp) == CHIP_NUM_5709) {
dev->features |= NETIF_F_IPV6_CSUM;
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index ddaa3fc..b9af6bc 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -295,6 +295,9 @@ struct l2_fhdr {
#define L2_FHDR_ERRORS_TCP_XSUM (1<<28)
#define L2_FHDR_ERRORS_UDP_XSUM (1<<31)
+ #define L2_FHDR_STATUS_USE_RXHASH \
+ (L2_FHDR_STATUS_TCP_SEGMENT | L2_FHDR_STATUS_RSS_HASH)
+
u32 l2_fhdr_hash;
#if defined(__BIG_ENDIAN)
u16 l2_fhdr_pkt_len;
--
1.6.4.GIT
^ permalink raw reply related
* [PATCH net-next 4/4] bnx2: Update version to 2.0.16.
From: Michael Chan @ 2010-07-04 6:42 UTC (permalink / raw)
To: davem; +Cc: netdev
In-Reply-To: <1278225738-7795-3-git-send-email-mchan@broadcom.com>
Signed-off-by: Michael Chan <mchan@broadcom.com>
---
drivers/net/bnx2.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 1450c75..ae0a9af 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -58,8 +58,8 @@
#include "bnx2_fw.h"
#define DRV_MODULE_NAME "bnx2"
-#define DRV_MODULE_VERSION "2.0.15"
-#define DRV_MODULE_RELDATE "May 4, 2010"
+#define DRV_MODULE_VERSION "2.0.16"
+#define DRV_MODULE_RELDATE "July 2, 2010"
#define FW_MIPS_FILE_06 "bnx2/bnx2-mips-06-5.0.0.j6.fw"
#define FW_RV2P_FILE_06 "bnx2/bnx2-rv2p-06-5.0.0.j3.fw"
#define FW_MIPS_FILE_09 "bnx2/bnx2-mips-09-5.0.0.j15.fw"
--
1.6.4.GIT
^ permalink raw reply related
* [PATCH net-next 3/4] bnx2: Dump some config space registers during TX timeout.
From: Michael Chan @ 2010-07-04 6:42 UTC (permalink / raw)
To: davem; +Cc: netdev
In-Reply-To: <1278225738-7795-2-git-send-email-mchan@broadcom.com>
These config register values will be useful when the memory registers
are returning 0xffffffff which has been reported.
Signed-off-by: Michael Chan <mchan@broadcom.com>
---
drivers/net/bnx2.c | 11 ++++++++---
1 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index ae0a9af..22fa1e9 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -6313,9 +6313,14 @@ static void
bnx2_dump_state(struct bnx2 *bp)
{
struct net_device *dev = bp->dev;
- u32 mcp_p0, mcp_p1;
-
- netdev_err(dev, "DEBUG: intr_sem[%x]\n", atomic_read(&bp->intr_sem));
+ u32 mcp_p0, mcp_p1, val1, val2;
+
+ pci_read_config_dword(bp->pdev, PCI_COMMAND, &val1);
+ netdev_err(dev, "DEBUG: intr_sem[%x] PCI_CMD[%08x]\n",
+ atomic_read(&bp->intr_sem), val1);
+ pci_read_config_dword(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &val1);
+ pci_read_config_dword(bp->pdev, BNX2_PCICFG_MISC_CONFIG, &val2);
+ netdev_err(dev, "DEBUG: PCI_PM[%08x] PCI_MISC_CFG[%08x]\n", val1, val2);
netdev_err(dev, "DEBUG: EMAC_TX_STATUS[%08x] EMAC_RX_STATUS[%08x]\n",
REG_RD(bp, BNX2_EMAC_TX_STATUS),
REG_RD(bp, BNX2_EMAC_RX_STATUS));
--
1.6.4.GIT
^ permalink raw reply related
* RE: [REGRESSION] e1000e stopped working
From: Maxim Levitsky @ 2010-07-04 0:41 UTC (permalink / raw)
To: Tantilov, Emil S
Cc: netdev@vger.kernel.org, Allan, Bruce W, Pieper, Jeffrey E
In-Reply-To: <1277938757.4138.3.camel@localhost.localdomain>
On Thu, 2010-07-01 at 01:59 +0300, Maxim Levitsky wrote:
> On Tue, 2010-06-29 at 12:37 -0600, Tantilov, Emil S wrote:
> > Maxim Levitsky wrote:
> > > On Mon, 2010-06-28 at 18:09 -0700, Allan, Bruce W wrote:
> > >> On Monday, June 28, 2010 10:14 AM, Maxim Levitsky wrote:
> > >>> On Mon, 2010-06-28 at 10:04 -0700, Allan, Bruce W wrote:
> > >>>> On Sunday, June 27, 2010 10:47 AM, Maxim Levitsky wrote:
> > >>>>> On Sun, 2010-06-27 at 20:43 +0300, Maxim Levitsky wrote:
> > >>>>>> On Sun, 2010-06-27 at 20:29 +0300, Maxim Levitsky wrote:
> > >>>>>>> On Sun, 2010-06-27 at 20:27 +0300, Maxim Levitsky wrote:
> > >>>>>>>> Just that,
> > >>>>>>>>
> > >>>>>>>> It doesn't receive anything from my internet router during
> > >>>>>>>> DHCP.
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> 00:19.0 Ethernet controller [0200]: Intel Corporation 82566DC
> > >>>>>>>> Gigabit Network Connection [8086:104b] (rev 02) Subsystem:
> > >>>>>>>> Intel Corporation Device [8086:0001] Control: I/O+ Mem+
> > >>>>>>>> BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping-
> > >>>>>>>> SERR- FastB2B- DisINTx+ Status: Cap+ 66MHz- UDF- FastB2B-
> > >>>>>>>> ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR-
> > >>>>>>>> INTx- Latency: 0 Interrupt: pin A routed to IRQ 47 Region 0:
> > >>>>>>>> Memory at 50300000 (32-bit, non-prefetchable) [size=128K]
> > >>>>>>>> Region 1: Memory at 50324000 (32-bit, non-prefetchable)
> > >>>>>>>> [size=4K] Region 2: I/O ports at 30e0 [size=32]
> > >>>>>>>> Capabilities: [c8] Power Management version 2 Flags: PMEClk-
> > >>>>>>>> DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
> > >>>>>>>> Status: D0 PME-Enable- DSel=0 DScale=1 PME- Capabilities:
> > >>>>>>>> [d0] Message Signalled Interrupts: Mask- 64bit+ Queue=0/0
> > >>>>>>>> Enable+ Address: 00000000fee0100c Data: 41c9 Kernel driver
> > >>>>>>>> in use: e1000e Kernel modules: e1000e
> > >>>>>>>>
> > >>>>>>>> I use vanilla tree, commit
> > >>>>>>>> bf2937695fe2330bfd8933a2310e7bdd2581dc2e
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> Best regards,
> > >>>>>>>> Maxim Levitsky
> > >>>>>>>>
> > >>>>>>>
> > >>>>>>> It appears to work now after reboot.
> > >>>>>>> Will keep a look for this.
> > >>>>>>>
> > >>>>>>> Disregard for now.
> > >>>>>>
> > >>>>>>
> > >>>>>> Just s2ram cycle, problem is back.
> > >>>>>> Did full reboot (power off then on), same thing card doesn't
> > >>>>>> work...
> > >>>>>>
> > >>>>>
> > >>>>> Yep, s2ram sometimes 'fixes', sometimes breaks the card.
> > >>>>> Something got broken in device initialization path.
> > >>>>>
> > >>>>> Best regards,
> > >>>>> Maxim Levitsky
> > >>>>
> > >>>> What distro are you using? If RedHat, since you are using DHCP
> > >>>> will you please try putting a "LINKDELAY=10" in the
> > >>>> /etc/sysconfig/network-scripts/ifcfg-ethX config file.
> > >>>>
> > >>> I use ubuntu 9.10
> > >>>
> > >>>> Is there anything in the system log that might help narrow down the
> > >>>> issue?
> > >>>
> > >>> Nothing, really nothing.
> > >>> It seems to detect link, dhcp client sends requests, but doesn't
> > >>> recieve a thing (even tried promisc mode - doesn't help)
> > >>>
> > >>>
> > >>>
> > >>> Best regards,
> > >>> Maxim Levitsky
> > >>
> > >> Since you say this is a regression, when did this last work for you
> > >> without this problem, i.e. which distro, which kernel?
> > >
> > > I always compile kernel, and last kernel I compiled here was vanilla
> > > 2.6.33-rc4.
> > > It works just fine.
> > >
> > > I mostly use my laptop, and therefore didn't update kernel on my
> > > desktop for long time.
> > >
> > > If I find some free time I try to bisect the problem.
> >
> > Could you provide some additional info about your setup:
> > ethtool -e eth0
> > ethtool -d eth0
> > kernel config (if possible)
> >
> > What is the model of your system/MB?
>
>
> Sure,
>
>
> My motherboard on this system is Intel DG965RY
>
> The bug in about 90% reproducible.
> Doing several s2ram cycles, its possible to catch a moment when the
> device starts working.
>
Just tested 2.6.34, and it works, so this is 2.6.35 regression.
Best regards,
Maxim Levitsky
^ permalink raw reply
* Re: setsockopt(IP_TOS) being privileged or distinct capability?
From: Alexander Clouter @ 2010-07-03 23:48 UTC (permalink / raw)
To: Philip Prindeville; +Cc: netdev
In-Reply-To: <4C2FC2C8.8080203@redfish-solutions.com>
Hi,
* Philip Prindeville <philipp_subx@redfish-solutions.com> [2010-07-03 17:07:52-0600]:
>
> On 7/3/10 12:55 PM, Alexander Clouter wrote:
>>
>>> Does anyone else think that setsockopt(IP_TOS) should be a privileged
>>> operation, perhaps using CAP_NET_ADMIN, or maybe even adding separate
>>> granularity as CAP_NET_TOS?
>>>
>>>
>> I really would prefer not having to run telnet and ssh *clients* as
>> root. :)
>
> Don't ping and traceroute -I currently run as root?
>
Indeed, but I have no idea what that has to do with ToS/DSCP flags?
ping and (old skool) traceroute use ICMP where you need to open a
privileged socket; to send and receive ICMP packets. Opening a UDP/TCP
is an unprivileged operation and so is setsockopt(IP_TOS).
I'm guessing, if you excuse me Google-stalking you), this is all linked
to:
https://bugzilla.mindrot.org/show_bug.cgi?id=1733
You have to bear in mind ToS is a marking that userland can utilise to
request that the network provides it with a particular QoS, this does
not mean for an instant the network has to honour that (I know my ISP
does not and neither does my work network I sysadmin for)...otherwise
nothing would stop me using:
iptables -t mangle -I POSTROUTING -j DSCP --set-dscp-class EF
QoS is meaningless unless you place boundaries on the policies; the
ToS/DSCP marking should only be used as a *hint* for classification of
traffic flows.
For example, 'interactive' and 'low latency' (in the case of SSH or
telnet) should not exceed 10kB/s...unless you like to play 0verkill :)
Anything marking it's traffic as interactive but shutting traffic at
500kB/s is obviously telling lies. If you build your policing rules to
blindly accept whatever is in the ToS/DSCP field, you are configuring a
DoS vector on your network.
Cheers
--
Alexander Clouter
.sigmonster says: A rolling stone gathers momentum.
^ permalink raw reply
* Re: setsockopt(IP_TOS) being privileged or distinct capability?
From: Philip Prindeville @ 2010-07-03 23:07 UTC (permalink / raw)
To: Alexander Clouter; +Cc: netdev
In-Reply-To: <2md4g7-3s3.ln1@chipmunk.wormnet.eu>
On 7/3/10 12:55 PM, Alexander Clouter wrote:
> Philip Prindeville<philipp_subx@redfish-solutions.com> wrote:
>
>> Does anyone else think that setsockopt(IP_TOS) should be a privileged
>> operation, perhaps using CAP_NET_ADMIN, or maybe even adding separate
>> granularity as CAP_NET_TOS?
>>
>>
> I really would prefer not having to run telnet and ssh *clients* as
> root. :)
>
> Cheers
>
>
Don't ping and traceroute -I currently run as root?
^ permalink raw reply
* [PATCH net-next-2.6] ipv6: adding ip_nonlocal_bind option from ipv4
From: Michal Humpula @ 2010-07-03 20:38 UTC (permalink / raw)
To: netdev
Adds ability to bind non-local IPv6 address the same way as for IPv4
Signed-off-by: Michal Humpula <michal.humpula@web4u.cz>
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index f350c69..27fa09a 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -962,6 +962,10 @@ bindv6only - BOOLEAN
FALSE: enable IPv4-mapped address feature
Default: FALSE (as specified in RFC2553bis)
+ipv6_nonlocal_bind - BOOLEAN
+ If set, allows processes to bind() to non-local IPv6 addresses,
+ which can be quite useful - but may break some applications.
+ Default: 0
IPv6 Fragmentation:
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 7bb5cb6..8957ead 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -528,6 +528,7 @@ enum {
NET_IPV6_IP6FRAG_TIME=23,
NET_IPV6_IP6FRAG_SECRET_INTERVAL=24,
NET_IPV6_MLD_MAX_MSF=25,
+ NET_IPV6_NONLOCAL_BIND=26
};
enum {
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 1f84124..f459fcb 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -641,6 +641,8 @@ static inline int snmp6_unregister_dev(struct inet6_dev *idev) { return 0; }
#endif
#ifdef CONFIG_SYSCTL
+extern int sysctl_ipv6_nonlocal_bind;
+
extern ctl_table ipv6_route_table_template[];
extern ctl_table ipv6_icmp_table_template[];
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 1357c57..525edae 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -559,6 +559,7 @@ static const struct bin_table bin_net_ipv6_table[] = {
{ CTL_DIR, NET_IPV6_ROUTE, "route", bin_net_ipv6_route_table },
{ CTL_DIR, NET_IPV6_ICMP, "icmp", bin_net_ipv6_icmp_table },
{ CTL_INT, NET_IPV6_BINDV6ONLY, "bindv6only" },
+ { CTL_INT, NET_IPV6_NONLOCAL_BIND, "ipv6_nonlocal_bind" },
{ CTL_INT, NET_IPV6_IP6FRAG_HIGH_THRESH, "ip6frag_high_thresh" },
{ CTL_INT, NET_IPV6_IP6FRAG_LOW_THRESH, "ip6frag_low_thresh" },
{ CTL_INT, NET_IPV6_IP6FRAG_TIME, "ip6frag_time" },
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e830cd4..55b3552 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -252,6 +252,8 @@ out_rcu_unlock:
goto out;
}
+int sysctl_ipv6_nonlocal_bind __read_mostly;
+EXPORT_SYMBOL(sysctl_ipv6_nonlocal_bind);
/* bind for INET6 API */
int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
@@ -345,8 +347,10 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
if (!(addr_type & IPV6_ADDR_MULTICAST)) {
if (!ipv6_chk_addr(net, &addr->sin6_addr,
dev, 0)) {
- err = -EADDRNOTAVAIL;
- goto out_unlock;
+ if (!sysctl_ipv6_nonlocal_bind) {
+ err = -EADDRNOTAVAIL;
+ goto out_unlock;
+ }
}
}
rcu_read_unlock();
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index fa1d8f4..56bfe76 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -35,6 +35,13 @@ static ctl_table ipv6_table_template[] = {
.mode = 0644,
.proc_handler = proc_dointvec
},
+ {
+ .procname = "ipv6_nonlocal_bind",
+ .data = &sysctl_ipv6_nonlocal_bind,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec
+ },
{ }
};
^ permalink raw reply related
* Re: [PATCH net-next-2.6] IB/{nes, ipoib}: Pass supported flags to ethtool_op_set_flags()
From: Ben Hutchings @ 2010-07-03 20:40 UTC (permalink / raw)
To: Roland Dreier
Cc: Randy Dunlap, amit.salecha, Chien Tung, sgruszka, amwang, dm,
brice, gallatin, shemminger, jgarzik, roprabhu, e1000-devel,
scofeldm, Roland Dreier, buytenh, Faisal Latif, vkolluri,
linux-net-drivers, netdev, anirban.chakraborty, linux-rdma,
David Miller
In-Reply-To: <adask40nxaa.fsf@roland-alpha.cisco.com>
On Sat, 2010-07-03 at 13:08 -0700, Roland Dreier wrote:
> > Following commit 1437ce3983bcbc0447a0dedcd644c14fe833d266 "ethtool:
> > Change ethtool_op_set_flags to validate flags", ethtool_op_set_flags
> > takes a third parameter and cannot be used directly as an
> > implementation of ethtool_ops::set_flags.
>
> I assume this commit is in one of Dave's trees and breaks nes and ipoib
> because it changed the ethtool_op_set_flags prototype?
Right.
> > Dave, Roland, you'd better decide between yourselves should apply this.
>
> Since this depends on a commit already in Dave's tree, Dave should
> probably take it into the same tree. I guess there's no way to roll
> this into the original patch to avoid breaking bisects once this ends up
> upstream?
Unfortunately it's too late to do that.
> anyway,
>
> Acked-by: Roland Dreier <rolandd@cisco.com>
>
> > +static int nes_netdev_set_flags(struct net_device *netdev, u32 flags)
> > +{
> > + return ethtool_op_set_flags(netdev, flags, ETH_FLAG_LRO);
> > +}
> > +
> > +
> > static const struct ethtool_ops nes_ethtool_ops = {
>
> Also would have been a bit nicer to avoid adding a double blank line
> here, although that's obviously a trivial issue.
This spacing is consistent with the surrounding code.
Ben.
--
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
E1000-devel mailing list
E1000-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/e1000-devel
To learn more about Intel® Ethernet, visit http://communities.intel.com/community/wired
^ permalink raw reply
* Re: [Linux-ATM-General] [PATCH 0/6] atm: propagate atm_dev signal carrier to LOWER_UP of netdevice
From: chas williams - CONTRACTOR @ 2010-07-03 20:09 UTC (permalink / raw)
To: Karl Hiramoto; +Cc: linux-atm-general, netdev
In-Reply-To: <1278092830-10473-1-git-send-email-karl@hiramoto.org>
thanks for writing this. this is something that has been missing for
some time in the atm stack. however, i was hoping it could take a
different approach. i would prefer this mechanism to be more generic
instead of being only suitable for signalling carrier changes. take a
look at the notifier/register_netdevice_notifier scheme.
clients (like br2684) who wish to get these notifications, would need
to call register_atmdevice_notifier(). and yes, instead of handling
setting the signal flag yourself, everyone (including the drivers in
usb/atm) should be using the atm_dev_signal_change().
i am not fond of the idea of adding to the vcc struct something that
is really per device, not per vcc.
On Fri, 2 Jul 2010 19:47:04 +0200
Karl Hiramoto <karl@hiramoto.org> wrote:
> In userspace it's helpfull to know if a network device has a carrier
> signal. Often it is monitored via netlink. This patchset allows a
> way for the struct atm_dev drivers to pass carrier on/off to the
> netdevice.
>
> For DSL, carrier is on when the line has reached showtime state.
>
> Currently this patchset only propagates the changes to br2684 vccs,
> as this is the only type of hardware I have to test.
>
> If you prefer git you can pull from:
> git://github.com/karlhiramoto/linux-2.6.git linux-atm
>
> Signed-off-by: Karl Hiramoto <karl@hiramoto.org>
>
> Karl Hiramoto (6):
> atm: add hooks to propagate signal changes to netdevice
> atm br2684: add callback for carrier signal changes.
> atm/idt77105.c: call atm_dev_signal_change() when signal changes.
> atm/solos-pci: call atm_dev_signal_change() when signal changes.
> atm/suni.c: call atm_dev_signal_change() when signal changes.
> atm/adummy: add syfs DEVICE_ATTR to change signal
>
> drivers/atm/adummy.c | 39
> +++++++++++++++++++++++++++++++++++++++ drivers/atm/idt77105.c |
> 11 ++++++----- drivers/atm/solos-pci.c | 6 +++---
> drivers/atm/suni.c | 5 +++--
> include/linux/atmdev.h | 5 +++++
> net/atm/br2684.c | 13 +++++++++++++
> net/atm/common.c | 33 +++++++++++++++++++++++++++++++++
> 7 files changed, 102 insertions(+), 10 deletions(-)
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Linux-atm-general mailing list
> Linux-atm-general@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/linux-atm-general
>
^ permalink raw reply
* Re: [PATCH net-next-2.6] IB/{nes,ipoib}: Pass supported flags to ethtool_op_set_flags()
From: Roland Dreier @ 2010-07-03 20:08 UTC (permalink / raw)
To: Ben Hutchings
Cc: David Miller, Roland Dreier, Randy Dunlap,
netdev-u79uwXL29TY76Z2rM5mHXA,
linux-net-drivers-s/n/eUQHGBpZroRs9YW3xA,
sgruszka-H+wXaHxf7aLQT0dZR+AlfA,
amit.salecha-h88ZbnxC6KDQT0dZR+AlfA,
amwang-H+wXaHxf7aLQT0dZR+AlfA,
anirban.chakraborty-h88ZbnxC6KDQT0dZR+AlfA,
dm-ut6Up61K2wZBDgjK7y7TUQ, scofeldm-FYB4Gu1CFyUAvxtiuMwx3w,
vkolluri-FYB4Gu1CFyUAvxtiuMwx3w, roprabhu-FYB4Gu1CFyUAvxtiuMwx3w,
e1000-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
buytenh-OLH4Qvv75CYX/NnBR394Jw, gallatin-vV262kQ/Wyo,
brice-vV262kQ/Wyo, shemminger-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b,
jgarzik-H+wXaHxf7aLQT0dZR+AlfA, Faisal Latif, Chien Tung,
linux-rdma-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <1278186089.4878.570.camel@localhost>
> Following commit 1437ce3983bcbc0447a0dedcd644c14fe833d266 "ethtool:
> Change ethtool_op_set_flags to validate flags", ethtool_op_set_flags
> takes a third parameter and cannot be used directly as an
> implementation of ethtool_ops::set_flags.
I assume this commit is in one of Dave's trees and breaks nes and ipoib
because it changed the ethtool_op_set_flags prototype?
> Dave, Roland, you'd better decide between yourselves should apply this.
Since this depends on a commit already in Dave's tree, Dave should
probably take it into the same tree. I guess there's no way to roll
this into the original patch to avoid breaking bisects once this ends up
upstream?
anyway,
Acked-by: Roland Dreier <rolandd-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org>
> +static int nes_netdev_set_flags(struct net_device *netdev, u32 flags)
> +{
> + return ethtool_op_set_flags(netdev, flags, ETH_FLAG_LRO);
> +}
> +
> +
> static const struct ethtool_ops nes_ethtool_ops = {
Also would have been a bit nicer to avoid adding a double blank line
here, although that's obviously a trivial issue.
- R.
--
Roland Dreier <rolandd-FYB4Gu1CFyUAvxtiuMwx3w@public.gmane.org> || For corporate legal information go to:
http://www.cisco.com/web/about/doing_business/legal/cri/index.html
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* [PATCH net-next-2.6] IB/{nes,ipoib}: Pass supported flags to ethtool_op_set_flags()
From: Ben Hutchings @ 2010-07-03 19:41 UTC (permalink / raw)
To: David Miller, Roland Dreier
Cc: Randy Dunlap, netdev-u79uwXL29TY76Z2rM5mHXA,
linux-net-drivers-s/n/eUQHGBpZroRs9YW3xA,
sgruszka-H+wXaHxf7aLQT0dZR+AlfA,
amit.salecha-h88ZbnxC6KDQT0dZR+AlfA,
amwang-H+wXaHxf7aLQT0dZR+AlfA,
anirban.chakraborty-h88ZbnxC6KDQT0dZR+AlfA,
dm-ut6Up61K2wZBDgjK7y7TUQ, scofeldm-FYB4Gu1CFyUAvxtiuMwx3w,
vkolluri-FYB4Gu1CFyUAvxtiuMwx3w, roprabhu-FYB4Gu1CFyUAvxtiuMwx3w,
e1000-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f,
buytenh-OLH4Qvv75CYX/NnBR394Jw, gallatin-vV262kQ/Wyo,
brice-vV262kQ/Wyo, shemminger-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b,
jgarzik-H+wXaHxf7aLQT0dZR+AlfA, Faisal Latif, Chien Tung,
linux-rdma-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <1278184884.4878.559.camel@localhost>
Following commit 1437ce3983bcbc0447a0dedcd644c14fe833d266 "ethtool:
Change ethtool_op_set_flags to validate flags", ethtool_op_set_flags
takes a third parameter and cannot be used directly as an
implementation of ethtool_ops::set_flags.
Changes nes and ipoib driver to pass in the appropriate value.
Signed-off-by: Ben Hutchings <bhutchings-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
---
This is compile-tested only.
Dave, Roland, you'd better decide between yourselves should apply this.
Ben.
drivers/infiniband/hw/nes/nes_nic.c | 8 +++++++-
drivers/infiniband/ulp/ipoib/ipoib_ethtool.c | 7 ++++++-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index 5cc0a9a..42e7aad 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -1567,6 +1567,12 @@ static int nes_netdev_set_settings(struct net_device *netdev, struct ethtool_cmd
}
+static int nes_netdev_set_flags(struct net_device *netdev, u32 flags)
+{
+ return ethtool_op_set_flags(netdev, flags, ETH_FLAG_LRO);
+}
+
+
static const struct ethtool_ops nes_ethtool_ops = {
.get_link = ethtool_op_get_link,
.get_settings = nes_netdev_get_settings,
@@ -1588,7 +1594,7 @@ static const struct ethtool_ops nes_ethtool_ops = {
.get_tso = ethtool_op_get_tso,
.set_tso = ethtool_op_set_tso,
.get_flags = ethtool_op_get_flags,
- .set_flags = ethtool_op_set_flags,
+ .set_flags = nes_netdev_set_flags,
};
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
index 40e8584..1a1657c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
@@ -147,6 +147,11 @@ static void ipoib_get_ethtool_stats(struct net_device *dev,
data[index++] = priv->lro.lro_mgr.stats.no_desc;
}
+static int ipoib_set_flags(struct net_device *dev, u32 flags)
+{
+ return ethtool_op_set_flags(dev, flags, ETH_FLAG_LRO);
+}
+
static const struct ethtool_ops ipoib_ethtool_ops = {
.get_drvinfo = ipoib_get_drvinfo,
.get_rx_csum = ipoib_get_rx_csum,
@@ -154,7 +159,7 @@ static const struct ethtool_ops ipoib_ethtool_ops = {
.get_coalesce = ipoib_get_coalesce,
.set_coalesce = ipoib_set_coalesce,
.get_flags = ethtool_op_get_flags,
- .set_flags = ethtool_op_set_flags,
+ .set_flags = ipoib_set_flags,
.get_strings = ipoib_get_strings,
.get_sset_count = ipoib_get_sset_count,
.get_ethtool_stats = ipoib_get_ethtool_stats,
--
1.7.1
--
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related
* Re: [PATCH net-next-2.6 1/3] ethtool: Change ethtool_op_set_flags to validate flags
From: Ben Hutchings @ 2010-07-03 19:21 UTC (permalink / raw)
To: Randy Dunlap
Cc: David Miller, netdev, linux-net-drivers, sgruszka, amit.salecha,
amwang, anirban.chakraborty, dm, scofeldm, vkolluri, roprabhu,
e1000-devel, buytenh, gallatin, brice, shemminger, jgarzik
In-Reply-To: <20100703120729.f2a2715b.randy.dunlap@oracle.com>
On Sat, 2010-07-03 at 12:07 -0700, Randy Dunlap wrote:
> On Fri, 02 Jul 2010 22:07:11 -0700 (PDT) David Miller wrote:
>
> > From: Randy Dunlap <randy.dunlap@oracle.com>
> > Date: Fri, 2 Jul 2010 09:55:14 -0700
> >
> > > On Wed, 30 Jun 2010 13:44:32 +0100 Ben Hutchings wrote:
> > >> @@ -457,7 +457,7 @@ int ethtool_op_set_tso(struct net_device *dev, u32 data);
> > >> u32 ethtool_op_get_ufo(struct net_device *dev);
> > >> int ethtool_op_set_ufo(struct net_device *dev, u32 data);
> > >> u32 ethtool_op_get_flags(struct net_device *dev);
> > >> -int ethtool_op_set_flags(struct net_device *dev, u32 data);
> > >> +int ethtool_op_set_flags(struct net_device *dev, u32 data, u32 supported);
> > >
> > > That one-line change is missing from linux-next-20100702, causing:
> > >
> > > drivers/infiniband/ulp/ipoib/ipoib_ethtool.c:157: warning: initialization from incompatible pointer type
> >
> > Strange, it's in net-next-2.6 for sure:
> >
> > davem@sunset:~/src/GIT/net-next-2.6$ egrep ethtool_op_set_flags include/linux/ethtool.h
> > int ethtool_op_set_flags(struct net_device *dev, u32 data, u32 supported);
>
> Yep, my bad.
>
> In include/linux/ethtool.h, struct ethtool_ops, field/member 'set_flags':
>
> int (*set_flags)(struct net_device *, u32);
>
> Does that need another u32 for 'supported'? This is where the linux-next
> warnings are coming from.
No, this is intentional. I just missed the users of
ethtool_op_set_flags() in drivers/infiniband. I'll send a patch for
those shortly.
Ben.
--
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* Re: setsockopt(IP_TOS) being privileged or distinct capability?
From: Alexander Clouter @ 2010-07-03 18:55 UTC (permalink / raw)
To: netdev
In-Reply-To: <4C2F7A55.5090700@redfish-solutions.com>
Philip Prindeville <philipp_subx@redfish-solutions.com> wrote:
>
> Does anyone else think that setsockopt(IP_TOS) should be a privileged
> operation, perhaps using CAP_NET_ADMIN, or maybe even adding separate
> granularity as CAP_NET_TOS?
>
I really would prefer not having to run telnet and ssh *clients* as
root. :)
Cheers
--
Alexander Clouter
.sigmonster says: Someday your prints will come.
-- Kodak
^ permalink raw reply
* Re: [PATCH net-next-2.6 1/3] ethtool: Change ethtool_op_set_flags to validate flags
From: Randy Dunlap @ 2010-07-03 19:07 UTC (permalink / raw)
To: David Miller
Cc: amit.salecha, linux-net-drivers, dm, sgruszka, amwang,
e1000-devel, netdev, anirban.chakraborty, vkolluri, brice,
gallatin, bhutchings, scofeldm, shemminger, jgarzik, buytenh,
roprabhu
In-Reply-To: <20100702.220711.39188625.davem@davemloft.net>
On Fri, 02 Jul 2010 22:07:11 -0700 (PDT) David Miller wrote:
> From: Randy Dunlap <randy.dunlap@oracle.com>
> Date: Fri, 2 Jul 2010 09:55:14 -0700
>
> > On Wed, 30 Jun 2010 13:44:32 +0100 Ben Hutchings wrote:
> >> @@ -457,7 +457,7 @@ int ethtool_op_set_tso(struct net_device *dev, u32 data);
> >> u32 ethtool_op_get_ufo(struct net_device *dev);
> >> int ethtool_op_set_ufo(struct net_device *dev, u32 data);
> >> u32 ethtool_op_get_flags(struct net_device *dev);
> >> -int ethtool_op_set_flags(struct net_device *dev, u32 data);
> >> +int ethtool_op_set_flags(struct net_device *dev, u32 data, u32 supported);
> >
> > That one-line change is missing from linux-next-20100702, causing:
> >
> > drivers/infiniband/ulp/ipoib/ipoib_ethtool.c:157: warning: initialization from incompatible pointer type
>
> Strange, it's in net-next-2.6 for sure:
>
> davem@sunset:~/src/GIT/net-next-2.6$ egrep ethtool_op_set_flags include/linux/ethtool.h
> int ethtool_op_set_flags(struct net_device *dev, u32 data, u32 supported);
Yep, my bad.
In include/linux/ethtool.h, struct ethtool_ops, field/member 'set_flags':
int (*set_flags)(struct net_device *, u32);
Does that need another u32 for 'supported'? This is where the linux-next
warnings are coming from.
---
~Randy
*** Remember to use Documentation/SubmitChecklist when testing your code ***
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
E1000-devel mailing list
E1000-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/e1000-devel
To learn more about Intel® Ethernet, visit http://communities.intel.com/community/wired
^ permalink raw reply
* setsockopt(IP_TOS) being privileged or distinct capability?
From: Philip Prindeville @ 2010-07-03 17:58 UTC (permalink / raw)
To: netdev
Does anyone else think that setsockopt(IP_TOS) should be a privileged
operation, perhaps using CAP_NET_ADMIN, or maybe even adding separate
granularity as CAP_NET_TOS?
-Philip
^ permalink raw reply
* (unknown),
From: MRS.ROSE RAUL @ 2010-07-03 17:33 UTC (permalink / raw)
--
Dear Customer:
You won $ 2,000,000.00USD From the end of the year Microsoft promo
To claim your winnings,You are expected to immediately contact UPS within
24 hours with the following information below.
Full name .....
Sex..........
Age ....
Marital Status......
Occupation.....
Monthly Income:........
Country ....
Address
Contact ...
Direct Number ....
UPS EXPRESS COURIER CONTACT
Mr. Mike Ali.
upscourierdept0147@gmail.com
Tel: +234 8054 5754 9499
Note: We paid for delivery and payment of their insurance premiums
and is awarded to pay the UPS courier service the sum of
$ 240 USD for its share of security. We could have paid this for you, But we
Do not know when you will be in touch with then.
Once again Congratulations
Mrs.Rose Raul.
ONLINE coordinator
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox