- 09 Jul, 2019 40 commits
-
-
Paul Blakey authored
Retreives connection tracking zone, mark, label, and state from a SKB. Signed-off-by:
Paul Blakey <paulb@mellanox.com> Signed-off-by:
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by:
Jiri Pirko <jiri@mellanox.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Paul Blakey authored
Allow sending a packet to conntrack module for connection tracking. The packet will be marked with conntrack connection's state, and any metadata such as conntrack mark and label. This state metadata can later be matched against with tc classifers, for example with the flower classifier as below. In addition to committing new connections the user can optionally specific a zone to track within, set a mark/label and configure nat with an address range and port range. Usage is as follows: $ tc qdisc add dev ens1f0_0 ingress $ tc qdisc add dev ens1f0_1 ingress $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 0 proto ip \ flower ip_proto tcp ct_state -trk \ action ct zone 2 pipe \ action goto chain 2 $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 2 proto ip \ flower ct_state +trk+new \ action ct zone 2 commit mark 0xbb nat src addr 5.5.5.7 pipe \ action mirred egress redirect dev ens1f0_1 $ tc filter add dev ens1f0_0 ingress \ prio 1 chain 2 proto ip \ flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \ action ct nat pipe \ action mirred egress redirect dev ens1f0_1 $ tc filter add dev ens1f0_1 ingress \ prio 1 chain 0 proto ip \ flower ip_proto tcp ct_state -trk \ action ct zone 2 pipe \ action goto chain 1 $ tc filter add dev ens1f0_1 ingress \ prio 1 chain 1 proto ip \ flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \ action ct nat pipe \ action mirred egress redirect dev ens1f0_0 Signed-off-by:
Yossi Kuperman <yossiku@mellanox.com> Acked-by:
-
David S. Miller authored
Parav Pandit says: ==================== devlink: Introduce PCI PF, VF ports and attributes This patchset carry forwards the work initiated in [1] and discussion futher concluded at [2]. To improve visibility of representor netdevice, its association with PF or VF, physical port, two new devlink port flavours are added as PCI PF and PCI VF ports. A sample eswitch view can be seen below, which will be futher extended to mdev subdevices of a PCI function in future. Patch-1 moves physical port's attribute to new structure Patch-2 enhances netlink response to consider port flavour Patch-3,4 extends devlink port attributes and port flavour Patch-5 extends mlx5 driver to register devlink ports for PF, VF and physical link. +---+ +---+ vf| | | | pf +-+-+ +-+-+ physical link <---------+ | | | | | | | | +-+-+ +-+-+ +-+-+ | 1 | | 2 | | 3 | +--+---+-----+---+------+---+--+ | physical vf pf | | port port port | | | | eswitch | | | +------------------------------+ [1] https://www.spinics.net/lists/netdev/msg555797.html [2] https://marc.info/?l=linux-netdev&m=155354609408485&w=2 Changelog: v5->v6: - Fixed port flavour check order for PCI PF vs other flavours in netlink response. - Changed 'physical' to 'phys'. v4->v5: - Split first patch to two patches to handle netlink response in separate patch. - Corrected typo 'otwerwise' to 'otherwise' in patches 3 and 4. v3->v4: - Addressed comments from Jiri. - Split first patch to two patches. - Renamed phys_port to physical to be consistent with pci_pf. - Removed port_number from __devlink_port_attrs_set and moved assignment to caller function. - Used capital letter while moving old comment to new structure. - Removed helper function is_devlink_phy_port_num_supported(). v2->v3: - Made port_number and split_port_number applicable only to physical port flavours. v1->v2: - Updated new APIs and mlx5 driver to drop port_number for PF, VF attributes - Updated port_number comment for its usage - Limited putting port_number to physical ports ==================== Reviewed-by:Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by:
-
Parav Pandit authored
Register devlink port of physical port, PCI PF and PCI VF flavour for each PF, VF when a given devlink instance is in switchdev mode. Implement ndo_get_devlink_port callback API to make use of registered devlink ports. This eliminates ndo_get_phys_port_name() and ndo_get_port_parent_id() callbacks. Hence, remove them. An example output with 2 VFs, without a PF and single uplink port is below. $devlink port show pci/0000:06:00.0/65535: type eth netdev ens2f0 flavour physical pci/0000:05:00.0/1: type eth netdev eth1 flavour pcivf pfnum 0 vfnum 0 pci/0000:05:00.0/2: type eth netdev eth2 flavour pcivf pfnum 0 vfnum 1 Reviewed-by:
Roi Dayan <roid@mellanox.com> Acked-by:
Parav Pandit <parav@mellanox.com> Signed-off-by:
-
Parav Pandit authored
In an eswitch, PCI VF may have port which is normally represented using a representor netdevice. To have better visibility of eswitch port, its association with VF, and its representor netdevice, introduce a PCI VF port flavour. When devlink port flavour is PCI VF, fill up PCI VF attributes of the port. Extend port name creation using PCI PF and VF number scheme on best effort basis, so that vendor drivers can skip defining their own scheme. $ devlink port show pci/0000:05:00.0/0: type eth netdev eth0 flavour pcipf pfnum 0 pci/0000:05:00.0/1: type eth netdev eth1 flavour pcivf pfnum 0 vfnum 0 pci/0000:05:00.0/2: type eth netdev eth2 flavour pcivf pfnum 0 vfnum 1 Acked-by:
-
Parav Pandit authored
In an eswitch, PCI PF may have port which is normally represented using a representor netdevice. To have better visibility of eswitch port, its association with PF and a representor netdevice, introduce a PCI PF port flavour and port attriute. When devlink port flavour is PCI PF, fill up PCI PF attributes of the port. Extend port name creation using PCI PF number on best effort basis. So that vendor drivers can skip defining their own scheme. $ devlink port show pci/0000:05:00.0/0: type eth netdev eth0 flavour pcipf pfnum 0 Acked-by:
-
Parav Pandit authored
Physical port number and split group fields are applicable only to physical port flavours such as PHYSICAL, CPU and DSA. Hence limit returning those values in netlink response to such port flavours. Acked-by:
-
Parav Pandit authored
To support additional devlink port flavours and to support few common and few different port attributes, move physical port attributes to a different structure. Acked-by:
-
David S. Miller authored
Jakub Kicinski says: ==================== nfp: tls: fixes for initial TLS support This series brings various fixes to nfp tls offload recently added to net-next. First 4 patches revolve around device mailbox communication, trying to make it more reliable. Next patch fixes statistical counter. Patch 6 improves the TX resync if device communication failed. Patch 7 makes sure we remove keys from memory after talking to FW. Patch 8 adds missing tls context initialization, we fill in the context information from various places based on the configuration and looks like we missed the init in the case of where TX is offloaded, but RX wasn't initialized yet. Patches 9 and 10 make the nfp driver undo TLS state changes if we need to drop the frame (e.g. due to DMA mapping error). Last but not least TLS fallback should not adjust socket memory after skb_orphan_partial(). This code will go away once we forbid orphaning of skbs in need of crypto, but that's "real" -next material, so lets do a quick fix. ==================== Signed-off-by: -
Jakub Kicinski authored
netem runs skb_orphan_partial() which "disconnects" the skb from normal TCP write memory accounting. We should not adjust sk->sk_wmem_alloc on the fallback path for such skbs. Fixes: e8f69799 ("net/tls: Add generic NIC offload infrastructure") Signed-off-by:
Dirk van der Merwe <dirk.vandermerwe@netronome.com> Signed-off-by:
-
Jakub Kicinski authored
If driver has to drop the TLS frame it needs to undo the TCP sequence tracking changes, otherwise device will receive segments out of order and drop them. Signed-off-by:
-
Jakub Kicinski authored
Move the #ifdef CONFIG_TLS_DEVICE a little so we can eliminate the other one. Signed-off-by:
-
Jakub Kicinski authored
Turns out TLS_TX in HW offload mode does not initialize tls_prot_info. Since commit 9cd81988 ("net/tls: use version from prot") we actually use this field on the datapath. Luckily we always compare it to TLS 1.3, and assume 1.2 otherwise. So since zero is not equal to 1.3, everything worked fine. Fixes: 9cd81988 ("net/tls: use version from prot") Signed-off-by:
-
Jakub Kicinski authored
Make sure the contents of the skb which carried key material to the FW is cleared. Signed-off-by:
-
Dirk van der Merwe authored
Introduce a return code for the tls_dev_resync callback. When the driver TX resync fails, kernel can retry the resync again until it succeeds. This prevents drivers from attempting to offload TLS packets if the connection is known to be out of sync. We don't worry about the RX resync since they will be retried naturally as more encrypted records get received. Signed-off-by:
-
Jakub Kicinski authored
Count the number of successfully submitted TLS segments, not skbs. This will make it easier to compare the TLS encryption count against other counters. Signed-off-by:
-
Dirk van der Merwe authored
Increase the batch limit to consume small message bursts more effectively. Practically, the effect on the 'add' messages is not significant since the mailbox is sized such that the 'add' messages are still limited to the same order of magnitude that it was originally set for. Furthermore, increase the queue size limit to 1024 entries. This further improves the handling of bursts of small control messages. Signed-off-by:
-
Jakub Kicinski authored
Connection 4 tuple reuse is slightly problematic - TLS socket and context do not get destroyed until all the associated skbs left the system and all references are released. This leads to stale connection entry in the device preventing addition of new one if the 4 tuple is reused quickly enough. Instead of using read 4 tuple as the key use a unique ID. Set the protocol to TCP and port to 0 to ensure no collisions with real connections. Signed-off-by:
-
Jakub Kicinski authored
Long lines are ugly. No functional changes. Signed-off-by:
-
Jakub Kicinski authored
We need to do our best not to drop delete commands, otherwise we will have stale entries in the connection table. Ignore the control message queue limits for delete commands. Signed-off-by:
-
Xin Long authored
sctp_bind_addr_state() is called either in packet rcv path or by sctp_copy_local_addr_list(), which are under rcu_read_lock. So there's no need to call it again in sctp_bind_addr_state(). Signed-off-by:
Xin Long <lucien.xin@gmail.com> Signed-off-by:
-
David S. Miller authored
Xin Long says: ==================== sctp: tidy up some ep and asoc feature flags This patchset is to remove some unnecessary feature flags from sctp_assocation and move some others to the right places. ==================== Signed-off-by: -
Xin Long authored
Like other endpoint features, strm_interleave should be moved to sctp_endpoint and renamed to intl_enable. Signed-off-by:
-
Xin Long authored
To keep consistent with other asoc features, we move intl_enable to peer.intl_capable in asoc. Signed-off-by:
-
Xin Long authored
Like reconf_enable, prsctp_enable should also be removed from asoc, as asoc->peer.prsctp_capable has taken its job. Signed-off-by:
-
Xin Long authored
asoc's reconf support is actually decided by the 4-shakehand negotiation, not something that users can set by sockopt. asoc->peer.reconf_capable is working for this. So remove it from asoc. Signed-off-by:
-
Fuqian Huang authored
linkmode_mod_bit is introduced as a helper function to set/clear bits in a linkmode. Replace the if else code structure with a call to the helper linkmode_mod_bit. Signed-off-by:
Fuqian Huang <huangfq.daxian@gmail.com> Signed-off-by:
-
David S. Miller authored
John Hurley says: ==================== Add MPLS actions to TC This patchset introduces a new TC action module that allows the manipulation of the MPLS headers of packets. The code impliments functionality including push, pop, and modify. Also included are tests for the new funtionality. Note that these will require iproute2 changes to be submitted soon. NOTE: these patches are applied to net-next along with the patch: [PATCH net 1/1] net: openvswitch: fix csum updates for MPLS actions This patch has been accepted into net but, at time of posting, is not yet in net-next. v6-v7: - add extra tests for setting max/min and exceeding range of fields - patch 5 (Roman Mashak) v5-v6: - add CONFIG_NET_ACT_MPLS to tc-testing config file - patch 5 (Davide Caratti) v4-v5: - move mpls_hdr() call to after skb_ensure_writable - patch 3 (Willem de Bruijn) - move mpls_dec_ttl to helper - patch 4 (Willem de Bruijn) - add iproute2 usage example to commit msg - patch 4 (David Ahern) - align label validation with mpls core code - patch 4 (David Ahern) - improve extack message for no proto in mpls pop - patch 4 (David Ahern) v3-v4: - refactor and reuse OvS code (Cong Wang) - use csum API rather than skb_post*rscum to update skb->csum (Cong Wang) - remove unnecessary warning (Cong Wang) - add comments to uapi attributes (David Ahern) - set strict type policy check for TCA_MPLS_UNSPEC (David Ahern) - expand/improve extack messages (David Ahern) - add option to manually set BOS v2-v3: - remove a few unnecessary line breaks (Jiri Pirko) - retract hw offload patch from set (resubmit with driver changes) (Jiri) v1->v2: - ensure TCA_ID_MPLS does not conflict with TCA_ID_CTINFO (Davide Caratti) ==================== Signed-off-by: -
John Hurley authored
Add a new series of selftests to verify the functionality of act_mpls in TC. Signed-off-by:
John Hurley <john.hurley@netronome.com> Reviewed-by:
Simon Horman <simon.horman@netronome.com> Acked-by:
-
John Hurley authored
Currently, TC offers the ability to match on the MPLS fields of a packet through the use of the flow_dissector_key_mpls struct. However, as yet, TC actions do not allow the modification or manipulation of such fields. Add a new module that registers TC action ops to allow manipulation of MPLS. This includes the ability to push and pop headers as well as modify the contents of new or existing headers. A further action to decrement the TTL field of an MPLS header is also provided with a new helper added to support this. Examples of the usage of the new action with flower rules to push and pop MPLS labels are: tc filter add dev eth0 protocol ip parent ffff: flower \ action mpls push protocol mpls_uc label 123 \ action mirred egress redirect dev eth1 tc filter add dev eth0 protocol mpls_uc parent ffff: flower \ action mpls pop protocol ipv4 \ action mirred egress redirect dev eth1 Signed-off-by:Willem de Bruijn <willemb@google.com> Acked-by:
Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by:
-
John Hurley authored
Open vSwitch allows the updating of an existing MPLS header on a packet. In preparation for supporting similar functionality in TC, move this to a common skb helper function. Signed-off-by:
-
John Hurley authored
Open vSwitch provides code to pop an MPLS header to a packet. In preparation for supporting this in TC, move the pop code to an skb helper that can be reused. Remove the, now unused, update_ethertype static function from OvS. Signed-off-by:
-
John Hurley authored
Open vSwitch provides code to push an MPLS header to a packet. In preparation for supporting this in TC, move the push code to an skb helper that can be reused. Signed-off-by:
-
git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller authored
Two cases of overlapping changes, nothing fancy. Signed-off-by: -
Willem de Bruijn authored
skb_warn_bad_offload and netdev_rx_csum_fault trigger on hard to debug issues. Dump more state and the header. Optionally dump the entire packet and linear segment. This is required to debug checksum bugs that may include bytes past skb_tail_pointer(). Both call sites call this function inside a net_ratelimit() block. Limit full packet log further to a hard limit of can_dump_full (5). Based on an earlier patch by Cong Wang, see link below. Changes v1 -> v2 - dump frag_list only on full_pkt Link: https://patchwork.ozlabs.org/patch/1000841/Signed-off-by:
-
Willem de Bruijn authored
Processes can request ipv6 flowlabels with cmsg IPV6_FLOWINFO. If not set, by default an autogenerated flowlabel is selected. Explicit flowlabels require a control operation per label plus a datapath check on every connection (every datagram if unconnected). This is particularly expensive on unconnected sockets multiplexing many flows, such as QUIC. In the common case, where no lease is exclusive, the check can be safely elided, as both lease request and check trivially succeed. Indeed, autoflowlabel does the same even with exclusive leases. Elide the check if no process has requested an exclusive lease. fl6_sock_lookup previously returns either a reference to a lease or NULL to denote failure. Modify to return a real error and update all callers. On return NULL, they can use the label and will elide the atomic_dec in fl6_sock_release. This is an optimization. Robust applications still have to revert to requesting leases if the fast path fails due to an exclusive lease. Changes RFC->v1: - use static_key_false_deferred to rate limit jump label operations - call static_key_deferred_flush to stop timers on exit - move decrement out of RCU context - defer optimization also if opt data is associated with a lease - updated all fp6_sock_lookup callers, not just udp Signed-off-by: -
Christoph Paasch authored
If an app is playing tricks to reuse a socket via tcp_disconnect(), bytes_acked/received needs to be reset to 0. Otherwise tcp_info will report the sum of the current and the old connection.. Cc: Eric Dumazet <edumazet@google.com> Fixes: 0df48c26 ("tcp: add tcpi_bytes_acked to tcp_info") Fixes: bdd1f9ed ("tcp: add tcpi_bytes_received to tcp_info") Signed-off-by:
Christoph Paasch <cpaasch@apple.com> Signed-off-by:
Eric Dumazet <edumazet@google.com> Signed-off-by:
-
Vincent Bernat authored
IFLA_BOND_PEER_NOTIF_DELAY was set to the value of downdelay instead of peer_notif_delay. After this change, the correct value is exported. Fixes: 07a4ddec ("bonding: add an option to specify a delay between peer notifications") Signed-off-by:
Vincent Bernat <vincent@bernat.ch> Signed-off-by:
-
Al Viro authored
socket->wq is assign-once, set when we are initializing both struct socket it's in and struct socket_wq it points to. As the matter of fact, the only reason for separate allocation was the ability to RCU-delay freeing of socket_wq. RCU-delaying the freeing of socket itself gets rid of that need, so we can just fold struct socket_wq into the end of struct socket and simplify the life both for sock_alloc_inode() (one allocation instead of two) and for tun/tap oddballs, where we used to embed struct socket and struct socket_wq into the same structure (now - embedding just the struct socket). Note that reference to struct socket_wq in struct sock does remain a reference - that's unchanged. Signed-off-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
-
Al Viro authored
we do have an RCU-delayed part there already (freeing the wq), so it's not like the pipe situation; moreover, it might be worth considering coallocating wq with the rest of struct sock_alloc. ->sk_wq in struct sock would remain a pointer as it is, but the object it normally points to would be coallocated with struct socket... Signed-off-by:
-
