summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2011-12-27tipc: Ignore broadcast acknowledgements that are out-of-rangeAllan Stephens
Adds checks to TIPC's broadcast link so that it ignores any acknowledgement message containing a sequence number that does not correspond to an unacknowledged message currently in the broadcast link's transmit queue. This change prevents the broadcast link from becoming stalled if a newly booted node receives stale broadcast link acknowledgement information from another node that has not yet fully synchronized its end of the broadcast link to reflect the current state of the new node's end. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Flush unsent broadcast messages when contact with last node is lostAllan Stephens
Adds code to release any unsent broadcast messages in the broadcast link transmit queue if TIPC loses contact with its only neighboring node. Previously, a broadcast link that was in the congested state would hold on to the unsent messages, even though the messages were now undeliverable. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Minor optimization of broadcast link transmit queue statisticAllan Stephens
The two broadcast link statistics fields that are used to derive the average length of that link's transmit queue are now updated only after a successful attempt to send a broadcast message, since there is no need to update these values when an unsuccessful send attempt leaves the queue unchanged. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Handle broadcast attempt when no neighboring nodes existAllan Stephens
Adds a check to detect when an attempt is made to send a message via the broadcast link and no neighboring nodes are currently available to receive it. Rather than wasting effort passing the message to the broadcast link and broadcast bearer, who will only throw it away, TIPC now frees the message immediately and reports success (i.e. the message has been delivered to all available destinations). Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Ensure broadcast link spinlock is held when updating node mapAllan Stephens
Fixes oversight that allowed broadcast link node map to be updated without first taking the broadcast link spinlock that protects the map. As part of this fix the node map has been incorporated into the broadcast link structure to make the need for such protection more evident. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Eliminate dynamic allocation of broadcast link data structuresAllan Stephens
Creates global variables to hold the broadcast link's pseudo-bearer and pseudo-link structures, rather than allocating them dynamically. There is only a single instance of each structure, and changing over to static allocation allows elimination of code to handle the cases where dynamic allocation was unsuccessful. The memset in the teardown code may look like they aren't used, but the same teardown code is run when there is a non-fatal error at init-time, so that stale data isn't present when the user fixes the cause of the soft error. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Eliminate useless check when network address is assignedAllan Stephens
Gets rid of an unnecessary check in the routine that updates the port id of a node's name publications when the node is assigned a network address, since the routine is only invoked if the new address is different from the existing one. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Minor correction to TIPC module unloadingAllan Stephens
Modifies TIPC's module unloading logic to switch itself into "single node" mode before starting to terminate networking support. This helps to ensure that no operations that require TIPC to be in "networking" mode can initiate once unloading starts. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Eliminate useless memset operations in Ethernet media supportAllan Stephens
Gets rid of two pointless operations that zero out the array used to record information about TIPC's Ethernet bearers. There is no need to initialize the array on start up since it is a global variable that is already zero'd out, and there is no need to zero it out on exit because the array is never referenced again. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Do timely cleanup of disabled Ethernet bearer resourcesAllan Stephens
Modifies Ethernet bearer disable logic to break the association between the bearer and its device driver at the time the bearer is disabled, rather than when the TIPC module is unloaded. This allows the array entry used by the disabled bearer to be re-used if the same bearer (or a different one) is subsequently enabled. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Minor optimization to deactivation of Ethernet media suppotAllan Stephens
Change TIPC's shutdown code to deactivate generic networking support before terminating Ethernet media support. The deactivation of generic networking support causes all existing bearers to be destroyed, meaning the Ethernet media termination routine no longer has to bother marking them as unavailable. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Revise comment justifying release of configuration spinlockAllan Stephens
Comment-only change to better explain why TIPC's configuration lock is temporarily released while activating support for network interfaces, and why the existing activation code doesn't require rework. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Allow run-time alteration of default link settingsAllan Stephens
Permits run-time alteration of default link settings on a per-media and per-bearer basis, in addition to the existing per-link basis. The following syntax can now be used: tipc-config -lt=<link-name|bearer-name|media-name>/<tolerance> tipc-config -lp=<link-name|bearer-name|media-name>/<priority> tipc-config -lw=<link-name|bearer-name|media-name>/<window> Note that changes to the default settings for a given media type has no effect on the default settings used by existing bearers. Similarly, changes to default bearer settings has no effect on existing link endpoints that utilize that interface. Thanks to Florian Westphal <fw@strlen.de> for his contributions to the development of this enhancement. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Ignore neighbor discovery messages containing invalid addressAllan Stephens
Adds a check to ensure that TIPC ignores an incoming neighbor discovery message that specifies an invalid media address as its source. The check ensures that the source address is a valid, non-broadcast address that could legally be used by a neighboring link endpoint. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Hide media-specific addressing details from generic bearer codeAllan Stephens
Reworks TIPC's media address data structure and associated processing routines to transfer all media-specific details of address conversion to the associated TIPC media adaptation code. TIPC's generic bearer code now only needs to know which media type an address is associated with and whether or not it is a broadcast address, and totally ignores the "value" field that contains the actual media-specific addressing info. These changes eliminate the need for a number of endianness conversion operations and will make it easier for TIPC to support new media types in the future. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Add new address conversion routines for Ethernet mediaAllan Stephens
Enhances TIPC's Ethernet media support to provide 3 new address conversion routines, which allow TIPC to interpret an address that is in string form and to convert an address to and from the 20 byte format used in TIPC's neighbor discovery messages. These routines are pre-requisites to a follow on commit that hides all media-specific addressing details from TIPC's generic bearer code. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Improve handling of media address printing errorsAllan Stephens
Enhances conversion of a media address to printable form so that an unconvertable address will be displayed as a string of hex digits, rather than not being displayed at all. (Also removes a pointless check for the existence of the media-specific address conversion routine, since the routine is not optional.) Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Streamline media registration error checkingAllan Stephens
Simplifies error handling performed during media registration, since TIPC no longer supports the dynamic addition of new media types that are potentially error-prone. These simplifications include the following: 1) No longer check for premature registration of a new media type. 2) No longer check for negative link priority values (which was pointless since such values are unsigned, and could cause a compiler warning). 3) No longer generate a warning describing the exact cause of any registration failure (just warns that overall registration failed). Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Eliminate duplication of media structuresAllan Stephens
Changes TIPC's list of registered media types from an array of media structures to an array of pointers to media structures. This eliminates the need to copy of the contents of the structure passed in during media registration. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Optimize detection of duplicate media registrationAllan Stephens
Streamlines the detection of an attempt to register a TIPC media structure using an already registered name or type identifier. The revised logic now reuses an existing routine to detect an existing name and no longer unnecessarily manipulates the media type counter during an unsuccessful registration attempt. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Register new media using pre-compiled structureAllan Stephens
Speeds up the registration of TIPC media types by passing in a structure containing the required information, rather than by passing in the various fields describing the media type individually. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-27tipc: Enable use by containers having their own network namespaceAllan Stephens
Permits a Linux container to use TIPC sockets even when it has its own network namespace defined by removing the check that prohibits such use. This makes it possible for users who wish to isolate their container network traffic from normal network traffic to utilize TIPC. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-12-26drm/i915: Disable RC6 on Sandybridge by defaultKeith Packard
RC6 fails again. > I found my system freeze mostly during starting up X and KDE. Sometimes it > works for some minutes, sometimes it freezes immediatly. When the freeze > happens, everything is dead (even the reset button does not work, I need to > power cycle). > I disabled RC6, and my system runs wonderfully. > The system is a Z68 Pro board with Sandybridge i5-2500K processor, 8 > GB of RAM and UEFI firmware. Reported-by: Kai Krakow <hurikhan77@gmail.com> Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-12-26drm/i915: Disable semaphores by default on SNBKeith Packard
Semaphores still cause problems on some machines: > From Udo Steinberg: > > With Linux-3.2-rc6 I'm frequently seeing GPU hangs when large amounts of > text scroll in an xterm, such as when extracting a tar archive. Such as this > one (note the timestamps): > > I can reproduce it fairly easily with something > as simple as: > > while true; do dmesg; done This patch turns them off on SNB while leaving them on for IVB. Reported-by: Udo Steinberg <udo@hypervisor.org> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: Eugeni Dodonov <eugeni@dodonov.net> Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-12-26bonding: document undocumented active_slave sysfs entry.Nicolas de Pesloüan
v2, based on Jay's review. I kept the 'link must be up' part, because this is enforced in the code. Signed-off-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr> Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> cc: Andy Gospodarek <andy@greyhouse.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-26Merge branch 'kvm-updates/3.2' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
* 'kvm-updates/3.2' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: PPC: e500: include linux/export.h KVM: PPC: fix kvmppc_start_thread() for CONFIG_SMP=N KVM: PPC: protect use of kvmppc_h_pr KVM: PPC: move compute_tlbie_rb to book3s_64 common header KVM: Don't automatically expose the TSC deadline timer in cpuid KVM: Device assignment permission checks KVM: Remove ability to assign a device without iommu support KVM: x86: Prevent starting PIT timers in the absence of irqchip support
2011-12-26Merge tag 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 post 3.2-rc7 pull request * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: MAINTAINERS: firewire git URL update
2011-12-26ipv6: Kill useless route tracing bits in net/ipv6/route.cDavid S. Miller
RDBG() wasn't even used, and the messages printed by RT6_DEBUG() were far from useful. Just get rid of all this stuff, we can replace it with something more suitable if we want. Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-26mlx4: Add missing include of linux/slab.hAxel Lin
Include linux/slab.h to fix below build error: CC drivers/net/ethernet/mellanox/mlx4/resource_tracker.o drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'mlx4_init_resource_tracker': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:233: error: implicit declaration of function 'kzalloc' drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:234: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'mlx4_free_resource_tracker': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:264: error: implicit declaration of function 'kfree' drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'alloc_qp_tr': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:370: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'alloc_mtt_tr': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:386: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'alloc_mpt_tr': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:402: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'alloc_eq_tr': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:417: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'alloc_cq_tr': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:431: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'alloc_srq_tr': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:446: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'alloc_counter_tr': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:461: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'add_res_range': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:521: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'mac_add_to_slave': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:1193: warning: assignment makes pointer from integer without a cast drivers/net/ethernet/mellanox/mlx4/resource_tracker.c: In function 'add_mcg_res': drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:2521: warning: assignment makes pointer from integer without a cast make[5]: *** [drivers/net/ethernet/mellanox/mlx4/resource_tracker.o] Error 1 make[4]: *** [drivers/net/ethernet/mellanox/mlx4] Error 2 make[3]: *** [drivers/net/ethernet/mellanox] Error 2 make[2]: *** [drivers/net/ethernet] Error 2 make[1]: *** [drivers/net] Error 2 make: *** [drivers] Error 2 Signed-off-by: Axel Lin <axel.lin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-26unix: If we happen to find peer NULL when diag dumping, write zero.David S. Miller
Otherwise we leave uninitialized kernel memory in there. Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-26unix_diag: Fix incoming connections nla lengthPavel Emelyanov
The NLA_PUT macro should accept the actual attribute length, not the amount of elements in array :( Signed-off-by: Pavel Emelyanov <xemul@parallels.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-26vfs: fix handling of lock allocation failure in lease-break caseLinus Torvalds
Bruce Fields notes that commit 778fc546f749 ("locks: fix tracking of inprogress lease breaks") introduced a possible error pointer dereference on failure to allocate memory. locks_conflict() will dereference the passed-in new lease lock structure that may be an error pointer. This means an open (without O_NONBLOCK set) on a file with a lease applied (generally only done when Samba or nfsd (with v4) is running) could crash if a kmalloc() fails. So instead of playing games with IS_ERROR() all over the place, just check the allocation failure early. That makes the code more straightforward, and avoids this possible bad pointer dereference. Based-on-patch-by: J. Bruce Fields <bfields@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-12-26KVM: PPC: e500: include linux/export.hScott Wood
This is required for THIS_MODULE. We recently stopped acquiring it via some other header. Signed-off-by: Scott Wood <scottwood@freescale.com> Signed-off-by: Alexander Graf <agraf@suse.de>
2011-12-26KVM: PPC: fix kvmppc_start_thread() for CONFIG_SMP=NMichael Neuling
Currently kvmppc_start_thread() tries to wake other SMT threads via xics_wake_cpu(). Unfortunately xics_wake_cpu only exists when CONFIG_SMP=Y so when compiling with CONFIG_SMP=N we get: arch/powerpc/kvm/built-in.o: In function `.kvmppc_start_thread': book3s_hv.c:(.text+0xa1e0): undefined reference to `.xics_wake_cpu' The following should be fine since kvmppc_start_thread() shouldn't called to start non-zero threads when SMP=N since threads_per_core=1. Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Alexander Graf <agraf@suse.de>
2011-12-26KVM: PPC: protect use of kvmppc_h_prAndreas Schwab
kvmppc_h_pr is only available if CONFIG_KVM_BOOK3S_64_PR. Signed-off-by: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: Alexander Graf <agraf@suse.de>
2011-12-26KVM: PPC: move compute_tlbie_rb to book3s_64 common headerAndreas Schwab
compute_tlbie_rb is only used on ppc64 and cannot be compiled on ppc32. Signed-off-by: Andreas Schwab <schwab@linux-m68k.org> Signed-off-by: Alexander Graf <agraf@suse.de>
2011-12-26KVM: Don't automatically expose the TSC deadline timer in cpuidJan Kiszka
Unlike all of the other cpuid bits, the TSC deadline timer bit is set unconditionally, regardless of what userspace wants. This is broken in several ways: - if userspace doesn't use KVM_CREATE_IRQCHIP, and doesn't emulate the TSC deadline timer feature, a guest that uses the feature will break - live migration to older host kernels that don't support the TSC deadline timer will cause the feature to be pulled from under the guest's feet; breaking it - guests that are broken wrt the feature will fail. Fix by not enabling the feature automatically; instead report it to userspace. Because the feature depends on KVM_CREATE_IRQCHIP, which we cannot guarantee will be called, we expose it via a KVM_CAP_TSC_DEADLINE_TIMER and not KVM_GET_SUPPORTED_CPUID. Fixes the Illumos guest kernel, which uses the TSC deadline timer feature. [avi: add the KVM_CAP + documentation] Reported-by: Alexey Zaytsev <alexey.zaytsev@gmail.com> Tested-by: Alexey Zaytsev <alexey.zaytsev@gmail.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Avi Kivity <avi@redhat.com>
2011-12-25KVM: Device assignment permission checksAlex Williamson
Only allow KVM device assignment to attach to devices which: - Are not bridges - Have BAR resources (assume others are special devices) - The user has permissions to use Assigning a bridge is a configuration error, it's not supported, and typically doesn't result in the behavior the user is expecting anyway. Devices without BAR resources are typically chipset components that also don't have host drivers. We don't want users to hold such devices captive or cause system problems by fencing them off into an iommu domain. We determine "permission to use" by testing whether the user has access to the PCI sysfs resource files. By default a normal user will not have access to these files, so it provides a good indication that an administration agent has granted the user access to the device. [Yang Bai: add missing #include] [avi: fix comment style] Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Yang Bai <hamo.by@gmail.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2011-12-25KVM: Remove ability to assign a device without iommu supportAlex Williamson
This option has no users and it exposes a security hole that we can allow devices to be assigned without iommu protection. Make KVM_DEV_ASSIGN_ENABLE_IOMMU a mandatory option. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2011-12-25KVM: x86: Prevent starting PIT timers in the absence of irqchip supportJan Kiszka
User space may create the PIT and forgets about setting up the irqchips. In that case, firing PIT IRQs will crash the host: BUG: unable to handle kernel NULL pointer dereference at 0000000000000128 IP: [<ffffffffa10f6280>] kvm_set_irq+0x30/0x170 [kvm] ... Call Trace: [<ffffffffa11228c1>] pit_do_work+0x51/0xd0 [kvm] [<ffffffff81071431>] process_one_work+0x111/0x4d0 [<ffffffff81071bb2>] worker_thread+0x152/0x340 [<ffffffff81075c8e>] kthread+0x7e/0x90 [<ffffffff815a4474>] kernel_thread_helper+0x4/0x10 Prevent this by checking the irqchip mode before starting a timer. We can't deny creating the PIT if the irqchips aren't set up yet as current user land expects this order to work. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2011-12-25MAINTAINERS: firewire git URL updateStefan Richter
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2011-12-25Merge branch 'nf-next' of git://1984.lsi.us.es/net-nextDavid S. Miller
2011-12-25netfilter: xtables: add nfacct match to support extended accountingPablo Neira Ayuso
This patch adds the match that allows to perform extended accounting. It requires the new nfnetlink_acct infrastructure. # iptables -I INPUT -p tcp --sport 80 -m nfacct --nfacct-name http-traffic # iptables -I OUTPUT -p tcp --dport 80 -m nfacct --nfacct-name http-traffic Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-12-25netfilter: add extended accounting infrastructure over nfnetlinkPablo Neira Ayuso
We currently have two ways to account traffic in netfilter: - iptables chain and rule counters: # iptables -L -n -v Chain INPUT (policy DROP 3 packets, 867 bytes) pkts bytes target prot opt in out source destination 8 1104 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 - use flow-based accounting provided by ctnetlink: # conntrack -L tcp 6 431999 ESTABLISHED src=192.168.1.130 dst=212.106.219.168 sport=58152 dport=80 packets=47 bytes=7654 src=212.106.219.168 dst=192.168.1.130 sport=80 dport=58152 packets=49 bytes=66340 [ASSURED] mark=0 use=1 While trying to display real-time accounting statistics, we require to pool the kernel periodically to obtain this information. This is OK if the number of flows is relatively low. However, in case that the number of flows is huge, we can spend a considerable amount of cycles to iterate over the list of flows that have been obtained. Moreover, if we want to obtain the sum of the flow accounting results that match some criteria, we have to iterate over the whole list of existing flows, look for matchings and update the counters. This patch adds the extended accounting infrastructure for nfnetlink which aims to allow displaying real-time traffic accounting without the need of complicated and resource-consuming implementation in user-space. Basically, this new infrastructure allows you to create accounting objects. One accounting object is composed of packet and byte counters. In order to manipulate create accounting objects, you require the new libnetfilter_acct library. It contains several examples of use: libnetfilter_acct/examples# ./nfacct-add http-traffic libnetfilter_acct/examples# ./nfacct-get http-traffic = { pkts = 000000000000, bytes = 000000000000 }; Then, you can use one of this accounting objects in several iptables rules using the new nfacct match (which comes in a follow-up patch): # iptables -I INPUT -p tcp --sport 80 -m nfacct --nfacct-name http-traffic # iptables -I OUTPUT -p tcp --dport 80 -m nfacct --nfacct-name http-traffic The idea is simple: if one packet matches the rule, the nfacct match updates the counters. Thanks to Patrick McHardy, Eric Dumazet, Changli Gao for reviewing and providing feedback for this contribution. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-12-24Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: vmwgfx: fix incorrect VRAM size check in vmw_kms_fb_create() drm/radeon/kms: bail on BTC parts if MC ucode is missing
2011-12-24rfs: better sizing of dev_flow_tableEric Dumazet
Aim of this patch is to provide full range of rps_flow_cnt on 64bit arches. Theorical limit on number of flows is 2^32 Fix some buggy RPS/RFS macros as well. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> CC: Tom Herbert <therbert@google.com> CC: Xi Wang <xi.wang@gmail.com> CC: Laurent Chavey <chavey@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-24Merge branch 'nf' of git://1984.lsi.us.es/netDavid S. Miller
2011-12-24netem: dont call vfree() under spinlock and BH disabledEric Dumazet
commit 6373a9a286 (netem: use vmalloc for distribution table) added a regression, since vfree() is called while holding a spinlock and BH being disabled. Fix this by doing the pointers swap in critical section, and freeing after spinlock release. Also add __GFP_NOWARN to the kmalloc() try, since we fallback to vmalloc(). Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Acked-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-12-24netfilter: ctnetlink: fix scheduling while atomic if helper is autoloadedPablo Neira Ayuso
This patch fixes one scheduling while atomic error: [ 385.565186] ctnetlink v0.93: registering with nfnetlink. [ 385.565349] BUG: scheduling while atomic: lt-expect_creat/16163/0x00000200 It can be triggered with utils/expect_create included in libnetfilter_conntrack if the FTP helper is not loaded. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-12-24netfilter: ctnetlink: fix return value of ctnetlink_get_expect()Pablo Neira Ayuso
This fixes one bogus error that is returned to user-space: libnetfilter_conntrack/utils# ./expect_get TEST: get expectation (-1)(Unknown error 18446744073709551504) This patch includes the correct handling for EAGAIN (nfnetlink uses this error value to restart the operation after module auto-loading). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>