summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * i40e/i40evf: Add TX/RX outer UDP checksum support for X722Anjali Singhai Jain2015-08-067-5/+50
| | | | | | | | | | | | | | | | | | | | | | X722 supports offloading of outer UDP TX and RX checksum for tunneled packets. This patch exposes the support and leaves it enabled by default. Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Tested-by: Jim Young <james.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e/i40evf: Add support for writeback on ITR feature for X722Anjali Singhai Jain2015-08-067-18/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | X722 fixes an issue from X710 where TX descriptor WB would not happen if the interrupts were disabled. In order for the write backs to happen a bit needs to be set in the dynamic interrupt control register called WB_ON_ITR. With this feature, the SW driver need not arm SW interrupts to work around the issue in X710. Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Tested-by: Jim Young <james.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e/i40evf: RSS changes for X722Anjali Singhai Jain2015-08-069-89/+307
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | X722 uses the admin queue to configure RSS. This patch adds the necessary flow changes to configure RSS through AQ. It also adds the separate VMDQ2 lookup tables and hash key programming for X722. X722 also exposes a different set of PCTYPES for RSS, this patch accommodates those changes. Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Signed-off-by: Mitch Williams <mitch.a.williams@intel.com> Tested-by: Jim Young <james.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e/i40evf: Update register.h file for X722Anjali Singhai Jain2015-08-062-2/+1991
| | | | | | | | | | | | | | | | | | Update the i40e and i40evf register.h file with the registers for X722. Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Tested-by: Jim Young <james.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e/i40evf: Update FW API with X722 supportAnjali Singhai Jain2015-08-066-1/+444
| | | | | | | | | | | | | | | | | | This patch does the firmware API update to support the new X722 device. Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Tested-by: Jim Young <james.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e/i40evf: Add flags for X722 capabilitiesAnjali Singhai Jain2015-08-063-1/+21
| | | | | | | | | | | | | | | | | | Add capabilities flags specific to X722. Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Tested-by: Jim Young <james.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
| * i40e/i40evf: Add device ids for X722Anjali Singhai Jain2015-08-066-2/+41
| | | | | | | | | | | | | | | | | | Adding device ids for new hardware X722 Signed-off-by: Anjali Singhai Jain <anjali.singhai@intel.com> Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Tested-by: Jim Young <james.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
* | net_dbg_ratelimited: turn into no-op when !DEBUGJason A. Donenfeld2015-08-071-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pr_debug family of functions turns into a no-op when -DDEBUG is not specified, opting instead to call "no_printk", which gets compiled to a no-op (but retains gcc's nice warnings about printf-style arguments). The problem with net_dbg_ratelimited is that it is defined to be a variant of net_ratelimited_function, which expands to essentially: if (net_ratelimit()) pr_debug(fmt, ...); When DEBUG is not defined, then this becomes, if (net_ratelimit()) ; This seems benign, except it isn't. Firstly, there's the obvious overhead of calling net_ratelimit needlessly, which does quite some book keeping for the rate limiting. Given that the pr_debug and net_dbg_ratelimited family of functions are sprinkled liberally through performance critical code, with developers assuming they'll be compiled out to a no-op most of the time, we certainly do not want this needless book keeping. Secondly, and most visibly, even though no debug message is printed when DEBUG is not defined, if there is a flood of invocations, dmesg winds up peppered with messages such as "net_ratelimit: 320 callbacks suppressed". This is because our aforementioned net_ratelimit() function actually prints this text in some circumstances. It's especially odd to see this when there isn't any other accompanying debug message. So, in sum, it doesn't make sense to have this function's current behavior, and instead it should match what every other debug family of functions in the kernel does with !DEBUG -- nothing. This patch replaces calls to net_dbg_ratelimited when !DEBUG with no_printk, keeping with the idiom of all the other debug print helpers. Also, though not strictly neccessary, it guards the call with an if (0) so that all evaluation of any arguments are sure to be compiled out. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | af_mpls: add null dev check in find_outdevRoopa Prabhu2015-08-071-0/+3
| | | | | | | | | | | | | | | | | | This patch adds null dev check for the 'cfg->rc_via_table == NEIGH_LINK_TABLE or dev_get_by_index() failed' case Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'test-bpf-next'David S. Miller2015-08-071-1/+710
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Nicolas Schichan says: ==================== test_bpf improvements Please find below the patch series with my latest changes to test_bpf. The first patch checks for unexpected NULL generated skbs before running the filter. The second patch adds the possibility for tests to generate fragmented skbs. The third patch tests LD_ABS and LD_IND on fragmented skbs. The fourth patch adds the possibility to restrict the tests being run by specifying the name/id/range of the test(s) to run via module parameters. The fifth patch tests LD_ABS and LD_IND on non fragmented skbs with various sizes and alignments. The sixth and final patch checks that the interpreter or JIT correctly resets A and X to 0. This serie is against today's net-next tree. Changes in V2: * move declaration of 'ptr' in if() block in patch 2/6. * fix various typos in patch 4/6 * rework default init of test_range array and cleanup exclude_test() return condition in patch 4/6. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * | test_bpf: add tests checking that JIT/interpreter sets A and X to 0.Nicolas Schichan2015-08-071-0/+158
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is mandatory for the JIT or interpreter to reset the A and X registers to 0 before running the filter. Check that it is the case on various ALU and JMP instructions. Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | test_bpf: add more tests for LD_ABS and LD_IND.Nicolas Schichan2015-08-071-0/+296
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This exerces the LD_ABS and LD_IND instructions for various sizes and alignments. This also checks that X when used as an offset to a BPF_IND instruction first in a filter is correctly set to 0. Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | test_bpf: add module parameters to filter the tests to run.Nicolas Schichan2015-08-071-0/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When developping on the interpreter or a particular JIT, it can be interesting to restrict the tests list to a specific test or a particular range of tests. This patch adds the following module parameters to the test_bpf module: * test_name=<string>: only the specified named test will be run. * test_id=<number>: only the test with the specified id will be run (see the output of test_bpf without parameters to get the test id). * test_range=<number>,<number>: only the tests within IDs in the specified id range are run (see the output of test_bpf without parameters to get the test ids). Any invalid range, test id or test name will result in -EINVAL being returned and no tests being run. Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | test_bpf: test LD_ABS and LD_IND instructions on fragmented skbs.Nicolas Schichan2015-08-071-0/+142
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These new tests exercise various load sizes and offsets crossing the head/fragment boundary. Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | test_bpf: allow tests to specify an skb fragment.Nicolas Schichan2015-08-071-1/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This introduce a new test->aux flag (FLAG_SKB_FRAG) to tell the populate_skb() function to add a fragment to the test skb containing the data specified in test->frag_data). Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | test_bpf: avoid oopsing the kernel when generate_test_data() fails.Nicolas Schichan2015-08-071-0/+5
|/ / | | | | | | | | | | | | Signed-off-by: Nicolas Schichan <nschichan@freebox.fr> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'mlx5e-next'David S. Miller2015-08-079-348/+675
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Amir Vadai says: ==================== net/mlx5e: Driver updates 04-Aug-2015 This patchset introduces two features to the ConnectX-4 driver: Patch 8/8 ("Support physical port counters") exposes some hardware counters through ethtool. Rest of the patches are preparation and usage of what we call light-weight netdev open/close. Some flows that used to be in the ndo_open/stop are moved to the PCI probe/remove flows - i.e. we will make the netdev open/close operations more "light-weight". The benefits of this change are: 1) Reduce the execution time of the stop/open operations. 2) Avoid saving SW shadows of resource configurations that must persist through stop/open operations (e.g flow table steering rules), and avoid deleting/applying them from/to the device upon netdev stop/open. 3) Avoid synchronizing threads that access those resources with the netdev stop/open threads. Instead of create/destroy the resource during netdev open/stop, This patchset changes the behavior such that upon netdev stop, traffic is redirected to a "Drop RQ" (a RQ that silently drops, at the NIC HW level all incoming traffic). After redirecting the traffic, RX/TX software resources could be destroyed. During netdev open, the RX/TX rings are created and traffic is redirected to the RX rings. Patchset was applied and tested over commit ba7591d ("ebpf: add skb->hash to offset map for usage in {cls, act}_bpf or filters") ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net/mlx5_core: Support physical port countersGal Pressman2015-08-075-1/+137
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added physical port counters in the following standard formats to ethtool statistics: - IEEE 802.3 - RFC2863 - RFC2819 Signed-off-by: Gal Pressman <galp@mellanox.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net/mlx5e: Take advantage of the light-weight netdev open/stopAchiad Shochat2015-08-073-106/+32Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that TIRs, TISs and flow tables are kept alive while the netdev is stopped (after executing ndo_stop()) we can do the following improvements: - Obsolete the active_vlans SW shadow. - Do not delete/add flow table rules upon ndo_stop/open. In addition to simplifying the flow, this change also fastens the ndo_open/close operations. - Obsolete synchronization of threads accessing the flow tables with the netdev stop/open threads. Signed-off-by: Achiad Shochat <achiad@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net/mlx5e: Disable async events before unregister_netdev()Achiad Shochat2015-08-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | It does not make sense to allow events while the netdev is unregistered. Signed-off-by: Achiad Shochat <achiad@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net/mlx5e: Rename/move functions following the ndo_stop flow changeAchiad Shochat2015-08-073-308/+306Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rename some functions that used to be invoked upon ndo_open/stop and are now invoked upon create/destroy_netdev() in order to better hint their place in the flow. Change some functions location in the file so that functions involved in ndo_open/stop flow will not be interleaved with other functions. This is a cosmetic change, no logical change here. Signed-off-by: Achiad Shochat <achiad@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net/mlx5e: Light-weight netdev open/stopAchiad Shochat2015-08-074-76/+184
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Create/destroy TIRs, TISs and flow tables upon PCI probe/remove rather than upon the netdev ndo_open/stop. Upon ndo_stop(), redirect all RX traffic to the (lately introduced) "Drop RQ" and then close only the RX/TX rings, leaving the TIRs, TISs and flow tables alive. Signed-off-by: Achiad Shochat <achiad@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net/mlx5_core: Introduce access function to modify RSS/LRO paramsAchiad Shochat2015-08-073-1/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To be used by the mlx5 Eth driver in following commit. This is in preparation for netdev "light-weight" open/stop flow change described in previous commit. Signed-off-by: Achiad Shochat <achiad@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net/mlx5e: Introduce the "Drop RQ"Achiad Shochat2015-08-072-11/+114
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RX traffic routed to this RQ will be silently dropped, at the NIC HW level. This is in preparation for netdev "light-weight" open/stop flow change described in previous commit. Signed-off-by: Achiad Shochat <achiad@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | net/mlx5e: Unify the RX flowAchiad Shochat2015-08-072-34/+69
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Generally an RX packet flows through the following objects: Flow table --> TIR --> RQT --> RQ Where: - TIR stands for "Transport Interface Receive", defining the RSS and LRO paramaters. - RQT stands for "RQ Table", implementing the RSS indirection table. - RQ stands for "Receive Queue" For flows that do not need LRO, nor RSS, the driver made a shortcut to the above RX flow by pointing to the RQ directly from the TIR, yielding this flow: Flow table --> TIR --> RQ In this commit we remove this shortcut by "inserting" a single-RQ RQT between the TIR and the RQ, i.e RX packets will reach the same RQ but will go through an RQT of size 1, pointing to just a single RQ. This way the RX traffic re-direction to/from the "Drop RQ" will be more uniform (AKA "one flow"), as it will involve only RQTs re-direction and no TIRs re-direction. Signed-off-by: Achiad Shochat <achiad@mellanox.com> Signed-off-by: Amir Vadai <amirv@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'cpsw-next'David S. Miller2015-08-071-48/+35Star
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mugunthan V N says: ==================== CPSW interrupt handling cleanup and performance improvement This patch series removes the irq controller disable interrupt and adding a napi for tx event handling which improves the performance by ~180Mbps on dra7-evm [ 5] local 192.168.10.116 port 5001 connected with 192.168.10.165 port 44176 [ 5] 0.0-60.0 sec 1.48 GBytes 210 Mbits/sec [ 4] local 192.168.10.116 port 5001 connected with 192.168.10.165 port 33257 [ 4] 0.0-60.0 sec 2.71 GBytes 386 Mbits/sec Changes from initial version: * Added a patch to have napi only for first interface as there is no use of having seperate napis for each interface as the interrupt is shared by both interface and only one napi is scheduled for each interrupt. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * | drivers: net: cpsw: add separate napi for txMugunthan V N2015-08-071-13/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of processing tx events in isr adding separate napi for tx which improves performance by ~180Mbps with omap2plus_defconfig on DRA74x platform. Also cleaning up rx napis by renaming to napi_rx for better understanding the code. Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | drivers: net: cpsw: dual_emac: simplify napi usageMugunthan V N2015-08-071-17/+9Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since interrupt is shared between the two ethernet interface and in isr only one napi is scheduled at an instance so having two napis doesn't make any difference. So making napi also as a common resource for the dual ethernet interfaces. Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | drivers: net: cpsw: remove disable_irq/enable_irq as irq can be masked from ↵Mugunthan V N2015-08-071-25/+2Star
|/ / | | | | | | | | | | | | | | | | | | | | | | | | cpsw itself CPSW interrupts can be disabled by masking CPSW interrupts and clearing interrupt by writing appropriate EOI. So removing all disable_irq/enable_irq as discussed in [1] [1] http://patchwork.ozlabs.org/patch/492741/ Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | mpls: small cleanup in inet/inet6_fib_lookup_dev()Dan Carpenter2015-08-071-9/+4Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We recently changed this code from returning NULL to returning ERR_PTR. There are some left over NULL assignments which we can remove. We can preserve the error code from ip_route_output() instead of always returning -ENODEV. Also these functions use a mix of gotos and direct returns. There is no cleanup necessary so I changed the gotos to direct returns. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com> Acked-by: Robert Shearman <rshearma@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | Merge branch 'bnx2x-cnic-bnx2fc-bd-support'David S. Miller2015-08-077-7/+236
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Yuval Mintz says: ==================== bnx2x, cnic, bnx2fc: add support for BD Commit 230d00eb4bfe ("bnx2x: new Multi-function mode - BD") added support for a new multi-function mode, but it added only the support required by bnx2x for L2 interfaces. This adds the required changes to support the new multi-function mode in the offloaded storage protocols. Dave, Please consider applying this series to `net-next'. Do notice that this involves non-networking driver changes - but sending this as a single series seemed like the best approach as we had to have bnx2x changes to support the new functionality. If this is problematic, please tell us what's the preferred solution here. Changes from previous versions ------------------------------ - From v1 - no actual changes; v1 failed to reach netdev so in order to keep things in line I've termed this one v2. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * | bnx2fc: Read npiv table from nvram and create vports.Joe Carnuccio2015-08-071-0/+66
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Joe Carnuccio <joe.carnuccio@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | bnx2x: Add BD support for storageYuval Mintz2015-08-074-2/+118
| | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 230d00eb4bfe ("bnx2x: new Multi-function mode - BD") adds support for the new mode in bnx2x. This expands this support by implementing APIs required by our storage drivers to support that mode. Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | cnic: Add the interfaces to get FC-NPIV table.Adheer Chandravanshi2015-08-072-2/+32
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Adheer Chandravanshi <adheer.chandravanshi@qlogic.com> Signed-off-by: Chad Dupuis <chad.dupuis@qlogic.com> Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
| * | cnic: Populate upper layer driver state in MFWTej Parkash2015-08-072-3/+20
|/ / | | | | | | | | | | Signed-off-by: Tej Parkash <tej.parkash@qlogic.com> Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | rocker: use netdev_err after register_netdevScott Feldman2015-08-071-1/+1
| | | | | | | | | | | | | | | | After successful register_netdev, we can use netdev_err rather the more generic dev_err. Signed-off-by: Scott Feldman <sfeldma@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* | rocker: NULL port if port probe failsScott Feldman2015-08-071-0/+1
|/ | | | | | | | Set port to NULL if port probe fails so we don't try to remove partially initialized port on port probe err cleanup path. Signed-off-by: Scott Feldman <sfeldma@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-nextDavid S. Miller2015-08-0524-217/+461
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next, they are: 1) A couple of cleanups for the netfilter core hook from Eric Biederman. 2) Net namespace hook registration, also from Eric. This adds a dependency with the rtnl_lock. This should be fine by now but we have to keep an eye on this because if we ever get the per-subsys nfnl_lock before rtnl we have may problems in the future. But we have room to remove this in the future by propagating the complexity to the clients, by registering hooks for the init netns functions. 3) Update nf_tables to use the new net namespace hook infrastructure, also from Eric. 4) Three patches to refine and to address problems from the new net namespace hook infrastructure. 5) Switch to alternate jumpstack in xtables iff the packet is reentering. This only applies to a very special case, the TEE target, but Eric Dumazet reports that this is slowing down things for everyone else. So let's only switch to the alternate jumpstack if the tee target is in used through a static key. This batch also comes with offline precalculation of the jumpstack based on the callchain depth. From Florian Westphal. 6) Minimal SCTP multihoming support for our conntrack helper, from Michal Kubecek. 7) Reduce nf_bridge_info per skbuff scratchpad area to 32 bytes, from Florian Westphal. 8) Fix several checkpatch errors in bridge netfilter, from Bernhard Thaler. 9) Get rid of useless debug message in ip6t_REJECT, from Subash Abhinov. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
| * netfilter: ip6t_REJECT: Remove debug messages from reject_tg6()Subash Abhinov Kasiviswanathan2015-08-041-5/+0Star
| | | | | | | | | | | | | | | | Make it similar to reject_tg() in ipt_REJECT. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: bridge: do not initialize statics to 0 or NULLBernhard Thaler2015-07-301-3/+3
| | | | | | | | | | | | | | | | Fix checkpatch.pl "ERROR: do not initialise statics to 0 or NULL" for all statics explicitly initialized to 0. Signed-off-by: Bernhard Thaler <bernhard.thaler@wvnet.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: bridge: reduce nf_bridge_info to 32 bytes againFlorian Westphal2015-07-306-28/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | We can use union for most of the temporary cruft (original ipv4/ipv6 address, source mac, physoutdev) since they're used during different stages of br netfilter traversal. Also get rid of the last two ->mask users. Shrinks struct from 48 to 32 on 64bit arch. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: nf_ct_sctp: minimal multihoming supportMichal Kubeček2015-07-303-24/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently nf_conntrack_proto_sctp module handles only packets between primary addresses used to establish the connection. Any packets between secondary addresses are classified as invalid so that usual firewall configurations drop them. Allowing HEARTBEAT and HEARTBEAT-ACK chunks to establish a new conntrack would allow traffic between secondary addresses to pass through. A more sophisticated solution based on the addresses advertised in the initial handshake (and possibly also later dynamic address addition and removal) would be much harder to implement. Moreover, in general we cannot assume to always see the initial handshake as it can be routed through a different path. The patch adds two new conntrack states: SCTP_CONNTRACK_HEARTBEAT_SENT - a HEARTBEAT chunk seen but not acked SCTP_CONNTRACK_HEARTBEAT_ACKED - a HEARTBEAT acked by HEARTBEAT-ACK State transition rules: - HEARTBEAT_SENT responds to usual chunks the same way as NONE (so that the behaviour changes as little as possible) - HEARTBEAT_ACKED responds to usual chunks the same way as ESTABLISHED does, except the resulting state is HEARTBEAT_ACKED rather than ESTABLISHED - previously existing states except NONE are preserved when HEARTBEAT or HEARTBEAT-ACK is seen - NONE (in the initial direction) changes to HEARTBEAT_SENT on HEARTBEAT and to CLOSED on HEARTBEAT-ACK - HEARTBEAT_SENT changes to HEARTBEAT_ACKED on HEARTBEAT-ACK in the reply direction - HEARTBEAT_SENT and HEARTBEAT_ACKED are preserved on HEARTBEAT and HEARTBEAT-ACK otherwise Normally, vtag is set from the INIT chunk for the reply direction and from the INIT-ACK chunk for the originating direction (i.e. each of these defines vtag value for the opposite direction). For secondary conntracks, we can't rely on seeing INIT/INIT-ACK and even if we have seen them, we would need to connect two different conntracks. Therefore simplified logic is applied: vtag of first packet in each direction (HEARTBEAT in the originating and HEARTBEAT-ACK in reply direction) is saved and all following packets in that direction are compared with this saved value. While INIT and INIT-ACK define vtag for the opposite direction, vtags extracted from HEARTBEAT and HEARTBEAT-ACK are always for their direction. Default timeout values for new states are HEARTBEAT_SENT: 30 seconds (default hb_interval) HEARTBEAT_ACKED: 210 seconds (hb_interval * path_max_retry + max_rto) (We cannot expect to see the shutdown sequence so that, unlike ESTABLISHED, the HEARTBEAT_ACKED timeout shouldn't be too long.) Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: rename local nf_hook_list to hook_listPablo Neira Ayuso2015-07-232-21/+21
| | | | | | | | | | | | | | | | 085db2c04557 ("netfilter: Per network namespace netfilter hooks.") introduced a new nf_hook_list that is global, so let's avoid this overlap. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
| * netfilter: fix possible removal of wrong hookPablo Neira Ayuso2015-07-231-22/+19Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | nf_unregister_net_hook() uses the nf_hook_ops fields as tuple to look up for the corresponding hook in the list. However, we may have two hooks with exactly the same configuration. This shouldn't be a problem for nftables since every new chain has an unique priv field set, but this may still cause us problems in the future, so better address this problem now by keeping a reference to the original nf_hook_ops structure to make sure we delete the right hook from nf_unregister_net_hook(). Fixes: 085db2c04557 ("netfilter: Per network namespace netfilter hooks.") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
| * netfilter: nf_queue: fix nf_queue_nf_hook_drop()Pablo Neira Ayuso2015-07-233-11/+5Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This function reacquires the rtnl_lock() which is already held by nf_unregister_hook(). This can be triggered via: modprobe nf_conntrack_ipv4 && rmmod nf_conntrack_ipv4 [ 720.628746] INFO: task rmmod:3578 blocked for more than 120 seconds. [ 720.628749] Not tainted 4.2.0-rc2+ #113 [ 720.628752] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 720.628754] rmmod D ffff8800ca46fd58 0 3578 3571 0x00000080 [...] [ 720.628783] Call Trace: [ 720.628790] [<ffffffff8152ea0b>] schedule+0x6b/0x90 [ 720.628795] [<ffffffff8152ecb3>] schedule_preempt_disabled+0x13/0x20 [ 720.628799] [<ffffffff8152ff55>] mutex_lock_nested+0x1f5/0x380 [ 720.628803] [<ffffffff81462622>] ? rtnl_lock+0x12/0x20 [ 720.628807] [<ffffffff81462622>] ? rtnl_lock+0x12/0x20 [ 720.628812] [<ffffffff81462622>] rtnl_lock+0x12/0x20 [ 720.628817] [<ffffffff8148ab25>] nf_queue_nf_hook_drop+0x15/0x160 [ 720.628825] [<ffffffff81488d48>] nf_unregister_net_hook+0x168/0x190 [ 720.628831] [<ffffffff81488e24>] nf_unregister_hook+0x64/0x80 [ 720.628837] [<ffffffff81488e60>] nf_unregister_hooks+0x20/0x30 [...] Moreover, nf_unregister_net_hook() should only destroy the queue for this netns, not for every netns. Reported-by: Fengguang Wu <fengguang.wu@intel.com> Fixes: 085db2c04557 ("netfilter: Per network namespace netfilter hooks.") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
| * netfilter: Fix memory leak in nf_register_net_hookEric W. Biederman2015-07-201-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the rare case that when it is a attempted to use a per network device netfilter hook and the network device does not exist the newly allocated structure can leak. Be a good citizen and free the newly allocated structure in the error handling code. Fixes: 085db2c04557 ("netfilter: Per network namespace netfilter hooks.") Reported-by: kbuild@01.org Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: xtables: remove __pure annotationFlorian Westphal2015-07-153-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | sparse complains: ip_tables.c:361:27: warning: incorrect type in assignment (different modifiers) ip_tables.c:361:27: expected struct ipt_entry *[assigned] e ip_tables.c:361:27: got struct ipt_entry [pure] * doesn't change generated code. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: add and use jump label for xt_teeFlorian Westphal2015-07-155-2/+16
| | | | | | | | | | | | | | | | | | Don't bother testing if we need to switch to alternate stack unless TEE target is used. Suggested-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: xtables: don't save/restore jumpstack offsetFlorian Westphal2015-07-155-49/+48Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In most cases there is no reentrancy into ip/ip6tables. For skbs sent by REJECT or SYNPROXY targets, there is one level of reentrancy, but its not relevant as those targets issue an absolute verdict, i.e. the jumpstack can be clobbered since its not used after the target issues absolute verdict (ACCEPT, DROP, STOLEN, etc). So the only special case where it is relevant is the TEE target, which returns XT_CONTINUE. This patch changes ip(6)_do_table to always use the jump stack starting from 0. When we detect we're operating on an skb sent via TEE (percpu nf_skb_duplicated is 1) we switch to an alternate stack to leave the original one alone. Since there is no TEE support for arptables, it doesn't need to test if tee is active. The jump stack overflow tests are no longer needed as well -- since ->stacksize is the largest call depth we cannot exceed it. A much better alternative to the external jumpstack would be to just declare a jumps[32] stack on the local stack frame, but that would mean we'd have to reject iptables rulesets that used to work before. Another alternative would be to start rejecting rulesets with a larger call depth, e.g. 1000 -- in this case it would be feasible to allocate the entire stack in the percpu area which would avoid one dereference. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * netfilter: move tee_active to coreFlorian Westphal2015-07-153-7/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | This prepares for a TEE like expression in nftables. We want to ensure only one duplicate is sent, so both will use the same percpu variable to detect duplication. The other use case is detection of recursive call to xtables, but since we don't want dependency from nft to xtables core its put into core.c instead of the x_tables core. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-09 14:57:12 +0200