* [PATCH net-next 5/5] qlcnic: Bumped up driver version to 5.0.12
From: Anirban Chakraborty @ 2010-11-17 0:09 UTC (permalink / raw)
To: David Miller, netdev@vger.kernel.org; +Cc: Dept_NX_Linux_NIC_Driver
Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com>
---
drivers/net/qlcnic/qlcnic.h | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
index 1375981..56f54ff 100644
--- a/drivers/net/qlcnic/qlcnic.h
+++ b/drivers/net/qlcnic/qlcnic.h
@@ -51,8 +51,8 @@
#define _QLCNIC_LINUX_MAJOR 5
#define _QLCNIC_LINUX_MINOR 0
-#define _QLCNIC_LINUX_SUBVERSION 11
-#define QLCNIC_LINUX_VERSIONID "5.0.11"
+#define _QLCNIC_LINUX_SUBVERSION 12
+#define QLCNIC_LINUX_VERSIONID "5.0.12"
#define QLCNIC_DRV_IDC_VER 0x01
#define QLCNIC_DRIVER_VERSION ((_QLCNIC_LINUX_MAJOR << 16) |\
(_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
--
1.5.4.5
^ permalink raw reply related
* [PATCH net-next 4/5] qlcnic: lro off message log from set rx checsum
From: Anirban Chakraborty @ 2010-11-17 0:08 UTC (permalink / raw)
To: David Miller, netdev@vger.kernel.org; +Cc: Dept_NX_Linux_NIC_Driver
From: Sony Chacko <sony.chacko@qlogic.com>
Log LRO off message while disabling rx checksum only when
LRO is already enabled.
Signed-off-by: Sony Chacko <sony.chacko@qlogic.com>
Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com>
---
drivers/net/qlcnic/qlcnic_ethtool.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/drivers/net/qlcnic/qlcnic_ethtool.c b/drivers/net/qlcnic/qlcnic_ethtool.c
index ec21d24..c389296 100644
--- a/drivers/net/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/qlcnic/qlcnic_ethtool.c
@@ -925,9 +925,10 @@ static int qlcnic_set_rx_csum(struct net_device *dev, u32 data)
dev->features &= ~NETIF_F_LRO;
qlcnic_send_lro_cleanup(adapter);
+ dev_info(&adapter->pdev->dev,
+ "disabling LRO as rx_csum is off\n");
}
adapter->rx_csum = !!data;
- dev_info(&adapter->pdev->dev, "disabling LRO as rx_csum is off\n");
return 0;
}
--
1.5.4.5
^ permalink raw reply related
* [PATCH net-next 3/5] qlcnic: Add description for CN1000Q adapter
From: Anirban Chakraborty @ 2010-11-17 0:08 UTC (permalink / raw)
To: David Miller, netdev@vger.kernel.org; +Cc: Dept_NX_Linux_NIC_Driver
From: Sritej Velaga <sritej.velaga@qlogic.com>
Add description for CN1000Q adapter
Signed-off-by: Sritej Velaga <sritej.velaga@qlogic.com>
Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com>
---
drivers/net/qlcnic/qlcnic.h | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
index a6b71fe..1375981 100644
--- a/drivers/net/qlcnic/qlcnic.h
+++ b/drivers/net/qlcnic/qlcnic.h
@@ -1376,6 +1376,8 @@ static const struct qlcnic_brdinfo qlcnic_boards[] = {
"3200 Series Single Port 10Gb Intelligent Ethernet Adapter"},
{0x1077, 0x8020, 0x103c, 0x3733,
"NC523SFP 10Gb 2-port Server Adapter"},
+ {0x1077, 0x8020, 0x103c, 0x3346,
+ "CN1000Q Dual Port Converged Network Adapter"},
{0x1077, 0x8020, 0x0, 0x0, "cLOM8214 1/10GbE Controller"},
};
--
1.5.4.5
^ permalink raw reply related
* [PATCH net-next 2/5] qlcnic: Fix for kdump
From: Anirban Chakraborty @ 2010-11-17 0:08 UTC (permalink / raw)
To: David Miller, netdev@vger.kernel.org; +Cc: Dept_NX_Linux_NIC_Driver
From: Rajesh Borundia <rajesh.borundia@qlogic.com>
In case of kdump environment the function may be in unknown state.
Reset the function using PCI FLR before initializing it.
Signed-off-by: Rajesh Borundia <rajesh.borundia@qlogic.com>
Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com>
---
drivers/net/qlcnic/qlcnic_ctx.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/net/qlcnic/qlcnic_ctx.c b/drivers/net/qlcnic/qlcnic_ctx.c
index 1cdc05d..3ad1f3e 100644
--- a/drivers/net/qlcnic/qlcnic_ctx.c
+++ b/drivers/net/qlcnic/qlcnic_ctx.c
@@ -480,6 +480,9 @@ int qlcnic_fw_create_ctx(struct qlcnic_adapter *adapter)
{
int err;
+ if (reset_devices)
+ pci_reset_function(adapter->pdev);
+
err = qlcnic_fw_cmd_create_rx_ctx(adapter);
if (err)
return err;
--
1.5.4.5
^ permalink raw reply related
* [PATCH net-next 1/5] qlcnic: Allow minimum bandwidth of zero
From: Anirban Chakraborty @ 2010-11-17 0:07 UTC (permalink / raw)
To: David Miller, netdev@vger.kernel.org; +Cc: Dept_NX_Linux_NIC_Driver
From: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Allow minimum bandwidth to be set zero
Signed-off-by: Sucheta Chakraborty <sucheta.chakraborty@qlogic.com>
Signed-off-by: Anirban Chakraborty <anirban.chakraborty@qlogic.com>
---
drivers/net/qlcnic/qlcnic.h | 5 ++---
1 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
index 8ecc170..a6b71fe 100644
--- a/drivers/net/qlcnic/qlcnic.h
+++ b/drivers/net/qlcnic/qlcnic.h
@@ -1126,8 +1126,7 @@ struct qlcnic_eswitch {
/* Return codes for Error handling */
#define QL_STATUS_INVALID_PARAM -1
-#define MAX_BW 100
-#define MIN_BW 1
+#define MAX_BW 100 /* % of link speed */
#define MAX_VLAN_ID 4095
#define MIN_VLAN_ID 2
#define MAX_TX_QUEUES 1
@@ -1135,7 +1134,7 @@ struct qlcnic_eswitch {
#define DEFAULT_MAC_LEARN 1
#define IS_VALID_VLAN(vlan) (vlan >= MIN_VLAN_ID && vlan < MAX_VLAN_ID)
-#define IS_VALID_BW(bw) (bw >= MIN_BW && bw <= MAX_BW)
+#define IS_VALID_BW(bw) (bw <= MAX_BW)
#define IS_VALID_TX_QUEUES(que) (que > 0 && que <= MAX_TX_QUEUES)
#define IS_VALID_RX_QUEUES(que) (que > 0 && que <= MAX_RX_QUEUES)
--
1.5.4.5
^ permalink raw reply related
* [PATCH net-next 0/5] qlcnic: Bug fixes
From: Anirban Chakraborty @ 2010-11-17 0:07 UTC (permalink / raw)
To: David Miller, netdev@vger.kernel.org; +Cc: Dept_NX_Linux_NIC_Driver
Please apply following patches to net-next.
Thanks,
Anirban
^ permalink raw reply
* Re: [Bugme-new] [Bug 22962] New: building (e)glibc against 2.6.37-rc1 headers fails
From: Changli Gao @ 2010-11-16 23:59 UTC (permalink / raw)
To: Stephan Raue
Cc: Andrew Morton, bugzilla-daemon, bugme-daemon, Eric Dumazet,
netdev
In-Reply-To: <4CE310A7.2060302@openelec.tv>
On Wed, Nov 17, 2010 at 7:15 AM, Stephan Raue <stephan@openelec.tv> wrote:
> Hi,
>
>
> Am 16.11.2010 23:33, schrieb Andrew Morton:
>> Maybe we need some __KERNEL__ guards in if.h.
>>
> in the meantime i can build with attached patch.
>
I checked the source code of linux/if.h in my Gentoo, and found the
conflict structures are renamed with __kernel_ prefix. Some changes in
linux/if.h is needed maybe.
--
Regards,
Changli Gao(xiaosuo@gmail.com)
^ permalink raw reply
* Re: [Bugme-new] [Bug 22962] New: building (e)glibc against 2.6.37-rc1 headers fails
From: Stephan Raue @ 2010-11-16 23:15 UTC (permalink / raw)
To: Andrew Morton; +Cc: bugzilla-daemon, bugme-daemon, Eric Dumazet, netdev
In-Reply-To: <20101116143349.2fbb6ed8.akpm@linux-foundation.org>
[-- Attachment #1: Type: text/plain, Size: 6191 bytes --]
Hi,
Am 16.11.2010 23:33, schrieb Andrew Morton:
> (switched to email. Please respond via emailed reply-to-all, not via the
> bugzilla web interface).
>
> On Mon, 15 Nov 2010 00:09:33 GMT
> bugzilla-daemon@bugzilla.kernel.org wrote:
>
>> https://bugzilla.kernel.org/show_bug.cgi?id=22962
>>
>> Summary: building (e)glibc against 2.6.37-rc1 headers fails
>> Product: Networking
>> Version: 2.5
>> Kernel Version: 2.6.37-rc1
> hm, thanks for picking this up so early. It would have been irritating
> to let this out in 2.6.37.
>
>> Platform: All
>> OS/Version: Linux
>> Tree: Mainline
>> Status: NEW
>> Severity: normal
>> Priority: P1
>> Component: Other
>> AssignedTo: acme@ghostprotocols.net
>> ReportedBy: stephan@openelec.tv
>> Regression: No
>>
>>
>> i have problems building eglibc against the linux-2.6.37-rc1 headers:
>>
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/bin/i686-openelec-linux-gnu-gcc
>> ../sysdeps/unix/sysv/linux/if_index.c -c -std=gnu99 -fgnu89-inline -O3 -Wall
>> -Winline -Wwrite-strings -fexcess-precision=fast -fgraphite-identity
>> -floop-block -floop-interchange -floop-strip-mine -fmerge-all-constants
>> -fno-stack-protector -fno-unwind-tables -ftree-loop-distribution -g -m32
>> -march=pentium-m -pipe -s -Wstrict-prototypes -mpreferred-stack-boundary=2
>> -fomit-frame-pointer -Wa,-mtune=i686 -I../include
>> -I/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet
>> -I/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc
>> -I../sysdeps/i386/elf -I../nptl/sysdeps/unix/sysv/linux/i386/i686
>> -I../sysdeps/unix/sysv/linux/i386/i686 -I../nptl/sysdeps/unix/sysv/linux/i386
>> -I../sysdeps/unix/sysv/linux/i386 -I../nptl/sysdeps/unix/sysv/linux
>> -I../nptl/sysdeps/pthread -I../sysdeps/pthread
>> -I../ports/sysdeps/unix/sysv/linux -I../sysdeps/unix/sysv/linux
>> -I../sysdeps/gnu -I../sysdeps/unix/common -I../sysdeps/unix/mman
>> -I../sysdeps/unix/inet -I../ports/sysdeps/unix/sysv/i386
>> -I../sysdeps/unix/sysv/i386 -I../nptl/sysdeps/unix/sysv
>> -I../ports/sysdeps/unix/sysv -I../sysdeps/unix/sysv -I../sysdeps/unix/i386
>> -I../nptl/sysdeps/unix -I../ports/sysdeps/unix -I../sysdeps/unix
>> -I../sysdeps/posix -I../sysdeps/i386/i686/fpu -I../sysdeps/i386/i686/multiarch
>> -I../nptl/sysdeps/i386/i686 -I../sysdeps/i386/i686 -I../sysdeps/i386/i486
>> -I../nptl/sysdeps/i386/i486 -I../sysdeps/i386/fpu -I../nptl/sysdeps/i386
>> -I../sysdeps/i386 -I../sysdeps/wordsize-32 -I../sysdeps/ieee754/ldbl-96
>> -I../sysdeps/ieee754/dbl-64 -I../sysdeps/ieee754/flt-32 -I../sysdeps/ieee754
>> -I../sysdeps/generic/elf -I../sysdeps/generic -I../nptl -I../ports -I..
>> -I../libio -I. -nostdinc -isystem
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/lib/gcc/i686-openelec-linux-gnu/4.5.1/include
>> -isystem
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/lib/gcc/i686-openelec-linux-gnu/4.5.1/include-fixed
>> -isystem
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include
>> -D_LIBC_REENTRANT -include ../include/libc-symbols.h -o
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet/if_index.o
>> -MD -MP -MF
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet/if_index.o.dt
>> -MT
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet/if_index.o
>> In file included from
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/netdevice.h:28:0,
>> from
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/rtnetlink.h:9,
>> from ../sysdeps/unix/sysv/linux/netlinkaccess.h:24,
>> from ../sysdeps/unix/sysv/linux/if_index.c:33:
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/if.h:135:8:
>> error: redefinition of 'struct ifmap'
>> ../sysdeps/gnu/net/if.h:112:8: note: originally defined here
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/if.h:169:8:
>> error: redefinition of 'struct ifreq'
>> ../sysdeps/gnu/net/if.h:127:8: note: originally defined here
>> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/if.h:218:8:
>> error: redefinition of 'struct ifconf'
>> ../sysdeps/gnu/net/if.h:177:8: note: originally defined here
>> make[3]: ***
>> [/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet/if_index.o]
>> Error 1
>> make[3]: Leaving directory
>> `/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/inet'
>> make[2]: *** [inet/subdir_lib] Error 2
>> make[2]: Leaving directory
>> `/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025'
>> make[1]: *** [all] Error 2
>> make[1]: Leaving directory
>> `/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc'
>> make: *** [squashfs] Fehler 2
>>
>> it seems because of an change in include/linux/rtnetlink.h (commit
>> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=24824a09e35402b8d58dcc5be803a5ad3937bdba)
>> where linux/netdevice.h will be included now linux/if.h together with net/if.h
>> will be included - see also comments here:
>> http://www.mail-archive.com/ubuntu-bugs@lists.ubuntu.com/msg2611725.html
>>
> Maybe we need some __KERNEL__ guards in if.h.
>
in the meantime i can build with attached patch.
greetings and thanks
Stephan
--
### OpenELEC.tv ###
The free and open Mediacenter Distribution 4 you
http://www.openelec.tv
[-- Attachment #2: linux-2.6.37-rc1-000_fix_include.patch --]
[-- Type: text/x-patch, Size: 718 bytes --]
diff -Naur linux-2.6.37-rc1/include/linux/rtnetlink.h linux-2.6.37-rc1.patch/include/linux/rtnetlink.h
--- linux-2.6.37-rc1/include/linux/rtnetlink.h 2010-11-01 12:54:12.000000000 +0100
+++ linux-2.6.37-rc1.patch/include/linux/rtnetlink.h 2010-11-15 18:03:38.434438769 +0100
@@ -6,7 +6,6 @@
#include <linux/if_link.h>
#include <linux/if_addr.h>
#include <linux/neighbour.h>
-#include <linux/netdevice.h>
/* rtnetlink families. Values up to 127 are reserved for real address
* families, values above 128 may be used arbitrarily.
@@ -606,6 +605,7 @@
#ifdef __KERNEL__
#include <linux/mutex.h>
+#include <linux/netdevice.h>
static __inline__ int rtattr_strcmp(const struct rtattr *rta, const char *str)
{
^ permalink raw reply
* Re: [PATCH] filter: Optimize instruction revalidation code.
From: Hagen Paul Pfeifer @ 2010-11-16 23:45 UTC (permalink / raw)
To: Changli Gao; +Cc: Tetsuo Handa, davem, eric.dumazet, drosenberg, netdev
In-Reply-To: <AANLkTi=-Kr7OpSSz1aTQxTEwaOwf_m6hPDr24vYw_z75@mail.gmail.com>
* Changli Gao | 2010-11-17 07:31:51 [+0800]:
>> Maybe I don't get it, but you increment the opcode by one, but you never
>> increment the opcode in sk_run_filter() - do I miss something? Did you test
>> the your patch (a trivial tcpdump rule should be sufficient)?
>>
>
>+ code = codes[code];
>+ if (!code--)
>+ return -EINVAL;
Right, temporary in sk_chk_filter() but as I wrote earlier not in sk_run_filter().
>But how about this:
>
>enum {
> BPF_S_RET_K = 1,
better.
Best regards, Hagen
BTW: you can verify your code by construct some artificial filter rules via
struct sock_filter {
uint16_t code; /* Actual filter code */
uint8_t jt; /* Jump true */
uint8_t jf; /* Jump false */
uint32_t k; /* Generic multiuse field
};
and attach them to a socket with setsockopt.
^ permalink raw reply
* Re: [PATCH] filter: Optimize instruction revalidation code.
From: Changli Gao @ 2010-11-16 23:31 UTC (permalink / raw)
To: Hagen Paul Pfeifer; +Cc: Tetsuo Handa, davem, eric.dumazet, drosenberg, netdev
In-Reply-To: <20101116221310.GA3058@nuttenaction>
On Wed, Nov 17, 2010 at 6:13 AM, Hagen Paul Pfeifer <hagen@jauu.net> wrote:
> * Tetsuo Handa | 2010-11-16 22:08:50 [+0900]:
>
>>--- a/net/core/filter.c
>>+++ b/net/core/filter.c
>>@@ -383,7 +383,57 @@ EXPORT_SYMBOL(sk_run_filter);
>> */
>> int sk_chk_filter(struct sock_filter *filter, int flen)
>> {
>>- struct sock_filter *ftest;
>>+ /*
>>+ * Valid instructions are initialized to non-0.
>>+ * Invalid instructions are initialized to 0.
>>+ */
>>+ static u16 codes[] = {
>>+ [BPF_ALU|BPF_ADD|BPF_K] = BPF_S_ALU_ADD_K + 1,
>>+ [BPF_ALU|BPF_ADD|BPF_X] = BPF_S_ALU_ADD_X + 1,
>>+ [BPF_ALU|BPF_SUB|BPF_K] = BPF_S_ALU_SUB_K + 1,
> [...]
>
> Maybe I don't get it, but you increment the opcode by one, but you never
> increment the opcode in sk_run_filter() - do I miss something? Did you test
> the your patch (a trivial tcpdump rule should be sufficient)?
>
+ code = codes[code];
+ if (!code--)
+ return -EINVAL;
But how about this:
enum {
BPF_S_RET_K = 1,
--
Regards,
Changli Gao(xiaosuo@gmail.com)
^ permalink raw reply
* Re: [PATCH] filter: Optimize instruction revalidation code.
From: Changli Gao @ 2010-11-16 23:24 UTC (permalink / raw)
To: Tetsuo Handa; +Cc: davem, eric.dumazet, drosenberg, netdev
In-Reply-To: <201011162208.BHC17628.SVtFMJOOLFQFOH@I-love.SAKURA.ne.jp>
On Tue, Nov 16, 2010 at 9:08 PM, Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
> In the wake of commit 57fe93b3 "filter: make sure filters dont read
> uninitialized memory", I came up with this patch. I don't know how to test.
> Please review and do tests.
>
> This patch optimizes sk_chk_filter(). Using gcc 4.1.2 on x86_32, the size of
> net/core/filter.o changed from 7416 bytes to 5260 bytes
> ("make allnoconfig" + CONFIG_NET=y).
>
> By the way, if "struct sock_filter *filter" argument of sk_run_filter() does
> not change after it was revalidated at sk_chk_filter(), can't we detect and
> reject "BPF_S_LD_MEM/BPF_S_LDX_MEM before BPF_S_ST/BPF_S_STX" at
> sk_chk_filter()?
> ----------------------------------------
> From 2bf36130bd4912590b409b47a6a9a82e2884e035 Mon Sep 17 00:00:00 2001
> From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Date: Tue, 16 Nov 2010 21:39:50 +0900
> Subject: [PATCH] filter: Optimize instruction revalidation code.
>
> Since repeating small value to small value conversion using switch() clause's
> case statement is wasteful, this patch instroduces u16 to u16 mapping table
> and removes most of case statements. As a result, the size of net/core/filter.o
> is reduced by about 30% on x86.
>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> ---
> net/core/filter.c | 214 ++++++++++++++++-------------------------------------
> 1 files changed, 65 insertions(+), 149 deletions(-)
>
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 23e9b2a..85be3d8 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -383,7 +383,57 @@ EXPORT_SYMBOL(sk_run_filter);
> */
> int sk_chk_filter(struct sock_filter *filter, int flen)
> {
> - struct sock_filter *ftest;
> + /*
> + * Valid instructions are initialized to non-0.
> + * Invalid instructions are initialized to 0.
> + */
> + static u16 codes[] = {
> + [BPF_ALU|BPF_ADD|BPF_K] = BPF_S_ALU_ADD_K + 1,
> + [BPF_ALU|BPF_ADD|BPF_X] = BPF_S_ALU_ADD_X + 1,
> + [BPF_ALU|BPF_SUB|BPF_K] = BPF_S_ALU_SUB_K + 1,
> + [BPF_ALU|BPF_SUB|BPF_X] = BPF_S_ALU_SUB_X + 1,
> + [BPF_ALU|BPF_MUL|BPF_K] = BPF_S_ALU_MUL_K + 1,
> + [BPF_ALU|BPF_MUL|BPF_X] = BPF_S_ALU_MUL_X + 1,
> + [BPF_ALU|BPF_DIV|BPF_X] = BPF_S_ALU_DIV_X + 1,
> + [BPF_ALU|BPF_AND|BPF_K] = BPF_S_ALU_AND_K + 1,
> + [BPF_ALU|BPF_AND|BPF_X] = BPF_S_ALU_AND_X + 1,
> + [BPF_ALU|BPF_OR|BPF_K] = BPF_S_ALU_OR_K + 1,
> + [BPF_ALU|BPF_OR|BPF_X] = BPF_S_ALU_OR_X + 1,
> + [BPF_ALU|BPF_LSH|BPF_K] = BPF_S_ALU_LSH_K + 1,
> + [BPF_ALU|BPF_LSH|BPF_X] = BPF_S_ALU_LSH_X + 1,
> + [BPF_ALU|BPF_RSH|BPF_K] = BPF_S_ALU_RSH_K + 1,
> + [BPF_ALU|BPF_RSH|BPF_X] = BPF_S_ALU_RSH_X + 1,
> + [BPF_ALU|BPF_NEG] = BPF_S_ALU_NEG + 1,
> + [BPF_LD|BPF_W|BPF_ABS] = BPF_S_LD_W_ABS + 1,
> + [BPF_LD|BPF_H|BPF_ABS] = BPF_S_LD_H_ABS + 1,
> + [BPF_LD|BPF_B|BPF_ABS] = BPF_S_LD_B_ABS + 1,
> + [BPF_LD|BPF_W|BPF_LEN] = BPF_S_LD_W_LEN + 1,
> + [BPF_LD|BPF_W|BPF_IND] = BPF_S_LD_W_IND + 1,
> + [BPF_LD|BPF_H|BPF_IND] = BPF_S_LD_H_IND + 1,
> + [BPF_LD|BPF_B|BPF_IND] = BPF_S_LD_B_IND + 1,
> + [BPF_LD|BPF_IMM] = BPF_S_LD_IMM + 1,
> + [BPF_LDX|BPF_W|BPF_LEN] = BPF_S_LDX_W_LEN + 1,
> + [BPF_LDX|BPF_B|BPF_MSH] = BPF_S_LDX_B_MSH + 1,
> + [BPF_LDX|BPF_IMM] = BPF_S_LDX_IMM + 1,
> + [BPF_MISC|BPF_TAX] = BPF_S_MISC_TAX + 1,
> + [BPF_MISC|BPF_TXA] = BPF_S_MISC_TXA + 1,
> + [BPF_RET|BPF_K] = BPF_S_RET_K + 1,
> + [BPF_RET|BPF_A] = BPF_S_RET_A + 1,
> + [BPF_ALU|BPF_DIV|BPF_K] = BPF_S_ALU_DIV_K + 1,
> + [BPF_LD|BPF_MEM] = BPF_S_LD_MEM + 1,
> + [BPF_LDX|BPF_MEM] = BPF_S_LDX_MEM + 1,
> + [BPF_ST] = BPF_S_ST + 1,
> + [BPF_STX] = BPF_S_STX + 1,
> + [BPF_JMP|BPF_JA] = BPF_S_JMP_JA + 1,
> + [BPF_JMP|BPF_JEQ|BPF_K] = BPF_S_JMP_JEQ_K + 1,
> + [BPF_JMP|BPF_JEQ|BPF_X] = BPF_S_JMP_JEQ_X + 1,
> + [BPF_JMP|BPF_JGE|BPF_K] = BPF_S_JMP_JGE_K + 1,
> + [BPF_JMP|BPF_JGE|BPF_X] = BPF_S_JMP_JGE_X + 1,
> + [BPF_JMP|BPF_JGT|BPF_K] = BPF_S_JMP_JGT_K + 1,
> + [BPF_JMP|BPF_JGT|BPF_X] = BPF_S_JMP_JGT_X + 1,
> + [BPF_JMP|BPF_JSET|BPF_K] = BPF_S_JMP_JSET_K + 1,
> + [BPF_JMP|BPF_JSET|BPF_X] = BPF_S_JMP_JSET_X + 1,
> + };
> int pc;
>
> if (flen == 0 || flen > BPF_MAXINSNS)
> @@ -391,135 +441,26 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
>
> /* check the filter code now */
> for (pc = 0; pc < flen; pc++) {
> - ftest = &filter[pc];
> -
> - /* Only allow valid instructions */
> - switch (ftest->code) {
> - case BPF_ALU|BPF_ADD|BPF_K:
> - ftest->code = BPF_S_ALU_ADD_K;
> - break;
> - case BPF_ALU|BPF_ADD|BPF_X:
> - ftest->code = BPF_S_ALU_ADD_X;
> - break;
> - case BPF_ALU|BPF_SUB|BPF_K:
> - ftest->code = BPF_S_ALU_SUB_K;
> - break;
> - case BPF_ALU|BPF_SUB|BPF_X:
> - ftest->code = BPF_S_ALU_SUB_X;
> - break;
> - case BPF_ALU|BPF_MUL|BPF_K:
> - ftest->code = BPF_S_ALU_MUL_K;
> - break;
> - case BPF_ALU|BPF_MUL|BPF_X:
> - ftest->code = BPF_S_ALU_MUL_X;
> - break;
> - case BPF_ALU|BPF_DIV|BPF_X:
> - ftest->code = BPF_S_ALU_DIV_X;
> - break;
> - case BPF_ALU|BPF_AND|BPF_K:
> - ftest->code = BPF_S_ALU_AND_K;
> - break;
> - case BPF_ALU|BPF_AND|BPF_X:
> - ftest->code = BPF_S_ALU_AND_X;
> - break;
> - case BPF_ALU|BPF_OR|BPF_K:
> - ftest->code = BPF_S_ALU_OR_K;
> - break;
> - case BPF_ALU|BPF_OR|BPF_X:
> - ftest->code = BPF_S_ALU_OR_X;
> - break;
> - case BPF_ALU|BPF_LSH|BPF_K:
> - ftest->code = BPF_S_ALU_LSH_K;
> - break;
> - case BPF_ALU|BPF_LSH|BPF_X:
> - ftest->code = BPF_S_ALU_LSH_X;
> - break;
> - case BPF_ALU|BPF_RSH|BPF_K:
> - ftest->code = BPF_S_ALU_RSH_K;
> - break;
> - case BPF_ALU|BPF_RSH|BPF_X:
> - ftest->code = BPF_S_ALU_RSH_X;
> - break;
> - case BPF_ALU|BPF_NEG:
> - ftest->code = BPF_S_ALU_NEG;
> - break;
> - case BPF_LD|BPF_W|BPF_ABS:
> - ftest->code = BPF_S_LD_W_ABS;
> - break;
> - case BPF_LD|BPF_H|BPF_ABS:
> - ftest->code = BPF_S_LD_H_ABS;
> - break;
> - case BPF_LD|BPF_B|BPF_ABS:
> - ftest->code = BPF_S_LD_B_ABS;
> - break;
> - case BPF_LD|BPF_W|BPF_LEN:
> - ftest->code = BPF_S_LD_W_LEN;
> - break;
> - case BPF_LD|BPF_W|BPF_IND:
> - ftest->code = BPF_S_LD_W_IND;
> - break;
> - case BPF_LD|BPF_H|BPF_IND:
> - ftest->code = BPF_S_LD_H_IND;
> - break;
> - case BPF_LD|BPF_B|BPF_IND:
> - ftest->code = BPF_S_LD_B_IND;
> - break;
> - case BPF_LD|BPF_IMM:
> - ftest->code = BPF_S_LD_IMM;
> - break;
> - case BPF_LDX|BPF_W|BPF_LEN:
> - ftest->code = BPF_S_LDX_W_LEN;
> - break;
> - case BPF_LDX|BPF_B|BPF_MSH:
> - ftest->code = BPF_S_LDX_B_MSH;
> - break;
> - case BPF_LDX|BPF_IMM:
> - ftest->code = BPF_S_LDX_IMM;
> - break;
> - case BPF_MISC|BPF_TAX:
> - ftest->code = BPF_S_MISC_TAX;
> - break;
> - case BPF_MISC|BPF_TXA:
> - ftest->code = BPF_S_MISC_TXA;
> - break;
> - case BPF_RET|BPF_K:
> - ftest->code = BPF_S_RET_K;
> - break;
> - case BPF_RET|BPF_A:
> - ftest->code = BPF_S_RET_A;
> - break;
> + struct sock_filter *ftest = &filter[pc];
Why move the define here?
> + u16 code = ftest->code;
>
> + if (code >= ARRAY_SIZE(codes))
> + return 0;
return -EINVAL;
> /* Some instructions need special checks */
> -
> - /* check for division by zero */
> + switch (code) {
> case BPF_ALU|BPF_DIV|BPF_K:
> + /* check for division by zero */
> if (ftest->k == 0)
> return -EINVAL;
> - ftest->code = BPF_S_ALU_DIV_K;
> break;
> -
> - /* check for invalid memory addresses */
> case BPF_LD|BPF_MEM:
> - if (ftest->k >= BPF_MEMWORDS)
> - return -EINVAL;
> - ftest->code = BPF_S_LD_MEM;
> - break;
> case BPF_LDX|BPF_MEM:
> - if (ftest->k >= BPF_MEMWORDS)
> - return -EINVAL;
> - ftest->code = BPF_S_LDX_MEM;
> - break;
> case BPF_ST:
> - if (ftest->k >= BPF_MEMWORDS)
> - return -EINVAL;
> - ftest->code = BPF_S_ST;
> - break;
> case BPF_STX:
> + /* check for invalid memory addresses */
> if (ftest->k >= BPF_MEMWORDS)
> return -EINVAL;
> - ftest->code = BPF_S_STX;
> break;
> -
> case BPF_JMP|BPF_JA:
> /*
> * Note, the large ftest->k might cause loops.
> @@ -528,40 +469,14 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
> */
> if (ftest->k >= (unsigned)(flen-pc-1))
> return -EINVAL;
> - ftest->code = BPF_S_JMP_JA;
> - break;
> -
> - case BPF_JMP|BPF_JEQ|BPF_K:
> - ftest->code = BPF_S_JMP_JEQ_K;
> - break;
> - case BPF_JMP|BPF_JEQ|BPF_X:
> - ftest->code = BPF_S_JMP_JEQ_X;
> - break;
> - case BPF_JMP|BPF_JGE|BPF_K:
> - ftest->code = BPF_S_JMP_JGE_K;
> - break;
> - case BPF_JMP|BPF_JGE|BPF_X:
> - ftest->code = BPF_S_JMP_JGE_X;
> - break;
> - case BPF_JMP|BPF_JGT|BPF_K:
> - ftest->code = BPF_S_JMP_JGT_K;
> - break;
> - case BPF_JMP|BPF_JGT|BPF_X:
> - ftest->code = BPF_S_JMP_JGT_X;
> break;
> - case BPF_JMP|BPF_JSET|BPF_K:
> - ftest->code = BPF_S_JMP_JSET_K;
> - break;
> - case BPF_JMP|BPF_JSET|BPF_X:
> - ftest->code = BPF_S_JMP_JSET_X;
> - break;
> -
> - default:
> - return -EINVAL;
> }
> -
> - /* for conditionals both must be safe */
> - switch (ftest->code) {
> + code = codes[code];
> + if (!code--)
> + return -EINVAL;
> +
> + /* for conditionals both must be safe */
> + switch (code) {
> case BPF_S_JMP_JEQ_K:
> case BPF_S_JMP_JEQ_X:
> case BPF_S_JMP_JGE_K:
> @@ -574,6 +489,7 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
> pc + ftest->jf + 1 >= flen)
> return -EINVAL;
> }
> + ftest->code = code;
> }
>
> /* last instruction must be a RET code */
> --
> 1.6.1
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
Regards,
Changli Gao(xiaosuo@gmail.com)
^ permalink raw reply
* Re: [PATCH] ethtool: Add support for vlan accleration.
From: Ben Hutchings @ 2010-11-16 23:14 UTC (permalink / raw)
To: Jesse Gross; +Cc: jgarzik, netdev, David Dillow
In-Reply-To: <1288059734-12916-1-git-send-email-jesse@nicira.com>
On Mon, 2010-10-25 at 19:22 -0700, Jesse Gross wrote:
> The kernel now has support for enabling and disabling vlan
> acceleration, similar to other forms of offloading. This
> adds the complementary userspace support.
Applied.
I had an earlier change that renamed 'off_flags_unwanted' to
'off_flags_mask', so I adjusted your patch accordingly.
Ben.
--
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* Re: [PATCH] ethtool: add get permanent address option (v2)
From: Ben Hutchings @ 2010-11-16 23:12 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: Jeff Garzik, netdev, Joe Perches
In-Reply-To: <20101018131104.02681d60@nehalam>
On Mon, 2010-10-18 at 13:11 -0700, Stephen Hemminger wrote:
> Add command level support for showing permanent address.
> The ioctl has been around for a long time but there was
> no option to display it.
>
> Note: MAX_ADDR_LEN is defined in netdevice.h but including
> netdevice.h leads to multiple definition errors with if.h.
[...]
Applied, along with the fix-up noted by Joe Perches.
Ben.
--
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* Re: [PATCH RESENT] ethtool: add stmmac support
From: Ben Hutchings @ 2010-11-16 23:11 UTC (permalink / raw)
To: Giuseppe CAVALLARO; +Cc: netdev, jgarzik
In-Reply-To: <1286959945-15007-1-git-send-email-peppe.cavallaro@st.com>
On Wed, 2010-10-13 at 10:52 +0200, Giuseppe CAVALLARO wrote:
> Add the stmmac support into the ethtool to
> dump both the Mac Core and Dma registers.
[...]
Applied.
Ben.
--
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply
* Re: [Bugme-new] [Bug 22962] New: building (e)glibc against 2.6.37-rc1 headers fails
From: Andrew Morton @ 2010-11-16 22:33 UTC (permalink / raw)
To: stephan; +Cc: bugzilla-daemon, bugme-daemon, Eric Dumazet, netdev
In-Reply-To: <bug-22962-10286@https.bugzilla.kernel.org/>
(switched to email. Please respond via emailed reply-to-all, not via the
bugzilla web interface).
On Mon, 15 Nov 2010 00:09:33 GMT
bugzilla-daemon@bugzilla.kernel.org wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=22962
>
> Summary: building (e)glibc against 2.6.37-rc1 headers fails
> Product: Networking
> Version: 2.5
> Kernel Version: 2.6.37-rc1
hm, thanks for picking this up so early. It would have been irritating
to let this out in 2.6.37.
> Platform: All
> OS/Version: Linux
> Tree: Mainline
> Status: NEW
> Severity: normal
> Priority: P1
> Component: Other
> AssignedTo: acme@ghostprotocols.net
> ReportedBy: stephan@openelec.tv
> Regression: No
>
>
> i have problems building eglibc against the linux-2.6.37-rc1 headers:
>
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/bin/i686-openelec-linux-gnu-gcc
> ../sysdeps/unix/sysv/linux/if_index.c -c -std=gnu99 -fgnu89-inline -O3 -Wall
> -Winline -Wwrite-strings -fexcess-precision=fast -fgraphite-identity
> -floop-block -floop-interchange -floop-strip-mine -fmerge-all-constants
> -fno-stack-protector -fno-unwind-tables -ftree-loop-distribution -g -m32
> -march=pentium-m -pipe -s -Wstrict-prototypes -mpreferred-stack-boundary=2
> -fomit-frame-pointer -Wa,-mtune=i686 -I../include
> -I/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet
> -I/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc
> -I../sysdeps/i386/elf -I../nptl/sysdeps/unix/sysv/linux/i386/i686
> -I../sysdeps/unix/sysv/linux/i386/i686 -I../nptl/sysdeps/unix/sysv/linux/i386
> -I../sysdeps/unix/sysv/linux/i386 -I../nptl/sysdeps/unix/sysv/linux
> -I../nptl/sysdeps/pthread -I../sysdeps/pthread
> -I../ports/sysdeps/unix/sysv/linux -I../sysdeps/unix/sysv/linux
> -I../sysdeps/gnu -I../sysdeps/unix/common -I../sysdeps/unix/mman
> -I../sysdeps/unix/inet -I../ports/sysdeps/unix/sysv/i386
> -I../sysdeps/unix/sysv/i386 -I../nptl/sysdeps/unix/sysv
> -I../ports/sysdeps/unix/sysv -I../sysdeps/unix/sysv -I../sysdeps/unix/i386
> -I../nptl/sysdeps/unix -I../ports/sysdeps/unix -I../sysdeps/unix
> -I../sysdeps/posix -I../sysdeps/i386/i686/fpu -I../sysdeps/i386/i686/multiarch
> -I../nptl/sysdeps/i386/i686 -I../sysdeps/i386/i686 -I../sysdeps/i386/i486
> -I../nptl/sysdeps/i386/i486 -I../sysdeps/i386/fpu -I../nptl/sysdeps/i386
> -I../sysdeps/i386 -I../sysdeps/wordsize-32 -I../sysdeps/ieee754/ldbl-96
> -I../sysdeps/ieee754/dbl-64 -I../sysdeps/ieee754/flt-32 -I../sysdeps/ieee754
> -I../sysdeps/generic/elf -I../sysdeps/generic -I../nptl -I../ports -I..
> -I../libio -I. -nostdinc -isystem
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/lib/gcc/i686-openelec-linux-gnu/4.5.1/include
> -isystem
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/lib/gcc/i686-openelec-linux-gnu/4.5.1/include-fixed
> -isystem
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include
> -D_LIBC_REENTRANT -include ../include/libc-symbols.h -o
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet/if_index.o
> -MD -MP -MF
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet/if_index.o.dt
> -MT
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet/if_index.o
> In file included from
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/netdevice.h:28:0,
> from
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/rtnetlink.h:9,
> from ../sysdeps/unix/sysv/linux/netlinkaccess.h:24,
> from ../sysdeps/unix/sysv/linux/if_index.c:33:
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/if.h:135:8:
> error: redefinition of 'struct ifmap'
> ../sysdeps/gnu/net/if.h:112:8: note: originally defined here
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/if.h:169:8:
> error: redefinition of 'struct ifreq'
> ../sysdeps/gnu/net/if.h:127:8: note: originally defined here
> /home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/toolchain/i686-openelec-linux-gnu/sysroot/usr/include/linux/if.h:218:8:
> error: redefinition of 'struct ifconf'
> ../sysdeps/gnu/net/if.h:177:8: note: originally defined here
> make[3]: ***
> [/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc/inet/if_index.o]
> Error 1
> make[3]: Leaving directory
> `/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/inet'
> make[2]: *** [inet/subdir_lib] Error 2
> make[2]: Leaving directory
> `/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025'
> make[1]: *** [all] Error 2
> make[1]: Leaving directory
> `/home/stephan/projects/openelec/build.OpenELEC-ATV.i386.devel/eglibc-2.12-12025/objdir-eglibc'
> make: *** [squashfs] Fehler 2
>
> it seems because of an change in include/linux/rtnetlink.h (commit
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=24824a09e35402b8d58dcc5be803a5ad3937bdba)
> where linux/netdevice.h will be included now linux/if.h together with net/if.h
> will be included - see also comments here:
> http://www.mail-archive.com/ubuntu-bugs@lists.ubuntu.com/msg2611725.html
>
Maybe we need some __KERNEL__ guards in if.h.
^ permalink raw reply
* Re: [PATCH] filter: Optimize instruction revalidation code.
From: Hagen Paul Pfeifer @ 2010-11-16 22:13 UTC (permalink / raw)
To: Tetsuo Handa; +Cc: davem, eric.dumazet, drosenberg, netdev
In-Reply-To: <201011162208.BHC17628.SVtFMJOOLFQFOH@I-love.SAKURA.ne.jp>
* Tetsuo Handa | 2010-11-16 22:08:50 [+0900]:
>--- a/net/core/filter.c
>+++ b/net/core/filter.c
>@@ -383,7 +383,57 @@ EXPORT_SYMBOL(sk_run_filter);
> */
> int sk_chk_filter(struct sock_filter *filter, int flen)
> {
>- struct sock_filter *ftest;
>+ /*
>+ * Valid instructions are initialized to non-0.
>+ * Invalid instructions are initialized to 0.
>+ */
>+ static u16 codes[] = {
>+ [BPF_ALU|BPF_ADD|BPF_K] = BPF_S_ALU_ADD_K + 1,
>+ [BPF_ALU|BPF_ADD|BPF_X] = BPF_S_ALU_ADD_X + 1,
>+ [BPF_ALU|BPF_SUB|BPF_K] = BPF_S_ALU_SUB_K + 1,
[...]
Maybe I don't get it, but you increment the opcode by one, but you never
increment the opcode in sk_run_filter() - do I miss something? Did you test
the your patch (a trivial tcpdump rule should be sufficient)?
If this question is answered (or fixed):
Signed-off-by: Hagen Paul Pfeifer <hagen@jauu.net>
HGN
^ permalink raw reply
* [PATCH 3/3] SELinux: return -ECONNREFUSED from ip_postroute to signal fatal error
From: Eric Paris @ 2010-11-16 21:52 UTC (permalink / raw)
To: netdev, linux-kernel, selinux, netfilter-devel
Cc: eparis, equinox, eric.dumazet, davem, hzhong, jmorris, kaber,
kuznet, paul.moore, pekkas, sds, yoshfuji
In-Reply-To: <20101116215238.6727.39248.stgit@paris.rdu.redhat.com>
The SELinux netfilter hooks just return NF_DROP if they drop a packet. We
want to signal that a drop in this hook is a permanant fatal error and is not
transient. If we do this the error will be passed back up the stack in some
places and applications will get a faster interaction that something went
wrong.
Signed-off-by: Eric Paris <eparis@redhat.com>
---
security/selinux/hooks.c | 16 ++++++++--------
1 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 8ba5001..b1104f9 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4594,11 +4594,11 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
secmark_perm = PACKET__SEND;
break;
default:
- return NF_DROP;
+ return NF_DROP_ERR(-ECONNREFUSED);
}
if (secmark_perm == PACKET__FORWARD_OUT) {
if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
- return NF_DROP;
+ return NF_DROP_ERR(-ECONNREFUSED);
} else
peer_sid = SECINITSID_KERNEL;
} else {
@@ -4611,28 +4611,28 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
ad.u.net.netif = ifindex;
ad.u.net.family = family;
if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
- return NF_DROP;
+ return NF_DROP_ERR(-ECONNREFUSED);
if (secmark_active)
if (avc_has_perm(peer_sid, skb->secmark,
SECCLASS_PACKET, secmark_perm, &ad))
- return NF_DROP;
+ return NF_DROP_ERR(-ECONNREFUSED);
if (peerlbl_active) {
u32 if_sid;
u32 node_sid;
if (sel_netif_sid(ifindex, &if_sid))
- return NF_DROP;
+ return NF_DROP_ERR(-ECONNREFUSED);
if (avc_has_perm(peer_sid, if_sid,
SECCLASS_NETIF, NETIF__EGRESS, &ad))
- return NF_DROP;
+ return NF_DROP_ERR(-ECONNREFUSED);
if (sel_netnode_sid(addrp, family, &node_sid))
- return NF_DROP;
+ return NF_DROP_ERR(-ECONNREFUSED);
if (avc_has_perm(peer_sid, node_sid,
SECCLASS_NODE, NODE__SENDTO, &ad))
- return NF_DROP;
+ return NF_DROP_ERR(-ECONNREFUSED);
}
return NF_ACCEPT;
^ permalink raw reply related
* [PATCH 2/3] network: tcp_connect should return certain errors up the stack
From: Eric Paris @ 2010-11-16 21:52 UTC (permalink / raw)
To: netdev, linux-kernel, selinux, netfilter-devel
Cc: eparis, equinox, eric.dumazet, davem, hzhong, jmorris, kaber,
kuznet, paul.moore, pekkas, sds, yoshfuji
In-Reply-To: <20101116215238.6727.39248.stgit@paris.rdu.redhat.com>
The current tcp_connect code completely ignores errors from sending an skb.
This makes sense in many situations (like -ENOBUFFS) but I want to be able to
immediately fail connections if they are denied by the SELinux netfilter hook.
Netfilter does not normally return ECONNREFUSED when it drops a packet so we
respect that error code as a final and fatal error that can not be recovered.
Based-on-patch-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Eric Paris <eparis@redhat.com>
---
net/ipv4/tcp_output.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e961522..15dcd7b 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2592,6 +2592,7 @@ int tcp_connect(struct sock *sk)
{
struct tcp_sock *tp = tcp_sk(sk);
struct sk_buff *buff;
+ int err;
tcp_connect_init(sk);
@@ -2614,7 +2615,9 @@ int tcp_connect(struct sock *sk)
sk->sk_wmem_queued += buff->truesize;
sk_mem_charge(sk, buff->truesize);
tp->packets_out += tcp_skb_pcount(buff);
- tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
+ err = tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
+ if (err == -ECONNREFUSED)
+ return err;
/* We change tp->snd_nxt after the tcp_transmit_skb() call
* in order to make this packet get counted in tcpOutSegs.
^ permalink raw reply related
* [PATCH 1/3] netfilter: allow hooks to pass error code back up the stack
From: Eric Paris @ 2010-11-16 21:52 UTC (permalink / raw)
To: netdev, linux-kernel, selinux, netfilter-devel
Cc: eparis, equinox, eric.dumazet, davem, hzhong, jmorris, kaber,
kuznet, paul.moore, pekkas, sds, yoshfuji
SELinux would like to pass certain fatal errors back up the stack. This patch
implements the generic netfilter support for this functionality.
Based-on-patch-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Eric Paris <eparis@redhat.com>
---
include/linux/netfilter.h | 2 ++
net/netfilter/core.c | 6 ++++--
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 03317c8..1893837 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -33,6 +33,8 @@
#define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE)
+#define NF_DROP_ERR(x) (((-x) << NF_VERDICT_BITS) | NF_DROP)
+
/* only for userspace compatibility */
#ifndef __KERNEL__
/* Generic cache responses from hook functions.
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 85dabb8..32fcbe2 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -173,9 +173,11 @@ next_hook:
outdev, &elem, okfn, hook_thresh);
if (verdict == NF_ACCEPT || verdict == NF_STOP) {
ret = 1;
- } else if (verdict == NF_DROP) {
+ } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
kfree_skb(skb);
- ret = -EPERM;
+ ret = -(verdict >> NF_VERDICT_BITS);
+ if (ret == 0)
+ ret = -EPERM;
} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
verdict >> NF_VERDICT_BITS))
^ permalink raw reply related
* Re: [PATCH] Enhance AF_PACKET implementation to not require high order contiguous memory allocation (v4)
From: Neil Horman @ 2010-11-16 21:30 UTC (permalink / raw)
To: David Miller; +Cc: netdev, eric.dumazet, zenczykowski
In-Reply-To: <20101116.102537.246547550.davem@davemloft.net>
On Tue, Nov 16, 2010 at 10:25:37AM -0800, David Miller wrote:
> From: nhorman@tuxdriver.com
> Date: Wed, 10 Nov 2010 14:09:54 -0500
>
> > Version 4 of this patch.
>
> Applied, thanks a lot for doing this.
No problem, thanks!
Neil
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply
* Re: [PATCH net-next-2.6 v4] can: Topcliff: PCH_CAN driver: Add Flow control/Fix Endianess issue/Separate IF register/Enumerate LEC macro/Move MSI processing/Use BIT(X)/Change Message Object index/Add prefix PCH_
From: David Miller @ 2010-11-16 21:10 UTC (permalink / raw)
To: w.sang-bIcnvbaLZ9MEGnE8C9+IrQ
Cc: andrew.chih.howe.khor-ral2JQCrhuEAvxtiuMwx3w,
socketcan-core-0fE9KPoRgkgATYTw5x5z8w,
sameo-VuQAYsv1563Yd54FQh9/CA,
margie.foster-ral2JQCrhuEAvxtiuMwx3w,
netdev-u79uwXL29TY76Z2rM5mHXA, chripell-VaTbYqLCNhc,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
yong.y.wang-ral2JQCrhuEAvxtiuMwx3w,
masa-korg-ECg8zkTtlr0C6LszWs/t0g,
kok.howg.ewe-ral2JQCrhuEAvxtiuMwx3w,
joel.clark-ral2JQCrhuEAvxtiuMwx3w, wg-5Yr1BZd7O62+XT7JhA+gdA,
qi.wang-ral2JQCrhuEAvxtiuMwx3w
In-Reply-To: <20101116210716.GA19893-bIcnvbaLZ9MEGnE8C9+IrQ@public.gmane.org>
From: Wolfram Sang <w.sang-bIcnvbaLZ9MEGnE8C9+IrQ@public.gmane.org>
Date: Tue, 16 Nov 2010 22:07:16 +0100
> On Tue, Nov 16, 2010 at 12:43:25PM -0800, David Miller wrote:
>> From: Wolfgang Grandegger <wg-5Yr1BZd7O62+XT7JhA+gdA@public.gmane.org>
>> Date: Tue, 16 Nov 2010 21:39:47 +0100
>>
>> > Please take into account that this patch got accepted by accident
>> > (because the maintainer did not respond properly in time). At that time
>> > the driver was incomplete, not ready for mainline and did not even work
>> > properly. Therefore it makes little sense to debug or even bisec these
>> > changes. Just for that reason I made an exemption and added my
>> > "Acked-by". Hope you can share my arguments.
>>
>> You don't put stupid on top of stupid and justify the latter using
>> the former.
>
> Is reverting the incomplete driver an option?
I told everyone that the plan was that we had several months
to fix this, and that's what we should do.
But yes if people are going to be maximally difficult about this and
refuse to split up the bug fixes, I will have to regrettably revert
the driver.
But let's avoid that if we can.
^ permalink raw reply
* Re: [PATCH net-next-2.6 v4] can: Topcliff: PCH_CAN driver: Add Flow control/Fix Endianess issue/Separate IF register/Enumerate LEC macro/Move MSI processing/Use BIT(X)/Change Message Object index/Add prefix PCH_
From: Wolfram Sang @ 2010-11-16 21:07 UTC (permalink / raw)
To: David Miller
Cc: andrew.chih.howe.khor-ral2JQCrhuEAvxtiuMwx3w,
socketcan-core-0fE9KPoRgkgATYTw5x5z8w,
sameo-VuQAYsv1563Yd54FQh9/CA,
margie.foster-ral2JQCrhuEAvxtiuMwx3w,
netdev-u79uwXL29TY76Z2rM5mHXA, chripell-VaTbYqLCNhc,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
yong.y.wang-ral2JQCrhuEAvxtiuMwx3w,
masa-korg-ECg8zkTtlr0C6LszWs/t0g,
kok.howg.ewe-ral2JQCrhuEAvxtiuMwx3w,
joel.clark-ral2JQCrhuEAvxtiuMwx3w, wg-5Yr1BZd7O62+XT7JhA+gdA,
qi.wang-ral2JQCrhuEAvxtiuMwx3w
In-Reply-To: <20101116.124325.116396459.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
[-- Attachment #1.1: Type: text/plain, Size: 898 bytes --]
On Tue, Nov 16, 2010 at 12:43:25PM -0800, David Miller wrote:
> From: Wolfgang Grandegger <wg-5Yr1BZd7O62+XT7JhA+gdA@public.gmane.org>
> Date: Tue, 16 Nov 2010 21:39:47 +0100
>
> > Please take into account that this patch got accepted by accident
> > (because the maintainer did not respond properly in time). At that time
> > the driver was incomplete, not ready for mainline and did not even work
> > properly. Therefore it makes little sense to debug or even bisec these
> > changes. Just for that reason I made an exemption and added my
> > "Acked-by". Hope you can share my arguments.
>
> You don't put stupid on top of stupid and justify the latter using
> the former.
Is reverting the incomplete driver an option?
--
Pengutronix e.K. | Wolfram Sang |
Industrial Linux Solutions | http://www.pengutronix.de/ |
[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 197 bytes --]
[-- Attachment #2: Type: text/plain, Size: 188 bytes --]
_______________________________________________
Socketcan-core mailing list
Socketcan-core-0fE9KPoRgkgATYTw5x5z8w@public.gmane.org
https://lists.berlios.de/mailman/listinfo/socketcan-core
^ permalink raw reply
* Re: [PATCH net-next-2.6 v4] can: Topcliff: PCH_CAN driver: Add Flow control/Fix Endianess issue/Separate IF register/Enumerate LEC macro/Move MSI processing/Use BIT(X)/Change Message Object index/Add prefix PCH_
From: David Miller @ 2010-11-16 20:43 UTC (permalink / raw)
To: wg-5Yr1BZd7O62+XT7JhA+gdA
Cc: andrew.chih.howe.khor-ral2JQCrhuEAvxtiuMwx3w,
socketcan-core-0fE9KPoRgkgATYTw5x5z8w,
sameo-VuQAYsv1563Yd54FQh9/CA,
margie.foster-ral2JQCrhuEAvxtiuMwx3w,
netdev-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
yong.y.wang-ral2JQCrhuEAvxtiuMwx3w,
masa-korg-ECg8zkTtlr0C6LszWs/t0g,
kok.howg.ewe-ral2JQCrhuEAvxtiuMwx3w, chripell-VaTbYqLCNhc,
joel.clark-ral2JQCrhuEAvxtiuMwx3w, qi.wang-ral2JQCrhuEAvxtiuMwx3w
In-Reply-To: <4CE2EC13.9090707-5Yr1BZd7O62+XT7JhA+gdA@public.gmane.org>
From: Wolfgang Grandegger <wg-5Yr1BZd7O62+XT7JhA+gdA@public.gmane.org>
Date: Tue, 16 Nov 2010 21:39:47 +0100
> Please take into account that this patch got accepted by accident
> (because the maintainer did not respond properly in time). At that time
> the driver was incomplete, not ready for mainline and did not even work
> properly. Therefore it makes little sense to debug or even bisec these
> changes. Just for that reason I made an exemption and added my
> "Acked-by". Hope you can share my arguments.
You don't put stupid on top of stupid and justify the latter using
the former.
^ permalink raw reply
* Re: [PATCH net-next-2.6 v4] can: Topcliff: PCH_CAN driver: Add Flow control/Fix Endianess issue/Separate IF register/Enumerate LEC macro/Move MSI processing/Use BIT(X)/Change Message Object index/Add prefix PCH_
From: Wolfgang Grandegger @ 2010-11-16 20:39 UTC (permalink / raw)
To: David Miller
Cc: andrew.chih.howe.khor-ral2JQCrhuEAvxtiuMwx3w,
socketcan-core-0fE9KPoRgkgATYTw5x5z8w,
sameo-VuQAYsv1563Yd54FQh9/CA,
margie.foster-ral2JQCrhuEAvxtiuMwx3w,
netdev-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
yong.y.wang-ral2JQCrhuEAvxtiuMwx3w,
masa-korg-ECg8zkTtlr0C6LszWs/t0g,
kok.howg.ewe-ral2JQCrhuEAvxtiuMwx3w, chripell-VaTbYqLCNhc,
joel.clark-ral2JQCrhuEAvxtiuMwx3w, qi.wang-ral2JQCrhuEAvxtiuMwx3w
In-Reply-To: <20101116.091443.226753420.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
Hi David,
On 11/16/2010 06:14 PM, David Miller wrote:
>
> Way too many changes in one patch.
>
> Please post one that fixes the endianness issues.
>
> One that fixes the register interface seperation.
>
> One that adds flow control processing.
>
> etc.
>
> When you combine many tasks into one patch it's impossible
> to bisect through your changes to debug problems in order
> to figure out which changed introduced a bug.
>
> I am not applying this, and I will not apply your patches
> until you split them up properly.
>
> You may think that there is zero value in this, but there
> is huge value in it for anyone who tries to debug your
> changes in the future. Right now you are making that a
> nearly impossible task.
Please take into account that this patch got accepted by accident
(because the maintainer did not respond properly in time). At that time
the driver was incomplete, not ready for mainline and did not even work
properly. Therefore it makes little sense to debug or even bisec these
changes. Just for that reason I made an exemption and added my
"Acked-by". Hope you can share my arguments.
Wolfgang.
^ permalink raw reply
* Re: iproute2: use automake
From: Jan Engelhardt @ 2010-11-16 20:12 UTC (permalink / raw)
To: David Miller
Cc: shemminger, stephen.hemminger, Netfilter Developer Mailing List,
netdev
In-Reply-To: <alpine.LNX.2.01.1011162017320.24880@obet.zrqbmnf.qr>
On Tuesday 2010-11-16 18:41, David Miller wrote:
>
>> Until you make a convincing case that the existing infrastructure
>> is a problem, choosing an alternative solution is bogus.
>
>I can't count the amount of times I've seen major source trees
>invest tons of engineering into things to decrease the pain of
>using things like automake and libtool.
The pro argument for a build system is not that Linux-only projects
receive unneeded portability work, but that the work involved with
maintaining all the commands in Makefiles, which tend to be a source
of update anomalies, gets reduced.
>X11 even has a script that basically turns libtool into one big
>fat NOP, because on Linux everything libtool tries to figure out
>is completely superfluous.
(I was not trying to make a case for Libtool specifically.)
And yet they do use a build system (which happens to be Automake, but
that's not my point). Was their time spent just to produce,
"unnecessary non-sense", as you call it? I can imagine they will
disagree with you.
>Don't crap up the tree with unnecessary non-sense just for some
>theoretical gain. Things work just fine right now.
They do not.
* running make in subdirs is broken
* iproute2/arpd compilation fails if db_185.h, atm.h is not present
and
* people could not quite opt out building arpd when they are
fine with not having it
* the DESTDIR variable was completely abused
* data files were shoven into /usr/lib where they don't even belong
(that is, if you care about FHS even a tiny bit)
* NO_SHARED_LIBS=y is broken
* -lresolv was added unconditionally when it's not even needed
* CFLAGS was overriden, which means a user running make CFLAGS="-g"
will kill the all-important -Wall and -I../include
* Out-of-tree building, anyone?
But what do I say; if it works _for you_, I must be wrong by
definition.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox