* Re: [PATCH 3/4] wl1251: spi: add vio regulator support
From: Pavel Machek @ 2013-11-05 13:12 UTC (permalink / raw)
To: Sebastian Reichel
Cc: Sebastian Reichel, Luciano Coelho, Rob Herring, Pawel Moll,
Mark Rutland, Stephen Warren, Ian Campbell, Rob Landley,
Tony Lindgren, Russell King, John W. Linville, Felipe Balbi,
Sachin Kamat, Greg Kroah-Hartman, Bill Pemberton,
devicetree-u79uwXL29TY76Z2rM5mHXA,
linux-doc-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-omap-u79uwXL29TY76Z2rM5mHXA,
linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r,
linux-wireless-u79uwXL29TY76Z2rM5mHXA,
netdev-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <1382890469-25286-4-git-send-email-sre-8fiUuRrzOP0dnm+yROfE0A@public.gmane.org>
On Sun 2013-10-27 17:14:28, Sebastian Reichel wrote:
> This patch adds support for requesting the regulator powering
> the vio pin.
>
> The patch also adds the regulator for the all boards using the
> wl1251 in spi mode (only the Nokia N900).
>
> Signed-off-by: Sebastian Reichel <sre-8fiUuRrzOP0dnm+yROfE0A@public.gmane.org>
Reviewed-by: Pavel Machek <pavel-+ZI9xUNit7I@public.gmane.org>
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 2/4] wl1251: move power GPIO handling into the driver
From: Pavel Machek @ 2013-11-05 13:11 UTC (permalink / raw)
To: Sebastian Reichel
Cc: Sebastian Reichel, Luciano Coelho, Rob Herring, Pawel Moll,
Mark Rutland, Stephen Warren, Ian Campbell, Rob Landley,
Tony Lindgren, Russell King, John W. Linville, Felipe Balbi,
Sachin Kamat, Greg Kroah-Hartman, Bill Pemberton,
devicetree-u79uwXL29TY76Z2rM5mHXA,
linux-doc-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-omap-u79uwXL29TY76Z2rM5mHXA,
linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r,
linux-wireless-u79uwXL29TY76Z2rM5mHXA,
netdev-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <1382890469-25286-3-git-send-email-sre-8fiUuRrzOP0dnm+yROfE0A@public.gmane.org>
On Sun 2013-10-27 17:14:27, Sebastian Reichel wrote:
> Move the power GPIO handling from the board code into
> the driver. This is a dependency for device tree support.
>
> Signed-off-by: Sebastian Reichel <sre-8fiUuRrzOP0dnm+yROfE0A@public.gmane.org>
Reviewed-by: Pavel Machek <pavel-+ZI9xUNit7I@public.gmane.org>
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH net] vti: fix spd lookup: match plaintext pkt, not ipsec pkt
From: Sergei Shtylyov @ 2013-11-05 13:05 UTC (permalink / raw)
To: Christophe Gouault, Steffen Klassert, David S. Miller
Cc: Herbert Xu, Saurabh Mohan, netdev
In-Reply-To: <1383646612-30103-1-git-send-email-christophe.gouault@6wind.com>
Hello.
On 05-11-2013 14:16, Christophe Gouault wrote:
> The vti interface inbound and outbound SPD lookups are based on the
> ipsec packet instead of the plaintext packet.
> Not only is it counterintuitive, it also restricts vti interfaces
> to a single policy (whose selector must match the tunnel local and
> remote addresses).
> The policy selector is supposed to match the plaintext packet, before
> encryption or after decryption.
> This patch performs the SPD lookup based on the plaintext packet. It
> enables to create several polices bound to the vti interface (via a
> mark equal to the vti interface okey).
> It remains possible to apply the same policy to all packets entering
> the vti interface, by setting an any-to-any selector (src 0.0.0.0/0
> dst 0.0.0.0/0 proto any mark OKEY).
> Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
> ---
> net/ipv4/ip_vti.c | 28 +++++++++++++++++++++++++++-
> 1 file changed, 27 insertions(+), 1 deletion(-)
> diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
> index 6e87f85..a7e03c0 100644
> --- a/net/ipv4/ip_vti.c
> +++ b/net/ipv4/ip_vti.c
[...]
> @@ -133,7 +134,12 @@ static int vti_rcv(struct sk_buff *skb)
> * only match policies with this mark.
> */
> skb->mark = be32_to_cpu(tunnel->parms.o_key);
> + /* the packet is decrypted, but not yet decapsulated.
> + * Temporarily make network_header point to the inner header
> + * for policy check */
Multi-line comment style in the networking code is:
/* bla
* bla
*/
[...]
> @@ -173,17 +181,35 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
>
> tos = old_iph->tos;
>
> + /* SPD lookup: we must provide a dst_entry to xfrm_lookup, normally the
> + * route to the final destination. However this route is a route via
> + * the vti interface. Now vti interfaces typically have the NOXFRM
> + * flag, hence xfrm_lookup would bypass IPsec.
> + *
> + * Therefore, we feed xfrm_lookup with a route to the vti tunnel remote
> + * endpoint instead.
> + */
Hm, you got it right the second and third time.
WBR, Sergei
^ permalink raw reply
* Re: [PATCH nf-next] netfilter: xtables: lightweight process control group matching
From: Daniel Borkmann @ 2013-11-05 13:03 UTC (permalink / raw)
To: pablo-Cap9r6Oaw4JrovVCs/uTlw
Cc: netfilter-devel-u79uwXL29TY76Z2rM5mHXA,
netdev-u79uwXL29TY76Z2rM5mHXA, Tejun Heo,
cgroups-u79uwXL29TY76Z2rM5mHXA
In-Reply-To: <ee0fb538d6e43e23d0488d3edd741de9c4589fb1.1382101225.git.dborkman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
On 10/18/2013 03:28 PM, Daniel Borkmann wrote:
> It would be useful e.g. in a server or desktop environment to have
> a facility in the notion of fine-grained "per application" or "per
> application group" firewall policies. Probably, users in the mobile/
> embedded area (e.g. Android based) with different security policy
> requirements for application groups could have great benefit from
> that as well. For example, with a little bit of configuration effort,
> an admin could whitelist well-known applications, and thus block
> otherwise unwanted "hard-to-track" applications like [1] from a
> user's machine.
>
> Implementation of PID-based matching would not be appropriate
> as they frequently change, and child tracking would make that
> even more complex and ugly. Cgroups would be a perfect candidate
> for accomplishing that as they associate a set of tasks with a
> set of parameters for one or more subsystems, in our case the
> netfilter subsystem, which, of course, can be combined with other
> cgroup subsystems into something more complex.
>
> As mentioned, to overcome this constraint, such processes could
> be placed into one or multiple cgroups where different fine-grained
> rules can be defined depending on the application scenario, while
> e.g. everything else that is not part of that could be dropped (or
> vice versa), thus making life harder for unwanted processes to
> communicate to the outside world. So, we make use of cgroups here
> to track jobs and limit their resources in terms of iptables
> policies; in other words, limiting what they are allowed to
> communicate.
>
> Minimal, basic usage example (many other iptables options can be
> applied obviously):
>
> 1) Configuring cgroups:
>
> mkdir /sys/fs/cgroup/net_filter
> mount -t cgroup -o net_filter net_filter /sys/fs/cgroup/net_filter
> mkdir /sys/fs/cgroup/net_filter/0
> echo 1 > /sys/fs/cgroup/net_filter/0/net_filter.fwid
>
> 2) Configuring netfilter:
>
> iptables -A OUTPUT -m cgroup ! --cgroup 1 -j DROP
>
> 3) Running applications:
>
> ping 208.67.222.222 <pid:1799>
> echo 1799 > /sys/fs/cgroup/net_filter/0/tasks
> 64 bytes from 208.67.222.222: icmp_seq=44 ttl=49 time=11.9 ms
> ...
>
> ping 208.67.220.220 <pid:1804>
> ping: sendmsg: Operation not permitted
> ...
> echo 1804 > /sys/fs/cgroup/net_filter/0/tasks
> 64 bytes from 208.67.220.220: icmp_seq=89 ttl=56 time=19.0 ms
> ...
>
> Of course, real-world deployments would make use of cgroups user
> space toolsuite, or own custom policy daemons dynamically moving
> applications from/to various net_filter cgroups.
>
> Design considerations appendix:
>
> Based on the discussion from [2], [3], it seems the best tradeoff
> imho to make this a subsystem, here's why:
>
> netfilter is a large enough and ubiquitous subsystem, meaning it
> is not somewhere in a niche, and enabled/shipped on most machines.
> It is true that the descision making on fwid is "outsourced" to
> netfilter itself, but that does not necessarily need to be
> considered as a bad thing to delegate and reuse as much as possible.
> The matching performance in the critical path is just a simple
> comparison of fwid tags, nothing more, thus resulting in a good
> performance suited for high-speed networking. Moreover, by simply
> transfering fwids between user- and kernel space, we can have the
> ruleset as packed as possible, giving an optimal footprint for
> large rulesets using this feature. The alternative draft that we
> have proposed in [3] comes at the cost of exposing some of the
> cgroups internals outside of cgroups to make it work, at least a
> higher memory footprint for transferal of rules and even worse a
> lower performance as more work needs to be done in the matching
> critical path, that is traversing all cgroups a task belongs to
> to find the one of our interest. Moreover, from the usability
> point of view, it seems less intuitive, rather more confusing
> than the approach presented here. Therefore, I consider this design
> the better and less intrusive tradeoff to go with.
As I've provided a code proposal for both variants and a design
discussion/conclusion, are you d'accord with this patch Tejun?
> [1] http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf
> [2] http://patchwork.ozlabs.org/patch/280687/
> [3] http://patchwork.ozlabs.org/patch/282477/
>
> Signed-off-by: Daniel Borkmann <dborkman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> Cc: Tejun Heo <tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
> Cc: cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> ---
> v1->v2:
> - Updated commit message, rebased
> - Applied Gao Feng's feedback from [2]
>
> Note: iptables part is still available in http://patchwork.ozlabs.org/patch/280690/
>
> Documentation/cgroups/00-INDEX | 2 +
> Documentation/cgroups/net_filter.txt | 27 +++++
> include/linux/cgroup_subsys.h | 5 +
> include/net/netfilter/xt_cgroup.h | 58 ++++++++++
> include/net/sock.h | 3 +
> include/uapi/linux/netfilter/Kbuild | 1 +
> include/uapi/linux/netfilter/xt_cgroup.h | 11 ++
> net/core/scm.c | 2 +
> net/core/sock.c | 14 +++
> net/netfilter/Kconfig | 8 ++
> net/netfilter/Makefile | 1 +
> net/netfilter/xt_cgroup.c | 177 +++++++++++++++++++++++++++++++
> 12 files changed, 309 insertions(+)
> create mode 100644 Documentation/cgroups/net_filter.txt
> create mode 100644 include/net/netfilter/xt_cgroup.h
> create mode 100644 include/uapi/linux/netfilter/xt_cgroup.h
> create mode 100644 net/netfilter/xt_cgroup.c
>
> diff --git a/Documentation/cgroups/00-INDEX b/Documentation/cgroups/00-INDEX
> index bc461b6..14424d2 100644
> --- a/Documentation/cgroups/00-INDEX
> +++ b/Documentation/cgroups/00-INDEX
> @@ -20,6 +20,8 @@ memory.txt
> - Memory Resource Controller; design, accounting, interface, testing.
> net_cls.txt
> - Network classifier cgroups details and usages.
> +net_filter.txt
> + - Network firewalling (netfilter) cgroups details and usages.
> net_prio.txt
> - Network priority cgroups details and usages.
> resource_counter.txt
> diff --git a/Documentation/cgroups/net_filter.txt b/Documentation/cgroups/net_filter.txt
> new file mode 100644
> index 0000000..22759e4
> --- /dev/null
> +++ b/Documentation/cgroups/net_filter.txt
> @@ -0,0 +1,27 @@
> +Netfilter cgroup
> +----------------
> +
> +The netfilter cgroup provides an interface to aggregate jobs
> +to a particular netfilter tag, that can be used to apply
> +various iptables/netfilter policies for those jobs in order
> +to limit resources/abilities for network communication.
> +
> +Creating a net_filter cgroups instance creates a net_filter.fwid
> +file. The value of net_filter.fwid is initialized to 0 on
> +default (so only global iptables/netfilter policies apply).
> +You can write a unique decimal fwid tag into net_filter.fwid
> +file, and use that tag along with iptables' --cgroup option.
> +
> +Minimal/basic usage example:
> +
> +1) Configuring cgroup:
> +
> + mkdir /sys/fs/cgroup/net_filter
> + mount -t cgroup -o net_filter net_filter /sys/fs/cgroup/net_filter
> + mkdir /sys/fs/cgroup/net_filter/0
> + echo 1 > /sys/fs/cgroup/net_filter/0/net_filter.fwid
> + echo [pid] > /sys/fs/cgroup/net_filter/0/tasks
> +
> +2) Configuring netfilter:
> +
> + iptables -A OUTPUT -m cgroup ! --cgroup 1 -p tcp --dport 80 -j DROP
> diff --git a/include/linux/cgroup_subsys.h b/include/linux/cgroup_subsys.h
> index b613ffd..ef58217 100644
> --- a/include/linux/cgroup_subsys.h
> +++ b/include/linux/cgroup_subsys.h
> @@ -50,6 +50,11 @@ SUBSYS(net_prio)
> #if IS_SUBSYS_ENABLED(CONFIG_CGROUP_HUGETLB)
> SUBSYS(hugetlb)
> #endif
> +
> +#if IS_SUBSYS_ENABLED(CONFIG_NETFILTER_XT_MATCH_CGROUP)
> +SUBSYS(net_filter)
> +#endif
> +
> /*
> * DO NOT ADD ANY SUBSYSTEM WITHOUT EXPLICIT ACKS FROM CGROUP MAINTAINERS.
> */
> diff --git a/include/net/netfilter/xt_cgroup.h b/include/net/netfilter/xt_cgroup.h
> new file mode 100644
> index 0000000..b2c702f
> --- /dev/null
> +++ b/include/net/netfilter/xt_cgroup.h
> @@ -0,0 +1,58 @@
> +#ifndef _XT_CGROUP_H
> +#define _XT_CGROUP_H
> +
> +#include <linux/types.h>
> +#include <linux/cgroup.h>
> +#include <linux/hardirq.h>
> +#include <linux/rcupdate.h>
> +
> +#if IS_ENABLED(CONFIG_NETFILTER_XT_MATCH_CGROUP)
> +struct cgroup_nf_state {
> + struct cgroup_subsys_state css;
> + u32 fwid;
> +};
> +
> +void sock_update_fwid(struct sock *sk);
> +
> +#if IS_BUILTIN(CONFIG_NETFILTER_XT_MATCH_CGROUP)
> +static inline u32 task_fwid(struct task_struct *p)
> +{
> + u32 fwid;
> +
> + if (in_interrupt())
> + return 0;
> +
> + rcu_read_lock();
> + fwid = container_of(task_css(p, net_filter_subsys_id),
> + struct cgroup_nf_state, css)->fwid;
> + rcu_read_unlock();
> +
> + return fwid;
> +}
> +#elif IS_MODULE(CONFIG_NETFILTER_XT_MATCH_CGROUP)
> +static inline u32 task_fwid(struct task_struct *p)
> +{
> + struct cgroup_subsys_state *css;
> + u32 fwid = 0;
> +
> + if (in_interrupt())
> + return 0;
> +
> + rcu_read_lock();
> + css = task_css(p, net_filter_subsys_id);
> + if (css)
> + fwid = container_of(css, struct cgroup_nf_state, css)->fwid;
> + rcu_read_unlock();
> +
> + return fwid;
> +}
> +#endif
> +#else /* !CONFIG_NETFILTER_XT_MATCH_CGROUP */
> +static inline u32 task_fwid(struct task_struct *p)
> +{
> + return 0;
> +}
> +
> +#define sock_update_fwid(sk)
> +#endif /* CONFIG_NETFILTER_XT_MATCH_CGROUP */
> +#endif /* _XT_CGROUP_H */
> diff --git a/include/net/sock.h b/include/net/sock.h
> index e3bf213..f7da4b4 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -387,6 +387,9 @@ struct sock {
> #if IS_ENABLED(CONFIG_NETPRIO_CGROUP)
> __u32 sk_cgrp_prioidx;
> #endif
> +#if IS_ENABLED(CONFIG_NETFILTER_XT_MATCH_CGROUP)
> + __u32 sk_cgrp_fwid;
> +#endif
> struct pid *sk_peer_pid;
> const struct cred *sk_peer_cred;
> long sk_rcvtimeo;
> diff --git a/include/uapi/linux/netfilter/Kbuild b/include/uapi/linux/netfilter/Kbuild
> index 1749154..94a4890 100644
> --- a/include/uapi/linux/netfilter/Kbuild
> +++ b/include/uapi/linux/netfilter/Kbuild
> @@ -37,6 +37,7 @@ header-y += xt_TEE.h
> header-y += xt_TPROXY.h
> header-y += xt_addrtype.h
> header-y += xt_bpf.h
> +header-y += xt_cgroup.h
> header-y += xt_cluster.h
> header-y += xt_comment.h
> header-y += xt_connbytes.h
> diff --git a/include/uapi/linux/netfilter/xt_cgroup.h b/include/uapi/linux/netfilter/xt_cgroup.h
> new file mode 100644
> index 0000000..43acb7e
> --- /dev/null
> +++ b/include/uapi/linux/netfilter/xt_cgroup.h
> @@ -0,0 +1,11 @@
> +#ifndef _UAPI_XT_CGROUP_H
> +#define _UAPI_XT_CGROUP_H
> +
> +#include <linux/types.h>
> +
> +struct xt_cgroup_info {
> + __u32 id;
> + __u32 invert;
> +};
> +
> +#endif /* _UAPI_XT_CGROUP_H */
> diff --git a/net/core/scm.c b/net/core/scm.c
> index b442e7e..f08672a 100644
> --- a/net/core/scm.c
> +++ b/net/core/scm.c
> @@ -36,6 +36,7 @@
> #include <net/sock.h>
> #include <net/compat.h>
> #include <net/scm.h>
> +#include <net/netfilter/xt_cgroup.h>
> #include <net/cls_cgroup.h>
>
>
> @@ -290,6 +291,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
> /* Bump the usage count and install the file. */
> sock = sock_from_file(fp[i], &err);
> if (sock) {
> + sock_update_fwid(sock->sk);
> sock_update_netprioidx(sock->sk);
> sock_update_classid(sock->sk);
> }
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 2bd9b3f..524a376 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -125,6 +125,7 @@
> #include <linux/skbuff.h>
> #include <net/net_namespace.h>
> #include <net/request_sock.h>
> +#include <net/netfilter/xt_cgroup.h>
> #include <net/sock.h>
> #include <linux/net_tstamp.h>
> #include <net/xfrm.h>
> @@ -1337,6 +1338,18 @@ void sock_update_netprioidx(struct sock *sk)
> EXPORT_SYMBOL_GPL(sock_update_netprioidx);
> #endif
>
> +#if IS_ENABLED(CONFIG_NETFILTER_XT_MATCH_CGROUP)
> +void sock_update_fwid(struct sock *sk)
> +{
> + u32 fwid;
> +
> + fwid = task_fwid(current);
> + if (fwid != sk->sk_cgrp_fwid)
> + sk->sk_cgrp_fwid = fwid;
> +}
> +EXPORT_SYMBOL(sock_update_fwid);
> +#endif
> +
> /**
> * sk_alloc - All socket objects are allocated here
> * @net: the applicable net namespace
> @@ -1363,6 +1376,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
>
> sock_update_classid(sk);
> sock_update_netprioidx(sk);
> + sock_update_fwid(sk);
> }
>
> return sk;
> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
> index 6e839b6..d276ff4 100644
> --- a/net/netfilter/Kconfig
> +++ b/net/netfilter/Kconfig
> @@ -806,6 +806,14 @@ config NETFILTER_XT_MATCH_BPF
>
> To compile it as a module, choose M here. If unsure, say N.
>
> +config NETFILTER_XT_MATCH_CGROUP
> + tristate '"control group" match support'
> + depends on NETFILTER_ADVANCED
> + depends on CGROUPS
> + ---help---
> + Socket/process control group matching allows you to match locally
> + generated packets based on which control group processes belong to.
> +
> config NETFILTER_XT_MATCH_CLUSTER
> tristate '"cluster" match support'
> depends on NF_CONNTRACK
> diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
> index c3a0a12..12f014f 100644
> --- a/net/netfilter/Makefile
> +++ b/net/netfilter/Makefile
> @@ -124,6 +124,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_MULTIPORT) += xt_multiport.o
> obj-$(CONFIG_NETFILTER_XT_MATCH_NFACCT) += xt_nfacct.o
> obj-$(CONFIG_NETFILTER_XT_MATCH_OSF) += xt_osf.o
> obj-$(CONFIG_NETFILTER_XT_MATCH_OWNER) += xt_owner.o
> +obj-$(CONFIG_NETFILTER_XT_MATCH_CGROUP) += xt_cgroup.o
> obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
> obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
> obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
> diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
> new file mode 100644
> index 0000000..249c7ee
> --- /dev/null
> +++ b/net/netfilter/xt_cgroup.c
> @@ -0,0 +1,177 @@
> +/*
> + * Xtables module to match the process control group.
> + *
> + * Might be used to implement individual "per-application" firewall
> + * policies in contrast to global policies based on control groups.
> + *
> + * (C) 2013 Daniel Borkmann <dborkman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> + * (C) 2013 Thomas Graf <tgraf-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License version 2 as
> + * published by the Free Software Foundation.
> + */
> +
> +#include <linux/skbuff.h>
> +#include <linux/module.h>
> +#include <linux/file.h>
> +#include <linux/cgroup.h>
> +#include <linux/fdtable.h>
> +#include <linux/netfilter/x_tables.h>
> +#include <linux/netfilter/xt_cgroup.h>
> +#include <net/netfilter/xt_cgroup.h>
> +#include <net/sock.h>
> +
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR("Daniel Borkmann <dborkman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>");
> +MODULE_DESCRIPTION("Xtables: process control group matching");
> +MODULE_ALIAS("ipt_cgroup");
> +MODULE_ALIAS("ip6t_cgroup");
> +
> +static int cgroup_mt_check(const struct xt_mtchk_param *par)
> +{
> + struct xt_cgroup_info *info = par->matchinfo;
> +
> + if (info->invert & ~1)
> + return -EINVAL;
> +
> + return info->id ? 0 : -EINVAL;
> +}
> +
> +static bool
> +cgroup_mt(const struct sk_buff *skb, struct xt_action_param *par)
> +{
> + const struct xt_cgroup_info *info = par->matchinfo;
> +
> + if (skb->sk == NULL)
> + return false;
> +
> + return (info->id == skb->sk->sk_cgrp_fwid) ^ info->invert;
> +}
> +
> +static struct xt_match cgroup_mt_reg __read_mostly = {
> + .name = "cgroup",
> + .revision = 0,
> + .family = NFPROTO_UNSPEC,
> + .checkentry = cgroup_mt_check,
> + .match = cgroup_mt,
> + .matchsize = sizeof(struct xt_cgroup_info),
> + .me = THIS_MODULE,
> + .hooks = (1 << NF_INET_LOCAL_OUT) |
> + (1 << NF_INET_POST_ROUTING),
> +};
> +
> +static inline struct cgroup_nf_state *
> +css_nf_state(struct cgroup_subsys_state *css)
> +{
> + return css ? container_of(css, struct cgroup_nf_state, css) : NULL;
> +}
> +
> +static struct cgroup_subsys_state *
> +cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
> +{
> + struct cgroup_nf_state *cs;
> +
> + cs = kzalloc(sizeof(*cs), GFP_KERNEL);
> + if (!cs)
> + return ERR_PTR(-ENOMEM);
> +
> + return &cs->css;
> +}
> +
> +static int cgroup_css_online(struct cgroup_subsys_state *css)
> +{
> + struct cgroup_nf_state *cs = css_nf_state(css);
> + struct cgroup_nf_state *parent = css_nf_state(css_parent(css));
> +
> + if (parent)
> + cs->fwid = parent->fwid;
> +
> + return 0;
> +}
> +
> +static void cgroup_css_free(struct cgroup_subsys_state *css)
> +{
> + kfree(css_nf_state(css));
> +}
> +
> +static int cgroup_fwid_update(const void *v, struct file *file, unsigned n)
> +{
> + int err;
> + struct socket *sock = sock_from_file(file, &err);
> +
> + if (sock)
> + sock->sk->sk_cgrp_fwid = (u32)(unsigned long) v;
> +
> + return 0;
> +}
> +
> +static u64 cgroup_fwid_read(struct cgroup_subsys_state *css,
> + struct cftype *cft)
> +{
> + return css_nf_state(css)->fwid;
> +}
> +
> +static int cgroup_fwid_write(struct cgroup_subsys_state *css,
> + struct cftype *cft, u64 id)
> +{
> + css_nf_state(css)->fwid = (u32) id;
> +
> + return 0;
> +}
> +
> +static void cgroup_attach(struct cgroup_subsys_state *css,
> + struct cgroup_taskset *tset)
> +{
> + struct cgroup_nf_state *cs = css_nf_state(css);
> + void *v = (void *)(unsigned long) cs->fwid;
> + struct task_struct *p;
> +
> + cgroup_taskset_for_each(p, css, tset) {
> + task_lock(p);
> + iterate_fd(p->files, 0, cgroup_fwid_update, v);
> + task_unlock(p);
> + }
> +}
> +
> +static struct cftype net_filter_ss_files[] = {
> + {
> + .name = "fwid",
> + .read_u64 = cgroup_fwid_read,
> + .write_u64 = cgroup_fwid_write,
> + },
> + { }
> +};
> +
> +struct cgroup_subsys net_filter_subsys = {
> + .name = "net_filter",
> + .css_alloc = cgroup_css_alloc,
> + .css_online = cgroup_css_online,
> + .css_free = cgroup_css_free,
> + .attach = cgroup_attach,
> + .subsys_id = net_filter_subsys_id,
> + .base_cftypes = net_filter_ss_files,
> + .module = THIS_MODULE,
> +};
> +
> +static int __init cgroup_mt_init(void)
> +{
> + int ret = cgroup_load_subsys(&net_filter_subsys);
> + if (ret)
> + goto out;
> +
> + ret = xt_register_match(&cgroup_mt_reg);
> + if (ret)
> + cgroup_unload_subsys(&net_filter_subsys);
> +out:
> + return ret;
> +}
> +
> +static void __exit cgroup_mt_exit(void)
> +{
> + xt_unregister_match(&cgroup_mt_reg);
> + cgroup_unload_subsys(&net_filter_subsys);
> +}
> +
> +module_init(cgroup_mt_init);
> +module_exit(cgroup_mt_exit);
>
^ permalink raw reply
* [PATCH net-next 0/2] bonding: extend round-robin mode
From: Nikolay Aleksandrov @ 2013-11-05 12:51 UTC (permalink / raw)
To: netdev; +Cc: davem, andy, fubar, vfalico
This small patchset adds a new option called packets_per_slave to the
bonding which aims to extend round-robin mode with the following effects:
0 - choose the slave id at random
1 - packet per slave (standard round-robin, default option value)
>1 - transmit >1 packets per slave, switch the slaves in round-robin
Patch02 adds a description for the new option to the bonding documentation.
Best regards,
Nikolay Aleksandrov
Nikolay Aleksandrov (2):
bonding: extend round-robin mode with packets_per_slave
bonding: document the new packets_per_slave option
Documentation/networking/bonding.txt | 9 ++++++
drivers/net/bonding/bond_main.c | 55 ++++++++++++++++++++++++++++++++----
drivers/net/bonding/bond_sysfs.c | 49 ++++++++++++++++++++++++++++++++
drivers/net/bonding/bonding.h | 3 +-
4 files changed, 110 insertions(+), 6 deletions(-)
--
1.8.1.4
^ permalink raw reply
* [PATCH net-next 1/2] bonding: extend round-robin mode with packets_per_slave
From: Nikolay Aleksandrov @ 2013-11-05 12:51 UTC (permalink / raw)
To: netdev; +Cc: davem, andy, fubar, vfalico
In-Reply-To: <1383655902-18744-1-git-send-email-nikolay@redhat.com>
This patch aims to extend round-robin mode with a new option called
packets_per_slave which can have the following values and effects:
0 - choose a random slave
1 (default) - standard round-robin, 1 packet per slave
>1 - round-robin when >1 packets have been transmitted per slave
The allowed values are between 0 and 65535.
This patch also fixes the comment style in bond_xmit_roundrobin().
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
---
drivers/net/bonding/bond_main.c | 55 ++++++++++++++++++++++++++++++++++++----
drivers/net/bonding/bond_sysfs.c | 49 +++++++++++++++++++++++++++++++++++
drivers/net/bonding/bonding.h | 3 ++-
3 files changed, 101 insertions(+), 6 deletions(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index a141f40..4dd5ee2 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -79,6 +79,7 @@
#include <net/pkt_sched.h>
#include <linux/rculist.h>
#include <net/flow_keys.h>
+#include <linux/reciprocal_div.h>
#include "bonding.h"
#include "bond_3ad.h"
#include "bond_alb.h"
@@ -111,6 +112,7 @@ static char *fail_over_mac;
static int all_slaves_active;
static struct bond_params bonding_defaults;
static int resend_igmp = BOND_DEFAULT_RESEND_IGMP;
+static int packets_per_slave = 1;
module_param(max_bonds, int, 0);
MODULE_PARM_DESC(max_bonds, "Max number of bonded devices");
@@ -183,6 +185,10 @@ MODULE_PARM_DESC(all_slaves_active, "Keep all frames received on an interface"
module_param(resend_igmp, int, 0);
MODULE_PARM_DESC(resend_igmp, "Number of IGMP membership reports to send on "
"link failure");
+module_param(packets_per_slave, int, 0);
+MODULE_PARM_DESC(packets_per_slave, "Packets to send per slave in balance-rr "
+ "mode; 0 for a random slave, 1 packet per "
+ "slave (default), >1 packets per slave.");
/*----------------------------- Global variables ----------------------------*/
@@ -3574,14 +3580,44 @@ void bond_xmit_slave_id(struct bonding *bond, struct sk_buff *skb, int slave_id)
kfree_skb(skb);
}
+/**
+ * bond_rr_gen_slave_id - generate slave id based on packets_per_slave
+ * @bond: bonding device to use
+ *
+ * Based on the value of the bonding device's packets_per_slave parameter
+ * this function generates a slave id, which is usually used as the next
+ * slave to transmit through.
+ */
+static u32 bond_rr_gen_slave_id(struct bonding *bond)
+{
+ int packets_per_slave = bond->params.packets_per_slave;
+ u32 slave_id;
+
+ switch (packets_per_slave) {
+ case 0:
+ slave_id = prandom_u32();
+ break;
+ case 1:
+ slave_id = bond->rr_tx_counter;
+ break;
+ default:
+ slave_id = reciprocal_divide(bond->rr_tx_counter,
+ packets_per_slave);
+ break;
+ }
+ bond->rr_tx_counter++;
+
+ return slave_id;
+}
+
static int bond_xmit_roundrobin(struct sk_buff *skb, struct net_device *bond_dev)
{
struct bonding *bond = netdev_priv(bond_dev);
struct iphdr *iph = ip_hdr(skb);
struct slave *slave;
+ u32 slave_id;
- /*
- * Start with the curr_active_slave that joined the bond as the
+ /* Start with the curr_active_slave that joined the bond as the
* default for sending IGMP traffic. For failover purposes one
* needs to maintain some consistency for the interface that will
* send the join/membership reports. The curr_active_slave found
@@ -3594,8 +3630,8 @@ static int bond_xmit_roundrobin(struct sk_buff *skb, struct net_device *bond_dev
else
bond_xmit_slave_id(bond, skb, 0);
} else {
- bond_xmit_slave_id(bond, skb,
- bond->rr_tx_counter++ % bond->slave_cnt);
+ slave_id = bond_rr_gen_slave_id(bond);
+ bond_xmit_slave_id(bond, skb, slave_id % bond->slave_cnt);
}
return NETDEV_TX_OK;
@@ -4099,6 +4135,12 @@ static int bond_check_params(struct bond_params *params)
resend_igmp = BOND_DEFAULT_RESEND_IGMP;
}
+ if (packets_per_slave < 0 || packets_per_slave > USHRT_MAX) {
+ pr_warn("Warning: packets_per_slave (%d) should be between 0 and %u resetting to 1\n",
+ packets_per_slave, USHRT_MAX);
+ packets_per_slave = 1;
+ }
+
/* reset values for TLB/ALB */
if ((bond_mode == BOND_MODE_TLB) ||
(bond_mode == BOND_MODE_ALB)) {
@@ -4288,7 +4330,10 @@ static int bond_check_params(struct bond_params *params)
params->resend_igmp = resend_igmp;
params->min_links = min_links;
params->lp_interval = BOND_ALB_DEFAULT_LP_INTERVAL;
-
+ if (packets_per_slave > 1)
+ params->packets_per_slave = reciprocal_value(packets_per_slave);
+ else
+ params->packets_per_slave = packets_per_slave;
if (primary) {
strncpy(params->primary, primary, IFNAMSIZ);
params->primary[IFNAMSIZ - 1] = 0;
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 47749c9..75dc4d0 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -40,6 +40,7 @@
#include <net/net_namespace.h>
#include <net/netns/generic.h>
#include <linux/nsproxy.h>
+#include <linux/reciprocal_div.h>
#include "bonding.h"
@@ -1640,6 +1641,53 @@ out:
static DEVICE_ATTR(lp_interval, S_IRUGO | S_IWUSR,
bonding_show_lp_interval, bonding_store_lp_interval);
+static ssize_t bonding_show_packets_per_slave(struct device *d,
+ struct device_attribute *attr,
+ char *buf)
+{
+ struct bonding *bond = to_bond(d);
+ int packets_per_slave = bond->params.packets_per_slave;
+
+ if (packets_per_slave > 1)
+ packets_per_slave = reciprocal_value(packets_per_slave);
+
+ return sprintf(buf, "%d\n", packets_per_slave);
+}
+
+static ssize_t bonding_store_packets_per_slave(struct device *d,
+ struct device_attribute *attr,
+ const char *buf, size_t count)
+{
+ struct bonding *bond = to_bond(d);
+ int new_value, ret = count;
+
+ if (sscanf(buf, "%d", &new_value) != 1) {
+ pr_err("%s: no packets_per_slave value specified.\n",
+ bond->dev->name);
+ ret = -EINVAL;
+ goto out;
+ }
+ if (new_value < 0 || new_value > USHRT_MAX) {
+ pr_err("%s: packets_per_slave must be between 0 and %u\n",
+ bond->dev->name, USHRT_MAX);
+ ret = -EINVAL;
+ goto out;
+ }
+ if (bond->params.mode != BOND_MODE_ROUNDROBIN)
+ pr_warn("%s: Warning: packets_per_slave has effect only in balance-rr mode\n",
+ bond->dev->name);
+ if (new_value > 1)
+ bond->params.packets_per_slave = reciprocal_value(new_value);
+ else
+ bond->params.packets_per_slave = new_value;
+out:
+ return ret;
+}
+
+static DEVICE_ATTR(packets_per_slave, S_IRUGO | S_IWUSR,
+ bonding_show_packets_per_slave,
+ bonding_store_packets_per_slave);
+
static struct attribute *per_bond_attrs[] = {
&dev_attr_slaves.attr,
&dev_attr_mode.attr,
@@ -1671,6 +1719,7 @@ static struct attribute *per_bond_attrs[] = {
&dev_attr_resend_igmp.attr,
&dev_attr_min_links.attr,
&dev_attr_lp_interval.attr,
+ &dev_attr_packets_per_slave.attr,
NULL,
};
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 046a605..77a07a1 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -156,6 +156,7 @@ struct bond_params {
int all_slaves_active;
int resend_igmp;
int lp_interval;
+ int packets_per_slave;
};
struct bond_parm_tbl {
@@ -222,7 +223,7 @@ struct bonding {
char proc_file_name[IFNAMSIZ];
#endif /* CONFIG_PROC_FS */
struct list_head bond_list;
- u16 rr_tx_counter;
+ u32 rr_tx_counter;
struct ad_bond_info ad_info;
struct alb_bond_info alb_info;
struct bond_params params;
--
1.8.1.4
^ permalink raw reply related
* [PATCH net-next 2/2] bonding: document the new packets_per_slave option
From: Nikolay Aleksandrov @ 2013-11-05 12:51 UTC (permalink / raw)
To: netdev; +Cc: davem, andy, fubar, vfalico
In-Reply-To: <1383655902-18744-1-git-send-email-nikolay@redhat.com>
Add new documentation for the packets_per_slave option available
for balance-rr mode.
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
---
Documentation/networking/bonding.txt | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 3856ed2..2cdb8b6 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -639,6 +639,15 @@ num_unsol_na
are generated by the ipv4 and ipv6 code and the numbers of
repetitions cannot be set independently.
+packets_per_slave
+
+ Specify the number of packets to transmit through a slave before
+ moving to the next one. When set to 0 then a slave is chosen at
+ random.
+
+ The valid range is 0 - 65535; the default value is 1. This option
+ has effect only in balance-rr mode.
+
primary
A string (eth0, eth2, etc) specifying which slave is the
--
1.8.1.4
^ permalink raw reply related
* RE: [PATCH net v2 2/3] r8152: modify the tx flow
From: hayeswang @ 2013-11-05 12:46 UTC (permalink / raw)
To: 'David Miller'
Cc: netdev, 'nic_swsd', linux-kernel, linux-usb
In-Reply-To: <20131104.155320.2172500441669637943.davem@davemloft.net>
David Miller [mailto:davem@davemloft.net]
> Sent: Tuesday, November 05, 2013 4:53 AM
> To: Hayeswang
> Cc: netdev@vger.kernel.org; nic_swsd;
> linux-kernel@vger.kernel.org; linux-usb@vger.kernel.org
> Subject: Re: [PATCH net v2 2/3] r8152: modify the tx flow
[...]
> The more TX work you push into the workqueue handler, the longer the
> latency for releasing the SKB and releasing all the queues that are
> waiting for release of that packet.
>
> Do you know that sockets, queueing discplines, etc. all rely upon
> there being a timely release of SKBs once they are successfully
> transmitted? It must happen at the earliest moment possible that
> can be reasonable obtained.
Thanks for your answer. I would resend the patches after finishing the
setting of the queue length.
^ permalink raw reply
* Re: [PATCH ] net_sched: actions - Add default lookup
From: Jamal Hadi Salim @ 2013-11-05 12:19 UTC (permalink / raw)
To: David Miller, eric.dumazet; +Cc: netdev, ebiederm, alexander.h.duyck
In-Reply-To: <20131103.231232.1438716028901698864.davem@davemloft.net>
Apologies for the latency
My intention was to eventually remove it everywhere since this is needed
by all actions. An action could override it, otherwise they get the
default.
cheers,
jamal
On 11/03/13 23:12, David Miller wrote:
> From: Eric Dumazet <eric.dumazet@gmail.com>
> Date: Wed, 30 Oct 2013 07:00:05 -0700
>
>> On Wed, 2013-10-30 at 07:25 -0400, Jamal Hadi Salim wrote:
>>> Attached. Tested with simple action.
>>>
>>> cheers,
>>> jamal
>>
>> Why not setting .lookup to tcf_hash_search
>> in the few actions not already doing that ?
>>
>> This would be more consistent.
>> # git grep -n tcf_hash_search
>> include/net/act_api.h:92:int tcf_hash_search(struct tc_action *a, u32 index);
>> net/sched/act_api.c:198:int tcf_hash_search(struct tc_action *a, u32 index)
>> net/sched/act_api.c:209:EXPORT_SYMBOL(tcf_hash_search);
>> net/sched/act_csum.c:588: .lookup = tcf_hash_search,
>> net/sched/act_gact.c:209: .lookup = tcf_hash_search,
>> net/sched/act_ipt.c:301: .lookup = tcf_hash_search,
>> net/sched/act_ipt.c:315: .lookup = tcf_hash_search,
>> net/sched/act_mirred.c:274: .lookup = tcf_hash_search,
>> net/sched/act_nat.c:311: .lookup = tcf_hash_search,
>> net/sched/act_pedit.c:246: .lookup = tcf_hash_search,
>> net/sched/act_police.c:410: .lookup = tcf_hash_search,
>
> Right, and BUG() if we try to register and action with a NULL .lookup
> member.
>
^ permalink raw reply
* Re: [PATCH 1/4] wl1251: split wl251 platform data to a separate structure
From: Pavel Machek @ 2013-11-05 12:13 UTC (permalink / raw)
To: Sebastian Reichel
Cc: Sebastian Reichel, Luciano Coelho, Rob Herring, Pawel Moll,
Mark Rutland, Stephen Warren, Ian Campbell, Rob Landley,
Tony Lindgren, Russell King, John W. Linville, Felipe Balbi,
Sachin Kamat, Greg Kroah-Hartman, Bill Pemberton,
devicetree-u79uwXL29TY76Z2rM5mHXA,
linux-doc-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
linux-omap-u79uwXL29TY76Z2rM5mHXA,
linux-arm-kernel-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r,
linux-wireless-u79uwXL29TY76Z2rM5mHXA,
netdev-u79uwXL29TY76Z2rM5mHXA, Luciano Coelho
In-Reply-To: <1382890469-25286-2-git-send-email-sre-8fiUuRrzOP0dnm+yROfE0A@public.gmane.org>
On Sun 2013-10-27 17:14:26, Sebastian Reichel wrote:
> From: Luciano Coelho <coelho-l0cyMroinI0@public.gmane.org>
>
> Move the wl1251 part of the wl12xx platform data structure into a new
> structure specifically for wl1251. Change the platform data built-in
> block and board files accordingly.
>
> Cc: Tony Lindgren <tony-4v6yS6AI5VpBDgjK7y7TUQ@public.gmane.org>
> Signed-off-by: Luciano Coelho <coelho-l0cyMroinI0@public.gmane.org>
> Acked-by: Tony Lindgren <tony-4v6yS6AI5VpBDgjK7y7TUQ@public.gmane.org>
> Reviewed-by: Felipe Balbi <balbi-l0cyMroinI0@public.gmane.org>
Reviewed-by: Pavel Machek <pavel-+ZI9xUNit7I@public.gmane.org>
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [patch net-next 3/3] fix skb_morph to preserve skb->sk and skb->destructor pointers
From: Marcelo Ricardo Leitner @ 2013-11-05 11:50 UTC (permalink / raw)
To: Jiri Pirko, netdev
Cc: davem, pablo, netfilter-devel, yoshfuji, kadlec, kaber, kuznet,
jmorris, wensong, horms, ja, edumazet, pshelar, jasowang,
alexander.h.duyck, coreteam, fw
In-Reply-To: <1383649333-6321-4-git-send-email-jiri@resnulli.us>
Em 05-11-2013 09:02, Jiri Pirko escreveu:
> Currently __skb_clone sets skb->sk and skb->destructor to NULL. This is
> not right for skb_morph use case because skb->sk may be previously
> set (e. g. by xt_TPROXY).
>
> Also, during skb_morph the destructor should not be called. It might be
> previously set, e. g. by xt_TPROXY to sock_edemux, and that would cause
> put sk while skb is still in flight.
>
> This patch fixes these.
>
> Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
> ---
> net/core/skbuff.c | 44 +++++++++++++++++++++++++++-----------------
> 1 file changed, 27 insertions(+), 17 deletions(-)
>
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 3735fad..21b320e 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -515,7 +515,7 @@ static void skb_free_head(struct sk_buff *skb)
> kfree(skb->head);
> }
>
> -static void skb_release_data(struct sk_buff *skb)
> +static void __skb_release_data(struct sk_buff *skb)
> {
> if (!skb->cloned ||
> !atomic_sub_return(skb->nohdr ? (1 << SKB_DATAREF_SHIFT) + 1 : 1,
> @@ -579,16 +579,12 @@ static void kfree_skbmem(struct sk_buff *skb)
> }
> }
>
> -static void skb_release_head_state(struct sk_buff *skb)
> +static void __skb_release_head_state(struct sk_buff *skb)
> {
> skb_dst_drop(skb);
> #ifdef CONFIG_XFRM
> secpath_put(skb->sp);
> #endif
> - if (skb->destructor) {
> - WARN_ON(in_irq());
> - skb->destructor(skb);
> - }
> #if IS_ENABLED(CONFIG_NF_CONNTRACK)
> nf_conntrack_put(skb->nfct);
> #endif
> @@ -607,12 +603,19 @@ static void skb_release_head_state(struct sk_buff *skb)
> #endif
> }
>
> -/* Free everything but the sk_buff shell. */
> -static void skb_release_all(struct sk_buff *skb)
> +static void skb_release_head_state(struct sk_buff *skb)
> +{
> + if (skb->destructor) {
> + WARN_ON(in_irq());
> + skb->destructor(skb);
> + }
> + __skb_release_head_state(skb);
> +}
> +
> +static void skb_release_data(struct sk_buff *skb)
> {
> - skb_release_head_state(skb);
> if (likely(skb->head))
> - skb_release_data(skb);
> + __skb_release_data(skb);
> }
>
> /**
> @@ -626,7 +629,8 @@ static void skb_release_all(struct sk_buff *skb)
>
> void __kfree_skb(struct sk_buff *skb)
> {
> - skb_release_all(skb);
> + skb_release_head_state(skb);
> + skb_release_data(skb);
> kfree_skbmem(skb);
> }
> EXPORT_SYMBOL(__kfree_skb);
> @@ -761,12 +765,11 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
> * You should not add any new code to this function. Add it to
> * __copy_skb_header above instead.
> */
> -static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
> +static struct sk_buff *___skb_clone(struct sk_buff *n, struct sk_buff *skb)
> {
> #define C(x) n->x = skb->x
>
> n->next = n->prev = NULL;
> - n->sk = NULL;
> __copy_skb_header(n, skb);
>
> C(len);
> @@ -775,7 +778,6 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
> n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
> n->cloned = 1;
> n->nohdr = 0;
> - n->destructor = NULL;
> C(tail);
> C(end);
> C(head);
> @@ -791,6 +793,13 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
> #undef C
> }
>
> +static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
> +{
> + n->sk = NULL;
> + n->destructor = NULL;
> + return ___skb_clone(n, skb);
> +}
> +
> /**
> * skb_morph - morph one skb into another
> * @dst: the skb to receive the contents
> @@ -803,8 +812,9 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
> */
> struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src)
> {
> - skb_release_all(dst);
> - return __skb_clone(dst, src);
> + __skb_release_head_state(dst);
> + skb_release_data(dst);
> + return ___skb_clone(dst, src);
> }
> EXPORT_SYMBOL_GPL(skb_morph);
>
> @@ -1107,7 +1117,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
> if (skb_has_frag_list(skb))
> skb_clone_fraglist(skb);
>
> - skb_release_data(skb);
> + __skb_release_data(skb);
> } else {
> skb_free_head(skb);
> }
>
^ permalink raw reply
* Re: [patch net-next 2/3] netfilter: ip6_tables: use reasm skb for matching
From: Marcelo Ricardo Leitner @ 2013-11-05 11:50 UTC (permalink / raw)
To: Jiri Pirko, netdev
Cc: davem, pablo, netfilter-devel, yoshfuji, kadlec, kaber, kuznet,
jmorris, wensong, horms, ja, edumazet, pshelar, jasowang,
alexander.h.duyck, coreteam, fw
In-Reply-To: <1383649333-6321-3-git-send-email-jiri@resnulli.us>
Em 05-11-2013 09:02, Jiri Pirko escreveu:
> Currently, when ipv6 fragment goes through the netfilter, match
> functions are called on them directly. This might cause match function
> to fail. So benefit from the fact that nf_defrag_ipv6 constructs
> reassembled skb for us and use this reassembled skb for matching.
>
> This patch fixes for example following situation:
> On HOSTA do:
> ip6tables -I INPUT -p icmpv6 -j DROP
> ip6tables -I INPUT -p icmpv6 -m icmp6 --icmpv6-type 128 -j ACCEPT
>
> and on HOSTB you do:
> ping6 HOSTA -s2000 (MTU is 1500)
>
> Incoming echo requests will be filtered out on HOSTA. This issue does
> not occur with smaller packets than MTU (where fragmentation does not happen).
>
> Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
> ---
> net/ipv6/netfilter/ip6_tables.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
> index 710238f..ec9cb1a 100644
> --- a/net/ipv6/netfilter/ip6_tables.c
> +++ b/net/ipv6/netfilter/ip6_tables.c
> @@ -328,6 +328,10 @@ ip6t_do_table(struct sk_buff *skb,
> const struct xt_table_info *private;
> struct xt_action_param acpar;
> unsigned int addend;
> + struct sk_buff *reasm = skb_nfct_reasm(skb);
> +
> + if (!reasm)
> + reasm = skb;
>
> /* Initialization */
> indev = in ? in->name : nulldevname;
> @@ -368,7 +372,7 @@ ip6t_do_table(struct sk_buff *skb,
>
> IP_NF_ASSERT(e);
> acpar.thoff = 0;
> - if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
> + if (!ip6_packet_match(reasm, indev, outdev, &e->ipv6,
> &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
> no_match:
> e = ip6t_next_entry(e);
> @@ -378,7 +382,7 @@ ip6t_do_table(struct sk_buff *skb,
> xt_ematch_foreach(ematch, e) {
> acpar.match = ematch->u.kernel.match;
> acpar.matchinfo = ematch->data;
> - if (!acpar.match->match(skb, &acpar))
> + if (!acpar.match->match(reasm, &acpar))
> goto no_match;
> }
>
>
^ permalink raw reply
* Re: [patch net-next 1/3] move skb_nfct_reasm into skbuff.h
From: Marcelo Ricardo Leitner @ 2013-11-05 11:50 UTC (permalink / raw)
To: Jiri Pirko, netdev
Cc: davem, pablo, netfilter-devel, yoshfuji, kadlec, kaber, kuznet,
jmorris, wensong, horms, ja, edumazet, pshelar, jasowang,
alexander.h.duyck, coreteam, fw
In-Reply-To: <1383649333-6321-2-git-send-email-jiri@resnulli.us>
Em 05-11-2013 09:02, Jiri Pirko escreveu:
> Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
> ---
> include/linux/skbuff.h | 11 +++++++++++
> include/net/ip_vs.h | 8 --------
> net/netfilter/ipvs/ip_vs_core.c | 1 +
> 3 files changed, 12 insertions(+), 8 deletions(-)
>
> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
> index 2e153b6..ececdad 100644
> --- a/include/linux/skbuff.h
> +++ b/include/linux/skbuff.h
> @@ -2606,6 +2606,17 @@ static inline void nf_conntrack_put_reasm(struct sk_buff *skb)
> kfree_skb(skb);
> }
> #endif
> +#ifdef NET_SKBUFF_NF_DEFRAG_NEEDED
> +static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
> +{
> + return skb->nfct_reasm;
> +}
> +#else
> +static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
> +{
> + return NULL;
> +}
> +#endif
> #ifdef CONFIG_BRIDGE_NETFILTER
> static inline void nf_bridge_put(struct nf_bridge_info *nf_bridge)
> {
> diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
> index cd7275f..6dff2b6 100644
> --- a/include/net/ip_vs.h
> +++ b/include/net/ip_vs.h
> @@ -119,10 +119,6 @@ struct ip_vs_iphdr {
>
> /* Dependency to module: nf_defrag_ipv6 */
> #if defined(CONFIG_NF_DEFRAG_IPV6) || defined(CONFIG_NF_DEFRAG_IPV6_MODULE)
> -static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
> -{
> - return skb->nfct_reasm;
> -}
> static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
> int len, void *buffer,
> const struct ip_vs_iphdr *ipvsh)
> @@ -134,10 +130,6 @@ static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
> return skb_header_pointer(skb, offset, len, buffer);
> }
> #else
> -static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
> -{
> - return NULL;
> -}
> static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
> int len, void *buffer,
> const struct ip_vs_iphdr *ipvsh)
> diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
> index 34fda62..085c242 100644
> --- a/net/netfilter/ipvs/ip_vs_core.c
> +++ b/net/netfilter/ipvs/ip_vs_core.c
> @@ -43,6 +43,7 @@
> #include <net/ip6_checksum.h>
> #include <net/netns/generic.h> /* net_generic() */
>
> +#include <linux/skbuff.h>
> #include <linux/netfilter.h>
> #include <linux/netfilter_ipv4.h>
>
>
^ permalink raw reply
* [patch net-next 2/3] netfilter: ip6_tables: use reasm skb for matching
From: Jiri Pirko @ 2013-11-05 11:02 UTC (permalink / raw)
To: netdev
Cc: davem, pablo, netfilter-devel, yoshfuji, kadlec, kaber, mleitner,
kuznet, jmorris, wensong, horms, ja, edumazet, pshelar, jasowang,
alexander.h.duyck, coreteam, fw
In-Reply-To: <1383649333-6321-1-git-send-email-jiri@resnulli.us>
Currently, when ipv6 fragment goes through the netfilter, match
functions are called on them directly. This might cause match function
to fail. So benefit from the fact that nf_defrag_ipv6 constructs
reassembled skb for us and use this reassembled skb for matching.
This patch fixes for example following situation:
On HOSTA do:
ip6tables -I INPUT -p icmpv6 -j DROP
ip6tables -I INPUT -p icmpv6 -m icmp6 --icmpv6-type 128 -j ACCEPT
and on HOSTB you do:
ping6 HOSTA -s2000 (MTU is 1500)
Incoming echo requests will be filtered out on HOSTA. This issue does
not occur with smaller packets than MTU (where fragmentation does not happen).
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
---
net/ipv6/netfilter/ip6_tables.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 710238f..ec9cb1a 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -328,6 +328,10 @@ ip6t_do_table(struct sk_buff *skb,
const struct xt_table_info *private;
struct xt_action_param acpar;
unsigned int addend;
+ struct sk_buff *reasm = skb_nfct_reasm(skb);
+
+ if (!reasm)
+ reasm = skb;
/* Initialization */
indev = in ? in->name : nulldevname;
@@ -368,7 +372,7 @@ ip6t_do_table(struct sk_buff *skb,
IP_NF_ASSERT(e);
acpar.thoff = 0;
- if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
+ if (!ip6_packet_match(reasm, indev, outdev, &e->ipv6,
&acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
no_match:
e = ip6t_next_entry(e);
@@ -378,7 +382,7 @@ ip6t_do_table(struct sk_buff *skb,
xt_ematch_foreach(ematch, e) {
acpar.match = ematch->u.kernel.match;
acpar.matchinfo = ematch->data;
- if (!acpar.match->match(skb, &acpar))
+ if (!acpar.match->match(reasm, &acpar))
goto no_match;
}
--
1.8.3.1
^ permalink raw reply related
* [patch net-next 1/3] move skb_nfct_reasm into skbuff.h
From: Jiri Pirko @ 2013-11-05 11:02 UTC (permalink / raw)
To: netdev
Cc: davem, pablo, netfilter-devel, yoshfuji, kadlec, kaber, mleitner,
kuznet, jmorris, wensong, horms, ja, edumazet, pshelar, jasowang,
alexander.h.duyck, coreteam, fw
In-Reply-To: <1383649333-6321-1-git-send-email-jiri@resnulli.us>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
---
include/linux/skbuff.h | 11 +++++++++++
include/net/ip_vs.h | 8 --------
net/netfilter/ipvs/ip_vs_core.c | 1 +
3 files changed, 12 insertions(+), 8 deletions(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 2e153b6..ececdad 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2606,6 +2606,17 @@ static inline void nf_conntrack_put_reasm(struct sk_buff *skb)
kfree_skb(skb);
}
#endif
+#ifdef NET_SKBUFF_NF_DEFRAG_NEEDED
+static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
+{
+ return skb->nfct_reasm;
+}
+#else
+static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
+{
+ return NULL;
+}
+#endif
#ifdef CONFIG_BRIDGE_NETFILTER
static inline void nf_bridge_put(struct nf_bridge_info *nf_bridge)
{
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index cd7275f..6dff2b6 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -119,10 +119,6 @@ struct ip_vs_iphdr {
/* Dependency to module: nf_defrag_ipv6 */
#if defined(CONFIG_NF_DEFRAG_IPV6) || defined(CONFIG_NF_DEFRAG_IPV6_MODULE)
-static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
-{
- return skb->nfct_reasm;
-}
static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
int len, void *buffer,
const struct ip_vs_iphdr *ipvsh)
@@ -134,10 +130,6 @@ static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
return skb_header_pointer(skb, offset, len, buffer);
}
#else
-static inline struct sk_buff *skb_nfct_reasm(const struct sk_buff *skb)
-{
- return NULL;
-}
static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset,
int len, void *buffer,
const struct ip_vs_iphdr *ipvsh)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 34fda62..085c242 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -43,6 +43,7 @@
#include <net/ip6_checksum.h>
#include <net/netns/generic.h> /* net_generic() */
+#include <linux/skbuff.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
--
1.8.3.1
^ permalink raw reply related
* [patch net-next 3/3] fix skb_morph to preserve skb->sk and skb->destructor pointers
From: Jiri Pirko @ 2013-11-05 11:02 UTC (permalink / raw)
To: netdev
Cc: davem, pablo, netfilter-devel, yoshfuji, kadlec, kaber, mleitner,
kuznet, jmorris, wensong, horms, ja, edumazet, pshelar, jasowang,
alexander.h.duyck, coreteam, fw
In-Reply-To: <1383649333-6321-1-git-send-email-jiri@resnulli.us>
Currently __skb_clone sets skb->sk and skb->destructor to NULL. This is
not right for skb_morph use case because skb->sk may be previously
set (e. g. by xt_TPROXY).
Also, during skb_morph the destructor should not be called. It might be
previously set, e. g. by xt_TPROXY to sock_edemux, and that would cause
put sk while skb is still in flight.
This patch fixes these.
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
---
net/core/skbuff.c | 44 +++++++++++++++++++++++++++-----------------
1 file changed, 27 insertions(+), 17 deletions(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 3735fad..21b320e 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -515,7 +515,7 @@ static void skb_free_head(struct sk_buff *skb)
kfree(skb->head);
}
-static void skb_release_data(struct sk_buff *skb)
+static void __skb_release_data(struct sk_buff *skb)
{
if (!skb->cloned ||
!atomic_sub_return(skb->nohdr ? (1 << SKB_DATAREF_SHIFT) + 1 : 1,
@@ -579,16 +579,12 @@ static void kfree_skbmem(struct sk_buff *skb)
}
}
-static void skb_release_head_state(struct sk_buff *skb)
+static void __skb_release_head_state(struct sk_buff *skb)
{
skb_dst_drop(skb);
#ifdef CONFIG_XFRM
secpath_put(skb->sp);
#endif
- if (skb->destructor) {
- WARN_ON(in_irq());
- skb->destructor(skb);
- }
#if IS_ENABLED(CONFIG_NF_CONNTRACK)
nf_conntrack_put(skb->nfct);
#endif
@@ -607,12 +603,19 @@ static void skb_release_head_state(struct sk_buff *skb)
#endif
}
-/* Free everything but the sk_buff shell. */
-static void skb_release_all(struct sk_buff *skb)
+static void skb_release_head_state(struct sk_buff *skb)
+{
+ if (skb->destructor) {
+ WARN_ON(in_irq());
+ skb->destructor(skb);
+ }
+ __skb_release_head_state(skb);
+}
+
+static void skb_release_data(struct sk_buff *skb)
{
- skb_release_head_state(skb);
if (likely(skb->head))
- skb_release_data(skb);
+ __skb_release_data(skb);
}
/**
@@ -626,7 +629,8 @@ static void skb_release_all(struct sk_buff *skb)
void __kfree_skb(struct sk_buff *skb)
{
- skb_release_all(skb);
+ skb_release_head_state(skb);
+ skb_release_data(skb);
kfree_skbmem(skb);
}
EXPORT_SYMBOL(__kfree_skb);
@@ -761,12 +765,11 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
* You should not add any new code to this function. Add it to
* __copy_skb_header above instead.
*/
-static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
+static struct sk_buff *___skb_clone(struct sk_buff *n, struct sk_buff *skb)
{
#define C(x) n->x = skb->x
n->next = n->prev = NULL;
- n->sk = NULL;
__copy_skb_header(n, skb);
C(len);
@@ -775,7 +778,6 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
n->cloned = 1;
n->nohdr = 0;
- n->destructor = NULL;
C(tail);
C(end);
C(head);
@@ -791,6 +793,13 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
#undef C
}
+static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
+{
+ n->sk = NULL;
+ n->destructor = NULL;
+ return ___skb_clone(n, skb);
+}
+
/**
* skb_morph - morph one skb into another
* @dst: the skb to receive the contents
@@ -803,8 +812,9 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
*/
struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src)
{
- skb_release_all(dst);
- return __skb_clone(dst, src);
+ __skb_release_head_state(dst);
+ skb_release_data(dst);
+ return ___skb_clone(dst, src);
}
EXPORT_SYMBOL_GPL(skb_morph);
@@ -1107,7 +1117,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
if (skb_has_frag_list(skb))
skb_clone_fraglist(skb);
- skb_release_data(skb);
+ __skb_release_data(skb);
} else {
skb_free_head(skb);
}
--
1.8.3.1
^ permalink raw reply related
* [patch net-next 0/3] couple of reasm fixes
From: Jiri Pirko @ 2013-11-05 11:02 UTC (permalink / raw)
To: netdev
Cc: davem, pablo, netfilter-devel, yoshfuji, kadlec, kaber, mleitner,
kuznet, jmorris, wensong, horms, ja, edumazet, pshelar, jasowang,
alexander.h.duyck, coreteam, fw
Couple of patches to fix issues which were found on
TPROXY vs. IPV6 frag packets use cases.
Jiri Pirko (3):
move skb_nfct_reasm into skbuff.h
netfilter: ip6_tables: use reasm skb for matching
fix skb_morph to preserve skb->sk and skb->destructor pointers
include/linux/skbuff.h | 11 +++++++++++
include/net/ip_vs.h | 8 --------
net/core/skbuff.c | 44 +++++++++++++++++++++++++----------------
net/ipv6/netfilter/ip6_tables.c | 8 ++++++--
net/netfilter/ipvs/ip_vs_core.c | 1 +
5 files changed, 45 insertions(+), 27 deletions(-)
--
1.8.3.1
^ permalink raw reply
* [RESEND PATCH net-next] virtio-net: switch to use XPS to choose txq
From: Jason Wang @ 2013-11-05 10:19 UTC (permalink / raw)
To: rusty, mst, virtualization, netdev, linux-kernel, davem
We used to use a percpu structure vq_index to record the cpu to queue
mapping, this is suboptimal since it duplicates the work of XPS and
loses all other XPS functionality such as allowing user to configure
their own transmission steering strategy.
So this patch switches to use XPS and suggest a default mapping when
the number of cpus is equal to the number of queues. With XPS support,
there's no need for keeping per-cpu vq_index and .ndo_select_queue(),
so they were removed also.
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
Resend since the previous complie warning disappears after commit
3573540cafa4296dd60f8be02f2aecaa31047525
(netif_set_xps_queue: make cpu mask const).
---
drivers/net/virtio_net.c | 48 ++----------------------------------------------
1 file changed, 2 insertions(+), 46 deletions(-)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index a7e9ad9..01f4eb5 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -132,9 +132,6 @@ struct virtnet_info {
/* Does the affinity hint is set for virtqueues? */
bool affinity_hint_set;
- /* Per-cpu variable to show the mapping from CPU to virtqueue */
- int __percpu *vq_index;
-
/* CPU hot plug notifier */
struct notifier_block nb;
};
@@ -1114,7 +1111,6 @@ static int virtnet_vlan_rx_kill_vid(struct net_device *dev,
static void virtnet_clean_affinity(struct virtnet_info *vi, long hcpu)
{
int i;
- int cpu;
if (vi->affinity_hint_set) {
for (i = 0; i < vi->max_queue_pairs; i++) {
@@ -1124,16 +1120,6 @@ static void virtnet_clean_affinity(struct virtnet_info *vi, long hcpu)
vi->affinity_hint_set = false;
}
-
- i = 0;
- for_each_online_cpu(cpu) {
- if (cpu == hcpu) {
- *per_cpu_ptr(vi->vq_index, cpu) = -1;
- } else {
- *per_cpu_ptr(vi->vq_index, cpu) =
- ++i % vi->curr_queue_pairs;
- }
- }
}
static void virtnet_set_affinity(struct virtnet_info *vi)
@@ -1155,7 +1141,7 @@ static void virtnet_set_affinity(struct virtnet_info *vi)
for_each_online_cpu(cpu) {
virtqueue_set_affinity(vi->rq[i].vq, cpu);
virtqueue_set_affinity(vi->sq[i].vq, cpu);
- *per_cpu_ptr(vi->vq_index, cpu) = i;
+ netif_set_xps_queue(vi->dev, cpumask_of(cpu), i);
i++;
}
@@ -1269,28 +1255,6 @@ static int virtnet_change_mtu(struct net_device *dev, int new_mtu)
return 0;
}
-/* To avoid contending a lock hold by a vcpu who would exit to host, select the
- * txq based on the processor id.
- */
-static u16 virtnet_select_queue(struct net_device *dev, struct sk_buff *skb)
-{
- int txq;
- struct virtnet_info *vi = netdev_priv(dev);
-
- if (skb_rx_queue_recorded(skb)) {
- txq = skb_get_rx_queue(skb);
- } else {
- txq = *__this_cpu_ptr(vi->vq_index);
- if (txq == -1)
- txq = 0;
- }
-
- while (unlikely(txq >= dev->real_num_tx_queues))
- txq -= dev->real_num_tx_queues;
-
- return txq;
-}
-
static const struct net_device_ops virtnet_netdev = {
.ndo_open = virtnet_open,
.ndo_stop = virtnet_close,
@@ -1302,7 +1266,6 @@ static const struct net_device_ops virtnet_netdev = {
.ndo_get_stats64 = virtnet_stats,
.ndo_vlan_rx_add_vid = virtnet_vlan_rx_add_vid,
.ndo_vlan_rx_kill_vid = virtnet_vlan_rx_kill_vid,
- .ndo_select_queue = virtnet_select_queue,
#ifdef CONFIG_NET_POLL_CONTROLLER
.ndo_poll_controller = virtnet_netpoll,
#endif
@@ -1613,10 +1576,6 @@ static int virtnet_probe(struct virtio_device *vdev)
if (vi->stats == NULL)
goto free;
- vi->vq_index = alloc_percpu(int);
- if (vi->vq_index == NULL)
- goto free_stats;
-
mutex_init(&vi->config_lock);
vi->config_enable = true;
INIT_WORK(&vi->config_work, virtnet_config_changed_work);
@@ -1643,7 +1602,7 @@ static int virtnet_probe(struct virtio_device *vdev)
/* Allocate/initialize the rx/tx queues, and invoke find_vqs */
err = init_vqs(vi);
if (err)
- goto free_index;
+ goto free_stats;
netif_set_real_num_tx_queues(dev, 1);
netif_set_real_num_rx_queues(dev, 1);
@@ -1696,8 +1655,6 @@ free_vqs:
virtnet_del_vqs(vi);
if (vi->alloc_frag.page)
put_page(vi->alloc_frag.page);
-free_index:
- free_percpu(vi->vq_index);
free_stats:
free_percpu(vi->stats);
free:
@@ -1736,7 +1693,6 @@ static void virtnet_remove(struct virtio_device *vdev)
flush_work(&vi->config_work);
- free_percpu(vi->vq_index);
free_percpu(vi->stats);
free_netdev(vi->dev);
}
--
1.8.3.2
^ permalink raw reply related
* [PATCH net] vti: fix spd lookup: match plaintext pkt, not ipsec pkt
From: Christophe Gouault @ 2013-11-05 10:16 UTC (permalink / raw)
To: Steffen Klassert, David S. Miller
Cc: Herbert Xu, Saurabh Mohan, netdev, Christophe Gouault
The vti interface inbound and outbound SPD lookups are based on the
ipsec packet instead of the plaintext packet.
Not only is it counterintuitive, it also restricts vti interfaces
to a single policy (whose selector must match the tunnel local and
remote addresses).
The policy selector is supposed to match the plaintext packet, before
encryption or after decryption.
This patch performs the SPD lookup based on the plaintext packet. It
enables to create several polices bound to the vti interface (via a
mark equal to the vti interface okey).
It remains possible to apply the same policy to all packets entering
the vti interface, by setting an any-to-any selector (src 0.0.0.0/0
dst 0.0.0.0/0 proto any mark OKEY).
Signed-off-by: Christophe Gouault <christophe.gouault@6wind.com>
---
net/ipv4/ip_vti.c | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 6e87f85..a7e03c0 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -126,6 +126,7 @@ static int vti_rcv(struct sk_buff *skb)
if (tunnel != NULL) {
struct pcpu_tstats *tstats;
u32 oldmark = skb->mark;
+ u16 netoff = skb_network_header(skb) - skb->data;
int ret;
@@ -133,7 +134,12 @@ static int vti_rcv(struct sk_buff *skb)
* only match policies with this mark.
*/
skb->mark = be32_to_cpu(tunnel->parms.o_key);
+ /* the packet is decrypted, but not yet decapsulated.
+ * Temporarily make network_header point to the inner header
+ * for policy check */
+ skb_reset_network_header(skb);
ret = xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb);
+ skb_set_network_header(skb, netoff);
skb->mark = oldmark;
if (!ret)
return -1;
@@ -166,6 +172,8 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
struct iphdr *old_iph = ip_hdr(skb);
__be32 dst = tiph->daddr;
struct flowi4 fl4;
+ struct flowi fl;
+ u32 oldmark = skb->mark;
int err;
if (skb->protocol != htons(ETH_P_IP))
@@ -173,17 +181,35 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
tos = old_iph->tos;
+ /* SPD lookup: we must provide a dst_entry to xfrm_lookup, normally the
+ * route to the final destination. However this route is a route via
+ * the vti interface. Now vti interfaces typically have the NOXFRM
+ * flag, hence xfrm_lookup would bypass IPsec.
+ *
+ * Therefore, we feed xfrm_lookup with a route to the vti tunnel remote
+ * endpoint instead.
+ */
memset(&fl4, 0, sizeof(fl4));
flowi4_init_output(&fl4, tunnel->parms.link,
be32_to_cpu(tunnel->parms.o_key), RT_TOS(tos),
RT_SCOPE_UNIVERSE,
IPPROTO_IPIP, 0,
dst, tiph->saddr, 0, 0);
- rt = ip_route_output_key(dev_net(dev), &fl4);
+ rt = __ip_route_output_key(tunnel->net, &fl4);
if (IS_ERR(rt)) {
dev->stats.tx_carrier_errors++;
goto tx_error_icmp;
}
+
+ memset(&fl, 0, sizeof(fl));
+ /* temporarily mark the skb with the tunnel o_key, to look up
+ * for a policy with this mark, matching the plaintext traffic.
+ */
+ skb->mark = be32_to_cpu(tunnel->parms.o_key);
+ __xfrm_decode_session(skb, &fl, AF_INET, 0);
+ skb->mark = oldmark;
+ rt = (struct rtable *)xfrm_lookup(tunnel->net, &rt->dst, &fl, NULL, 0);
+
/* if there is no transform then this tunnel is not functional.
* Or if the xfrm is not mode tunnel.
*/
--
1.7.10.4
^ permalink raw reply related
* Re: [PATCH] net: mv643xx_eth: Add missing phy_addr_set in DT mode
From: Sebastian Hesselbarth @ 2013-11-05 9:04 UTC (permalink / raw)
To: Jason Gunthorpe
Cc: Andrew Lunn, Jason Cooper, netdev, linux-kernel, linux-arm-kernel,
linuxppc-dev, David Miller, Lennert Buytenhek
In-Reply-To: <1383611239-14556-1-git-send-email-jgunthorpe@obsidianresearch.com>
On 11/05/2013 01:27 AM, Jason Gunthorpe wrote:
> Commit cc9d4598 'net: mv643xx_eth: use of_phy_connect if phy_node
> present' made the call to phy_scan optional, if the DT has a link to
> the phy node.
>
> However phy_scan has the side effect of calling phy_addr_set, which
> writes the phy MDIO address to the ethernet controller. If phy_addr_set
> is not called, and the bootloader has not set the correct address then
> the driver will fail to function.
>
> Tested on Kirkwood.
>
> Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
> ---
Jason,
thanks for catching this! I do my kirkwood testing on Dockstar,
which has PHY addr 0x0 - also the reset default, which may be
why it slipped through.
Acked-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
> ---
> drivers/net/ethernet/marvell/mv643xx_eth.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
> index 2c210ec..00e43b5 100644
> --- a/drivers/net/ethernet/marvell/mv643xx_eth.c
> +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
> @@ -2890,6 +2890,7 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
> PHY_INTERFACE_MODE_GMII);
> if (!mp->phy)
> err = -ENODEV;
> + phy_addr_set(mp, mp->phy->addr);
> } else if (pd->phy_addr != MV643XX_ETH_PHY_NONE) {
> mp->phy = phy_scan(mp, pd->phy_addr);
>
>
^ permalink raw reply
* Re: Bluetooth 6LoWPAN and routing
From: Alexander Aring @ 2013-11-05 8:55 UTC (permalink / raw)
To: Jukka Rissanen; +Cc: Claudio Takahasi, netdev
In-Reply-To: <1383640589.12691.36.camel@jrissane-mobl.ger.corp.intel.com>
On Tue, Nov 05, 2013 at 10:36:29AM +0200, Jukka Rissanen wrote:
> Hi Claudio,
>
> On ma, 2013-11-04 at 19:46 -0200, Claudio Takahasi wrote:
> > Hi Jukka,
> >
> > On Thu, Oct 24, 2013 at 9:48 AM, Jukka Rissanen
> > <jukka.rissanen@linux.intel.com> wrote:
> > > Hi Alexander,
> > >
> > >
> > > On 24.10.2013 15:25, Alexander Aring wrote:
> > >>
> > >> Hi Jukka,
> > >>
> > >> On Thu, Oct 24, 2013 at 09:45:40AM +0300, Jukka Rissanen wrote:
> > >>>
> > >>> Hi,
> > >>>
> > >>> I have been prototyping with BT 6LoWPAN support (using this draft
> > >>> http://tools.ietf.org/html/draft-ietf-6lowpan-btle-12 as a
> > >>> reference). I sent first version yesterday to linux-bluetooth ml
> > >>> http://thread.gmane.org/gmane.linux.bluez.kernel/39394
> > >>>
> > >> I see you take many code from the 6lowpan ieee802154 implementation.
> > >> (Just notice you drop the original authors from there)
> > >
> > >
> > > Hmm, those got dropped, I am sorry about that. I will add the original
> > > authors information of course.
> > >
> > >
> > >>
> > >> I have a couple of patches to fix a lot of bugs in the current 6LoWPAN
> > >> ieee802154 implementation.
> > >>
> > >> Some bugs which I found:
> > >>
> > >> - Fix race conditions in fragmentation handling
> > >> - Fix UDP compression/uncompressionm, which is completly broken
> > >> - Fragmentation handling isn't rfc4944 compatible
> > >>
> > >> And some other improvements. I see your rfc has the same issues (e.g.
> > >> fragmentation race conditions).
> > >>
> > >> Currently I preparing these patches for mainlining.
> > >
> > >
> > > Excellent news!
> >
> >
> > Is it necessary to implement 6loWPAN fragmentation/reassembling? For
> > Bluetooth, I thought L2CAP FAR (Fragmentation and Reassembling) could
> > handle the transfer of IPv6 packets that doesn't fit in one single
> > BTLE PDU.
>
> Yes, the Bluetooth 6lowpan code I sent handles the L2CAP FAR already.
> The question is who handles the IPv6 packets that are larger than
> IPV6_MIN_MTU (1280 bytes), or is that automatically done by other parts
ahh I understand now, yes that's handled by the normal IPv6 Fragmentation.
But you don't want a high payload like this. ;)
- Alex
^ permalink raw reply
* Re: Bluetooth 6LoWPAN and routing
From: Alexander Aring @ 2013-11-05 8:52 UTC (permalink / raw)
To: Jukka Rissanen; +Cc: Claudio Takahasi, netdev
In-Reply-To: <1383640589.12691.36.camel@jrissane-mobl.ger.corp.intel.com>
Hi Jukka,
On Tue, Nov 05, 2013 at 10:36:29AM +0200, Jukka Rissanen wrote:
> Hi Claudio,
>
> On ma, 2013-11-04 at 19:46 -0200, Claudio Takahasi wrote:
> > Hi Jukka,
> >
> > On Thu, Oct 24, 2013 at 9:48 AM, Jukka Rissanen
> > <jukka.rissanen@linux.intel.com> wrote:
> > > Hi Alexander,
> > >
> > >
> > > On 24.10.2013 15:25, Alexander Aring wrote:
> > >>
> > >> Hi Jukka,
> > >>
> > >> On Thu, Oct 24, 2013 at 09:45:40AM +0300, Jukka Rissanen wrote:
> > >>>
> > >>> Hi,
> > >>>
> > >>> I have been prototyping with BT 6LoWPAN support (using this draft
> > >>> http://tools.ietf.org/html/draft-ietf-6lowpan-btle-12 as a
> > >>> reference). I sent first version yesterday to linux-bluetooth ml
> > >>> http://thread.gmane.org/gmane.linux.bluez.kernel/39394
> > >>>
> > >> I see you take many code from the 6lowpan ieee802154 implementation.
> > >> (Just notice you drop the original authors from there)
> > >
> > >
> > > Hmm, those got dropped, I am sorry about that. I will add the original
> > > authors information of course.
> > >
> > >
> > >>
> > >> I have a couple of patches to fix a lot of bugs in the current 6LoWPAN
> > >> ieee802154 implementation.
> > >>
> > >> Some bugs which I found:
> > >>
> > >> - Fix race conditions in fragmentation handling
> > >> - Fix UDP compression/uncompressionm, which is completly broken
> > >> - Fragmentation handling isn't rfc4944 compatible
> > >>
> > >> And some other improvements. I see your rfc has the same issues (e.g.
> > >> fragmentation race conditions).
> > >>
> > >> Currently I preparing these patches for mainlining.
> > >
> > >
> > > Excellent news!
> >
> >
> > Is it necessary to implement 6loWPAN fragmentation/reassembling? For
> > Bluetooth, I thought L2CAP FAR (Fragmentation and Reassembling) could
> > handle the transfer of IPv6 packets that doesn't fit in one single
> > BTLE PDU.
>
> Yes, the Bluetooth 6lowpan code I sent handles the L2CAP FAR already.
> The question is who handles the IPv6 packets that are larger than
> IPV6_MIN_MTU (1280 bytes), or is that automatically done by other parts
> of the networking subsystem.
>
In [1] you use the fragmentation according rfc4944 which isn't for
bluetooth correct. [2] says:
"Since FAR in BT-LE is a function of the L2CAP layer, fragmentation
functionality as defined in RFC 4944 [RFC4944] MUST NOT be used in
BT-LE networks."
MUST NOT, so you can't use it.
[1] http://article.gmane.org/gmane.linux.bluez.kernel/39397
lowpan_process_data function and the first part of evaluating dispatch
value. This code is the most ugly code in 6lowpan but I will rework
it this right now... Only few problems with the skb_checksum because
I uncompress the header after fragmentation(I think so).
Of course that's only the receiving side, you need to check the
transmit side.
[2] http://tools.ietf.org/html/draft-ietf-6lowpan-btle-12#section-3.2
- Alex
^ permalink raw reply
* Re: Bluetooth 6LoWPAN and routing
From: Jukka Rissanen @ 2013-11-05 8:36 UTC (permalink / raw)
To: Claudio Takahasi; +Cc: netdev
In-Reply-To: <CAKT1EBeHs4T3YiFvze2RBbM537pXEj03gTcnCMEZprdBz882hg@mail.gmail.com>
Hi Claudio,
On ma, 2013-11-04 at 19:46 -0200, Claudio Takahasi wrote:
> Hi Jukka,
>
> On Thu, Oct 24, 2013 at 9:48 AM, Jukka Rissanen
> <jukka.rissanen@linux.intel.com> wrote:
> > Hi Alexander,
> >
> >
> > On 24.10.2013 15:25, Alexander Aring wrote:
> >>
> >> Hi Jukka,
> >>
> >> On Thu, Oct 24, 2013 at 09:45:40AM +0300, Jukka Rissanen wrote:
> >>>
> >>> Hi,
> >>>
> >>> I have been prototyping with BT 6LoWPAN support (using this draft
> >>> http://tools.ietf.org/html/draft-ietf-6lowpan-btle-12 as a
> >>> reference). I sent first version yesterday to linux-bluetooth ml
> >>> http://thread.gmane.org/gmane.linux.bluez.kernel/39394
> >>>
> >> I see you take many code from the 6lowpan ieee802154 implementation.
> >> (Just notice you drop the original authors from there)
> >
> >
> > Hmm, those got dropped, I am sorry about that. I will add the original
> > authors information of course.
> >
> >
> >>
> >> I have a couple of patches to fix a lot of bugs in the current 6LoWPAN
> >> ieee802154 implementation.
> >>
> >> Some bugs which I found:
> >>
> >> - Fix race conditions in fragmentation handling
> >> - Fix UDP compression/uncompressionm, which is completly broken
> >> - Fragmentation handling isn't rfc4944 compatible
> >>
> >> And some other improvements. I see your rfc has the same issues (e.g.
> >> fragmentation race conditions).
> >>
> >> Currently I preparing these patches for mainlining.
> >
> >
> > Excellent news!
>
>
> Is it necessary to implement 6loWPAN fragmentation/reassembling? For
> Bluetooth, I thought L2CAP FAR (Fragmentation and Reassembling) could
> handle the transfer of IPv6 packets that doesn't fit in one single
> BTLE PDU.
Yes, the Bluetooth 6lowpan code I sent handles the L2CAP FAR already.
The question is who handles the IPv6 packets that are larger than
IPV6_MIN_MTU (1280 bytes), or is that automatically done by other parts
of the networking subsystem.
> What am I missing here?
>
> It seems that some BLE development kits/firmwares don't support FAR on
> L2CAP Basic Mode, but this is another problem that should be fixed
> soon.
>
> Regards,
> Claudio
Cheers,
Jukka
^ permalink raw reply
* Re: [PATCH net-next v2 2/3] tipc: message reassembly using fragment chain
From: Erik Hugne @ 2013-11-05 8:15 UTC (permalink / raw)
To: David Miller; +Cc: netdev, jon.maloy, maloy, paul.gortmaker, ying.xue
In-Reply-To: <20131104.161254.1576011108092991976.davem@davemloft.net>
On Mon, Nov 04, 2013 at 04:12:54PM -0500, David Miller wrote:
> From: <erik.hugne@ericsson.com>
> Date: Thu, 31 Oct 2013 09:40:13 +0100
>
> > + skb_pull(frag, msg_hdr_sz(msg));
> > + if (fragid == FIRST_FRAGMENT) {
> > + if (*head)
> > + goto out_free;
> > + *head = frag;
> > + skb_frag_list_init(*head);
> > return 0;
> > + } else {
> > + if (!*head)
> > + goto out_free;
> > + if (!skb_has_frag_list(*head))
> > + skb_shinfo(*head)->frag_list = frag;
> > + else
> > + (*tail)->next = frag;
> > + *tail = frag;
> > + (*head)->truesize += frag->truesize;
> > + }
> > + if (fragid == LAST_FRAGMENT) {
> > + *fbuf = *head;
> > + *tail = *head = NULL;
> > + return LINK_REASM_COMPLETE;
> > }
>
> Please use skb_try_coalese(), and only use frag lists if that does not
> succeed.
Will fix.
>
> Also you must be certain to unclone the SKB if you are going to modify
> it in this kind of way.
Is it enough to just unclone the list head skb?
>
> For a good example of how to attend to all of these things, see
> ip_frag_reasm() in net/ipv4/ip_fragment.c
Thanks David.
^ permalink raw reply
* Re: pull request: wireless-next 2013-11-04
From: David Miller @ 2013-11-05 7:35 UTC (permalink / raw)
To: linville; +Cc: linux-wireless, netdev, linux-kernel
In-Reply-To: <20131104202241.GB1989@tuxdriver.com>
From: "John W. Linville" <linville@tuxdriver.com>
Date: Mon, 4 Nov 2013 15:22:42 -0500
> Please accept the following pull request intended for the 3.13 tree...
Pulled, thanks John.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox