- 20 Aug, 2024 2 commits
-
-
Florian Westphal authored
Reject rules where a load occurs from a register that has not seen a store early in the same rule. commit 4c905f67 ("netfilter: nf_tables: initialize registers in nft_do_chain()") had to add a unconditional memset to the nftables register space to avoid leaking stack information to userspace. This memset shows up in benchmarks. After this change, this commit can be reverted again. Note that this breaks userspace compatibility, because theoretically you can do rule 1: reg2 := meta load iif, reg2 == 1 jump ... rule 2: reg2 == 2 jump ... // read access with no store in this rule ... after this change this is rejected. Neither nftables nor iptables-nft generate such rules, each rule is always standalone. This resuts in a small increase of nft_ctx structure by sizeof(long). To cope with hypothetical rulesets like the example above one could emit on-demand "reg[x] = 0" store when generating the datapath blob in nf_tables_commit_chain_prepare(). A patch that does this is linked to below. For now, lets disable this. In nf_tables, a rule is the smallest unit that can be replaced from userspace, i.e. a hypothetical ruleset that relies on earlier initialisations of registers can't be changed at will as register usage would need to be coordinated. Link: https://lore.kernel.org/netfilter-devel/20240627135330.17039-4-fw@strlen.de/Signed-off-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org>
-
Florian Westphal authored
Mechanical transformation, no logical changes intended. Signed-off-by:
-
- 19 Aug, 2024 7 commits
-
-
Xin Long authored
This patch is to move nf_ct_netns_get() out of nf_conncount_init() and let the consumers of nf_conncount decide if they want to turn on netfilter conntrack. It makes nf_conncount more flexible to be used in other places and avoids netfilter conntrack turned on when using it in openvswitch conntrack. Signed-off-by:
Xin Long <lucien.xin@gmail.com> Reviewed-by:
-
Pablo Neira Ayuso authored
pipapo set backend maintains two copies of the datastructure, removing the elements from the copy that is going to be discarded slows down the abort path significantly, from several minutes to few seconds after this patch. This patch was previously reverted by f86fb940 ("netfilter: nf_tables: revert do not remove elements if set backend implements .abort") but it is now possible since recent work by Florian Westphal to perform on-demand clone from insert/remove path: 532aec7e ("netfilter: nft_set_pipapo: remove dirty flag") 3f1d886c ("netfilter: nft_set_pipapo: move cloning of match info to insert/removal path") a2381067 ("netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone") c5444786 ("netfilter: nft_set_pipapo: merge deactivate helper into caller") 6c108d9b ("netfilter: nft_set_pipapo: prepare walk function for on-demand clone") 8b8a2417 ("netfilter: nft_set_pipapo: prepare destroy function for on-demand clone") 80efd299 ("netfilter: nft_set_pipapo: make pipapo_clone helper return NULL") a590f476 ("netfilter: nft_set_pipapo: move prove_locking helper around") after this series, the clone is fully released once aborted, no need to take it back to previous state. Thus, no stale reference to elements can occur. Signed-off-by:
-
Florian Westphal authored
nft_set_lookup_byid() is very slow when transaction becomes large, due to walk of the transaction list. Add a dedicated list that contains only the new sets. Before: nft -f ruleset 0.07s user 0.00s system 0% cpu 1:04.84 total After: nft -f ruleset 0.07s user 0.00s system 0% cpu 30.115 total .. where ruleset contains ~10 sets with ~100k elements. The above number is for a combined flush+reload of the ruleset. With previous flush, even the first NEWELEM has to walk through a few hundred thousands of DELSET(ELEM) transactions before the first NEWSET object. To cope with random-order-newset-newsetelem we'd need to replace commit_set_list with a hashtable. Expectation is that a NEWELEM operation refers to the most recently added set, so last entry of the dedicated list should be the set we want. NB: This is not a bug fix per se (functionality is fine), but with larger transaction batches list search takes forever, so it would be nice to speed this up for -stable too, hence adding a "fixes" tag. Fixes: 958bee14 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Reported-by:
Nadia Pinaeva <n.m.pinaeva@gmail.com> Signed-off-by:
-
Donald Hunter authored
Use consume_skb in the batch code path to avoid generating spurious NOT_SPECIFIED skb drop reasons. Signed-off-by:
Donald Hunter <donald.hunter@gmail.com> Signed-off-by:
-
Antonio Ojea authored
Test that nfqueue with and without GSO process SCTP packets correctly. Joint work with Florian and Pablo. Signed-off-by:
Antonio Ojea <aojea@google.com> Signed-off-by:
-
Antonio Ojea authored
when packet is enqueued with nfqueue and GSO is enabled, checksum calculation has to take into account the protocol, as SCTP uses a 32 bits CRC checksum. Enter skb_gso_segment() path in case of SCTP GSO packets because skb_zerocopy() does not support for GSO_BY_FRAGS. Joint work with Pablo. Signed-off-by:
-
Frank Li authored
fsl,enetc-ptp is embedded pcie device. Add compatible string pci1957,ee02. Fix warning: arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-kbox-a-230-ls.dtb: ethernet@0,4: compatible:0: 'pci1957,ee02' is not one of ['fsl,etsec-ptp', 'fsl,fman-ptp-timer', 'fsl,dpaa2-ptp', 'fsl,enetc-ptp'] Signed-off-by:
Frank Li <Frank.Li@nxp.com> Acked-by:
Rob Herring (Arm) <robh@kernel.org> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
- 17 Aug, 2024 2 commits
-
-
Simon Horman authored
In bnx2x_get_vf_config(): * The vlan field of ivi is a 32-bit integer, it is used to store a vlan ID. * The vlan field of bulletin is a 16-bit integer, it is also used to store a vlan ID. In the current code, ivi->vlan is set using memset. But in the case of setting it to the value of bulletin->vlan, this involves reading 32 bits from a 16bit source. This is likely safe, as the following 6 bytes are padding in the same structure, but none the less, it seems undesirable. However, it is entirely unclear to me how this scheme works on big-endian systems. Resolve this by simply assigning integer values to ivi->vlan. Flagged by W=1 builds. f.e. gcc-14 reports: In function 'fortify_memcpy_chk', inlined from 'bnx2x_get_vf_config' at .../bnx2x_sriov.c:2655:4: .../fortify-string.h:580:25: warning: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 580 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Compile tested only. Signed-off-by:Simon Horman <horms@kernel.org> Reviewed-by:
Brett Creeley <brett.creeley@amd.com> Link: https://patch.msgid.link/20240815-bnx2x-int-vlan-v1-1-5940b76e37ad@kernel.orgSigned-off-by:
Jakub Kicinski <kuba@kernel.org>
-
Christoph Paasch authored
mpls_xmit() needs to prepend the MPLS-labels to the packet. That implies one needs to make sure there is enough space for it in the headers. Calling skb_cow() implies however that one wants to change even the playload part of the packet (which is not true for MPLS). Thus, call skb_cow_head() instead, which is what other tunnelling protocols do. Running a server with this comm it entirely removed the calls to pskb_expand_head() from the callstack in mpls_xmit() thus having significant CPU-reduction, especially at peak times. Cc: Roopa Prabhu <roopa@nvidia.com> Reported-by:
Craig Taylor <cmtaylor@apple.com> Signed-off-by:
Christoph Paasch <cpaasch@apple.com> Reviewed-by:
-
- 16 Aug, 2024 29 commits
-
-
Simon Horman authored
Remove unnecessary NULL check before freeing using kvfree(). This function will ignore a NULL argument. Flagged by Coccinelle: .../txgbe_hw.c:187:2-8: WARNING: NULL check before some freeing functions is not needed. No functional change intended. Compile tested only. Signed-off-by:
-
Aleksander Jan Bajkowski authored
Remove a variable that has never been used. Signed-off-by:
Aleksander Jan Bajkowski <olek2@wp.pl> Link: https://patch.msgid.link/20240815074956.155224-1-olek2@wp.plSigned-off-by:
-
Tariq Toukan authored
Following commit 9f7e8fbb ("net/mlx5: offset comp irq index in name by one"), which fixed the index in IRQ name to start once again from 0, we change the documentation accordingly. Signed-off-by:
Tariq Toukan <tariqt@nvidia.com> Reviewed-by:
Dragos Tatulea <dtatulea@nvidia.com> Link: https://patch.msgid.link/20240815142343.2254247-1-tariqt@nvidia.comSigned-off-by:
-
Frank Li authored
Change mdio.yaml nodename match pattern to '^mdio(-(bus|external))?(@.+|-([0-9]+))$' Fix mdio.yaml wrong parser mdio controller's address instead phy's address when mdio-mux exista. For example: mdio-mux-emi1@54 { compatible = "mdio-mux-mmioreg", "mdio-mux"; mdio@20 { reg = <0x20>; ^^^ This is mdio controller register ethernet-phy@2 { reg = <0x2>; ^^^ This phy's address }; }; }; Only phy's address is limited to 31 because MDIO bus definition. But CHECK_DTBS report below warning: arch/arm64/boot/dts/freescale/fsl-ls1043a-qds.dtb: mdio-mux-emi1@54: mdio@20:reg:0:0: 32 is greater than the maximum of 31 The reason is that "mdio-mux-emi1@54" match "nodename: '^mdio(@.*)?'" in mdio.yaml. Change to '^mdio(-(bus|external))?(@.+|-([0-9]+))?$' to avoid wrong match mdio mux controller's node. Signed-off-by: -
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queueJakub Kicinski authored
Tony Nguyen says: ==================== ice: iavf: add support for TC U32 filters on VFs Ahmed Zaki says: The Intel Ethernet 800 Series is designed with a pipeline that has an on-chip programmable capability called Dynamic Device Personalization (DDP). A DDP package is loaded by the driver during probe time. The DDP package programs functionality in both the parser and switching blocks in the pipeline, allowing dynamic support for new and existing protocols. Once the pipeline is configured, the driver can identify the protocol and apply any HW action in different stages, for example, direct packets to desired hardware queues (flow director), queue groups or drop. Patches 1-8 introduce a DDP package parser API that enables different pipeline stages in the driver to learn the HW parser capabilities from the DDP package that is downloaded to HW. The parser library takes raw packet patterns and masks (in binary) indicating the packet protocol fields to be matched and generates the final HW profiles that can be applied at the required stage. With this API, raw flow filtering for FDIR or RSS could be done on new protocols or headers without any driver or Kernel updates (only need to update the DDP package). These patches were submitted before [1] but were not accepted mainly due to lack of a user. Patches 9-11 extend the virtchnl support to allow the VF to request raw flow director filters. Upon receiving the raw FDIR filter request, the PF driver allocates and runs a parser lib instance and generates the hardware profile definitions required to program the FDIR stage. These were also submitted before [2]. Finally, patches 12 and 13 add TC U32 filter support to the iavf driver. Using the parser API, the ice driver runs the raw patterns sent by the user and then adds a new profile to the FDIR stage associated with the VF's VSI. Refer to examples in patch 13 commit message. [1]: https://lore.kernel.org/netdev/20230904021455.3944605-1-junfeng.guo@intel.com/ [2]: https://lore.kernel.org/intel-wired-lan/20230818064703.154183-1-junfeng.guo@intel.com/ * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: iavf: add support for offloading tc U32 cls filters iavf: refactor add/del FDIR filters ice: enable FDIR filters from raw binary patterns for VFs ice: add method to disable FDIR SWAP option virtchnl: support raw packet in protocol header ice: add API for parser profile initialization ice: add UDP tunnels support to the parser ice: support turning on/off the parser's double vlan mode ice: add parser execution main loop ice: add parser internal helper functions ice: add debugging functions for the parser sections ice: parse and init various DDP parser sections ice: add parser create and destroy skeleton ==================== Link: https://patch.msgid.link/20240813222249.3708070-1-anthony.l.nguyen@intel.comSigned-off-by:
-
Pavan Kumar Linga authored
'req_vec_chunks' is used to store the vector info received from the device control plane. The memory for it is allocated in idpf_send_alloc_vectors_msg and returns an error if the memory allocation fails. 'req_vec_chunks' cannot be NULL in the later code flow. So remove the conditional check to extract the vector ids received from the device control plane. Smatch static checker warning: drivers/net/ethernet/intel/idpf/idpf_lib.c:417 idpf_intr_req() error: we previously assumed 'adapter->req_vec_chunks' could be null (see line 360) Reported-by:
Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/intel-wired-lan/a355ae8a-9011-4a85-a4d1-5b2793bb5f7b@stanley.mountain/Reviewed-by:
Pavan Kumar Linga <pavan.kumar.linga@intel.com> Tested-by:
Krishneil Singh <krishneil.k.singh@intel.com> Signed-off-by:
Tony Nguyen <anthony.l.nguyen@intel.com> Link: https://patch.msgid.link/20240814175903.4166390-1-anthony.l.nguyen@intel.comSigned-off-by:
-
Jakub Kicinski authored
Rosen Penev says: ==================== use more devm for ag71xx Some of these were introduced after the driver got introduced. In any case, using more devm allows removal of the remove function and overall simplifies the code. All of these were tested on a TP-LINK Archer C7v2. ==================== Link: https://patch.msgid.link/20240813170516.7301-1-rosenp@gmail.comSigned-off-by:
-
Rosen Penev authored
Allows completely removing the remove function. Nothing is being done manually now. Tested on TP-LINK Archer C7v2. Signed-off-by:
Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20240813170516.7301-4-rosenp@gmail.comSigned-off-by:
-
Rosen Penev authored
Allows removing ag71xx_mdio_remove. Removed ag.mii_bus variable. Local one can be used with devm. Easier to reason about as mii_bus is only used here now. Also shrinks the struct slightly. Signed-off-by:
-
Rosen Penev authored
Allows removal of clk_prepare_enable to simplify the code slightly. Tested on a TP-LINK Archer C7v2. Signed-off-by:
-
Jakub Kicinski authored
Ido Schimmel says: ==================== selftests: fib_rule_tests: Cleanups and new tests This patchset performs some cleanups and adds new tests in preparation for upcoming FIB rule DSCP selector. ==================== Link: https://patch.msgid.link/20240814111005.955359-1-idosch@nvidia.comSigned-off-by:
-
Ido Schimmel authored
The TOS value reaches the FIB rule core via different call paths when an input route is looked up compared to an output route. Re-test TOS matching with input routes to exercise these code paths. Pass the 'iif' and 'from' selectors separately from the 'get{,no}match' variables as otherwise the test name is too long to be printed without misalignments. Signed-off-by:Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20240814111005.955359-6-idosch@nvidia.comSigned-off-by:
-
Ido Schimmel authored
The fib_rule{4,6}_connect tests verify that locally generated traffic from a socket that specifies a DS Field using the IP_TOS / IPV6_TCLASS socket options is correctly redirected using a FIB rule that matches on the given DS Field. Add negative tests to verify that the FIB rule is not hit when the socket specifies a DS Field that differs from the one used by the FIB rule. Signed-off-by: -
Ido Schimmel authored
The fib_rule{4,6} tests verify the behavior of a given FIB rule selector (e.g., dport, sport) by redirecting to a routing table with a default route using a FIB rule with the given selector and checking that a route lookup using the selector matches this default route. Add negative tests to verify that a FIB rule is not hit when it should not. Signed-off-by: -
Ido Schimmel authored
Clarify the test results by grouping the output of test cases belonging to the same test under a common title. This is consistent with the output of fib_tests.sh. Before: # ./fib_rule_tests.sh TEST: rule6 check: oif redirect to table [ OK ] TEST: rule6 del by pref: oif redirect to table [ OK ] [...] TEST: rule4 check: oif redirect to table [ OK ] TEST: rule4 del by pref: oif redirect to table [ OK ] [...] Tests passed: 116 Tests failed: 0 After: # ./fib_rule_tests.sh IPv6 FIB rule tests TEST: rule6 check: oif redirect to table [ OK ] TEST: rule6 del by pref: oif redirect to table [ OK ] [...] IPv4 FIB rule tests TEST: rule4 check: oif redirect to table [ OK ] TEST: rule4 del by pref: oif redirect to table [ OK ] [...] Tests passed: 116 Tests failed: 0 Signed-off-by: -
Ido Schimmel authored
The functions are unused since commit 816cda9a ("selftests: net: fib_rule_tests: add support to select a test to run"). Remove them. Signed-off-by:
-
Jakub Kicinski authored
Simon Horman says: ==================== ipv6: Add ipv6_addr_{cpu_to_be32,be32_to_cpu} helpers This series adds and uses some new helpers, ipv6_addr_{cpu_to_be32,be32_to_cpu}, which are intended to assist in byte order manipulation of IPv6 addresses stored as as arrays. v1: https://lore.kernel.org/r/20240812-ipv6_addr-helpers-v1-0-aab5d1f35c40@kernel.org ==================== Link: https://patch.msgid.link/20240813-ipv6_addr-helpers-v2-0-5c974f8cca3e@kernel.orgSigned-off-by: -
Simon Horman authored
Use new ipv6_addr_cpu_to_be32 and ipv6_addr_be32_to_cpu helpers, and IPV6_ADDR_WORDS. This is arguably slightly nicer. No functional change intended. Compile tested only. Suggested-by:
Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/netdev/c7684349-535c-45a4-9a74-d47479a50020@lunn.ch/Reviewed-by:
Jijie Shao <shaojijie@huawei.com> Signed-off-by:
-
Simon Horman authored
Use ipv6_addr_cpu_to_be32 and ipv6_addr_be32_to_cpu helpers to convert address, rather than open coding the conversion. No functional change intended. Compile tested only. Suggested-by:
-
Simon Horman authored
Add helpers to convert an ipv6 addr, expressed as an array of words, from CPU to big-endian byte order, and vice versa. No functional change intended. Compile tested only. Suggested-by:
-
Jakub Kicinski authored
Pieter Van Trappen says: ==================== net: dsa: microchip: ksz8795: add Wake on LAN support Add WoL support for KSZ8795 family of switches. This code was tested with a KSZ8794 chip. Strongly based on existing KSZ9477 code which has now been moved to ksz_common instead of duplicating, as proposed during the review of the v1 version of this patch. In addition to the device-tree addition and the actual code, there's two additional patches that fix some bugs found when further testing DSA with this KSZ8794 chip. v5: https://lore.kernel.org/20240812153015.653044-1-vtpieter@gmail.com v4: https://lore.kernel.org/20240812084945.578993-1-vtpieter@gmail.com v3: https://lore.kernel.org/20240806132606.1438953-1-vtpieter@gmail.com v2: https://lore.kernel.org/20240731103403.407818-1-vtpieter@gmail.com v1: https://lore.kernel.org/20240717193725.469192-1-vtpieter@gmail.com ==================== Link: https://patch.msgid.link/20240813142750.772781-1-vtpieter@gmail.comSigned-off-by:
-
Pieter Van Trappen authored
Fix the tag_ksz egress mask for DSA_TAG_PROTO_KSZ8795, the port is encoded in the two and not three LSB. This fix is for completeness, for example the bug doesn't manifest itself on the KSZ8794 because bit 2 seems to be always zero. Signed-off-by:
Pieter Van Trappen <pieter.van.trappen@cern.ch> Acked-by:
Arun Ramadoss <arun.ramadoss@microchip.com> Link: https://patch.msgid.link/20240813142750.772781-7-vtpieter@gmail.comSigned-off-by:
-
Pieter Van Trappen authored
The KSZ87xx switches have 32 static MAC address table entries and not 8. This fixes -ENOSPC non-critical errors from ksz8_add_sta_mac when configured as a bridge. Add a new ksz87xx_dev_ops structure to be able to use the ksz_r_mib_stat64 pointer for this family; this corrects a wrong mib->counters cast to ksz88xx_stats_raw. This fixes iproute2 statistics. Rename ksz8_dev_ops structure to ksz88x3_dev_ops, in line with ksz_is_* naming conventions from ksz_common.h. Signed-off-by:
-
Pieter Van Trappen authored
Add WoL support for KSZ87xx family of switches. This code was tested with a KSZ8794 chip. Implement ksz_common usage of the new device-tree property 'microchip,pme-active-high'. Make use of the now generalized ksz_common WoL functions, adding an additional interrupt register write for KSZ87xx. Add helper functions to convert from PME (port) read/writes to indirect register read/writes in the dedicated ksz8795 sources. Add initial configuration during (port) setup as per KSZ9477. Signed-off-by:
-
Pieter Van Trappen authored
Generalize KSZ9477 WoL functions at ksz_common. Move dedicated registers and generic masks to existing structures & defines for that purpose. Introduction of PME (port) read/write helper functions, which happen to be the generic read/write for KSZ9477 but not for the incoming KSZ87xx patch. Signed-off-by:
-
Pieter Van Trappen authored
Move KSZ9477 WoL functions to ksz_common, in preparation for adding KSZ87xx family support. Signed-off-by:
-
Pieter Van Trappen authored
Add microchip,pme-active-high property to set the PME (Power Management Event) pin polarity for Wake on Lan interrupts. Note that the polarity is active-low by default. Signed-off-by:
Oleksij Rempel <o.rempel@pengutronix.de> Link: https://patch.msgid.link/20240813142750.772781-2-vtpieter@gmail.comSigned-off-by:
-
Oleksij Rempel authored
Introduce cable testing support for the DP83TG720 PHY. This implementation is based on the "DP83TG720S-Q1: Configuring for Open Alliance Specification Compliance (Rev. B)" application note. The feature has been tested with cables of various lengths: - No cable: 1m till open reported. - 5 meter cable: reported properly. - 20 meter cable: reported as 19m. - 40 meter cable: reported as cable ok. Reviewed-by:
-
Oleksij Rempel authored
Introduce helper functions specific to Open Alliance diagnostics, integrating them into the PHY framework. Currently, these helpers are limited to 1000BaseT1 specific TDR functionality. Signed-off-by:
-
