- 09 Feb, 2024 26 commits
-
-
Jinjian Song authored
Add support for userspace to get/set the device mode, device's state machine changes between (unknown/ready/reset/fastboot). Get the device state mode: - 'cat /sys/bus/pci/devices/${bdf}/t7xx_mode' Set the device state mode: - reset(cold reset): 'echo reset > /sys/bus/pci/devices/${bdf}/t7xx_mode' - fastboot: 'echo fastboot_switching > /sys/bus/pci/devices/${bdf}/t7xx_mode' Reload driver to get the new device state after setting operation. Signed-off-by:Jinjian Song <jinjian.song@fibocom.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Jinjian Song authored
Add a new WWAN port that connects to the device fastboot protocol interface. Signed-off-by:
-
David S. Miller authored
Matthew Wood says: ==================== netconsole: Add userdata append support Add the ability to add custom userdata to every outbound netconsole message as a collection of key/value pairs, allowing users to add metadata to every netconsole message which can be used for for tagging, filtering, and aggregating log messages. In a previous patch series the ability to prepend the uname release was added towards the goals above. This patch series builds on that idea to allow any userdata, keyed by a user provided name, to be included in netconsole messages. If CONFIG_NETCONSOLE_DYNAMIC is enabled an additional userdata directory will be presented in the netconsole configfs tree, allowing the addition of userdata entries. /sys/kernel/config/netconsole/ <target>/ enabled release dev_name local_port remote_port local_ip remote_ip local_mac remote_mac userdata/ <key>/ value <key>/ value ... v1->v2: * Updated netconsole_target docs, kdoc is now clean v2->v3: * Remove inline keyword from to_userdat* functions * Break up some lines that exceeded 80 chars * Replace typos and remove {} from single line if statement * Remove unused variable Testing for this series is as follows: Build every patch without CONFIG_NETCONSOLE_DYNAMIC, and also built with CONFIG_NETCONSOLE_DYNAMIC enabled for every patch after the config option was added Test Userdata configfs # Adding userdata cd /sys/kernel/config/netconsole/ && mkdir cmdline0 && cd cmdline0 mkdir userdata/release && echo hotfix1 > userdata/release/value preview=$(for f in `ls userdata`; do echo $f=$(cat userdata/$f/value); done) [[ "$preview" == $'release=hotfix1' ]] && echo pass || echo fail mkdir userdata/testing && echo something > userdata/testing/value preview=$(for f in `ls userdata`; do echo $f=$(cat userdata/$f/value); done) [[ "$preview" == $'release=hotfix1\ntesting=something' ]] && echo pass || echo fail # # Removing Userdata rmdir userdata/testing preview=$(for f in `ls userdata`; do echo $f=$(cat userdata/$f/value); done) [[ "$preview" == $'release=hotfix1' ]] && echo pass || echo fail rmdir userdata/release preview=$(for f in `ls userdata`; do echo $f=$(cat userdata/$f/value); done) [[ "$preview" == $'' ]] && echo pass || echo fail # # Adding userdata key with too large of 6.7.0-rc8-virtme,12,481,17954104,-directory name [<54 chars] mkdir userdata/testing12345678901234567890123456789012345678901234567890 [[ $? == 1 ]] && echo pass || echo fail # # Adding userdata value with too large of value [<200 chars] mkdir userdata/testing echo `for i in {1..201};do printf "%s" "v";done` > userdata/testing/value [[ $? == 1 ]] && echo pass || echo fail rmdir userdata/testing - Output: pass pass pass pass pass mkdir: cannot create directory ‘cmdline0/userdata/testing12345678901234567890123456789012345678901234567890’: File name too long pass bash: echo: write error: Message too long pass Test netconsole messages (w/ msg fragmentation) echo `for i in {1..996};do printf "%s" "v";done` > /dev/kmsg - Output: 6.7.0-rc8-virtme,12,484,84321212,-,ncfrag=0/997;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv6.7.0-rc8-virtme,12,484,84321212,-,ncfrag=952/997;vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv Test empty userdatum cd /sys/kernel/config/netconsole/ && mkdir cmdline0 mkdir cmdline0/userdata/empty echo test > /dev/kmsg rmdir cmdline0/userdata/empty - Output: Test netconsole messages (w/o userdata fragmentation) cd /sys/kernel/config/netconsole/ && mkdir cmdline0 mkdir cmdline0/userdata/release && echo hotfix1 > cmdline0/userdata/release/value mkdir cmdline0/userdata/testing && echo something > cmdline0/userdata/testing/value echo test > /dev/kmsg rmdir cmdline0/userdata/release rmdir cmdline0/userdata/testing ==================== Signed-off-by: -
Matthew Wood authored
Regardless of whether the original message body or formatted userdata exceeds the MAX_PRINT_CHUNK, append userdata to the netconsole message starting with the first chunk that has available space after writing the body. Co-developed-by:
Breno Leitao <leitao@debian.org> Signed-off-by:
Matthew Wood <thepacketgeek@gmail.com> Signed-off-by:
-
Matthew Wood authored
Append userdata to outgoing unfragmented (<1000 bytes) netconsole messages. When sending messages the userdata string is already formatted and stored in netconsole_target->userdata_complete. Always write the outgoing message to buf, so userdata can be appended in a standard fashion. This is a change from only using buf when the release needs to be prepended to the message. Co-developed-by:
-
Matthew Wood authored
Store a formatted string for userdata that will be appended to netconsole messages. The string has a capacity of 4KB, as calculated by the userdatum entry length of 256 bytes and a max of 16 userdata entries. Update the stored netconsole_target->userdata_complete string with the new formatted userdata values when a userdatum is created, edited, or removed. Each userdata entry contains a trailing newline, which will be formatted as such in netconsole messages:: 6.7.0-rc8-virtme,12,500,1646292204,-;test release=foo something=bar 6.7.0-rc8-virtme,12,500,1646292204,-;another test release=foo something=bar Enforcement of MAX_USERDATA_ITEMS is done in userdatum_make_item; update_userdata will not check for this case but will skip any userdata children over the limit of MAX_USERDATA_ITEMs. If a userdata entry/dir is created but no value is provided, that entry will be skipped. This is in part because update_userdata() can't be called in userdatum_make_item() since the item will not have been added to the userdata config_group children yet. To preserve the experience of adding an empty userdata that doesn't show up in the netconsole messages, purposefully skip empty userdata items even when update_userdata() can be called. Co-developed-by: -
Matthew Wood authored
Create configfs machinery for netconsole userdata appending, which depends on CONFIG_NETCONSOLE_DYNAMIC (for configfs interface). Add a userdata config_group to netconsole_target for managing userdata entries as a tree under the netconsole configfs subsystem. Directory names created under the userdata directory become userdatum keys; the userdatum value is the content of the value file. Include the minimum-viable-changes for userdata configfs config_group. init_target_config_group() ties in the complete configfs machinery to avoid unused func/variable errors during build. Initializing the netconsole_target->group is moved to init_target_config_group, which will also init and add the userdata config_group. Each userdatum entry has a limit of 256 bytes (54 for the key/directory, 200 for the value, and 2 for '=' and '\n' characters), which is enforced by the configfs functions for updating the userdata config_group. When a new netconsole_target is created, initialize the userdata config_group and add it as a default group for netconsole_target config_group, allowing the userdata configfs sub-tree to be presented in the netconsole configfs tree under the userdata directory. Co-developed-by:
-
Matthew Wood authored
Add a new User Data section to the netconsole docs to describe the appending of user data capability (for netconsole dynamic configuration) with usage and netconsole output examples. Co-developed-by:
-
Matthew Wood authored
Move newline trimming logic from `dev_name_store()` to a new function (trim_newline()) for shared use in netconsole.c Signed-off-by:
-
Matthew Wood authored
In order to support a nested userdata config_group in later patches, use a config_group for netconsole_target instead of a config_item. It's a no-op functionality-wise, since config_group maintains all features of a config_item via the cg_item member. Signed-off-by:
-
Matthew Wood authored
Address checkpatch lint suggestions in preparation for later changes Signed-off-by:
-
Eric Dumazet authored
for_each_netdev_dump() can be used with RCU protection, no need for rtnl if we are going to use dev_hold()/dev_put(). Signed-off-by:
Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20240207153514.3640952-1-edumazet@google.comSigned-off-by:
Jakub Kicinski <kuba@kernel.org>
-
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queueJakub Kicinski authored
Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2024-02-06 (ixgbe) This series contains updates to ixgbe driver only. Jedrzej continues cleanup work from conversion away from ixgbe_status; s32 values are changed to int, various style issues are addressed, and some return statements refactored to address some smatch warnings. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixgbe: Clarify the values of the returning status ixgbe: Rearrange args to fix reverse Christmas tree ixgbe: Convert ret val type from s32 to int ==================== Link: https://lore.kernel.org/r/20240206214054.1002919-1-anthony.l.nguyen@intel.comSigned-off-by:
-
Jakub Kicinski authored
Biju Das says: ==================== Add HW checksum offload support for RZ/G2L GbEthernet IP This patch series aims to add HW checksum offload supported by TOE module found on the RZ/G2L Gb ethernet IP. TOE has hardware support for calculating IP header and TCP/UDP/ICMP checksum for both IPv4 and IPv6. For Rx, the 4-byte result of checksum calculation is attached to the Ethernet frames.First 2-bytes is result of IPv4 header checksum and next 2-bytes is TCP/UDP/ICMP checksum. If a frame does not have checksum error, 0x0000 is attached as checksum calculation result. For unsupported frames 0xFFFF is attached as checksum calculation result. In case of an IPv6 packet, IPv4 checksum is always set to 0xFFFF. For Tx, the result of checksum calculation is set to the checksum field of each IPv4 Header/TCP/UDP/ICMP of ethernet frames. For the unsupported frames, those fields are not changed. If a transmission frame is an UDPv4 frame and its checksum value in the UDP header field is 0x0000, TOE does not calculate checksum for UDP part of this frame as it is optional function as per standards. Add Tx/Rx checksum offload supported by TOE for IPv4 and TCP/UDP protocols. Results of iperf3 in Mbps RZ/V2L: TCP(Tx/Rx) results with checksum offload Enabled: {921,932} TCP(Tx/Rx) results with checksum offload Disabled: {867,612} UDP(Tx/Rx) results with checksum offload Enabled: {950,946} UDP(Tx/Rx) results with checksum offload Disabled: {952,920} RZ/G2L: TCP(Tx/Rx) results with checksum offload Enabled: {920,936} TCP(Tx/Rx) results with checksum offload Disabled: {871,626} UDP(Tx/Rx) results with checksum offload Enabled: {953,950} UDP(Tx/Rx) results with checksum offload Disabled: {954,920} RZ/G2LC: TCP(Tx/Rx) results with checksum offload Enabled: {927,936} TCP(Tx/Rx) results with checksum offload Disabled: {889,626} UDP(Tx/Rx) results with checksum offload Enabled: {950,946} UDP(Tx/Rx) results with checksum offload Disabled: {949,944} ==================== Link: https://lore.kernel.org/r/20240207092838.160627-1-biju.das.jz@bp.renesas.comSigned-off-by: -
Biju Das authored
TOE has hardware support for calculating IP header and TCP/UDP/ICMP checksum for both IPv4 and IPv6. Add Tx checksum offload supported by TOE for IPv4 and TCP/UDP. For Tx, the result of checksum calculation is set to the checksum field of each IPv4 Header/TCP/UDP/ICMP of ethernet frames. For the unsupported frames, those fields are not changed. If a transmission frame is an UDPv4 frame and its checksum value in the UDP header field is 0x0000, TOE does not calculate checksum for UDP part of this frame as it is optional function as per standards. We can test this functionality by the below commands ethtool -K eth0 tx on --> to turn on Tx checksum offload ethtool -K eth0 tx off --> to turn off Tx checksum offload Signed-off-by:
Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by:
Sergey Shtylyov <s.shtylyov@omp.ru> Link: https://lore.kernel.org/r/20240207092838.160627-3-biju.das.jz@bp.renesas.comSigned-off-by:
-
Biju Das authored
TOE has hardware support for calculating IP header and TCP/UDP/ICMP checksum for both IPv4 and IPv6. Add Rx checksum offload supported by TOE for IPv4 and TCP/UDP protocols. For Rx, the 4-byte result of checksum calculation is attached to the Ethernet frames.First 2-bytes is result of IPv4 header checksum and next 2-bytes is TCP/UDP/ICMP checksum. If a frame does not have checksum error, 0x0000 is attached as checksum calculation result. For unsupported frames 0xFFFF is attached as checksum calculation result. In case of an IPv6 packet, IPv4 checksum is always set to 0xFFFF. We can test this functionality by the below commands ethtool -K eth0 rx on --> to turn on Rx checksum offload ethtool -K eth0 rx off --> to turn off Rx checksum offload Signed-off-by:
-
Colin Ian King authored
The variable capability is being assigned a value that is never read and is being re-assigned later. The assignment is redundant and can be removed. Also remove empty line before assignment to capability. Cleans up clang scan build warning: drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c:1189:2: warning: Value stored to 'capability' is never read [deadcode.DeadStores] Signed-off-by:
Colin Ian King <colin.i.king@gmail.com> Reviewed-by:
Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20240206115049.1879389-1-colin.i.king@gmail.comSigned-off-by:
-
Eric Dumazet authored
In commit 759ab1ed ("net: store netdevs in an xarray") Jakub added net->dev_by_index to map ifindex to netdevices. We can get rid of the old hash table (net->dev_index_head), one patch at a time, if performance is acceptable. This patch removes unpleasant code to something more readable. As a bonus, /proc/net/dev gets netdevices sorted by their ifindex. Signed-off-by:
-
Heiner Kallweit authored
Convert EEE handling to use linkmode bitmaps. This prepares for removing the legacy bitmaps from struct ethtool_keee. No functional change intended. When replacing _bnxt_fw_to_ethtool_adv_spds() with _bnxt_fw_to_linkmode(), remove the fw_pause argument because it's always passed as 0. Note: There's a discussion on whether the underlying implementation is correct, but it's independent of this mechanical conversion w/o functional change. Signed-off-by:
Heiner Kallweit <hkallweit1@gmail.com> Reviewed-by:
Michael Chan <michael.chan@broadcom.com> Link: https://lore.kernel.org/r/9123bf18-a0d0-404e-a7c4-d6c466b4c5e8@gmail.comSigned-off-by:
-
Colin Ian King authored
Variable opaque_fid is being assigned twice with the same value in two identical statements. Remove the redundant first assignment. Cleans up clang scan build warning: drivers/net/ethernet/qlogic/qed/qed_rdma.c:1796:2: warning: Value stored to 'opaque_fid' is never read [deadcode.DeadStores] Signed-off-by:
-
Colin Ian King authored
The variable okay is being initialized with a value that is never read, it is being re-assigned later on. The initialization is redundant and can be removed. Also clean up assignment to variable freespace using an assignment and mask operation. Cleans up clang scan build warning: drivers/net/ethernet/xircom/xirc2ps_cs.c:1244:5: warning: Value stored to 'okay' is never read [deadcode.DeadStores] Signed-off-by:
-
Vladimir Oltean authored
The convention is to not use the "inline" keyword for functions in C files, but to let the compiler choose. Signed-off-by:
Vladimir Oltean <vladimir.oltean@nxp.com> Reviewed-by:
-
Vladimir Oltean authored
The convention is to not use "inline" functions in C files, and let the compiler decide whether to inline or not. Signed-off-by:
-
Vladimir Oltean authored
After commit f86ad77f ("net: dsa: bcm_sf2: Utilize b53_{enable, disable}_port"), bcm_sf2.c no longer calls b53_eee_enable_set(), and all its callers are in b53_common.c. We also need to move it, because it is called within b53_common.c before its definition, and we want to avoid forward declarations. Signed-off-by:
Florian Fainelli <florian.fainelli@broadcom.com> Link: https://lore.kernel.org/r/20240206112527.4132299-1-vladimir.oltean@nxp.comSigned-off-by:
-
Sagi Maimon authored
Adding support for the Adva timecard. The card uses different drivers to provide access to the firmware SPI flash (Altera based). Other parts of the code are the same and could be reused. Signed-off-by:
Sagi Maimon <maimon.sagi@gmail.com> Reviewed-by:
Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://lore.kernel.org/r/20240205153046.3642-1-maimon.sagi@gmail.comSigned-off-by:
-
Kees Cook authored
Since NUM_XMIT_BUFFS is always 1, building m68k with sun3_defconfig and -Warraybounds, this build warning is visible[1]: drivers/net/ethernet/i825xx/sun3_82586.c: In function 'sun3_82586_timeout': drivers/net/ethernet/i825xx/sun3_82586.c:990:122: warning: array subscript 1 is above array bounds of 'volatile struct transmit_cmd_struct *[1]' [-Warray-bounds=] 990 | printk("%s: command-stats: %04x %04x\n",dev->name,swab16(p->xmit_cmds[0]->cmd_status),swab16(p->xmit_cmds[1]->cmd_status)); | ~~~~~~~~~~~~^~~ ... drivers/net/ethernet/i825xx/sun3_82586.c:156:46: note: while referencing 'xmit_cmds' 156 | volatile struct transmit_cmd_struct *xmit_cmds[NUM_XMIT_BUFFS]; Avoid accessing index 1 since it doesn't exist. Link: https://github.com/KSPP/linux/issues/325 [1] Cc: Sam Creasey <sammy@sammy.net> Signed-off-by:Kees Cook <keescook@chromium.org> Reviewed-by:
Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/20240206161651.work.876-kees@kernel.orgSigned-off-by:
-
- 08 Feb, 2024 14 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski authored
Cross-merge networking fixes after downstream PR. No conflicts. Adjacent changes: drivers/net/ethernet/stmicro/stmmac/common.h 38cc3c6d ("net: stmmac: protect updates of 64-bit statistics counters") fd5a6a71 ("net: stmmac: est: Per Tx-queue error count for HLBF") c5c3e1bf ("net: stmmac: Offload queueMaxSDU from tc-taprio") drivers/net/wireless/microchip/wilc1000/netdev.c c9013880 ("wifi: fill in MODULE_DESCRIPTION()s for wilc1000") 328efda2 ("wifi: wilc1000: do not realloc workqueue everytime an interface is added") net/unix/garbage.c 11498715 ("af_unix: Remove io_uring code for GC.") 1279f9d9 ("af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.") Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netLinus Torvalds authored
Pull networking fixes from Paolo Abeni: "Including fixes from WiFi and netfilter. Current release - regressions: - nic: intel: fix old compiler regressions - netfilter: ipset: missing gc cancellations fixed Current release - new code bugs: - netfilter: ctnetlink: fix filtering for zone 0 Previous releases - regressions: - core: fix from address in memcpy_to_iter_csum() - netfilter: nfnetlink_queue: un-break NF_REPEAT - af_unix: fix memory leak for dead unix_(sk)->oob_skb in GC. - devlink: avoid potential loop in devlink_rel_nested_in_notify_work() - iwlwifi: - mvm: fix a battery life regression - fix double-free bug - mac80211: fix waiting for beacons logic - nic: nfp: flower: prevent re-adding mac index for bonded port Previous releases - always broken: - rxrpc: fix generation of serial numbers to skip zero - tipc: check the bearer type before calling tipc_udp_nl_bearer_add() - tunnels: fix out of bounds access when building IPv6 PMTU error - nic: hv_netvsc: register VF in netvsc_probe if NET_DEVICE_REGISTER missed - nic: atlantic: fix DMA mapping for PTP hwts ring Misc: - selftests: more fixes to deal with very slow hosts" * tag 'net-6.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (80 commits) netfilter: nft_set_pipapo: remove scratch_aligned pointer netfilter: nft_set_pipapo: add helper to release pcpu scratch area netfilter: nft_set_pipapo: store index in scratch maps netfilter: nft_set_rbtree: skip end interval element from gc netfilter: nfnetlink_queue: un-break NF_REPEAT netfilter: nf_tables: use timestamp to check for set element timeout netfilter: nft_ct: reject direction for ct id netfilter: ctnetlink: fix filtering for zone 0 s390/qeth: Fix potential loss of L3-IP@ in case of network issues netfilter: ipset: Missing gc cancellations fixed octeontx2-af: Initialize maps. net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio netfilter: nft_set_pipapo: remove static in nft_pipapo_get() netfilter: nft_compat: restrict match/target protocol to u16 netfilter: nft_compat: reject unused compat flag netfilter: nft_compat: narrow down revision to unsigned 8-bits net: intel: fix old compiler regressions MAINTAINERS: Maintainer change for rds selftests: cmsg_ipv6: repeat the exact packet ... -
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrlLinus Torvalds authored
Pull pinctrl fix from Linus Walleij: "A single fix for the AMD driver which affects developer laptops, the pinctrl/GPIO driver won't probe on some systems" * tag 'pinctrl-v6.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: amd: Add IRQF_ONESHOT to the interrupt request
-
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nfPaolo Abeni authored
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Narrow down target/match revision to u8 in nft_compat. 2) Bail out with unused flags in nft_compat. 3) Restrict layer 4 protocol to u16 in nft_compat. 4) Remove static in pipapo get command that slipped through when reducing set memory footprint. 5) Follow up incremental fix for the ipset performance regression, this includes the missing gc cancellation, from Jozsef Kadlecsik. 6) Allow to filter by zone 0 in ctnetlink, do not interpret zone 0 as no filtering, from Felix Huettner. 7) Reject direction for NFT_CT_ID. 8) Use timestamp to check for set element expiration while transaction is handled to prevent garbage collection from removing set elements that were just added by this transaction. Packet path and netlink dump/get path still use current time to check for expiration. 9) Restore NF_REPEAT in nfnetlink_queue, from Florian Westphal. 10) map_index needs to be percpu and per-set, not just percpu. At this time its possible for a pipapo set to fill the all-zero part with ones and take the 'might have bits set' as 'start-from-zero' area. From Florian Westphal. This includes three patches: - Change scratchpad area to a structure that provides space for a per-set-and-cpu toggle and uses it of the percpu one. - Add a new free helper to prepare for the next patch. - Remove the scratch_aligned pointer and makes AVX2 implementation use the exact same memory addresses for read/store of the matching state. netfilter pull request 24-02-08 * tag 'nf-24-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_set_pipapo: remove scratch_aligned pointer netfilter: nft_set_pipapo: add helper to release pcpu scratch area netfilter: nft_set_pipapo: store index in scratch maps netfilter: nft_set_rbtree: skip end interval element from gc netfilter: nfnetlink_queue: un-break NF_REPEAT netfilter: nf_tables: use timestamp to check for set element timeout netfilter: nft_ct: reject direction for ct id netfilter: ctnetlink: fix filtering for zone 0 netfilter: ipset: Missing gc cancellations fixed netfilter: nft_set_pipapo: remove static in nft_pipapo_get() netfilter: nft_compat: restrict match/target protocol to u16 netfilter: nft_compat: reject unused compat flag netfilter: nft_compat: narrow down revision to unsigned 8-bits ==================== Link: https://lore.kernel.org/r/20240208112834.1433-1-pablo@netfilter.orgSigned-off-by:Paolo Abeni <pabeni@redhat.com>
-
Florian Westphal authored
use ->scratch for both avx2 and the generic implementation. After previous change the scratch->map member is always aligned properly for AVX2, so we can just use scratch->map in AVX2 too. The alignoff delta is stored in the scratchpad so we can reconstruct the correct address to free the area again. Fixes: 7400b063 ("nft_set_pipapo: Introduce AVX2-based lookup implementation") Reviewed-by:
Stefano Brivio <sbrivio@redhat.com> Signed-off-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org>
-
Florian Westphal authored
After next patch simple kfree() is not enough anymore, so add a helper for it. Reviewed-by:
-
Florian Westphal authored
Pipapo needs a scratchpad area to keep state during matching. This state can be large and thus cannot reside on stack. Each set preallocates percpu areas for this. On each match stage, one scratchpad half starts with all-zero and the other is inited to all-ones. At the end of each stage, the half that starts with all-ones is always zero. Before next field is tested, pointers to the two halves are swapped, i.e. resmap pointer turns into fill pointer and vice versa. After the last field has been processed, pipapo stashes the index toggle in a percpu variable, with assumption that next packet will start with the all-zero half and sets all bits in the other to 1. This isn't reliable. There can be multiple sets and we can't be sure that the upper and lower half of all set scratch map is always in sync (lookups can be conditional), so one set might have swapped, but other might not have been queried. Thus we need to keep the index per-set-and-cpu, just like the scratchpad. Note that this bug fix is incomplete, there is a related issue. avx2 and normal implementation might use slightly different areas of the map array space due to the avx2 alignment requirements, so m->scratch (generic/fallback implementation) and ->scratch_aligned (avx) may partially overlap. scratch and scratch_aligned are not distinct objects, the latter is just the aligned address of the former. After this change, write to scratch_align->map_index may write to scratch->map, so this issue becomes more prominent, we can set to 1 a bit in the supposedly-all-zero area of scratch->map[]. A followup patch will remove the scratch_aligned and makes generic and avx code use the same (aligned) area. Its done in a separate change to ease review. Fixes: 3c4287f6 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reviewed-by:
-
Pablo Neira Ayuso authored
rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval elements that are not yet active. Fixes: f718863a ("netfilter: nft_set_rbtree: fix overlap expiration walk") Cc: stable@vger.kernel.org Reported-by:
lonial con <kongln9170@gmail.com> Signed-off-by:
-
Florian Westphal authored
Only override userspace verdict if the ct hook returns something other than ACCEPT. Else, this replaces NF_REPEAT (run all hooks again) with NF_ACCEPT (move to next hook). Fixes: 6291b3a6 ("netfilter: conntrack: convert nf_conntrack_update to netfilter verdicts") Reported-by: l.6diay@passmail.com Signed-off-by:
-
Pablo Neira Ayuso authored
Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to use the timestamp, this avoids that an element expires while control plane transaction is still unfinished. .lookup and .update, which are used from packet path, still use the current time to check if the element has expired. And .get path and dump also since this runs lockless under rcu read size lock. Then, there is async gc which also needs to check the current time since it runs asynchronously from a workqueue. Fixes: c3e1b005 ("netfilter: nf_tables: add set element timeout support") Signed-off-by:
-
Pablo Neira Ayuso authored
Direction attribute is ignored, reject it in case this ever needs to be supported Fixes: 3087c3f7 ("netfilter: nft_ct: Add ct id support") Signed-off-by:
-
Felix Huettner authored
previously filtering for the default zone would actually skip the zone filter and flush all zones. Fixes: eff3c558 ("netfilter: ctnetlink: support filtering by zone") Reported-by:
Ilya Maximets <i.maximets@ovn.org> Closes: https://lore.kernel.org/netdev/2032238f-31ac-4106-8f22-522e76df5a12@ovn.org/Signed-off-by:
Felix Huettner <felix.huettner@mail.schwarz> Signed-off-by:
-
Alexandra Winter authored
Symptom: In case of a bad cable connection (e.g. dirty optics) a fast sequence of network DOWN-UP-DOWN-UP could happen. UP triggers recovery of the qeth interface. In case of a second DOWN while recovery is still ongoing, it can happen that the IP@ of a Layer3 qeth interface is lost and will not be recovered by the second UP. Problem: When registration of IP addresses with Layer 3 qeth devices fails, (e.g. because of bad address format) the respective IP address is deleted from its hash-table in the driver. If registration fails because of a ENETDOWN condition, the address should stay in the hashtable, so a subsequent recovery can restore it. 3caa4af8 ("qeth: keep ip-address after LAN_OFFLINE failure") fixes this for registration failures during normal operation, but not during recovery. Solution: Keep L3-IP address in case of ENETDOWN in qeth_l3_recover_ip(). For consistency with qeth_l3_add_ip() we also keep it in case of EADDRINUSE, i.e. for some reason the card already/still has this address registered. Fixes: 4a71df50 ("qeth: new qeth device driver") Cc: stable@vger.kernel.org Signed-off-by:
Alexandra Winter <wintera@linux.ibm.com> Link: https://lore.kernel.org/r/20240206085849.2902775-1-wintera@linux.ibm.comSigned-off-by:
-
Jozsef Kadlecsik authored
The patch fdb8e12cc2cc ("netfilter: ipset: fix performance regression in swap operation") missed to add the calls to gc cancellations at the error path of create operations and at module unload. Also, because the half of the destroy operations now executed by a function registered by call_rcu(), neither NFNL_SUBSYS_IPSET mutex or rcu read lock is held and therefore the checking of them results false warnings. Fixes: 97f7cf1c ("netfilter: ipset: fix performance regression in swap operation") Reported-by: syzbot+52bbc0ad036f6f0d4a25@syzkaller.appspotmail.com Reported-by:Brad Spengler <spender@grsecurity.net> Reported-by:
Стас Ничипорович <stasn77@gmail.com> Tested-by:
Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by:
-
