- Feb 05, 2019
-
-
Florian Westphal authored
nf_nat_ipv6 calls two ipv6 core functions, so add those to v6ops to avoid the module dependency. This is a prerequisite for merging ipv4 and ipv6 nat implementations. Add wrappers to avoid the indirection if ipv6 is builtin. Signed-off-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org>
-
- Feb 04, 2019
-
-
wenxu authored
nft "tunnel" expr match both the tun_info of RX and TX. This patch provide the NFTA_TUNNEL_MODE to individually match the tun_info of RX or TX. Signed-off-by:
wenxu <wenxu@ucloud.cn> Signed-off-by:
-
- Jan 29, 2019
-
-
Florian Westphal authored
Fixes: 75dd48e2 ("netfilter: nf_tables: Support RULE_ID reference in new rule") Reported-by:
Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by:
Phil Sutter <phil@nwl.cc> Signed-off-by:
-
Stephen Rothwell authored
Fixes: d4fd0404 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") Signed-off-by:
Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-nextDavid S. Miller authored
Daniel Borkmann says: ==================== pull-request: bpf-next 2019-01-29 The following pull-request contains BPF updates for your *net-next* tree. The main changes are: 1) Teach verifier dead code removal, this also allows for optimizing / removing conditional branches around dead code and to shrink the resulting image. Code store constrained architectures like nfp would have hard time doing this at JIT level, from Jakub. 2) Add JMP32 instructions to BPF ISA in order to allow for optimizing code generation for 32-bit sub-registers. Evaluation shows that this can result in code reduction of ~5-20% compared to 64 bit-only code generation. Also add implementation for most JITs, from Jiong. 3) Add support for __int128 types in BTF which is also needed for vmlinux's BTF conversion to work, from Yonghong. 4) Add a new command to bpftool in order to dump a list of BPF-related parameters from the system or for a specific network device e.g. in terms of available prog/map types or helper functions, from Quentin. 5) Add AF_XDP sock_diag interface for querying sockets from user space which provides information about the RX/TX/fill/completion rings, umem, memory usage etc, from Björn. 6) Add skb context access for skb_shared_info->gso_segs field, from Eric. 7) Add support for testing flow dissector BPF programs by extending existing BPF_PROG_TEST_RUN infrastructure, from Stanislav. 8) Split BPF kselftest's test_verifier into various subgroups of tests in order better deal with merge conflicts in this area, from Jakub. 9) Add support for queue/stack manipulations in bpftool, from Stanislav. 10) Document BTF, from Yonghong. 11) Dump supported ELF section names in libbpf on program load failure, from Taeung. 12) Silence a false positive compiler warning in verifier's BTF handling, from Peter. 13) Fix help string in bpftool's feature probing, from Prashant. 14) Remove duplicate includes in BPF kselftests, from Yue. ==================== Signed-off-by: -
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-nextDavid S. Miller authored
Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter/IPVS updates for your net-next tree: 1) Introduce a hashtable to speed up object lookups, from Florian Westphal. 2) Make direct calls to built-in extension, also from Florian. 3) Call helper before confirming the conntrack as it used to be originally, from Florian. 4) Call request_module() to autoload br_netfilter when physdev is used to relax the dependency, also from Florian. 5) Allow to insert rules at a given position ID that is internal to the batch, from Phil Sutter. 6) Several patches to replace conntrack indirections by direct calls, and to reduce modularization, from Florian. This also includes several follow up patches to deal with minor fallout from this rework. 7) Use RCU from conntrack gre helper, from Florian. 8) GRE conntrack module becomes built-in into nf_conntrack, from Florian. 9) Replace nf_ct_invert_tuplepr() by calls to nf_ct_invert_tuple(), from Florian. 10) Unify sysctl handling at the core of nf_conntrack, from Florian. 11) Provide modparam to register conntrack hooks. 12) Allow to match on the interface kind string, from wenxu. 13) Remove several exported symbols, not required anymore now after a bit of de-modulatization work has been done, from Florian. 14) Remove built-in map support in the hash extension, this can be done with the existing userspace infrastructure, from laura. 15) Remove indirection to calculate checksums in IPVS, from Matteo Croce. 16) Use call wrappers for indirection in IPVS, also from Matteo. 17) Remove superfluous __percpu parameter in nft_counter, patch from Luc Van Oostenryck. ==================== Signed-off-by: -
Daniel Borkmann authored
Stanislav Fomichev says: ==================== This patch series adds support for testing flow dissector BPF programs by extending already existing BPF_PROG_TEST_RUN. The goal is to have a packet as an input and `struct bpf_flow_key' as an output. That way we can easily test flow dissector programs' behavior. I've also modified existing test_progs.c test to do a simple flow dissector run as well. * first patch introduces new __skb_flow_bpf_dissect to simplify sharing between __skb_flow_bpf_dissect and BPF_PROG_TEST_RUN * second patch adds actual BPF_PROG_TEST_RUN support * third patch adds example usage to the selftests v3: * rebased on top of latest bpf-next v2: * loop over 'kattr->test.repeat' inside of bpf_prog_test_run_flow_dissector, don't reuse bpf_test_run/bpf_test_run_one ==================== Signed-off-by:Daniel Borkmann <daniel@iogearbox.net>
-
Stanislav Fomichev authored
Use existing pkt_v4 and pkt_v6 to make sure flow_keys are what we want. Also, add new bpf_flow_load routine (and flow_dissector_load.h header) that loads bpf_flow.o program and does all required setup. Signed-off-by:
Stanislav Fomichev <sdf@google.com> Acked-by:
Song Liu <songliubraving@fb.com> Signed-off-by:
-
Stanislav Fomichev authored
The input is packet data, the output is struct bpf_flow_key. This should make it easy to test flow dissector programs without elaborate setup. Signed-off-by:
-
Stanislav Fomichev authored
This way, we can reuse it for flow dissector in BPF_PROG_TEST_RUN. No functional changes. Signed-off-by:
-
Jakub Kicinski authored
When prog array is updated with bpftool users often refer to the map via the ID. Unfortunately, that's likely to lead to confusion because prog arrays get flushed when the last user reference is gone. If there is no other reference bpftool will create one, update successfully just to close the map again and have it flushed. Warn about this case in non-JSON mode. If the problem continues causing confusion we can remove the support for referring to a map by ID for prog array update completely. For now it seems like the potential inconvenience to users who know what they're doing outweighs the benefit. Signed-off-by:
Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by:
Quentin Monnet <quentin.monnet@netronome.com> Acked-by:
-
YueHaibing authored
Remove duplicated include. Signed-off-by:
YueHaibing <yuehaibing@huawei.com> Acked-by:
-
David S. Miller authored
Michal Kalderon says: ==================== qed*: Error recovery process Parity errors might happen in the device's memories due to momentary bit flips which are caused by radiation. Errors that are not correctable initiate a process kill event, which blocks the device access towards the host and the network, and a recovery process is started in the management FW and in the driver. This series adds the support of this process in the qed core module and in the qede driver (patches 2 & 3). Patch 1 in the series revises the load sequence, to avoid PCI errors that might be observed during a recovery process. Changes in v2: - Addressed issue found in https://patchwork.ozlabs.org/patch/1030545/ The change was done be removing the enum and passing a boolean to the related functions. ==================== Signed-off-by:
-
Tomer Tayar authored
This patch adds the error recovery process in the qede driver. The process includes a partial/customized driver unload and load, which allows it to look like a short suspend period to the kernel while preserving the net devices' state. Signed-off-by:
Tomer Tayar <tomer.tayar@cavium.com> Signed-off-by:
Ariel Elior <ariel.elior@cavium.com> Signed-off-by:
Michal Kalderon <michal.kalderon@cavium.com> Signed-off-by:
-
Tomer Tayar authored
This patch adds the detection and handling of a parity error ("process kill event"), including the update of the protocol drivers, and the prevention of any HW access that will lead to device access towards the host while recovery is in progress. It also provides the means for the protocol drivers to trigger a recovery process on their decision. Signed-off-by: -
Tomer Tayar authored
Initiating final cleanup after an ungraceful driver unload can lead to bad PCI accesses towards the host. This patch revises the load sequence so final cleanup is sent while the internal master enable is cleared, to prevent the host accesses, and clears the internal error indications just before enabling the internal master enable. Signed-off-by:
-
Lubomir Rintel authored
is_broadcast_packet() expands to compare_ether_addr() which doesn't exist since commit 7367d0b5 ("drivers/net: Convert uses of compare_ether_addr to ether_addr_equal"). It turns out it's actually not used. Signed-off-by:
Lubomir Rintel <lkundrak@v3.sk> Signed-off-by:
-
David S. Miller authored
Ido Schimmel says: ==================== mlxsw: Misc updates This patchset contains miscellaneous patches we gathered in our queue. Some of them are dependencies of larger patchsets that I will submit later this cycle. Patches #1-#3 perform small non-functional changes in mlxsw. Patch #4 adds more extended ack messages in mlxsw. Patch #5 adds devlink parameters documentation for mlxsw. To be extended with more parameters this cycle. Patches #6-#7 perform small changes in forwarding selftests infrastructure. ==================== Signed-off-by: -
Ido Schimmel authored
It is easier to distinguish "[ OK ]" from "[FAIL]" than "[PASS]". Signed-off-by:
Ido Schimmel <idosch@mellanox.com> Suggested-by:
David Ahern <dsahern@gmail.com> Cc: David Ahern <dsahern@gmail.com> Signed-off-by:
-
Jiri Pirko authored
As for the others, check help message output to find out if devlink supports "resource" object. Signed-off-by:
Jiri Pirko <jiri@mellanox.com> Signed-off-by:
-
Jiri Pirko authored
Add initial documentation file for devlink params of mlxsw driver. Only "fw_load_policy" is now supported. Signed-off-by:
-
Ido Schimmel authored
Add more extack messages that let the user know why VXLAN offload failed. Signed-off-by:
-
Jiri Pirko authored
Signed-off-by:
-
Jiri Pirko authored
Move the struct to the place where they belong, alongside with the rest of the MR code. Signed-off-by:
-
Jiri Pirko authored
No need to pass ruleset/group and chunk pointers on action_replace call path, nobody uses them. Signed-off-by:
-
- Jan 28, 2019
-
-
Florian Westphal authored
Only one caller; place it where needed and get rid of the EXPORT_SYMBOL. Signed-off-by:
-
Cong Wang authored
When nf_ct_netns_get() fails, it should clean up itself, its caller doesn't need to call nf_conntrack_fini_net(). nf_conntrack_init_net() is called after registering sysctl and proc, so its cleanup function should be called before unregistering sysctl and proc. Fixes: ba3fbe66 ("netfilter: nf_conntrack: provide modparam to always register conntrack hooks") Fixes: b884fa46 ("netfilter: conntrack: unify sysctl handling") Reported-and-tested-by:
<syzbot+fcee88b2d87f0539dfe9@syzkaller.appspotmail.com> Signed-off-by:
-
Luc Van Oostenryck authored
nft_counter_rest() has its first argument declared as struct nft_counter_percpu_priv __percpu *priv but this structure is not percpu (it only countains a member 'counter' which is, correctly, a pointer to a percpu struct nft_counter). So, remove the '__percpu' from the argument's declaration. Signed-off-by:
Luc Van Oostenryck <luc.vanoostenryck@gmail.com> Signed-off-by:
-
Matteo Croce authored
Use the new indirect call wrappers in IPVS when calling the TCP or UDP protocol specific functions. This avoids an indirect calls in IPVS, and reduces the performance impact of the Spectre mitigation. Signed-off-by:
Matteo Croce <mcroce@redhat.com> Acked-by:
Julian Anastasov <ja@ssi.bg> Acked-by:
Simon Horman <horms@verge.net.au> Signed-off-by:
-
Matteo Croce authored
The function pointer ip_vs_protocol->csum_check is only used in protocol specific code, and never in the generic one. Remove the function pointer from struct ip_vs_protocol and call the checksum functions directly. This reduces the performance impact of the Spectre mitigation, and should give a small improvement even with RETPOLINES disabled. Signed-off-by:
-
Alexei Starovoitov authored
Jakub Kicinski says: ==================== The tools/testing/selftests/bpf/test_verifier.c file is way too large, and since most people add their at the end of the list it's very prone to conflicts. Break it up in the simplest possible way - slice the array up into smaller C files and include them in the right spot. Tested: $ make -C tools/testing/selftests/bpf/ $ cd tools/testing/selftests/bpf/ ; make v2: The indentation is reduced further as discussed and lines folded. The conversion was scripted, and double checked by hand. ==================== Signed-off-by:Alexei Starovoitov <ast@kernel.org>
-
Jakub Kicinski authored
Break up the rest of test_verifier tests into separate files. Signed-off-by:
Jiong Wang <jiong.wang@netronome.com> Signed-off-by:
-
Jakub Kicinski authored
Break up the first 10 kLoC of test verifier test cases out into smaller files. Looks like git line counting gets a little flismy above 16 bit integers, so we need two commits to break up test_verifier. Signed-off-by:
-
Jakub Kicinski authored
test_verifier.c has grown to be very long (almost 16 kLoC), and it is very conflict prone since we always add tests at the end. Try to break it apart a little bit. Allow test snippets to be defined in separate files and include them automatically into the huge test array. Signed-off-by:
-
David S. Miller authored
Wei Wang says: ==================== tcp: change pingpong to 3 in delayed ack logic TCP receiver today tries not to delay the ACKs to speed up the initial slow start (a.k.a QUICK ACK mechanism). However the previous design does not work well with modern TCP applications that starts with an application-level handshake. For example, a HTTPs server often receives the SSL hello and responds right away which triggers the TCP stack to stop the quick ack and start delaying the ACKs based only one instance of ping-pong. This patchset changes the threshold from 1 to 3 ping-pong transactions, so that we only start to delay the acks after the receiver responds data quickly three times. ==================== Signed-off-by: -
Wei Wang authored
In order to be more confident about an on-going interactive session, we increment pingpong count by 1 for every interactive transaction and we adjust TCP_PINGPONG_THRESH to 3. This means, we only consider a session in pingpong mode after we see 3 interactive transactions, and start to activate delayed acks in quick ack mode. And in order to not over-count the credits, we only increase pingpong count for the first packet sent in response for the previous received packet. This is mainly to prevent delaying the ack immediately after some handshake protocol but no real interactive traffic pattern afterwards. Signed-off-by:
Wei Wang <weiwan@google.com> Signed-off-by:
Yuchung Cheng <ycheng@google.com> Signed-off-by:
Eric Dumazet <edumazet@google.com> Signed-off-by:
-
Wei Wang authored
Instead of using pingpong as a single bit information, we refactor the code to treat it as a counter. When interactive session is detected, we set pingpong count to TCP_PINGPONG_THRESH. And when pingpong count is >= TCP_PINGPONG_THRESH, we consider the session in pingpong mode. This patch is a pure refactor and sets foundation for the next patch. This patch itself does not change any pingpong logic. Signed-off-by:
-
Yang Wei authored
Fix blank line coding style issues, make the code cleaner. Remove a redundant blank line in ip_rcv_core(). Insert a blank line in ip_rcv() between different statement blocks. Signed-off-by:
Yang Wei <yang.wei9@zte.com.cn> Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Signed-off-by:
-
Carlo Caione authored
Libphy provides a standard set of helpers to access the MMD PHY registers. Use those instead of relying on custom driver-specific functions. Signed-off-by:
Carlo Caione <ccaione@baylibre.com> Reviewed-by:
Florian Fainelli <f.fainelli@gmail.com> Signed-off-by:
-
-
