OpenVZ Forum - RDF feed
type: channel
items: [PATCH net-2.6.25 0/10] Make fragments live in net namespaces
items: [PATCH net-2.6.25 1/10][NETNS][FRAGS]: Move ctl tables around.
items: [PATCH net-2.6.25 2/10][NETNS][FRAGS]: Make the inet_frag_queue lookup work in namespaces.
items: [PATCH net-2.6.25 3/10][NETNS][FRAGS]: Make the nqueues counter per-namespace.
items: [PATCH net-2.6.25 4/10][NETNS][FRAGS]: Make the mem counter per-namespace.
items: Re: [PATCH net-2.6.25 1/10][NETNS][FRAGS]: Move ctl tables around.
items: [PATCH net-2.6.25 5/10][NETNS][FRAGS]: Duplicate sysctl tables for new namespaces.
items: [PATCH net-2.6.25 6/10][NETNS][FRAGS]: Make the net.ipv4.ipfrag_timeout work in namespaces.
items: [PATCH net-2.6.25 7/10][NETNS][FRAGS]: Make thresholds work in namespaces.
items: Re: [PATCH net-2.6.25 2/10][NETNS][FRAGS]: Make the inet_frag_queue lookup work in namespaces.
items: Re: [PATCH net-2.6.25 3/10][NETNS][FRAGS]: Make the nqueues counter per-namespace.
items: [PATCH net-2.6.25 8/10][NETNS][FRAGS]: Isolate the secret interval from namespaces.
items: Re: [PATCH net-2.6.25 4/10][NETNS][FRAGS]: Make the mem counter per-namespace.
items: [PATCH net-2.6.25 9/10][NETNS][FRAGS]: Make the LRU list per namespace.
items: Re: [PATCH net-2.6.25 5/10][NETNS][FRAGS]: Duplicate sysctl tables for new namespaces.
items: Re: [PATCH net-2.6.25 6/10][NETNS][FRAGS]: Make the net.ipv4.ipfrag_timeout work in namespaces.
items: Re: [PATCH net-2.6.25 7/10][NETNS][FRAGS]: Make thresholds work in namespaces.
items: [PATCH net-2.6.25 10/10][NETNS][FRAGS]: Make the pernet subsystem for fragments.
items: Re: [PATCH net-2.6.25 8/10][NETNS][FRAGS]: Isolate the secret interval from namespaces.
items: Re: [PATCH net-2.6.25 9/10][NETNS][FRAGS]: Make the LRU list per namespace.
items: Re: [PATCH net-2.6.25 10/10][NETNS][FRAGS]: Make the pernet subsystem for fragments.

[PATCH net-2.6.25 0/10] Make fragments live in net namespaces
type: item
description: The overall design I propose is to keep the hash table global and tag inet_frag_queue with the net. Since the fragments hash is going to be re-sizable, this is OK to keep fragments from different namespace in one hash. To speedup the evicting process LRU list is made per namespace. As far as the CTL-tuned variables are concerned, the timeout and thresholds are made per namespace, since they have the per namespace sense, but the secret rebuild interval is read-only in sub-namespaces. Since fragment management code is consolidated for ipv4 and ipv6 I make them all in one go. The conntrack_reasm netns-ization is not done - we have to make at least the core netfilter per namespace first, but this reasm code is patched to keep working in the initial namespace. Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
creator: Pavel Emelianov
date: 2008-01-22T13:52:36-00:00

[PATCH net-2.6.25 1/10][NETNS][FRAGS]: Move ctl tables around.
type: item
description: This is a preparation for sysctl netns-ization. Move the ctl tables to the files, where the tuning variables reside. Plus make the helpers to register the tables. This will simplify the later patches and will keep similar things closer to each other. ipv4, ipv6 and conntrack_reasm are patched differently, bu the result is all the tables are in appropriate files. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/ip.h | 5 -- include/net/ipv6.h | 1 - include/net/netfilter/ipv6/nf_conntrack_ipv6.h | 4 +- net/ipv4/ip_fragment.c | 74 +++++++++++++++++++++++- net/ipv4/sysctl_net_ipv4.c | 42 ------------- net/ipv6/af_inet6.c | 5 -- net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 29 --------- net/ipv6/netfilter/nf_conntrack_reasm.c | 31 ++++++++++- net/ipv6/reassembly.c | 66 ++++++++++++++++++++- net/ipv6/sysctl_net_ipv6.c | 40 +------------ 10 files changed, 169 insertions(+), 128 deletions(-) diff --git a/include/net/ip.h b/include/net/ip.h index 2ad4d2f..ff14fc8 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -179,11 +179,6 @@ extern int sysctl_ip_nonlocal_bind; extern struct ctl_path net_ipv4_ctl_path[]; -/* From ip_fragment.c */ -struct inet_frags_ctl; -extern struct inet_frags_ctl ip4_frags_ctl; -extern int sysctl_ipfrag_max_dist; - /* From inetpeer.c */ extern int inet_peer_threshold; extern int inet_peer_minttl; diff --git a/include/net/ipv6.h b/include/net/ipv6.h index 3712cae..87ca1bf 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -587,7 +587,6 @@ extern int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf, #ifdef CONFIG_PROC_FS extern struct ctl_table *ipv6_icmp_sysctl_init(struct net *net); -extern void ipv6_frag_sysctl_init(struct net *net); extern struct ctl_table *ipv6_route_sysctl_init(struct net *net); extern int ac6_proc_init(void); diff --git a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h index f703533..abc55ad 100644 --- a/include/net/netfilter/ipv6/nf_conntrac…
creator: Pavel Emelianov
date: 2008-01-22T13:55:23-00:00

[PATCH net-2.6.25 2/10][NETNS][FRAGS]: Make the inet_frag_queue lookup work in namespaces.
type: item
description: Since fragment management code is consolidated, we cannot have the pointer from inet_frag_queue to struct net, since we must know what king of fragment this is. So, I introduce the netns_frags structure. This one is currently empty, but will be eventually filled with per-namespace attributes. Each inet_frag_queue is tagged with this one. The conntrack_reasm is not "netns-izated", so it has one statis netns_frags instance to keep working in init namespace. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/inet_frag.h | 8 ++++++-- include/net/netns/ipv4.h | 4 ++++ include/net/netns/ipv6.h | 1 + net/ipv4/inet_fragment.c | 27 +++++++++++++++------------ net/ipv4/ip_fragment.c | 8 +++++--- net/ipv6/netfilter/nf_conntrack_reasm.c | 3 ++- net/ipv6/reassembly.c | 8 +++++--- 7 files changed, 38 insertions(+), 21 deletions(-) diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index 954def4..8ab6df6 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -1,8 +1,12 @@ #ifndef __NET_FRAG_H__ #define __NET_FRAG_H__ +struct netns_frags { +}; + struct inet_frag_queue { struct hlist_node list; + struct netns_frags *net; struct list_head lru_list; /* lru list member */ spinlock_t lock; atomic_t refcnt; @@ -55,8 +59,8 @@ void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f, int *work); int inet_frag_evictor(struct inet_frags *f); -struct inet_frag_queue *inet_frag_find(struct inet_frags *f, void *key, - unsigned int hash); +struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, + struct inet_frags *f, void *key, unsigned int hash); static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f) { diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h index 3872aa7..80680e0 100644 --- a/include/net/netns/ipv4.h +++ b/include/net/netns/ipv4.h @@ -5,6 +5,8 @@ #ifndef __NETNS_IPV4_H__ #define __NETNS_IPV4_H__ +#include <net/…
creator: Pavel Emelianov
date: 2008-01-22T13:57:06-00:00

[PATCH net-2.6.25 3/10][NETNS][FRAGS]: Make the nqueues counter per-namespace.
type: item
description: This is simple - just move the variable from struct inet_frags to struct netns_frags and adjust the usage appropriately. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/inet_frag.h | 4 +++- include/net/ip.h | 2 +- include/net/ipv6.h | 2 +- net/ipv4/inet_fragment.c | 11 ++++++++--- net/ipv4/ip_fragment.c | 6 ++++-- net/ipv4/proc.c | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 1 + net/ipv6/proc.c | 2 +- net/ipv6/reassembly.c | 6 ++++-- 9 files changed, 24 insertions(+), 12 deletions(-) diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index 8ab6df6..d36f3a6 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -2,6 +2,7 @@ #define __NET_FRAG_H__ struct netns_frags { + int nqueues; }; struct inet_frag_queue { @@ -36,7 +37,6 @@ struct inet_frags { struct hlist_head hash[INETFRAGS_HASHSZ]; rwlock_t lock; u32 rnd; - int nqueues; int qsize; atomic_t mem; struct timer_list secret_timer; @@ -55,6 +55,8 @@ struct inet_frags { void inet_frags_init(struct inet_frags *); void inet_frags_fini(struct inet_frags *); +void inet_frags_init_net(struct netns_frags *nf); + void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f, int *work); diff --git a/include/net/ip.h b/include/net/ip.h index ff14fc8..9ea1bc5 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -330,7 +330,7 @@ enum ip_defrag_users int ip_defrag(struct sk_buff *skb, u32 user); int ip_frag_mem(void); -int ip_frag_nqueues(void); +int ip_frag_nqueues(struct net *net); /* * Functions provided by ip_forward.c diff --git a/include/net/ipv6.h b/include/net/ipv6.h index 87ca1bf..da1c089 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -245,7 +245,7 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, extern int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb); -int ip6_frag_nqueues(void); +int ip6_frag_nqueues(struct net *net); int ip6_frag_mem(vo…
creator: Pavel Emelianov
date: 2008-01-22T13:58:13-00:00

[PATCH net-2.6.25 4/10][NETNS][FRAGS]: Make the mem counter per-namespace.
type: item
description: This is also simple, but introduces more changes, since then mem counter is altered in more places. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/inet_frag.h | 4 ++-- include/net/ip.h | 2 +- include/net/ipv6.h | 2 +- net/ipv4/inet_fragment.c | 21 +++++++++++---------- net/ipv4/ip_fragment.c | 29 +++++++++++++++-------------- net/ipv4/proc.c | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 14 +++++++------- net/ipv6/proc.c | 2 +- net/ipv6/reassembly.c | 28 +++++++++++++++------------- 9 files changed, 54 insertions(+), 50 deletions(-) diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index d36f3a6..6edce7b 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -3,6 +3,7 @@ struct netns_frags { int nqueues; + atomic_t mem; }; struct inet_frag_queue { @@ -38,7 +39,6 @@ struct inet_frags { rwlock_t lock; u32 rnd; int qsize; - atomic_t mem; struct timer_list secret_timer; struct inet_frags_ctl *ctl; @@ -60,7 +60,7 @@ void inet_frags_init_net(struct netns_frags *nf); void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f, int *work); -int inet_frag_evictor(struct inet_frags *f); +int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f); struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, struct inet_frags *f, void *key, unsigned int hash); diff --git a/include/net/ip.h b/include/net/ip.h index 9ea1bc5..d41ff83 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -329,7 +329,7 @@ enum ip_defrag_users }; int ip_defrag(struct sk_buff *skb, u32 user); -int ip_frag_mem(void); +int ip_frag_mem(struct net *net); int ip_frag_nqueues(struct net *net); /* diff --git a/include/net/ipv6.h b/include/net/ipv6.h index da1c089..fa80ea4 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -246,7 +246,7 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, extern int ipv6_opt_accepted(struct sock *sk, …
creator: Pavel Emelianov
date: 2008-01-22T13:59:41-00:00

Re: [PATCH net-2.6.25 1/10][NETNS][FRAGS]: Move ctl tables around.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 16:55:23 +0300 > This is a preparation for sysctl netns-ization. > Move the ctl tables to the files, where the tuning > variables reside. Plus make the helpers to register > the tables. > > This will simplify the later patches and will keep > similar things closer to each other. > > ipv4, ipv6 and conntrack_reasm are patched differently, > bu the result is all the tables are in appropriate files. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Applied.
creator: davem
date: 2008-01-22T14:00:54-00:00

[PATCH net-2.6.25 5/10][NETNS][FRAGS]: Duplicate sysctl tables for new namespaces.
type: item
description: Each namespace has to have own tables to tune their different parameters, so duplicate the tables and register them. All the tables in sub-namespaces are temporarily made read-only. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/netns/ipv4.h | 1 + include/net/netns/ipv6.h | 1 + net/ipv4/ip_fragment.c | 42 +++++++++++++++++++++++++++++++++++++++--- net/ipv6/reassembly.c | 41 ++++++++++++++++++++++++++++++++++++++--- 4 files changed, 79 insertions(+), 6 deletions(-) diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h index 80680e0..15a0b05 100644 --- a/include/net/netns/ipv4.h +++ b/include/net/netns/ipv4.h @@ -16,6 +16,7 @@ struct sock; struct netns_ipv4 { #ifdef CONFIG_SYSCTL struct ctl_table_header *forw_hdr; + struct ctl_table_header *frags_hdr; #endif struct ipv4_devconf *devconf_all; struct ipv4_devconf *devconf_dflt; diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h index 057c8e4..87ab56a 100644 --- a/include/net/netns/ipv6.h +++ b/include/net/netns/ipv6.h @@ -12,6 +12,7 @@ struct ctl_table_header; struct netns_sysctl_ipv6 { #ifdef CONFIG_SYSCTL struct ctl_table_header *table; + struct ctl_table_header *frags_hdr; #endif struct inet_frags_ctl frags; int bindv6only; diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index 4f01334..c51e1a1 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -661,17 +661,53 @@ static struct ctl_table ip4_frags_ctl_table[] = { static int ip4_frags_ctl_register(struct net *net) { + struct ctl_table *table; struct ctl_table_header *hdr; - hdr = register_net_sysctl_table(net, net_ipv4_ctl_path, - ip4_frags_ctl_table); - return hdr == NULL ? -ENOMEM : 0; + table = ip4_frags_ctl_table; + if (net != &init_net) { + table = kmemdup(table, sizeof(ip4_frags_ctl_table), GFP_KERNEL); + if (table == NULL) + goto err_alloc; + + table[0].mode &= ~0222; + table[1].mode &= ~0222; + table[2].mode &= ~0222; + table[3].mode &= ~0222; + table[4].mode &= ~0222; + } + + hdr = regist…
creator: Pavel Emelianov
date: 2008-01-22T14:01:02-00:00

[PATCH net-2.6.25 6/10][NETNS][FRAGS]: Make the net.ipv4.ipfrag_timeout work in namespaces.
type: item
description: Move it to the netns_frags, adjust the usage and make the appropriate ctl table writable. Now fragment, that live in different namespaces can live for different times. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/inet_frag.h | 4 +++- net/ipv4/inet_fragment.c | 2 +- net/ipv4/ip_fragment.c | 20 ++++++++++---------- net/ipv6/netfilter/nf_conntrack_reasm.c | 4 ++-- net/ipv6/reassembly.c | 6 +++--- 5 files changed, 19 insertions(+), 17 deletions(-) diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index 6edce7b..f56e296 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -4,6 +4,9 @@ struct netns_frags { int nqueues; atomic_t mem; + + /* sysctls */ + int timeout; }; struct inet_frag_queue { @@ -29,7 +32,6 @@ struct inet_frag_queue { struct inet_frags_ctl { int high_thresh; int low_thresh; - int timeout; int secret_interval; }; diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index ad79ae0..9da9679 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -206,7 +206,7 @@ static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf, } #endif qp = qp_in; - if (!mod_timer(&qp->timer, jiffies + f->ctl->timeout)) + if (!mod_timer(&qp->timer, jiffies + nf->timeout)) atomic_inc(&qp->refcnt); atomic_inc(&qp->refcnt); diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index c51e1a1..70d241c 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -83,13 +83,6 @@ static struct inet_frags_ctl ip4_frags_ctl __read_mostly = { */ .high_thresh = 256 * 1024, .low_thresh = 192 * 1024, - - /* - * Important NOTE! Fragment queue must be destroyed before MSL expires. - * RFC791 is wrong proposing to prolongate timer each fragment arrival - * by TTL. - */ - .timeout = IP_FRAG_TIME, .secret_interval = 10 * 60 * HZ, }; @@ -287,7 +280,7 @@ static int ip_frag_reinit(struct ipq *qp) { struct sk_buff *fp; - if (!mod_timer(&qp->q.timer, jiffies + ip4_frags_ctl.timeout)) { + if (!mod_timer…
creator: Pavel Emelianov
date: 2008-01-22T14:02:17-00:00

[PATCH net-2.6.25 7/10][NETNS][FRAGS]: Make thresholds work in namespaces.
type: item
description: This is the same as with the timeout variable. Currently, after exceeding the high threshold _all_ the fragments are evicted, but it will be fixed in later patch. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/inet_frag.h | 4 ++-- net/ipv4/inet_fragment.c | 2 +- net/ipv4/ip_fragment.c | 26 +++++++++++++------------- net/ipv6/netfilter/nf_conntrack_reasm.c | 12 ++++++------ net/ipv6/reassembly.c | 15 +++++++-------- 5 files changed, 29 insertions(+), 30 deletions(-) diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index f56e296..de41359 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -7,6 +7,8 @@ struct netns_frags { /* sysctls */ int timeout; + int high_thresh; + int low_thresh; }; struct inet_frag_queue { @@ -30,8 +32,6 @@ struct inet_frag_queue { #define INETFRAGS_HASHSZ 64 struct inet_frags_ctl { - int high_thresh; - int low_thresh; int secret_interval; }; diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 9da9679..5ab399c 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -153,7 +153,7 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f) struct inet_frag_queue *q; int work, evicted = 0; - work = atomic_read(&nf->mem) - f->ctl->low_thresh; + work = atomic_read(&nf->mem) - nf->low_thresh; while (work > 0) { read_lock(&f->lock); if (list_empty(&f->lru_list)) { diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index 70d241c..80c2c19 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -75,14 +75,6 @@ struct ipq { }; static struct inet_frags_ctl ip4_frags_ctl __read_mostly = { - /* - * Fragment cache limits. We will commit 256K at one time. Should we - * cross that limit we will prune down to 192K. This should cope with - * even the most extreme cases without allowing an attacker to - * measurably harm machine performance. - */ - .high_thresh = 256 * 1024, - .low_thresh = 192 * 1024, .secret_interval = 10 * 60 * HZ, }; @@ -582,7 …
creator: Pavel Emelianov
date: 2008-01-22T14:05:47-00:00

Re: [PATCH net-2.6.25 2/10][NETNS][FRAGS]: Make the inet_frag_queue lookup work in namespaces.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 16:57:06 +0300 > Since fragment management code is consolidated, we > cannot have the pointer from inet_frag_queue to > struct net, since we must know what king of fragment > this is. > > So, I introduce the netns_frags structure. This one > is currently empty, but will be eventually filled with > per-namespace attributes. Each inet_frag_queue is > tagged with this one. > > The conntrack_reasm is not "netns-izated", so it has > one statis netns_frags instance to keep working in > init namespace. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Applied.
creator: davem
date: 2008-01-22T14:05:58-00:00

Re: [PATCH net-2.6.25 3/10][NETNS][FRAGS]: Make the nqueues counter per-namespace.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 16:58:13 +0300 > This is simple - just move the variable from struct inet_frags > to struct netns_frags and adjust the usage appropriately. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Applied.
creator: davem
date: 2008-01-22T14:06:35-00:00

[PATCH net-2.6.25 8/10][NETNS][FRAGS]: Isolate the secret interval from namespaces.
type: item
description: Since we have one hashtable to lookup the fragment, having different secret_interval-s for hash rebuild doesn't make sense, so move this one to inet_frags. The inet_frags_ctl becomes empty after this, so remove it. The appropriate ctl table is kept read-only in namespaces. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/inet_frag.h | 6 +----- include/net/netns/ipv6.h | 1 - net/ipv4/inet_fragment.c | 4 ++-- net/ipv4/ip_fragment.c | 8 ++------ net/ipv6/netfilter/nf_conntrack_reasm.c | 6 +----- net/ipv6/reassembly.c | 6 ++---- 6 files changed, 8 insertions(+), 23 deletions(-) diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index de41359..1917fbe 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -31,18 +31,14 @@ struct inet_frag_queue { #define INETFRAGS_HASHSZ 64 -struct inet_frags_ctl { - int secret_interval; -}; - struct inet_frags { struct list_head lru_list; struct hlist_head hash[INETFRAGS_HASHSZ]; rwlock_t lock; u32 rnd; int qsize; + int secret_interval; struct timer_list secret_timer; - struct inet_frags_ctl *ctl; unsigned int (*hashfn)(struct inet_frag_queue *); void (*constructor)(struct inet_frag_queue *q, diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h index 87ab56a..187c424 100644 --- a/include/net/netns/ipv6.h +++ b/include/net/netns/ipv6.h @@ -14,7 +14,6 @@ struct netns_sysctl_ipv6 { struct ctl_table_header *table; struct ctl_table_header *frags_hdr; #endif - struct inet_frags_ctl frags; int bindv6only; int flush_delay; int ip6_rt_max_size; diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 5ab399c..fcf5252 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -47,7 +47,7 @@ static void inet_frag_secret_rebuild(unsigned long dummy) } write_unlock(&f->lock); - mod_timer(&f->secret_timer, now + f->ctl->secret_interval); + mod_timer(&f->secret_timer, now + f->secret_interval); } void inet_frags_init(struct inet_frags *f) @@ -65,7 +65,7 @@ void inet_fra…
creator: Pavel Emelianov
date: 2008-01-22T14:07:08-00:00

Re: [PATCH net-2.6.25 4/10][NETNS][FRAGS]: Make the mem counter per-namespace.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 16:59:41 +0300 > This is also simple, but introduces more changes, since > then mem counter is altered in more places. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Applied.
creator: davem
date: 2008-01-22T14:07:37-00:00

[PATCH net-2.6.25 9/10][NETNS][FRAGS]: Make the LRU list per namespace.
type: item
description: The inet_frags.lru_list is used for evicting only, so we have to make it per-namespace, to evict only those fragments, who's namespace exceeded its high threshold, but not the whole hash. Besides, this helps to avoid long loops in evictor. The spinlock is not per-namespace because it protects the hash table as well, which is global. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/inet_frag.h | 2 +- net/ipv4/inet_fragment.c | 8 ++++---- net/ipv4/ip_fragment.c | 2 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- net/ipv6/reassembly.c | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index 1917fbe..3695ff4 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -4,6 +4,7 @@ struct netns_frags { int nqueues; atomic_t mem; + struct list_head lru_list; /* sysctls */ int timeout; @@ -32,7 +33,6 @@ struct inet_frag_queue { #define INETFRAGS_HASHSZ 64 struct inet_frags { - struct list_head lru_list; struct hlist_head hash[INETFRAGS_HASHSZ]; rwlock_t lock; u32 rnd; diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index fcf5252..f1b95e1 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -57,7 +57,6 @@ void inet_frags_init(struct inet_frags *f) for (i = 0; i < INETFRAGS_HASHSZ; i++) INIT_HLIST_HEAD(&f->hash[i]); - INIT_LIST_HEAD(&f->lru_list); rwlock_init(&f->lock); f->rnd = (u32) ((num_physpages ^ (num_physpages>>7)) ^ @@ -74,6 +73,7 @@ void inet_frags_init_net(struct netns_frags *nf) { nf->nqueues = 0; atomic_set(&nf->mem, 0); + INIT_LIST_HEAD(&nf->lru_list); } EXPORT_SYMBOL(inet_frags_init_net); @@ -156,12 +156,12 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f) work = atomic_read(&nf->mem) - nf->low_thresh; while (work > 0) { read_lock(&f->lock); - if (list_empty(&f->lru_list)) { + if (list_empty(&nf->lru_list)) { read_unlock(&f->lock); break; } - q = list_first_entry(&f->lru_list, + q = list_first_entry(&nf->lru_li…
creator: Pavel Emelianov
date: 2008-01-22T14:08:54-00:00

Re: [PATCH net-2.6.25 5/10][NETNS][FRAGS]: Duplicate sysctl tables for new namespaces.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 17:01:02 +0300 > Each namespace has to have own tables to tune their > different parameters, so duplicate the tables and > register them. > > All the tables in sub-namespaces are temporarily made > read-only. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Applied.
creator: davem
date: 2008-01-22T14:09:09-00:00

Re: [PATCH net-2.6.25 6/10][NETNS][FRAGS]: Make the net.ipv4.ipfrag_timeout work in namespaces.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 17:02:17 +0300 > Move it to the netns_frags, adjust the usage and > make the appropriate ctl table writable. > > Now fragment, that live in different namespaces can > live for different times. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Applied.
creator: davem
date: 2008-01-22T14:09:47-00:00

Re: [PATCH net-2.6.25 7/10][NETNS][FRAGS]: Make thresholds work in namespaces.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 17:05:47 +0300 > This is the same as with the timeout variable. > > Currently, after exceeding the high threshold _all_ > the fragments are evicted, but it will be fixed in > later patch. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Applied.
creator: davem
date: 2008-01-22T14:10:25-00:00

[PATCH net-2.6.25 10/10][NETNS][FRAGS]: Make the pernet subsystem for fragments.
type: item
description: On namespace start we mainly prepare the ctl variables. When the namespace is stopped we have to kill all the fragments that point to this namespace. The inet_frags_exit_net() handles it. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- include/net/inet_frag.h | 1 + net/ipv4/inet_fragment.c | 7 +++++++ net/ipv4/ip_fragment.c | 13 ++++++++++++- net/ipv6/reassembly.c | 14 +++++++++++++- 4 files changed, 33 insertions(+), 2 deletions(-) diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h index 3695ff4..7374251 100644 --- a/include/net/inet_frag.h +++ b/include/net/inet_frag.h @@ -54,6 +54,7 @@ void inet_frags_init(struct inet_frags *); void inet_frags_fini(struct inet_frags *); void inet_frags_init_net(struct netns_frags *nf); +void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f); void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); void inet_frag_destroy(struct inet_frag_queue *q, diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index f1b95e1..724d69a 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -83,6 +83,13 @@ void inet_frags_fini(struct inet_frags *f) } EXPORT_SYMBOL(inet_frags_fini); +void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f) +{ + nf->low_thresh = 0; + inet_frag_evictor(nf, f); +} +EXPORT_SYMBOL(inet_frags_exit_net); + static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f) { write_lock(&f->lock); diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index 29b4b09..a2e92f9 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -713,9 +713,20 @@ static int ipv4_frags_init_net(struct net *net) return ip4_frags_ctl_register(net); } +static void ipv4_frags_exit_net(struct net *net) +{ + ip4_frags_ctl_unregister(net); + inet_frags_exit_net(&net->ipv4.frags, &ip4_frags); +} + +static struct pernet_operations ip4_frags_ops = { + .init = ipv4_frags_init_net, + .exit = ipv4_frags_exit_net, +}; + void __init ipf…
creator: Pavel Emelianov
date: 2008-01-22T14:10:51-00:00

Re: [PATCH net-2.6.25 8/10][NETNS][FRAGS]: Isolate the secret interval from namespaces.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 17:07:10 +0300 > Since we have one hashtable to lookup the fragment, having > different secret_interval-s for hash rebuild doesn't make > sense, so move this one to inet_frags. > > The inet_frags_ctl becomes empty after this, so remove it. > The appropriate ctl table is kept read-only in namespaces. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Applied.
creator: davem
date: 2008-01-22T14:11:16-00:00

Re: [PATCH net-2.6.25 9/10][NETNS][FRAGS]: Make the LRU list per namespace.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 17:08:54 +0300 > The inet_frags.lru_list is used for evicting only, so we have > to make it per-namespace, to evict only those fragments, who's > namespace exceeded its high threshold, but not the whole hash. > Besides, this helps to avoid long loops in evictor. > > The spinlock is not per-namespace because it protects the > hash table as well, which is global. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Applied.
creator: davem
date: 2008-01-22T14:11:58-00:00

Re: [PATCH net-2.6.25 10/10][NETNS][FRAGS]: Make the pernet subsystem for fragments.
type: item
description: From: Pavel Emelyanov <xemul@openvz.org> Date: Tue, 22 Jan 2008 17:10:51 +0300 > On namespace start we mainly prepare the ctl variables. > > When the namespace is stopped we have to kill all the > fragments that point to this namespace. > The inet_frags_exit_net() handles it. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Also applied, thanks a lot!
creator: davem
date: 2008-01-22T14:12:52-00:00