From 3bfdc59a6c24608ed23e903f670aaf5f58c7a6f3 Mon Sep 17 00:00:00 2001 From: Sven Wegener Date: Thu, 29 May 2014 20:27:05 +0000 Subject: [PATCH 1/7] ipv6: Fix regression caused by efe4208 in udp_v6_mcast_next() Commit efe4208 ("ipv6: make lookups simpler and faster") introduced a regression in udp_v6_mcast_next(), resulting in multicast packets not reaching the destination sockets under certain conditions. The packet's IPv6 addresses are wrongly compared to the IPv6 addresses from the function's socket argument, which indicates the starting point for looping, instead of the loop variable. If the addresses from the first socket do not match the packet's addresses, no socket in the list will match. Signed-off-by: Sven Wegener Acked-by: Eric Dumazet Signed-off-by: David S. Miller --- net/ipv6/udp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 1e586d92260e..20b63d2ab70f 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -716,15 +716,15 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk, if (inet->inet_dport != rmt_port) continue; } - if (!ipv6_addr_any(&sk->sk_v6_daddr) && - !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr)) + if (!ipv6_addr_any(&s->sk_v6_daddr) && + !ipv6_addr_equal(&s->sk_v6_daddr, rmt_addr)) continue; if (s->sk_bound_dev_if && s->sk_bound_dev_if != dif) continue; - if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) { - if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr)) + if (!ipv6_addr_any(&s->sk_v6_rcv_saddr)) { + if (!ipv6_addr_equal(&s->sk_v6_rcv_saddr, loc_addr)) continue; } if (!inet6_mc_check(s, loc_addr, rmt_addr)) From d4c642ea1239f0c5c1d794a5b788319d3373c58c Mon Sep 17 00:00:00 2001 From: Fabio Estevam Date: Tue, 3 Jun 2014 19:55:38 -0300 Subject: [PATCH 2/7] gianfar: Call netif_carrier_off() prior to registration Quoting David Miller: "At the moment you call register_netdev() the device is visible, notifications are sent to userspace, and userland tools can try to bring the interface up and see the incorrect link state, before you do the netif_carrier_off(). Said another way, between the register_netdev() and netif_carrier_off() call, userspace can see the device in an inconsistent state." So call netif_carrier_off() prior to register_netdev(). Signed-off-by: Fabio Estevam Signed-off-by: David S. Miller --- drivers/net/ethernet/freescale/gianfar.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c index e2d42475b006..c81625ade4a3 100644 --- a/drivers/net/ethernet/freescale/gianfar.c +++ b/drivers/net/ethernet/freescale/gianfar.c @@ -1373,6 +1373,9 @@ static int gfar_probe(struct platform_device *ofdev) gfar_hw_init(priv); + /* Carrier starts down, phylib will bring it up */ + netif_carrier_off(dev); + err = register_netdev(dev); if (err) { @@ -1380,9 +1383,6 @@ static int gfar_probe(struct platform_device *ofdev) goto register_fail; } - /* Carrier starts down, phylib will bring it up */ - netif_carrier_off(dev); - device_init_wakeup(&dev->dev, priv->device_flags & FSL_GIANFAR_DEV_HAS_MAGIC_PACKET); From c531692073847fe64635f6992d774fb319e3529a Mon Sep 17 00:00:00 2001 From: Rajesh Borundia Date: Wed, 4 Jun 2014 03:40:54 -0400 Subject: [PATCH 3/7] qlcnic: Initialize mailbox cmd structure to zero o Uninitialzed fields in mailbox command structure caused commands to time out randomly due to garbage values so initialize it to zero. Signed-off-by: Rajesh Borundia Signed-off-by: David S. Miller --- drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c index 6afe9c1f5ab9..d9216afa93c1 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c @@ -454,6 +454,7 @@ static int qlcnic_sriov_get_vf_acl(struct qlcnic_adapter *adapter) struct qlcnic_cmd_args cmd; int ret = 0; + memset(&cmd, 0, sizeof(cmd)); ret = qlcnic_sriov_alloc_bc_mbx_args(&cmd, QLCNIC_BC_CMD_GET_ACL); if (ret) return ret; @@ -1441,6 +1442,7 @@ static int qlcnic_sriov_channel_cfg_cmd(struct qlcnic_adapter *adapter, u8 cmd_o struct qlcnic_vf_info *vf = &adapter->ahw->sriov->vf_info[0]; int ret; + memset(&cmd, 0, sizeof(cmd)); if (qlcnic_sriov_alloc_bc_mbx_args(&cmd, cmd_op)) return -ENOMEM; @@ -1998,6 +2000,7 @@ int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *adapter, struct qlcnic_cmd_args cmd; int ret; + memset(&cmd, 0, sizeof(cmd)); if (vid == 0) return 0; From 59ae9fc67007da8b5aea7b0a31c3607745cfbfee Mon Sep 17 00:00:00 2001 From: Zoltan Kiss Date: Wed, 4 Jun 2014 19:58:51 +0100 Subject: [PATCH 4/7] xen-netback: Fix handling of skbs requiring too many slots A recent commit (a02eb4 "xen-netback: worse-case estimate in xenvif_rx_action is underestimating") capped the slot estimation to MAX_SKB_FRAGS, but that triggers the next BUG_ON a few lines down, as the packet consumes more slots than estimated. This patch introduces full_coalesce on the skb callback buffer, which is used in start_new_rx_buffer() to decide whether netback needs coalescing more aggresively. By doing that, no packet should need more than (XEN_NETIF_MAX_TX_SIZE + 1) / PAGE_SIZE data slots (excluding the optional GSO slot, it doesn't carry data, therefore irrelevant in this case), as the provided buffers are fully utilized. Signed-off-by: Zoltan Kiss Cc: Paul Durrant Cc: Wei Liu Cc: Ian Campbell Cc: David Vrabel Reviewed-by: Paul Durrant Acked-by: Wei Liu Signed-off-by: David S. Miller --- drivers/net/xen-netback/netback.c | 36 +++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 11 deletions(-) diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index 7367208ee8cd..a160b4ef5ba0 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -163,7 +163,8 @@ bool xenvif_rx_ring_slots_available(struct xenvif *vif, int needed) * adding 'size' bytes to a buffer which currently contains 'offset' * bytes. */ -static bool start_new_rx_buffer(int offset, unsigned long size, int head) +static bool start_new_rx_buffer(int offset, unsigned long size, int head, + bool full_coalesce) { /* simple case: we have completely filled the current buffer. */ if (offset == MAX_BUFFER_OFFSET) @@ -175,6 +176,7 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head) * (i) this frag would fit completely in the next buffer * and (ii) there is already some data in the current buffer * and (iii) this is not the head buffer. + * and (iv) there is no need to fully utilize the buffers * * Where: * - (i) stops us splitting a frag into two copies @@ -185,6 +187,8 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head) * by (ii) but is explicitly checked because * netfront relies on the first buffer being * non-empty and can crash otherwise. + * - (iv) is needed for skbs which can use up more than MAX_SKB_FRAGS + * slot * * This means we will effectively linearise small * frags but do not needlessly split large buffers @@ -192,7 +196,8 @@ static bool start_new_rx_buffer(int offset, unsigned long size, int head) * own buffers as before. */ BUG_ON(size > MAX_BUFFER_OFFSET); - if ((offset + size > MAX_BUFFER_OFFSET) && offset && !head) + if ((offset + size > MAX_BUFFER_OFFSET) && offset && !head && + !full_coalesce) return true; return false; @@ -227,6 +232,13 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif *vif, return meta; } +struct xenvif_rx_cb { + int meta_slots_used; + bool full_coalesce; +}; + +#define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb) + /* * Set up the grant operations for this fragment. If it's a flipping * interface, we also set up the unmap request from here. @@ -261,7 +273,10 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb, if (bytes > size) bytes = size; - if (start_new_rx_buffer(npo->copy_off, bytes, *head)) { + if (start_new_rx_buffer(npo->copy_off, + bytes, + *head, + XENVIF_RX_CB(skb)->full_coalesce)) { /* * Netfront requires there to be some data in the head * buffer. @@ -541,12 +556,6 @@ static void xenvif_add_frag_responses(struct xenvif *vif, int status, } } -struct xenvif_rx_cb { - int meta_slots_used; -}; - -#define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb) - void xenvif_kick_thread(struct xenvif *vif) { wake_up(&vif->wq); @@ -602,10 +611,15 @@ static void xenvif_rx_action(struct xenvif *vif) /* To avoid the estimate becoming too pessimal for some * frontends that limit posted rx requests, cap the estimate - * at MAX_SKB_FRAGS. + * at MAX_SKB_FRAGS. In this case netback will fully coalesce + * the skb into the provided slots. */ - if (max_slots_needed > MAX_SKB_FRAGS) + if (max_slots_needed > MAX_SKB_FRAGS) { max_slots_needed = MAX_SKB_FRAGS; + XENVIF_RX_CB(skb)->full_coalesce = true; + } else { + XENVIF_RX_CB(skb)->full_coalesce = false; + } /* We may need one more slot for GSO metadata */ if (skb_is_gso(skb) && From 1cff389ddbc4af34edb3bf20c9fe847d84b1b883 Mon Sep 17 00:00:00 2001 From: Amos Kong Date: Thu, 5 Jun 2014 11:01:21 +0800 Subject: [PATCH 5/7] mvme147: fix ram size in comment The order of ram pages is 3, so the ram size is 2^3 * 4K = 32K. Signed-off-by: Amos Kong Signed-off-by: David S. Miller --- drivers/net/ethernet/amd/mvme147.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/amd/mvme147.c b/drivers/net/ethernet/amd/mvme147.c index 0e8399dec054..0660ac5846bb 100644 --- a/drivers/net/ethernet/amd/mvme147.c +++ b/drivers/net/ethernet/amd/mvme147.c @@ -26,9 +26,9 @@ #include #include -/* We have 16834 bytes of RAM for the init block and buffers. This places +/* We have 32K of RAM for the init block and buffers. This places * an upper limit on the number of buffers we can use. NetBSD uses 8 Rx - * buffers and 2 Tx buffers. + * buffers and 2 Tx buffers, it takes (8 + 2) * 1544 bytes. */ #define LANCE_LOG_TX_BUFFERS 1 #define LANCE_LOG_RX_BUFFERS 3 @@ -111,7 +111,7 @@ struct net_device * __init mvme147lance_probe(int unit) dev->dev_addr); lp = netdev_priv(dev); - lp->ram = __get_dma_pages(GFP_ATOMIC, 3); /* 16K */ + lp->ram = __get_dma_pages(GFP_ATOMIC, 3); /* 32K */ if (!lp->ram) { printk("%s: No memory for LANCE buffers\n", dev->name); free_netdev(dev); From 78c8dbb6524c92f28ea56a09ce3960b435d8ed92 Mon Sep 17 00:00:00 2001 From: Amos Kong Date: Thu, 5 Jun 2014 11:01:22 +0800 Subject: [PATCH 6/7] hplance: fix ram size in comment drivers/net/ethernet/amd/hplance.h: #define HPLANCE_MEMOFF 0x8000 /* struct lance_init_block */ #define HPLANCE_NVRAMOFF 0xC008 /* etheraddress as one *nibble* per byte */ The offset of RAM start is 0x8000, the offset of RAM end is 0xC008, so the RAM size is 16392 bytes. Signed-off-by: Amos Kong Signed-off-by: David S. Miller --- drivers/net/ethernet/amd/hplance.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/amd/hplance.c b/drivers/net/ethernet/amd/hplance.c index 47ce57c2c893..6c9de117ffc6 100644 --- a/drivers/net/ethernet/amd/hplance.c +++ b/drivers/net/ethernet/amd/hplance.c @@ -27,9 +27,9 @@ #include "hplance.h" -/* We have 16834 bytes of RAM for the init block and buffers. This places +/* We have 16392 bytes of RAM for the init block and buffers. This places * an upper limit on the number of buffers we can use. NetBSD uses 8 Rx - * buffers and 2 Tx buffers. + * buffers and 2 Tx buffers, it takes (8 + 2) * 1544 bytes. */ #define LANCE_LOG_TX_BUFFERS 1 #define LANCE_LOG_RX_BUFFERS 3 From 0dcceabb0c1bf2d4c12a748df9933fad303072a7 Mon Sep 17 00:00:00 2001 From: Alexei Starovoitov Date: Thu, 5 Jun 2014 14:39:36 -0700 Subject: [PATCH 7/7] net: filter: fix SKF_AD_PKTTYPE extension on big-endian BPF classic->internal converter broke SKF_AD_PKTTYPE extension, since pkt_type_offset() was failing to find skb->pkt_type field which is defined as: __u8 pkt_type:3, fclone:2, ipvs_property:1, peeked:1, nf_trace:1; Fix it by searching for 3 most significant bits and shift them by 5 at run-time Fixes: bd4cf0ed331a ("net: filter: rework/optimize internal BPF interpreter's instruction set") Signed-off-by: Alexei Starovoitov Acked-by: Daniel Borkmann Tested-by: Daniel Borkmann Signed-off-by: David S. Miller --- net/core/filter.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/net/core/filter.c b/net/core/filter.c index 4aec7b93f1a9..ab3c74e49f07 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -578,7 +578,11 @@ EXPORT_SYMBOL_GPL(sk_run_filter_int_skb); * to make sure its still a 3bit field starting at a byte boundary; * taken from arch/x86/net/bpf_jit_comp.c. */ +#ifdef __BIG_ENDIAN_BITFIELD +#define PKT_TYPE_MAX (7 << 5) +#else #define PKT_TYPE_MAX 7 +#endif static unsigned int pkt_type_offset(void) { struct sk_buff skb_probe = { .pkt_type = ~0, }; @@ -685,6 +689,13 @@ static bool convert_bpf_extensions(struct sock_filter *fp, insn->code = BPF_ALU | BPF_AND | BPF_K; insn->a_reg = A_REG; insn->imm = PKT_TYPE_MAX; +#ifdef __BIG_ENDIAN_BITFIELD + insn++; + + insn->code = BPF_ALU | BPF_RSH | BPF_K; + insn->a_reg = A_REG; + insn->imm = 5; +#endif break; case SKF_AD_OFF + SKF_AD_IFINDEX: