- 18 Sep, 2015 32 commits
-
-
David S. Miller authored
Eric W. Biederman says: ==================== Passing net through the netfilter hooks My primary goal with this patchset and it's follow ups is to cleanup the network routing paths so that we do not look at the output device to derive the network namespace. My plan is to pass the network namespace of the transmitting socket through the output path, to replace code that looks at the output network device today. Once that is done we can have routes with output devices outside of the current network namespace. Which should allow reception and transmission of packets in network namespaces to be as fast as normal packet reception and transmission with early demux disabled, because it will same code path. Once skb_dst(skb)->dev is a little better under control I think it will also be possible to use rcu to cleanup the ancient hack that sets dst->dev to loopback_dev when a network device is removed. The work to get there is a series of code cleanups. I am starting with passing net into the netfilter hooks and into the functions that are called after the netfilter hooks. This removes from netfilter the need to guess which network namespace it is working on. To get there I perform a series of minor prep patches so the big changes at the end are possible to audit without getting lost in the noise. In particular I have a lot of patches computing net into a local variable and then using it through out the function. So this patchset encompases removing dead code, sorting out the _sk functions that were added last time someone pushed a prototype change through the post netfilter functions. Cleaning up individual functions use of the network namespace. Passing net into the netfilter hooks. Passing net into the post netfilter functions. Using state->net in the netfilter code where it is available and trivially usable. Pablo, Dave I don't know whose tree this makes more sense to go through. I am assuming at least initially Pablos as netfilter is involved. From what I have seen there will be a lot of back and forth between the netfilter code paths and the routing code paths. The patches are also available (against 4.3-rc1) at: git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/net-next.git master ==================== Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Eric W. Biederman authored
In code review it was noticed that I had failed to add some blank lines in places where they are customarily used. Taking a second look at the code I have to agree blank lines would be nice so I have added them here. Reported-by:
Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by:
"Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by:
-
Eric W. Biederman authored
This is immediately motivated by the bridge code that chains functions that call into netfilter. Without passing net into the okfns the bridge code would need to guess about the best expression for the network namespace to process packets in. As net is frequently one of the first things computed in continuation functions after netfilter has done it's job passing in the desired network namespace is in many cases a code simplification. To support this change the function dst_output_okfn is introduced to simplify passing dst_output as an okfn. For the moment dst_output_okfn just silently drops the struct net. Signed-off-by:
-
Eric W. Biederman authored
Instead of saying "net = dev_net(state->in?state->in:state->out)" just say "state->net". As that information is now availabe, much less confusing and much less error prone. Signed-off-by:
-
Eric W. Biederman authored
Pass a network namespace parameter into the netfilter hooks. At the call site of the netfilter hooks the path a packet is taking through the network stack is well known which allows the network namespace to be easily and reliabily. This allows the replacement of magic code like "dev_net(state->in?:state->out)" that appears at the start of most netfilter hooks with "state->net". In almost all cases the network namespace passed in is derived from the first network device passed in, guaranteeing those paths will not see any changes in practice. The exceptions are: xfrm/xfrm_output.c:xfrm_output_resume() xs_net(skb_dst(skb)->xfrm) ipvs/ip_vs_xmit.c:ip_vs_nat_send_or_cont() ip_vs_conn_net(cp) ipvs/ip_vs_xmit.c:ip_vs_send_or_cont() ip_vs_conn_net(cp) ipv4/raw.c:raw_send_hdrinc() sock_net(sk) ipv6/ip6_output.c:ip6_xmit() sock_net(sk) ipv6/ndisc.c:ndisc_send_skb() dev_net(skb->dev) not dev_net(dst->dev) ipv6/raw.c:raw6_send_hdrinc() sock_net(sk) br_netfilter_hooks.c:br_nf_pre_routing_finish() dev_net(skb->dev) before skb->dev is set to nf_bridge->physindev In all cases these exceptions seem to be a better expression for the network namespace the packet is being processed in then the historic "dev_net(in?in:out)". I am documenting them in case something odd pops up and someone starts trying to track down what happened. Signed-off-by:
-
Eric W. Biederman authored
netif_receive_skb_sk is only called once in the bridge code, replace it with a bridge specific function that calls netif_receive_skb. Signed-off-by:
-
Eric W. Biederman authored
This is prep work for passing net to the netfilter hooks. Signed-off-by:
-
Eric W. Biederman authored
When struct net starts being passed through the ipv4 and ipv6 fragment routines br_nf_push_frag_xmit will need to take a net parameter. Prepare br_nf_push_frag_xmit before that is needed and introduce br_nf_push_frag_xmit_sk for the call sites that still need the old calling conventions. Signed-off-by:
-
Eric W. Biederman authored
This is a prep work for passing struct net through ip_do_fragment and later the netfilter okfn. Doing this independently makes the later code changes clearer. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Keep net in a local variable so I can use it in NF_HOOK_COND when I pass struct net to all of the netfilter hooks. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Avoid silly redundant code Signed-off-by:
-
Eric W. Biederman authored
A function with weird arguments that it will never use to accomdate a netfilter callback prototype is absolutely in the core of the networking stack. Frankly it does not make sense and it causes a lot of confusion as to why arguments that are never used are being passed to the function. As I am preparing to make a second change to arguments to the okfn even the names stops making sense. As I have removed the two callers of this function remove this confusion from the networking stack. Signed-off-by:
-
Eric W. Biederman authored
The function dev_queue_xmit_skb_sk is unncessary and very confusing. Introduce br_send_bpdu_finish to remove the need for dev_queue_xmit_skb_sk, and have br_send_bpdu_finish call dev_queue_xmit. Signed-off-by:
-
Eric W. Biederman authored
The function dev_queue_xmit_skb_sk is unncessary and very confusing. Introduce arp_xmit_finish to remove the need for dev_queue_xmit_skb_sk, and have arp_xmit_finish call dev_queue_xmit. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Calling dev_net(dev) for is just silly. Signed-off-by:
-
Eric W. Biederman authored
This is a prepatory patch to passing net int the netfilter hooks, where net will be used again. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Compute struct net from the input device in ip_forward before it is used. Signed-off-by:
-
Eric W. Biederman authored
Add a sock paramter to dst_output making dst_output_sk superfluous. Add a skb->sk parameter to all of the callers of dst_output Have the callers of dst_output_sk call dst_output. Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
Signed-off-by:
-
Eric W. Biederman authored
The !CONFIG_NETFILTER definition of nf_hook_thresh calls okfn when the CONFIG_NETFITLER defintion does not, making it buggy. As the !CONFIG_NETFILTER defintion of nf_hook_thresh is not used remove it rather than fix it. Signed-off-by:
-
- 17 Sep, 2015 3 commits
-
-
git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queueDavid S. Miller authored
Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2015-09-15 This series contains updates to ixgbe and fm10k. Don fixes a ixgbe issue by adding checks for systems that do not have SFP's to avoid incorrectly acting on interrupts that are falsely interpreted as SFP events. Alex Williamson adds a fix for ixgbe to disable SR-IOV prior to unregistering the netdev to avoid issues with guest OS's which do not support hot-unplug or their hot-unplug is broken. Alex Duyck update the lowest limit for adaptive interrupt interrupt moderation to about 12K interrupts per second for ixgbe. This change increases the performance for ixgbe. Also fixed up fm10k to remove the optimization that assumed that all fragments would be limited to page size, since that assumption is incorrect as the TCP allocator can provide up to a 32K page fragment. Updated fm10k to add the MAC address to the list of values recorded on driver load. Fixes fm10k so that we only trigger the data path reset if the fabric is ready to handle traffic to avoid triggering the reset unless the switch API is ready for us. Jacob updates the fm10k driver to disable the service task during suspend and re-enable it after we resume. If we don't do this, the device could be UP when you suspend and come back from resume as DOWN. Also update fm10k to prevent the removal of default VID rules, and correctly remove the stack layers information of the VLAN, but then return to forwarding that VID as untagged frames. If we deleted the VID rules here, we would begin dropping traffic due to VLAN membership violations. Fixed fm10k to use pcie_get_minimum_link(), which is useful in cases where we connect to a slot at Gen3, but the slot is behind a bus which is only connected at Gen2. Updated fm10k to update the netdev permanent address during reinit instead of up to enable users to immediately see the new MAC address on the VF even if the device is not up. Adds the creation of VLAN interfaces on a device, even while the device is down for fm10k. Fixed an issue where we request the incorrect MAC/VLAN combinations, and prevents us from accidentally reporting some frames as VLAN tagged. Provided a couple of trivial fixes for fm10k to fix code style and typos in code comments. ==================== Signed-off-by: -
Thadeu Lima de Souza Cascardo authored
Redo commit ed1acc8c. Commit 822b3b2e ("net: Add max rate tx queue attribute") moved get_netdev_queue_index around, but kept the old version. Probably because of a reuse of the original patch from before Eric's change to that function. Remove one inline keyword, and no need for a loop to find an index into a table. Signed-off-by:
Thadeu Lima de Souza Cascardo <cascardo@redhat.com> Fixes: 822b3b2e ("net: Add max rate tx queue attribute") Acked-by:
Or Gerlitz <ogerlitz@mellanox.com> Acked-by:
John Fastabend <john.r.fastabend@intel.com> Cc: Eric Dumazet <edumazet@google.com> Signed-off-by:
-
Robert Jarzmik authored
Convert the dma transfers to be dmaengine based, now pxa has a dmaengine slave driver. This makes this driver a bit more PXA agnostic. The driver was tested on pxa27x (mainstone) and pxa310 (zylonite), ie. only pxa platforms. Signed-off-by:
Robert Jarzmik <robert.jarzmik@free.fr> Cc: Russell King <linux@arm.linux.org.uk> Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
- 16 Sep, 2015 5 commits
-
-
Randy Dunlap authored
Fix build error caused by missing Kconfig dependency: ERROR: "cdc_parse_cdc_header" [drivers/net/usb/cdc-phonet.ko] undefined! Reported-by:
Fengguang Wu <fengguang.wu@intel.com> Signed-off-by:
Randy Dunlap <rdunlap@infradead.org> Signed-off-by:
-
Stephen Rothwell authored
Signed-off-by:
Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by:
-
Jacob Keller authored
The VF will send a message to request multicast addresses with the default VID. In the current code, if the PF has statically assigned a VLAN to a VF, then the VF will not get the multicast addresses. Fix up all of the various VLAN messages to use identical checks (since each check was different). Also use set as a variable, so that it simplifies our check for whether VLAN matches the pf_vid. The new logic will allow set of a VLAN if it is zero, automatically converting to the default VID. Otherwise it will allow setting the PF VID, or any VLAN if PF has not statically assigned a VLAN. This is consistent behavior, and allows VF to request either 0 or the default_vid without silently failing. Note that we need the check for zero since VFs might not get the default VID message in time to actually request non-zero VLANs. Signed-off-by:
Jacob Keller <jacob.e.keller@intel.com> Tested-by:
Krishneil Singh <krishneil.k.singh@intel.com> Signed-off-by:
Jeff Kirsher <jeffrey.t.kirsher@intel.com>
-
Alexander Duyck authored
This change makes it so that we only trigger the data path reset if the fabric is ready to handle traffic. The general idea is to avoid triggering the reset unless the switch API is ready for us. Otherwise we can just postpone the reset until we receive a switch ready notification. Signed-off-by:
Alexander Duyck <alexander.h.duyck@redhat.com> Signed-off-by:
-
Jacob Keller authored
Modify behavior of Malicious Driver Detection events. Presently, the hardware disables the VF queues and re-assigns them to the PF. This causes the VF in question to continuously Tx hang, because it assumes that it can transmit over the queues in question. For transient events, this results in continuous logging of malicious events. New behavior is to reset the LPORT and VF state, so that the VF will have to reset and re-enable itself. This does mean that malicious VFs will possibly be able to continue and attempt malicious events again. However, it is expected that system administrators will step in and manually remove or disable the VF in question. Signed-off-by:
-
