1. 20 12月, 2012 5 次提交
    • V
      RDMA/cxgb4: Fix bug for active and passive LE hash collision path · 793dad94
      Vipul Pandya 提交于
      Retries active opens for INUSE errors.
      
      Logs any active ofld_connect_wr error replies.
      
      Sends ofld_connect_wr on same ctrlq. It needs to go  on the same control txq as
      regular CPL active/passive messages.
      
      Retries on active open replies with EADDRINUSE.
      
      Uses active open fw wr only if active filter region is set.
      
      Adds stat for ofld_connect_wr failures.
      
      This patch also adds debugfs file to show endpoints.
      Signed-off-by: NVipul Pandya <vipul@chelsio.com>
      Signed-off-by: NRoland Dreier <roland@purestorage.com>
      793dad94
    • V
      RDMA/cxgb4: Fix LE hash collision bug for passive open connection · 1cab775c
      Vipul Pandya 提交于
      It establishes passive open connection through firmware work request. Passive
      open connection will go through this path as now instead of listening server we
      create a server filter which will redirect the incoming SYN packet to the
      offload queue. After this driver tries to establish the connection using
      firmware work request.
      Signed-off-by: NVipul Pandya <vipul@chelsio.com>
      Signed-off-by: NRoland Dreier <roland@purestorage.com>
      1cab775c
    • V
      RDMA/cxgb4: Fix LE hash collision bug for active open connection · 5be78ee9
      Vipul Pandya 提交于
      It enables establishing active open connection using fw_ofld_connection work
      request when cpl_act_open_rpl says TCAM full error which may be because
      of LE hash collision. Current support is only for IPv4 active open connections.
      
      Sets ntuple bits in active open requests. For T4 firmware greater than 1.4.10.0
      ntuple bits are required to be set.
      
      Adds nocong and enable_ecn module parameter options.
      Signed-off-by: NVipul Pandya <vipul@chelsio.com>
      
      [ Move all FW return values to t4fw_api.h.  - Roland ]
      Signed-off-by: NRoland Dreier <roland@purestorage.com>
      5be78ee9
    • V
      cxgb4: Add LE hash collision bug fix path in LLD driver · dca4faeb
      Vipul Pandya 提交于
      It supports establishing passive open connection through firmware filter work
      request. Passive open connection will go through this path as now instead of
      listening server we create a server filter which will redirect the incoming SYN
      packet to the offload queue.
      
      It divides filter region into regular filters and server filter portion. It
      introduces new server filter region which will be exclusively used for creating
      server filters. This region will not overlap with regular filter region.
      
      It provides new API cxgb4_alloc_sftid in LLD for getting stid in case of LE
      hash collision path. This new stid will be used to open server filter in the
      filter region.
      Signed-off-by: NVipul Pandya <vipul@chelsio.com>
      Signed-off-by: NRoland Dreier <roland@purestorage.com>
      dca4faeb
    • V
      cxgb4: Add T4 filter support · f2b7e78d
      Vipul Pandya 提交于
      The T4 architecture is capable of filtering ingress packets at line rate
      using the rule in TCAM. If packet hits a rule in the TCAM then it can be either
      dropped or passed to the receive queues based on a rule settings.
      
      This patch adds framework for managing filters and to use T4's filter
      capabilities. It constructs a Firmware Filter Work Request which writes the
      filter at a specified index to get the work done. It hosts shadow copy of
      ingress filter entry to check field size limitations and save memory in the
      case where the filter table is large.
      Signed-off-by: NVipul Pandya <vipul@chelsio.com>
      Signed-off-by: NRoland Dreier <roland@purestorage.com>
      f2b7e78d
  2. 14 12月, 2012 1 次提交
    • E
      tuntap: dont use skb after netif_rx_ni(skb) · 49974420
      Eric Dumazet 提交于
      On Wed, 2012-12-12 at 23:16 -0500, Dave Jones wrote:
      > Since todays net merge, I see this when I start openvpn..
      >
      > general protection fault: 0000 [#1] PREEMPT SMP
      > Modules linked in: ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack nf_conntrack ip6table_filter ip6_tables xfs iTCO_wdt iTCO_vendor_support snd_emu10k1 snd_util_mem snd_ac97_codec coretemp ac97_bus microcode snd_hwdep snd_seq pcspkr snd_pcm snd_page_alloc snd_timer lpc_ich i2c_i801 snd_rawmidi mfd_core snd_seq_device snd e1000e soundcore emu10k1_gp gameport i82975x_edac edac_core vhost_net tun macvtap macvlan kvm_intel kvm binfmt_misc nfsd auth_rpcgss nfs_acl lockd sunrpc btrfs libcrc32c zlib_deflate firewire_ohci sata_sil firewire_core crc_itu_t radeon i2c_algo_bit drm_kms_helper ttm drm i2c_core floppy
      > CPU 0
      > Pid: 1381, comm: openvpn Not tainted 3.7.0+ #14                  /D975XBX
      > RIP: 0010:[<ffffffff815b54a4>]  [<ffffffff815b54a4>] skb_flow_dissect+0x314/0x3e0
      > RSP: 0018:ffff88007d0d9c48  EFLAGS: 00010206
      > RAX: 000000000000055d RBX: 6b6b6b6b6b6b6b4b RCX: 1471030a0180040a
      > RDX: 0000000000000005 RSI: 00000000ffffffe0 RDI: ffff8800ba83fa80
      > RBP: ffff88007d0d9cb8 R08: 0000000000000000 R09: 0000000000000000
      > R10: 0000000000000000 R11: 0000000000000101 R12: ffff8800ba83fa80
      > R13: 0000000000000008 R14: ffff88007d0d9cc8 R15: ffff8800ba83fa80
      > FS:  00007f6637104800(0000) GS:ffff8800bf600000(0000) knlGS:0000000000000000
      > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      > CR2: 00007f563f5b01c4 CR3: 000000007d140000 CR4: 00000000000007f0
      > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      > Process openvpn (pid: 1381, threadinfo ffff88007d0d8000, task ffff8800a540cd60)
      > Stack:
      >  ffff8800ba83fa80 0000000000000296 0000000000000000 0000000000000000
      >  ffff88007d0d9cc8 ffffffff815bcff4 ffff88007d0d9ce8 ffffffff815b1831
      >  ffff88007d0d9ca8 00000000703f6364 ffff8800ba83fa80 0000000000000000
      > Call Trace:
      >  [<ffffffff815bcff4>] ? netif_rx+0x114/0x4c0
      >  [<ffffffff815b1831>] ? skb_copy_datagram_from_iovec+0x61/0x290
      >  [<ffffffff815b672a>] __skb_get_rxhash+0x1a/0xd0
      >  [<ffffffffa03b9538>] tun_get_user+0x418/0x810 [tun]
      >  [<ffffffff8135f468>] ? delay_tsc+0x98/0xf0
      >  [<ffffffff8109605c>] ? __rcu_read_unlock+0x5c/0xa0
      >  [<ffffffffa03b9a41>] tun_chr_aio_write+0x81/0xb0 [tun]
      >  [<ffffffff81145011>] ? __buffer_unlock_commit+0x41/0x50
      >  [<ffffffff811db917>] do_sync_write+0xa7/0xe0
      >  [<ffffffff811dc01f>] vfs_write+0xaf/0x190
      >  [<ffffffff811dc375>] sys_write+0x55/0xa0
      >  [<ffffffff81705540>] tracesys+0xdd/0xe2
      > Code: 41 8b 44 24 68 41 2b 44 24 6c 01 de 29 f0 83 f8 03 0f 8e a0 00 00 00 48 63 de 49 03 9c 24 e0 00 00 00 48 85 db 0f 84 72 fe ff ff <8b> 03 41 89 46 08 b8 01 00 00 00 e9 43 fd ff ff 0f 1f 40 00 48
      > RIP  [<ffffffff815b54a4>] skb_flow_dissect+0x314/0x3e0
      >  RSP <ffff88007d0d9c48>
      > ---[ end trace 6d42c834c72c002e ]---
      >
      >
      > Faulting instruction is
      >
      >    0:	8b 03                	mov    (%rbx),%eax
      >
      > rbx is slab poison (-20) so this looks like a use-after-free here...
      >
      >                         flow->ports = *ports;
      >  314:   8b 03                   mov    (%rbx),%eax
      >  316:   41 89 46 08             mov    %eax,0x8(%r14)
      >
      > in the inlined skb_header_pointer in skb_flow_dissect
      >
      > 	Dave
      >
      
      commit 96442e42 (tuntap: choose the txq based on rxq) added
      a use after free.
      
      Cache rxhash in a temp variable before calling netif_rx_ni()
      Reported-by: NDave Jones <davej@redhat.com>
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Jason Wang <jasowang@redhat.com>
      Acked-by: NJason Wang <jasowang@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      49974420
  3. 13 12月, 2012 2 次提交
  4. 12 12月, 2012 16 次提交
  5. 11 12月, 2012 16 次提交