Nothing remarkable. Mainly bonding fixes and bringing ibm_newemac up to snuff. Please pull from 'upstream-linus' branch of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6.git upstream-linus to receive the following updates: Documentation/networking/bonding.txt | 29 ++++++++- arch/powerpc/boot/dts/sequoia.dts | 5 ++ drivers/net/Kconfig | 1 + drivers/net/bonding/bond_main.c | 116 +++++++++++++++++++++------------- ...

Yes, I agree. They should not happen often. Especially compared to LSPP requirements of auditing whenever SA or SPD entries were added or Also, there is great possibility of additional messages. This is for RFC 4303, which is ESP. There are also audit messages listed for rfc 4301-IPsec architecture and rfc 4302-AH that may happen later. --

I'm all for continuing to use it, but I feel like the op= strings should probably all get collected up in one place to ease maintenance in the future, might not matter but it's nice to be able to look only on place in the code to find all of the possible op= The one advantage to multiple messages is the ability to exclude and not audit certain things. How often will these extra messages actually pop out of a system? Enough that people would likely still care about some of them but decide ...

Make the INET_TWDR_TWKILL_SLOTS vs sizeof(twdr->thread_slots) check nicer. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c index a60b99e..d43e787 100644 --- a/net/ipv4/inet_timewait_sock.c +++ b/net/ipv4/inet_timewait_sock.c @@ -194,16 +194,14 @@ out: EXPORT_SYMBOL_GPL(inet_twdr_hangman); -extern void twkill_slots_invalid(void); - void inet_twdr_twkill_work(struct work_struct *work) { struct ...

/me shrugs ... I have no idea, I've just always followed the lead of what was already written, but now that you mention it - it doesn't make much sense. I suppose at some point we can go through and change all the 'audit_enabled' users, but I wonder if there is some point (?performance?) to having the callers check? -- paul moore linux security @ hp --

Acked-by: Eric Paris <eparis@redhat.com> although it does make me wonder why audit_log_start doesn't just check --

This is essentially IN_DEV_ANDCONF with proper arguments. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h index dd093ea..962a062 100644 --- a/include/linux/inetdevice.h +++ b/include/linux/inetdevice.h @@ -78,9 +78,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev) (max(IPV4_DEVCONF_ALL(attr), IN_DEV_CONF_GET((in_dev), attr))) #define IN_DEV_FORWARD(in_dev) IN_DEV_CONF_GET((in_dev), ...

ipv4: unify assignment of fi to fib_result Signed-off-by: Denis V. Lunev <den@openvz.org> Acked-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> --- net/ipv4/fib_hash.c | 19 ++++--------------- net/ipv4/fib_lookup.h | 10 ++++++++++ net/ipv4/fib_trie.c | 19 ++++--------------- 3 files changed, 18 insertions(+), 30 deletions(-) diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c index 76bb7fd..a52b570 100644 --- a/net/ipv4/fib_hash.c +++ b/net/ipv4/fib_hash.c @@ -315,10 +315,7 ...

Hello all, As part of the IPv6 "gap analysis" that the Linux Foundation is currently doing I've been looking at the IPsec auditing requirements as defined in RFC4303 and I came across some odd behavior regarding SA sequence number overflows ... RFC4303 states the following: 3.3.3. Sequence Number Generation The sender's counter is initialized to 0 when an SA is established. The sender increments the sequence number (or ESN) counter for this SA and inserts the low-order ...

The following patch create the usual static inline functions to disable the xfrm6_init and xfrm6_fini function when XFRM is off. That's allow to remove some ifdef and make the code a little more clear. Signed-off-by: Daniel Lezcano <dlezcano@fr.ibm.com> --- include/net/xfrm.h | 16 +++++++++++++--- net/ipv6/route.c | 7 +------ 2 files changed, 14 insertions(+), 9 deletions(-) Index: ...

Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> --yoshfuji --

Just move the variable on the struct net and adjust its usage. Others sysctls from sys.net.core table are more difficult to virtualize (i.e. make them per-namespace), but I'll look at them as well a bit later. Signed-off-by: Pavel Emelyanov <xemul@oenvz.org> --- diff --git a/include/linux/socket.h b/include/linux/socket.h index eb5bdd5..bd2b30a 100644 --- a/include/linux/socket.h +++ b/include/linux/socket.h @@ -24,7 +24,6 @@ struct __kernel_sockaddr_storage { #include ...

Making them per-namespace is required for the following two reasons: First, some ctl values have a per-namespace meaning. Second, making them writable from the sub-namespace is an isolation hole. So I introduce the pernet operations to create these tables. For init_net I use the existing statically declared tables, for sub-namespace they are duplicated and the write bits are removed from the mode. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git ...

From: David Howells <dhowells@redhat.com> Applied, thanks David. --

[Empty message]

According to Herbert, the ipv4_devconf_setall should be called only when the ifa is added to the device. However, failed ifa allocation may bring things into inconsistent state. Move the call to ipv4_devconf_setall after the ifa allocation. Fits both net-2.6 (with offsets) and net-2.6.25 (cleanly). Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 0b5f042..1c3e20c 100644 --- a/net/ipv4/devinet.c +++ ...

[Empty message]

From: David Sterba <dsterba@suse.cz> From: David Sterba <dsterba@suse.cz> Use macros for comparing jiffies. Jiffies' wrap caused missed events and hangs. Module reinsert was needed to make bonding work again. Signed-off-by: David Sterba <dsterba@suse.cz> Acked-by: Jay Vosburgh <fubar@us.ibm.com> --- drivers/net/bonding/bond_main.c | 25 +++++++++++++------------ 1 files changed, 13 insertions(+), 12 deletions(-) diff --git a/drivers/net/bonding/bond_main.c ...

From: Wagner Ferenc <wferi@niif.hu> From: Wagner Ferenc <wferi@niif.hu> Adhere to coding style: break line after the if condition Signed-off-by: Ferenc Wagner <wferi@niif.hu> Acked-by: Jay Vosburgh <fubar@us.ibm.com> --- drivers/net/bonding/bond_sysfs.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c index 5c31f5c..9de2c52 100644 --- a/drivers/net/bonding/bond_sysfs.c +++ ...

Fixes a race condition in module unload. Without this change, workqueue events may fire while bonding data structures are partially freed but before bond_close() is invoked by unregister_netdevice(). Update version to 3.2.3. Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> --- drivers/net/bonding/bond_main.c | 43 ++++++++++++++++++++------------------- drivers/net/bonding/bonding.h | 2 +- 2 files changed, 23 insertions(+), 22 deletions(-) diff --git ...

From: Wagner Ferenc <wferi@niif.hu> From: Wagner Ferenc <wferi@niif.hu> Also remove trailing spaces from multivalued files. This fixes output like for example: $ od -c /sys/class/net/bond0/bonding/slaves 0000000 e t h - l e f t e t h - r i g 0000020 h t \n \0 0000025 It mostly entails deleting '+1'-s after sprintf() calls: the return value of sprintf is the number of characters printed, without the closing NUL, ie. exactly what the sysfs ...

From: Mitsuru Chinen <mitch@linux.vnet.ibm.com> Applied, thanks. I'll probably combine this with your original change before I push these changes upstream. --

From: Arnaldo Carvalho de Melo <acme@redhat.com> Pulled and pushed out to net-2.6.25, thanks! --

Jeff, This patch looks good. Please accept. --

From: Denis Cheng <crquan@gmail.com> Applied. --

From: "Denis V. Lunev" <den@openvz.org> Applied. --

From: Daniel Lezcano <dlezcano@fr.ibm.com> Applied, thanks. --

From: Daniel Lezcano <dlezcano@fr.ibm.com> Also applied. --

From: Daniel Lezcano <dlezcano@fr.ibm.com> Applied, thanks! --

From: Patrick McHardy <kaber@trash.net> Applied and I'll push to -stable once Linus pulls it in. --

From: Richard Knutsson <ricknu-0@student.ltu.se> When you say "int found;" is there any doubt in your mind that this integer is going to hold a 1 or a 0 depending upon whether we "found" something? That's the problem I have with these kinds of patches, they do not increase clarity, it's just pure mindless edits. In new code, fine, use booleans if you want. I would even accept that it helps to change to boolean for arguments to functions that are global in scope. But not for function ...

Yeah, this (very likely) due to the new SACK processing (in net-2.6.25). I'll look what could go wrong with fack_count calculations, most likely it's the reason (I've found earlier one out-of-place retransmission segment in one of my test case which already indicated that there's something incorrect with them but didn't have time to debug it yet). Thanks for report. Some info about how easily you can reproduce & couple of sentences about the test case might be useful later on when ...

applied #upstream-fixes --

I'm using a Marvell 88E8062 on a custom PPC64 blade and ran into RX lockups while validating the sky2 driver. The receive MAC FIFO would become stuck during testing with high traffic. One port of the 88E8062 would lockup, while the other port remained functional. Re-inserting the sky2 module would not fix the problem - only a power cycle would. I looked over Marvell's most recent sk98lin driver and it looks like they had a "workaround" for the Yukon XL that the sky2 doesn't have yet. The ...

Ah... you need to tell me these things. I looked for a kernel version in your messages but did not see one. git fetch -f $NETDEV_URL upstream:upstream copies the latest upstream branch from netdev-2.6.git, and stores it as your local upstream branch. You may do the same for #upstream-fixes too. Jeff --

applied #upstream-fixes --

applied #upstream-fixes --

From: Stephen Hemminger <shemminger@linux-foundation.org> I know about this, I'm just curious what exactly Ilpo is using :-) --

David - I'm aware of this, the discussion is which behaviour is ok. Let's go back to a real life example. I've already researched that the squid web proxy has a poll() based main loop doing nonblocking connects, may be with multiple threads. Situation: One user wants to access a web page that needs IPSEC. The SA takes 30 seconds to come up. a) Non-blocking connect is respected: SYN packets during the first 30 seconds will be dropped as you said. Connection can be completed on the next ...

Updated patch, added your netmask validation code but without the check that made 0.0.0.0 (default) and 255.255.255.255 (one address) invalid netmasks as they are permitted in CIDR format. Signed-off-by: Andreas Henriksson <andreas@fatal.se> diff --git a/lib/utils.c b/lib/utils.c index 4c42dfd..b4a6125 100644 --- a/lib/utils.c +++ b/lib/utils.c @@ -47,6 +47,41 @@ int get_integer(int *val, const char *arg, int base) return 0; } +/* a valid netmask must be 2^n - 1 (n = 1..31) ...

Greetings Ilpo, We had been using one of your earlier patches, and still had the problem. I think you've cured the problem with SACK itself, but there still seems to be something taking a lot of CPU while recovering from the loss. It is possible that it was to do with web100 which we have also been running, but I cut out most of the statistics from that and still had problems. Cheers, Lachlan -- Lachlan Andrew Dept of Computer Science, Caltech 1200 E California Blvd, Mail Code ...

On Thu, 6 Dec 2007, Lachlan Andrew wrote: > On 04/12/2007, Ilpo J

(commit 2b1e300a9dfc3196ccddf6f1d74b91b7af55e416) This seems to have broken the use of /proc/bus/usb as a mountpoint. It always appears empty now, whatever's supposed to be mounted there. -- dwmw2 --

Andrew, I become too relaxed after receiving "Tested-by: Giacomo Catenazzi <cate@debian.org>" Eric, I believe that reverting an original behavior is better than your new one as - you introduce search into the depth by calling have_submounts(dentry) during revalidation for all(!) /proc dentries - your shadowing behavior will be broken if you'll mount something in the depth of shadowed tree (this can be done as a DoS attempt) As a last minute call, may be it will be better to pin network ...

Is reposting here ok to get these queued for the next kernel release, or are there people to CC: for this? -- Ben (ben@fluff.org, http://www.fluff.org/) 'a smiley only costs 4 bytes' --