- 21 Mar, 2022 33 commits
-
-
Jakub Kicinski authored
Ziyang Xuan says: ==================== net/tls: some optimizations for tls Do some small optimizations for tls, including jump instructions optimization, and judgement processes optimization. ==================== Link: https://lore.kernel.org/r/cover.1647658604.git.william.xuanziyang@huawei.comSigned-off-by:
Jakub Kicinski <kuba@kernel.org>
-
Ziyang Xuan authored
It is known that priority setting HW offload when set tls TX/RX offload by setsockopt(). Check netdevice whether support NETIF_F_HW_TLS_TX or not at the later stages in the whole tls_set_device_offload() process, some memory allocations have been done before that. We must release those memory and return error if we judge the netdevice not support NETIF_F_HW_TLS_TX. It is redundant. Move NETIF_F_HW_TLS_TX judgement forward, and move start_marker_record and offload_ctx memory allocation back slightly. Thus, we can get simpler exception handling process. Signed-off-by:
Ziyang Xuan <william.xuanziyang@huawei.com> Signed-off-by:
-
Ziyang Xuan authored
Avoid using "goto" jump instruction unconditionally when we can return directly. Remove unnecessary jump instructions in do_tls_setsockopt_conf(). Signed-off-by:
-
Sebastian Andrzej Siewior authored
The lockdep annotation lockdep_assert_softirq_will_run() expects that either hard or soft interrupts are disabled because both guaranty that the "raised" soft-interrupts will be processed once the context is left. This triggers in flush_smp_call_function_from_idle() but it this case it explicitly calls do_softirq() in case of pending softirqs. Revert the "softirq will run" annotation in ____napi_schedule() and move the check back to __netif_rx() as it was. Keep the IRQ-off assert in ____napi_schedule() because this is always required. Fixes: fbd9a2ce ("net: Add lockdep asserts to ____napi_schedule().") Signed-off-by:
Sebastian Andrzej Siewior <bigeasy@linutronix.de> Reviewed-by:
Jason A. Donenfeld <Jason@zx2c4.com> Link: https://lore.kernel.org/r/YjhD3ZKWysyw8rc6@linutronix.deSigned-off-by:
-
David S. Miller authored
Jakub Kicinski says: ==================== devlink: hold the instance lock in eswitch callbacks Series number 2 in the effort to hold the devlink instance lock in call driver callbacks. We have the following drivers using this API: - bnxt, nfp, netdevsim - their own locking is removed / simplified by this series; all of them needed a lock to protect from changes to the number of VFs while switching modes, now the VF config bus callback takes the devlink instance lock via devl_lock(); - ice - appears not to allow changing modes while SR-IOV enabled, so nothing to do there; - liquidio - does not contain any locking; - octeontx2/af - is very special but at least doesn't have locking so doesn't get in the way either; - mlx5 has a wealth of locks - I chickened out and dropped the lock in the callbacks so that I can leave the driver be, for now. The last one is obviously not ideal, but I would prefer to transition the API already as it make take longer. v2: use a wrapper in mlx5 and extend the comment ==================== Signed-off-by:David S. Miller <davem@davemloft.net>
-
Jakub Kicinski authored
Make the devlink core hold the instance lock during eswitch_mode callbacks. Cheat in case of mlx5 (see the cover letter). Reviewed-by:
Leon Romanovsky <leonro@nvidia.com> Reviewed-by:
Jiri Pirko <jiri@nvidia.com> Signed-off-by:
-
Jakub Kicinski authored
Similarly to the previous commit, use the devlink instance lock and let it replace the vfs_lock. nsim_esw_legacy_enable() was locked by both port lock and vfs lock so one set of lock/unlocks goes away. netdevsim's .eswitch_mode_set callback is now ready for the callback to take the instance lock. Signed-off-by:
-
Jakub Kicinski authored
Take advantage of the devlink instance lock for protecting the port list. This will simplify locking even more once all devlink callbacks hold the instance lock. We need to add locking in nsim_dev_port_add_all() which used to assume higher layer protection when accessing the list. Signed-off-by:
-
Jakub Kicinski authored
We'll need an explicitly locked rate node API for netdevsim to switch eswitch mode setting to locked. Reviewed-by:
-
Jakub Kicinski authored
In prep for .eswitch_mode_set being called with the devlink instance lock held use that lock explicitly instead of creating a local mutex just for the sriov reconfig. Signed-off-by:
-
David S. Miller authored
Tong Zhang says: ==================== fix typos: "to short" -> "too short" doing some code review and I found out there are a couple of places where "too short" is misspelled as "to short". ==================== Signed-off-by: -
Tong Zhang authored
"frame to short" -> "frame too short" Signed-off-by:
Tong Zhang <ztong0001@gmail.com> Signed-off-by:
-
Tong Zhang authored
"Frame to short" -> "Frame too short" Signed-off-by:
-
Tong Zhang authored
"packet length to short" -> "packet length too short" Signed-off-by:
-
Tong Zhang authored
"RX USB to short" -> "RX USB too short" Signed-off-by:
-
David S. Miller authored
Casper Andersson says: ==================== net: sparx5: Add multicast support Add multicast support to Sparx5. ==================== Signed-off-by: -
Casper Andersson authored
Adds mdb handlers. Uses the PGID arbiter to find a free entry in the PGID table for the multicast group port mask. Signed-off-by:
Casper Andersson <casper.casan@gmail.com> Signed-off-by:
-
Casper Andersson authored
The PGID (Port Group ID) table holds port masks for different purposes. The first 72 are reserved for port destination masks, flood masks, and CPU forwarding. The rest are shared between multicast, link aggregation, and virtualization profiles. The GLAG area is reserved to not be used by anything else, since it is a subset of the MCAST area. The arbiter keeps track of which entries are in use. You can ask for a free ID or give back one you are done using. Signed-off-by:
-
David S. Miller authored
Simon Horman says: ==================== nfp: support for NFP-3800 Yinjun Zhan says: This is the second of a two part series to support the NFP-3800 device. To utilize the new hardware features of the NFP-3800, driver adds support of a new data path NFDK. This series mainly does some refactor work to the data path related implementations. The data path specific implementations are now separated into nfd3 and nfdk directories respectively, and the common part is also moved into a new file. * The series starts with a small refinement in Patch 1/10. Patches 2/10 and 3/10 are the main refactoring of data path implementation, which prepares for the adding the NFDK data path. * Before the introduction of NFDK, there's some more preparation work for NFP-3800 features, such as multi-descriptor per-packet and write-back mechanism of TX pointer, which is done in patches 4/10, 5/10, 6/10, 7/10. * Patch 8/10 allows the driver to select data path according to firmware version. Finally, patches 9/10 and 10/10 introduce the new NFDK data path. Changes between v1 and v2 * Correct kdoc for nfp_nfdk_tx() * Correct build warnings on 32-bit Thanks to everyone who contributed to this work. ==================== Signed-off-by: -
Yinjun Zhang authored
Due to the different definition of txbuf in NFDK comparing to NFD3, there're no pre-allocated txbufs for xdp use in NFDK's implementation, we just use the existed rxbuf and recycle it when xdp tx is completed. For each packet to transmit in xdp path, we cannot use more than `NFDK_TX_DESC_PER_SIMPLE_PKT` txbufs, one is to stash virtual address, and another is for dma address, so currently the amount of transmitted bytes is not accumulated. Also we borrow the last bit of virtual addr to indicate a new transmitted packet due to address's alignment attribution. Signed-off-by:
Yinjun Zhang <yinjun.zhang@corigine.com> Signed-off-by:
Fei Qin <fei.qin@corigine.com> Signed-off-by:
Simon Horman <simon.horman@corigine.com> Signed-off-by:
-
Jakub Kicinski authored
Add new data path. The TX is completely different, each packet has multiple descriptor entries (between 2 and 32). TX ring is divided into blocks 32 descriptor, and descritors of one packet can't cross block bounds. The RX side is the same for now. ABI version 5 or later is required. There is no support for VLAN insertion on TX. XDP_TX action and AF_XDP zero-copy is not implemented in NFDK path. Changes to Jakub's work: * Move statistics of hw_csum_tx after jumbo packet's segmentation. * Set L3_CSUM flag to enable recaculating of L3 header checksum in ipv4 case. * Mark the case of TSO a packet with metadata prepended as unsupported. Signed-off-by:
Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by:
Xingfeng Hu <xingfeng.hu@corigine.com> Signed-off-by:
Dianchao Wang <dianchao.wang@corigine.com> Signed-off-by:
-
Jakub Kicinski authored
Prepare for choosing data path based on the firmware version field. Exploit one bit from the reserved byte in the firmware version field as the data path type. We need the firmware version right after vNIC is allocated, so it has to be read inside nfp_net_alloc(), callers don't have to set it afterwards. Following patches will bring the implementation of the second data path. Signed-off-by:
-
Jakub Kicinski authored
Make sure that features supported only by some of the data paths are not enabled for all. Add a mask of supported features into the data path op structure. Signed-off-by:
-
Jakub Kicinski authored
Newer versions of the PCIe microcode support writing back the position of the TX pointer back into host memory. This speeds up TX completions, because we avoid a read from device memory (replacing PCIe read with DMA coherent read). Signed-off-by:
-
Jakub Kicinski authored
QCidx is not used on fast path, move it to the lower cacheline. Signed-off-by:
-
Jakub Kicinski authored
New datapaths may use multiple descriptor units to describe a single packet. Prepare for that by adding a descriptors per simple frame constant into ring size calculations. Signed-off-by:
-
Jakub Kicinski authored
To reduce the coupling of slow path ring implementations and their callers, use callbacks instead. Changes to Jakub's work: * Also use callbacks for xmit functions Signed-off-by:
-
Jakub Kicinski authored
In preparation for support for a new datapath format move all ring and fast path logic into separate files. It is basically a verbatim move with some wrapping functions, no new structures and functions added. The current data path is called NFD3 from the initial version of the driver ABI it used. The non-fast path, but ring related functions are moved to nfp_net_dp.c file. Changes to Jakub's work: * Rebase on xsk related code. * Split the patch, move the callback changes to next commit. Signed-off-by:
-
Jakub Kicinski authored
Ring enable masks are 64bit long. Replace mask calculation from: block_cnt == 64 ? 0xffffffffffffffffULL : (1 << block_cnt) - 1 with: (U64_MAX >> (64 - block_cnt)) to simplify the code. Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-nextDavid S. Miller authored
Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next. This patchset contains updates for the nf_tables register tracking infrastructure, disable bogus warning when attaching ct helpers, one namespace pollution fix and few cleanups for the flowtable. 1) Revisit conntrack gc routine to reduce chances of overruning the netlink buffer from the event path. From Florian Westphal. 2) Disable warning on explicit ct helper assignment, from Phil Sutter. 3) Read-only expressions do not update registers, mark them as NFT_REDUCE_READONLY. Add helper functions to update the register tracking information. This patch re-enables the register tracking infrastructure. 4) Cancel register tracking in case an expression fully/partially clobbers existing data. 5) Add register tracking support for remaining expressions: ct, lookup, meta, numgen, osf, hash, immediate, socket, xfrm, tunnel, fib, exthdr. 6) Rename init and exit functions for the conntrack h323 helper, from Randy Dunlap. 7) Remove redundant field in struct flow_offload_work. 8) Update nf_flow_table_iterate() to pass flowtable to callback. ==================== Signed-off-by: -
Casper Andersson authored
Standalone ports use vid 0. Let the bridge use vid 1 when "vlan_default_pvid 0" is set to avoid collisions. Since no VLAN is created when default pvid is 0 this is set at "PORT_ATTR_SET" and handled in the Switchdev fdb handler. Signed-off-by:
-
Wan Jiabing authored
allocated_mem is allocated by kcalloc(). The memory is set to zero. It is unnecessary to call memset again. Signed-off-by:
Wan Jiabing <wanjiabing@vivo.com> Signed-off-by:
-
Wang Yufen authored
In calipso_map_cat_ntoh(), in the for loop, if the return value of netlbl_bitmap_walk() is equal to (net_clen_bits - 1), when netlbl_bitmap_walk() is called next time, out-of-bounds memory accesses of bitmap[byte_offset] occurs. The bug was found during fuzzing. The following is the fuzzing report BUG: KASAN: slab-out-of-bounds in netlbl_bitmap_walk+0x3c/0xd0 Read of size 1 at addr ffffff8107bf6f70 by task err_OH/252 CPU: 7 PID: 252 Comm: err_OH Not tainted 5.17.0-rc7+ #17 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x21c/0x230 show_stack+0x1c/0x60 dump_stack_lvl+0x64/0x7c print_address_description.constprop.0+0x70/0x2d0 __kasan_report+0x158/0x16c kasan_report+0x74/0x120 __asan_load1+0x80/0xa0 netlbl_bitmap_walk+0x3c/0xd0 calipso_opt_getattr+0x1a8/0x230 calipso_sock_getattr+0x218/0x340 calipso_sock_getattr+0x44/0x60 netlbl_sock_getattr+0x44/0x80 selinux_netlbl_socket_setsockopt+0x138/0x170 selinux_socket_setsockopt+0x4c/0x60 security_socket_setsockopt+0x4c/0x90 __sys_setsockopt+0xbc/0x2b0 __arm64_sys_setsockopt+0x6c/0x84 invoke_syscall+0x64/0x190 el0_svc_common.constprop.0+0x88/0x200 do_el0_svc+0x88/0xa0 el0_svc+0x128/0x1b0 el0t_64_sync_handler+0x9c/0x120 el0t_64_sync+0x16c/0x170 Reported-by:
Hulk Robot <hulkci@huawei.com> Signed-off-by:
Wang Yufen <wangyufen@huawei.com> Acked-by:
Paul Moore <paul@paul-moore.com> Signed-off-by:
-
- 19 Mar, 2022 7 commits
-
-
Pablo Neira Ayuso authored
The flowtable object is already passed as argument to nf_flow_table_iterate(), do use not data pointer to pass flowtable. Signed-off-by:Pablo Neira Ayuso <pablo@netfilter.org>
-
Pablo Neira Ayuso authored
Already available through the flowtable object, remove it. Signed-off-by: -
Randy Dunlap authored
Eliminate anonymous module_init() and module_exit(), which can lead to confusion or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log. Give each of these init and exit functions unique driver-specific names to eliminate the anonymous names. Example 1: (System.map) ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log) calling init+0x0/0x12 @ 1 initcall init+0x0/0x12 returned 0 after 15 usecs calling init+0x0/0x60 @ 1 initcall init+0x0/0x60 returned 0 after 2 usecs calling init+0x0/0x9a @ 1 initcall init+0x0/0x9a returned 0 after 74 usecs Fixes: f587de0e ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port") Signed-off-by:
Randy Dunlap <rdunlap@infradead.org> Acked-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
-
Florian Westphal authored
Check if we can elide the load. Cancel if the new candidate isn't identical to previous store. Signed-off-by:
-
Florian Westphal authored
The fib expression stores to a register, so we can't add empty stub. Check that the register that is being written is in fact redundant. In most cases, this is expected to cancel tracking as re-use is unlikely. Signed-off-by:
-
Pablo Neira Ayuso authored
Check if the destination register already contains the data that this tunnel expression performs. This allows to skip this redundant operation. If the destination contains a different selector, update the register tracking information. This patch does not perform bitwise tracking. Signed-off-by: -
Pablo Neira Ayuso authored
Check if the destination register already contains the data that this xfrm expression performs. This allows to skip this redundant operation. If the destination contains a different selector, update the register tracking information. Signed-off-by:
-
