* Re: [PATCH net-next] tcp: add tcp_add_backlog()
From: Eric Dumazet @ 2016-09-22 23:21 UTC (permalink / raw)
To: Marcelo Ricardo Leitner
Cc: David Miller, netdev, Neal Cardwell, Yuchung Cheng
In-Reply-To: <20160922223411.GA17222@localhost.localdomain>
On Thu, 2016-09-22 at 19:34 -0300, Marcelo Ricardo Leitner wrote:
> On Sat, Aug 27, 2016 at 07:37:54AM -0700, Eric Dumazet wrote:
> > +bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)
> > +{
> > + u32 limit = sk->sk_rcvbuf + sk->sk_sndbuf;
> ^^^
> ...
> > + if (!skb->data_len)
> > + skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
> > +
> > + if (unlikely(sk_add_backlog(sk, skb, limit))) {
> ...
> > - } else if (unlikely(sk_add_backlog(sk, skb,
> > - sk->sk_rcvbuf + sk->sk_sndbuf))) {
> ^---- [1]
> > - bh_unlock_sock(sk);
> > - __NET_INC_STATS(net, LINUX_MIB_TCPBACKLOGDROP);
> > + } else if (tcp_add_backlog(sk, skb)) {
>
> Hi Eric, after this patch, do you think we still need to add sk_sndbuf
> as a stretching factor to the backlog here?
>
> It was added by [1] and it was justified that the (s)ack packets were
> just too big for the rx buf size. Maybe this new patch alone is enough
> already, as such packets will have a very small truesize then.
>
> Marcelo
>
> [1] da882c1f2eca ("tcp: sk_add_backlog() is too agressive for TCP")
>
Hi Marcelo
Yes, it is still needed, some drivers provide linear skbs, so the
skb->truesize of ack packets will likely be the same (skb->head points
to a full size frame allocated by the driver)
^ permalink raw reply
* Re: [Patch net-next] net_sched: check NULL on error path in route4_change()
From: Jamal Hadi Salim @ 2016-09-22 23:26 UTC (permalink / raw)
To: Cong Wang, netdev
In-Reply-To: <1474239140-6738-1-git-send-email-xiyou.wangcong@gmail.com>
On 16-09-18 06:52 PM, Cong Wang wrote:
> On error path in route4_change(), 'f' could be NULL,
> so we should check NULL before calling tcf_exts_destroy().
>
> Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()")
> Reported-by: kbuild test robot <fengguang.wu@intel.com>
> Cc: Jamal Hadi Salim <jhs@mojatatu.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
cheers,
jamal
^ permalink raw reply
* Re: [Patch net] sch_qfq: keep backlog updated with qlen
From: Jamal Hadi Salim @ 2016-09-22 23:27 UTC (permalink / raw)
To: Cong Wang, netdev
In-Reply-To: <1474240968-15202-1-git-send-email-xiyou.wangcong@gmail.com>
On 16-09-18 07:22 PM, Cong Wang wrote:
> Reported-by: Stas Nichiporovich <stasn77@gmail.com>
> Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
> Cc: Jamal Hadi Salim <jhs@mojatatu.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
cheers,
jamal
^ permalink raw reply
* Re: [Patch net] sch_sfb: keep backlog updated with qlen
From: Jamal Hadi Salim @ 2016-09-22 23:28 UTC (permalink / raw)
To: Cong Wang, netdev
In-Reply-To: <1474240968-15202-2-git-send-email-xiyou.wangcong@gmail.com>
On 16-09-18 07:22 PM, Cong Wang wrote:
> Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
> Cc: Jamal Hadi Salim <jhs@mojatatu.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
cheers,
jamal
^ permalink raw reply
* [PATCH net-next 0/3] Few minor BPF helper improvements
From: Daniel Borkmann @ 2016-09-22 23:28 UTC (permalink / raw)
To: davem; +Cc: alexei.starovoitov, netdev, Daniel Borkmann
Just a few minor improvements around BPF helpers, first one is a
fix but given this late stage and that it's not really a critical
one, I think net-next is just fine. For details please see the
individual patches.
Thanks!
Daniel Borkmann (3):
bpf: use skb_to_full_sk helper in bpf_skb_under_cgroup
bpf: use bpf_get_smp_processor_id_proto instead of raw one
bpf: add helper to invalidate hash
include/uapi/linux/bpf.h | 7 +++++++
net/core/filter.c | 22 +++++++++++++++++++++-
2 files changed, 28 insertions(+), 1 deletion(-)
--
1.9.3
^ permalink raw reply
* [PATCH net-next 2/3] bpf: use bpf_get_smp_processor_id_proto instead of raw one
From: Daniel Borkmann @ 2016-09-22 23:28 UTC (permalink / raw)
To: davem; +Cc: alexei.starovoitov, netdev, Daniel Borkmann
In-Reply-To: <cover.1474586162.git.daniel@iogearbox.net>
Same motivation as in commit 80b48c445797 ("bpf: don't use raw processor
id in generic helper"), but this time for XDP typed programs. Thus, allow
for preemption checks when we have DEBUG_PREEMPT enabled, and otherwise
use the raw variant.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
---
net/core/filter.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index e5d9977..acf84fb 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2551,6 +2551,8 @@ xdp_func_proto(enum bpf_func_id func_id)
switch (func_id) {
case BPF_FUNC_perf_event_output:
return &bpf_xdp_event_output_proto;
+ case BPF_FUNC_get_smp_processor_id:
+ return &bpf_get_smp_processor_id_proto;
default:
return sk_filter_func_proto(func_id);
}
--
1.9.3
^ permalink raw reply related
* [PATCH net-next 3/3] bpf: add helper to invalidate hash
From: Daniel Borkmann @ 2016-09-22 23:28 UTC (permalink / raw)
To: davem; +Cc: alexei.starovoitov, netdev, Daniel Borkmann
In-Reply-To: <cover.1474586162.git.daniel@iogearbox.net>
Add a small helper that complements 36bbef52c7eb ("bpf: direct packet
write and access for helpers for clsact progs") for invalidating the
current skb->hash after mangling on headers via direct packet write.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
---
include/uapi/linux/bpf.h | 7 +++++++
net/core/filter.c | 18 ++++++++++++++++++
2 files changed, 25 insertions(+)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index e07432b..f09c70b 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -419,6 +419,13 @@ enum bpf_func_id {
*/
BPF_FUNC_csum_update,
+ /**
+ * bpf_set_hash_invalid(skb)
+ * Invalidate current skb>hash.
+ * @skb: pointer to skb
+ */
+ BPF_FUNC_set_hash_invalid,
+
__BPF_FUNC_MAX_ID,
};
diff --git a/net/core/filter.c b/net/core/filter.c
index acf84fb..00351cd 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1777,6 +1777,22 @@ static const struct bpf_func_proto bpf_get_hash_recalc_proto = {
.arg1_type = ARG_PTR_TO_CTX,
};
+BPF_CALL_1(bpf_set_hash_invalid, struct sk_buff *, skb)
+{
+ /* After all direct packet write, this can be used once for
+ * triggering a lazy recalc on next skb_get_hash() invocation.
+ */
+ skb_clear_hash(skb);
+ return 0;
+}
+
+static const struct bpf_func_proto bpf_set_hash_invalid_proto = {
+ .func = bpf_set_hash_invalid,
+ .gpl_only = false,
+ .ret_type = RET_INTEGER,
+ .arg1_type = ARG_PTR_TO_CTX,
+};
+
BPF_CALL_3(bpf_skb_vlan_push, struct sk_buff *, skb, __be16, vlan_proto,
u16, vlan_tci)
{
@@ -2534,6 +2550,8 @@ tc_cls_act_func_proto(enum bpf_func_id func_id)
return &bpf_get_route_realm_proto;
case BPF_FUNC_get_hash_recalc:
return &bpf_get_hash_recalc_proto;
+ case BPF_FUNC_set_hash_invalid:
+ return &bpf_set_hash_invalid_proto;
case BPF_FUNC_perf_event_output:
return &bpf_skb_event_output_proto;
case BPF_FUNC_get_smp_processor_id:
--
1.9.3
^ permalink raw reply related
* [PATCH net-next 1/3] bpf: use skb_to_full_sk helper in bpf_skb_under_cgroup
From: Daniel Borkmann @ 2016-09-22 23:28 UTC (permalink / raw)
To: davem; +Cc: alexei.starovoitov, netdev, Daniel Borkmann
In-Reply-To: <cover.1474586162.git.daniel@iogearbox.net>
We need to use skb_to_full_sk() helper introduced in commit bd5eb35f16a9
("xfrm: take care of request sockets") as otherwise we miss tcp synack
messages, since ownership is on request socket and therefore it would
miss the sk_fullsock() check. Use skb_to_full_sk() as also done similarly
in the bpf_get_cgroup_classid() helper via 2309236c13fe ("cls_cgroup:
get sk_classid only from full sockets") fix to not let this fall through.
Fixes: 4a482f34afcc ("cgroup: bpf: Add bpf_skb_in_cgroup_proto")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
---
net/core/filter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index 0920c2a..e5d9977 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2408,7 +2408,7 @@ BPF_CALL_3(bpf_skb_under_cgroup, struct sk_buff *, skb, struct bpf_map *, map,
struct cgroup *cgrp;
struct sock *sk;
- sk = skb->sk;
+ sk = skb_to_full_sk(skb);
if (!sk || !sk_fullsock(sk))
return -ENOENT;
if (unlikely(idx >= array->map.max_entries))
--
1.9.3
^ permalink raw reply related
* Re: [PATCH iproute2] ss: Support displaying and filtering on socket marks.
From: Stephen Hemminger @ 2016-09-22 23:37 UTC (permalink / raw)
To: Lorenzo Colitti; +Cc: netdev, shemming, zenczykowski
In-Reply-To: <1474473770-81126-1-git-send-email-lorenzo@google.com>
On Thu, 22 Sep 2016 01:02:50 +0900
Lorenzo Colitti <lorenzo@google.com> wrote:
> This allows the user to dump sockets with a given mark (via
> "fwmark = 0x1234/0x1234" or "fwmark = 12345", etc.) , and to
> display the socket marks of dumped sockets.
>
> The relevant kernel commits are: d545caca827b ("net: inet: diag:
> expose the socket mark to privileged processes.") and
> - a52e95abf772 ("net: diag: allow socket bytecode filters to
> match socket marks")
>
> Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Applied to net-next.
^ permalink raw reply
* Re: [PATCH iproute2] misc/ss: tcp cwnd should be unsigned
From: Stephen Hemminger @ 2016-09-22 23:39 UTC (permalink / raw)
To: Hangbin Liu; +Cc: netdev, Phil Sutter
In-Reply-To: <1474533628-5784-1-git-send-email-liuhangbin@gmail.com>
On Thu, 22 Sep 2016 16:40:28 +0800
Hangbin Liu <liuhangbin@gmail.com> wrote:
> tcp->snd_cwd is a u32, but ss treats it like a signed int. This may
> results in negative bandwidth calculations.
>
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Sure applied.
^ permalink raw reply
* Re: [PATCH net-next 4/4] net/sched: act_mirred: Implement ingress actions
From: Jamal Hadi Salim @ 2016-09-22 23:40 UTC (permalink / raw)
To: Shmulik Ladkani, David S. Miller
Cc: WANG Cong, Eric Dumazet, netdev, Shmulik Ladkani
In-Reply-To: <1474550512-7552-5-git-send-email-shmulik.ladkani@gmail.com>
On 16-09-22 09:21 AM, Shmulik Ladkani wrote:
> From: Shmulik Ladkani <shmulik.ladkani@gmail.com>
>
> Up until now, 'action mirred' supported only egress actions (either
> TCA_EGRESS_REDIR or TCA_EGRESS_MIRROR).
>
> This patch implements the corresponding ingress actions
> TCA_INGRESS_REDIR and TCA_INGRESS_MIRROR.
>
> This allows attaching filters whose target is to hand matching skbs into
> the rx processing of a specified device.
>
Thank you for doing this. There was something that made me remove
initial support for this feature - I am blanking out right now but
will find my notes and give more details. It may be around preventing
loops maybe. If that was the thought then:
I am just wondering is there a use case for a packet that is redirected
from egress ethx to ingress of ethy that then requires ingress of ethy
classify? Otherwise you could just set the "dont classify" flag.
i.e SET_TC_NCLS()
cheers,
jamal
^ permalink raw reply
* Re: [PATCH iproute2] ip: Use specific slave id
From: Stephen Hemminger @ 2016-09-22 23:40 UTC (permalink / raw)
To: Hangbin Liu
Cc: netdev, Phil Sutter, Nikolay Aleksandrov, David Ahern,
Sabrina Dubroca
In-Reply-To: <1474365732-6087-1-git-send-email-liuhangbin@gmail.com>
On Tue, 20 Sep 2016 18:02:12 +0800
Hangbin Liu <liuhangbin@gmail.com> wrote:
> The original bond/bridge/vrf and slaves use same id, which make people
> confused. Use bond/bridge/vrf_slave as id name will make code more clear.
>
> Acked-by: Phil Sutter <psutter@redhat.com>
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> ---
Applied
^ permalink raw reply
* Re: [PATCH iproute2 0/2] ip rule: merger iprule_flush and add selector support
From: Stephen Hemminger @ 2016-09-22 23:43 UTC (permalink / raw)
To: Hangbin Liu; +Cc: netdev, Phil Sutter
In-Reply-To: <1474525729-2845-1-git-send-email-liuhangbin@gmail.com>
On Thu, 22 Sep 2016 14:28:47 +0800
Hangbin Liu <liuhangbin@gmail.com> wrote:
> When merge iprule_flush() and iprule_list_or_save(). Renamed
> rtnl_filter_t filter to filter_fn because we want to use global
> variable 'filter' to filter nlmsg in the next patch.
>
> Hangbin Liu (2):
> ip rule: merge ip rule flush and list, save together
> ip rule: add selector support
>
> ip/iprule.c | 295 +++++++++++++++++++++++++++++++++++++++++------------
> man/man8/ip-rule.8 | 6 +-
> 2 files changed, 231 insertions(+), 70 deletions(-)
>
Fix Phil's man page comment and resubmit.
^ permalink raw reply
* Re: [PATCH net-next 0/4] net: dsa: add port fast ageing
From: Andrew Lunn @ 2016-09-22 23:43 UTC (permalink / raw)
To: Vivien Didelot
Cc: netdev, linux-kernel, kernel, David S. Miller, Florian Fainelli,
John Crispin
In-Reply-To: <20160922204924.16229-1-vivien.didelot@savoirfairelinux.com>
On Thu, Sep 22, 2016 at 04:49:20PM -0400, Vivien Didelot wrote:
> Today the DSA drivers are in charge of flushing the MAC addresses
> associated to a port when its STP state changes from Learning or
> Forwarding, to Disabled or Blocking or Listening.
>
> This makes the drivers more complex and hides this generic switch logic.
>
> This patchset introduces a new optional port_fast_age operation to
> dsa_switch_ops, to move this logic to the DSA layer and keep drivers
> simple. b53 and mv88e6xxx are updated accordingly.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply
* Re: [PATCH v2] bpf: Set register type according to is_valid_access()
From: Alexei Starovoitov @ 2016-09-23 0:08 UTC (permalink / raw)
To: Mickaël Salaün
Cc: linux-kernel, Alexei Starovoitov, Andy Lutomirski,
Daniel Borkmann, Kees Cook, Sargun Dhillon, Tejun Heo, netdev
In-Reply-To: <20160922195647.27914-1-mic@digikod.net>
On Thu, Sep 22, 2016 at 09:56:47PM +0200, Mickaël Salaün wrote:
> This fix a pointer leak when an unprivileged eBPF program read a pointer
> value from the context. Even if is_valid_access() returns a pointer
> type, the eBPF verifier replace it with UNKNOWN_VALUE. The register
> value containing an address is then allowed to leak. Moreover, this
> prevented unprivileged eBPF programs to use functions with (legitimate)
> pointer arguments.
>
> This bug is not an issue for now because the only unprivileged eBPF
> program allowed is of type BPF_PROG_TYPE_SOCKET_FILTER and all the types
> from its context are UNKNOWN_VALUE. However, this fix is important for
> future unprivileged eBPF program types which could use pointers in their
> context.
>
> Signed-off-by: Mickaël Salaün <mic@digikod.net>
> Fixes: 969bf05eb3ce ("bpf: direct packet access")
Please drop 'fixes' tag and rewrite commit log.
It's not a fix.
Right now only two reg types can be seen: PTR_TO_PACKET and PTR_TO_PACKET_END.
Both are only in clsact and xdp programs which are root only.
So nothing is leaking at present.
Best case this patch is a pre-patch for some future work.
^ permalink raw reply
* Re: [PATCH net-next v2 0/3] add support for RGMII on GMAC0 through TRGMII hardware module
From: David Miller @ 2016-09-23 0:13 UTC (permalink / raw)
To: sergei.shtylyov
Cc: sean.wang, john, nbd, netdev, linux-kernel, linux-mediatek,
andrew, f.fainelli, keyhaede, objelf
In-Reply-To: <b2157c96-0b5c-5b7a-31c2-9eb4df71c73d@cogentembedded.com>
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Date: Thu, 22 Sep 2016 20:08:47 +0300
> Despite my comments? Sigh...
Sorry, I thought he had addressed your feedback in v2.
I'll wait longer next time.
^ permalink raw reply
* [PATCH net] tcp: fix a compile error in DBGUNDO()
From: Eric Dumazet @ 2016-09-23 0:54 UTC (permalink / raw)
To: David Miller; +Cc: netdev
From: Eric Dumazet <edumazet@google.com>
If DBGUNDO() is enabled (FASTRETRANS_DEBUG > 1), a compile
error will happen, since inet6_sk(sk)->daddr became sk->sk_v6_daddr
Fixes: efe4208f47f9 ("ipv6: make lookups simpler and faster")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
net/ipv4/tcp_input.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 08323bd95f2a..a756b8749a26 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2329,10 +2329,9 @@ static void DBGUNDO(struct sock *sk, const char *msg)
}
#if IS_ENABLED(CONFIG_IPV6)
else if (sk->sk_family == AF_INET6) {
- struct ipv6_pinfo *np = inet6_sk(sk);
pr_debug("Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
msg,
- &np->daddr, ntohs(inet->inet_dport),
+ &sk->sk_v6_daddr, ntohs(inet->inet_dport),
tp->snd_cwnd, tcp_left_out(tp),
tp->snd_ssthresh, tp->prior_ssthresh,
tp->packets_out);
^ permalink raw reply related
* Re: [PATCH net-next] Documentation: devicetree: revise ethernet device-tree binding about TRGMII
From: Sean Wang @ 2016-09-23 2:52 UTC (permalink / raw)
To: sergei.shtylyov
Cc: john, davem, nbd, netdev, linux-kernel, linux-mediatek, keyhaede,
objelf
In-Reply-To: <0582f22e-6e6f-1564-fcdd-1bcfc3562cf3@cogentembedded.com>
Date: Thu, 22 Sep 2016 19:48:47 +0300, Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> wrote:
>On 09/22/2016 07:16 PM, sean.wang@mediatek.com wrote:
>
>> From: Sean Wang <sean.wang@mediatek.com>
>>
>> fix typo in mediatek-net.txt and add phy-mode "trgmii" to ethernet.txt
>
> These changes are unrelated to each other, so there should be 2 separate
>patches. And have the patches I reviewed been merged already, why are you
>sending an incremental patch?
>
okay, I will make them into distinct patchs.
I saw they had been applied so I created an incremental
patch based on codebase after applied.
>> Cc: devicetree@vger.kernel.org
>> Reported-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
>[...]
>
>MBR, Sergei
>
>
^ permalink raw reply
* Re: [PATCH iproute2 2/2] ip rule: add selector support
From: Hangbin Liu @ 2016-09-23 3:06 UTC (permalink / raw)
To: Phil Sutter, Hangbin Liu, network dev, Stephen Hemminger
In-Reply-To: <20160922084553.GA22100@orbyte.nwl.cc>
2016-09-22 16:45 GMT+08:00 Phil Sutter <phil@nwl.cc>:
> On Thu, Sep 22, 2016 at 02:28:49PM +0800, Hangbin Liu wrote:
> [...]
>> diff --git a/man/man8/ip-rule.8 b/man/man8/ip-rule.8
>> index 3508d80..ec0e31d 100644
>> --- a/man/man8/ip-rule.8
>> +++ b/man/man8/ip-rule.8
>> @@ -15,7 +15,8 @@ ip-rule \- routing policy database management
>>
>> .ti -8
>> .B ip rule
>> -.RB "[ " list " ]"
>> +.RB "[ " list
>> +.I "[ " SELECTOR " ]]"
>
> This makes the brackets cursive, too. Better use this instead:
>
> | .RI "[ " SELECTOR " ]]"
Thanks Phil, I'm not familiar with man doc syntax :)
Cheers
Hangbin
^ permalink raw reply
* Re: [PATCH] net: VRF: Fix receiving multicast traffic
From: Mark Tomlinson @ 2016-09-23 3:06 UTC (permalink / raw)
To: David Ahern, netdev@vger.kernel.org
In-Reply-To: <319068be-b1b9-c245-55d6-5e012e57487b@cumulusnetworks.com>
On 09/23/2016 10:41 AM, David Ahern wrote:
> On 9/22/16 4:10 PM, Mark Tomlinson wrote:
>> On 09/23/2016 03:14 AM, David Ahern wrote:
>>> l3mdev devices do not support IPv4 multicast so checking mcast against that device should not be working at all. For that reason I was fine with the change in the previous patch. ie., you want the real ingress device there not the vrf device.
>>>
>>> What test are you running that says your previous patch broke something?
>> Although we do not expect any multicast routing to work in an l3mdev,
>> (IGMP snooping or PIM), we still want to have multicast packets
>> delivered for protocols such as RIP. This was working before my previous
>> patch, but these multicast packets are now dropped. This current patch
>> fixes that again, hopefully still with the benefits of my first patch.
>>
> can you discern which check is making that happen?
>
> It does not make sense to look at the in_device of a vrf device for mcast addresses. For IPv6 linklocal and mcast is specifically blocked. IPv4 should do the same. So, how is RIP getting the packet at all?
This might be due to some other changes we've made for VRF and multicast
but haven't sent upstream. In particular, a change to do_ip_setsockopt()
and its handling of IP_MULTICAST_IF as well as IP_ADD/DROP_MEMBERSHIP. I
am guessing that without these changes, we wouldn't be able to receive
multicast packets in RIP. With our changes, the in_dev->mc_list does
contain the RIP MC address (224.0.0.9) in the master interface, and so
the function ip_check_mc_rcu() returns success with the master only.
Our RIP daemon is VRF-aware. So it does use setsockopt(SO_BINDTODEVICE,
"vrf-master") when running in a VRF. Without following it all the way
down, I believe that it is this that allows the multicast lookup at the
top of ip_check_mc_rcu() to succeed on the vrf-master, but not the
ingress interface. That is, in_dev->mc_list does contain 224.0.0.9 only
on the vrf-master. Provided the lookup in ip_check_mc_rcu() succeeds (im
!= NULL), this function can return success.
Are you interested in the other patches at the moment?
^ permalink raw reply
* [PATCHv2 iproute2 0/2] ip rule: merger iprule_flush and add selector support
From: Hangbin Liu @ 2016-09-23 3:25 UTC (permalink / raw)
To: netdev; +Cc: Stephen Hemminger, Phil Sutter, Hangbin Liu
When merge iprule_flush() and iprule_list_or_save(). Renamed
rtnl_filter_t filter to filter_fn because we want to use global
variable 'filter' to filter nlmsg in the next patch.
Hangbin Liu (2):
ip rule: merge ip rule flush and list, save together
ip rule: add selector support
ip/iprule.c | 295 +++++++++++++++++++++++++++++++++++++++++------------
man/man8/ip-rule.8 | 6 +-
2 files changed, 231 insertions(+), 70 deletions(-)
--
2.5.5
^ permalink raw reply
* [PATCHv2 iproute2 1/2] ip rule: merge ip rule flush and list, save together
From: Hangbin Liu @ 2016-09-23 3:25 UTC (permalink / raw)
To: netdev; +Cc: Stephen Hemminger, Phil Sutter, Hangbin Liu
In-Reply-To: <1474601155-28171-1-git-send-email-liuhangbin@gmail.com>
iprule_flush() and iprule_list_or_save() both call function
rtnl_wilddump_request() and rtnl_dump_filter(). So merge them
together just like other files do.
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
ip/iprule.c | 121 +++++++++++++++++++++++++++---------------------------------
1 file changed, 54 insertions(+), 67 deletions(-)
diff --git a/ip/iprule.c b/ip/iprule.c
index 70562c5..e18505f 100644
--- a/ip/iprule.c
+++ b/ip/iprule.c
@@ -27,6 +27,12 @@
#include "utils.h"
#include "ip_common.h"
+enum list_action {
+ IPRULE_LIST,
+ IPRULE_FLUSH,
+ IPRULE_SAVE,
+};
+
extern struct rtnl_handle rth;
static void usage(void) __attribute__((noreturn));
@@ -243,24 +249,61 @@ static int save_rule(const struct sockaddr_nl *who,
return ret == n->nlmsg_len ? 0 : ret;
}
-static int iprule_list_or_save(int argc, char **argv, int save)
+static int flush_rule(const struct sockaddr_nl *who, struct nlmsghdr *n,
+ void *arg)
+{
+ struct rtnl_handle rth2;
+ struct rtmsg *r = NLMSG_DATA(n);
+ int len = n->nlmsg_len;
+ struct rtattr *tb[FRA_MAX+1];
+
+ len -= NLMSG_LENGTH(sizeof(*r));
+ if (len < 0)
+ return -1;
+
+ parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
+
+ if (tb[FRA_PRIORITY]) {
+ n->nlmsg_type = RTM_DELRULE;
+ n->nlmsg_flags = NLM_F_REQUEST;
+
+ if (rtnl_open(&rth2, 0) < 0)
+ return -1;
+
+ if (rtnl_talk(&rth2, n, NULL, 0) < 0)
+ return -2;
+
+ rtnl_close(&rth2);
+ }
+
+ return 0;
+}
+
+static int iprule_list_flush_or_save(int argc, char **argv, int action)
{
- rtnl_filter_t filter = print_rule;
+ rtnl_filter_t filter_fn;
int af = preferred_family;
if (af == AF_UNSPEC)
af = AF_INET;
if (argc > 0) {
- fprintf(stderr, "\"ip rule %s\" does not take any arguments.\n",
- save ? "save" : "show");
+ fprintf(stderr,
+ "\"ip rule list/flush/save\" does not take any arguments\n");
return -1;
}
- if (save) {
+ switch (action) {
+ case IPRULE_SAVE:
if (save_rule_prep())
return -1;
- filter = save_rule;
+ filter_fn = save_rule;
+ break;
+ case IPRULE_FLUSH:
+ filter_fn = flush_rule;
+ break;
+ default:
+ filter_fn = print_rule;
}
if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
@@ -268,7 +311,7 @@ static int iprule_list_or_save(int argc, char **argv, int save)
return 1;
}
- if (rtnl_dump_filter(&rth, filter, stdout) < 0) {
+ if (rtnl_dump_filter(&rth, filter_fn, stdout) < 0) {
fprintf(stderr, "Dump terminated\n");
return 1;
}
@@ -511,72 +554,16 @@ static int iprule_modify(int cmd, int argc, char **argv)
return 0;
}
-
-static int flush_rule(const struct sockaddr_nl *who, struct nlmsghdr *n,
- void *arg)
-{
- struct rtnl_handle rth2;
- struct rtmsg *r = NLMSG_DATA(n);
- int len = n->nlmsg_len;
- struct rtattr *tb[FRA_MAX+1];
-
- len -= NLMSG_LENGTH(sizeof(*r));
- if (len < 0)
- return -1;
-
- parse_rtattr(tb, FRA_MAX, RTM_RTA(r), len);
-
- if (tb[FRA_PRIORITY]) {
- n->nlmsg_type = RTM_DELRULE;
- n->nlmsg_flags = NLM_F_REQUEST;
-
- if (rtnl_open(&rth2, 0) < 0)
- return -1;
-
- if (rtnl_talk(&rth2, n, NULL, 0) < 0)
- return -2;
-
- rtnl_close(&rth2);
- }
-
- return 0;
-}
-
-static int iprule_flush(int argc, char **argv)
-{
- int af = preferred_family;
-
- if (af == AF_UNSPEC)
- af = AF_INET;
-
- if (argc > 0) {
- fprintf(stderr, "\"ip rule flush\" does not allow arguments\n");
- return -1;
- }
-
- if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
- perror("Cannot send dump request");
- return 1;
- }
-
- if (rtnl_dump_filter(&rth, flush_rule, NULL) < 0) {
- fprintf(stderr, "Flush terminated\n");
- return 1;
- }
-
- return 0;
-}
-
int do_iprule(int argc, char **argv)
{
if (argc < 1) {
- return iprule_list_or_save(0, NULL, 0);
+ return iprule_list_flush_or_save(0, NULL, IPRULE_LIST);
} else if (matches(argv[0], "list") == 0 ||
matches(argv[0], "lst") == 0 ||
matches(argv[0], "show") == 0) {
- return iprule_list_or_save(argc-1, argv+1, 0);
+ return iprule_list_flush_or_save(argc-1, argv+1, IPRULE_LIST);
} else if (matches(argv[0], "save") == 0) {
- return iprule_list_or_save(argc-1, argv+1, 1);
+ return iprule_list_flush_or_save(argc-1, argv+1, IPRULE_SAVE);
} else if (matches(argv[0], "restore") == 0) {
return iprule_restore();
} else if (matches(argv[0], "add") == 0) {
@@ -584,7 +571,7 @@ int do_iprule(int argc, char **argv)
} else if (matches(argv[0], "delete") == 0) {
return iprule_modify(RTM_DELRULE, argc-1, argv+1);
} else if (matches(argv[0], "flush") == 0) {
- return iprule_flush(argc-1, argv+1);
+ return iprule_list_flush_or_save(argc-1, argv+1, IPRULE_FLUSH);
} else if (matches(argv[0], "help") == 0)
usage();
--
2.5.5
^ permalink raw reply related
* [PATCHv2 iproute2 2/2] ip rule: add selector support
From: Hangbin Liu @ 2016-09-23 3:25 UTC (permalink / raw)
To: netdev; +Cc: Stephen Hemminger, Phil Sutter, Hangbin Liu
In-Reply-To: <1474601155-28171-1-git-send-email-liuhangbin@gmail.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
ip/iprule.c | 180 +++++++++++++++++++++++++++++++++++++++++++++++++++--
man/man8/ip-rule.8 | 6 +-
2 files changed, 180 insertions(+), 6 deletions(-)
diff --git a/ip/iprule.c b/ip/iprule.c
index e18505f..42fb6af 100644
--- a/ip/iprule.c
+++ b/ip/iprule.c
@@ -20,6 +20,7 @@
#include <netinet/ip.h>
#include <arpa/inet.h>
#include <string.h>
+#include <linux/if.h>
#include <linux/fib_rules.h>
#include <errno.h>
@@ -41,7 +42,7 @@ static void usage(void)
{
fprintf(stderr, "Usage: ip rule { add | del } SELECTOR ACTION\n");
fprintf(stderr, " ip rule { flush | save | restore }\n");
- fprintf(stderr, " ip rule [ list ]\n");
+ fprintf(stderr, " ip rule [ list [ SELECTOR ]]\n");
fprintf(stderr, "SELECTOR := [ not ] [ from PREFIX ] [ to PREFIX ] [ tos TOS ] [ fwmark FWMARK[/MASK] ]\n");
fprintf(stderr, " [ iif STRING ] [ oif STRING ] [ pref NUMBER ] [ l3mdev ]\n");
fprintf(stderr, "ACTION := [ table TABLE_ID ]\n");
@@ -55,6 +56,105 @@ static void usage(void)
exit(-1);
}
+static struct
+{
+ int not;
+ int l3mdev;
+ int iifmask, oifmask;
+ unsigned int tb;
+ unsigned int tos, tosmask;
+ unsigned int pref, prefmask;
+ unsigned int fwmark, fwmask;
+ char iif[IFNAMSIZ];
+ char oif[IFNAMSIZ];
+ inet_prefix src;
+ inet_prefix dst;
+} filter;
+
+static bool filter_nlmsg(struct nlmsghdr *n, struct rtattr **tb, int host_len)
+{
+ struct rtmsg *r = NLMSG_DATA(n);
+ inet_prefix src = { .family = r->rtm_family };
+ inet_prefix dst = { .family = r->rtm_family };
+ __u32 table;
+
+ if (preferred_family != AF_UNSPEC && r->rtm_family != preferred_family)
+ return false;
+
+ if (filter.prefmask &&
+ filter.pref ^ (tb[FRA_PRIORITY] ? rta_getattr_u32(tb[FRA_PRIORITY]) : 0))
+ return false;
+ if (filter.not && !(r->rtm_flags & FIB_RULE_INVERT))
+ return false;
+
+ if (filter.src.family) {
+ if (tb[FRA_SRC]) {
+ memcpy(&src.data, RTA_DATA(tb[FRA_SRC]),
+ (r->rtm_src_len + 7) / 8);
+ }
+ if (filter.src.family != r->rtm_family ||
+ filter.src.bitlen > r->rtm_src_len ||
+ inet_addr_match(&src, &filter.src, filter.src.bitlen))
+ return false;
+ }
+
+ if (filter.dst.family) {
+ if (tb[FRA_DST]) {
+ memcpy(&dst.data, RTA_DATA(tb[FRA_DST]),
+ (r->rtm_dst_len + 7) / 8);
+ }
+ if (filter.dst.family != r->rtm_family ||
+ filter.dst.bitlen > r->rtm_dst_len ||
+ inet_addr_match(&dst, &filter.dst, filter.dst.bitlen))
+ return false;
+ }
+
+ if (filter.tosmask && filter.tos ^ r->rtm_tos)
+ return false;
+
+ if (filter.fwmark) {
+ __u32 mark = 0;
+ if (tb[FRA_FWMARK])
+ mark = rta_getattr_u32(tb[FRA_FWMARK]);
+ if (filter.fwmark ^ mark)
+ return false;
+ }
+ if (filter.fwmask) {
+ __u32 mask = 0;
+ if (tb[FRA_FWMASK])
+ mask = rta_getattr_u32(tb[FRA_FWMASK]);
+ if (filter.fwmask ^ mask)
+ return false;
+ }
+
+ if (filter.iifmask) {
+ if (tb[FRA_IFNAME]) {
+ if (strcmp(filter.iif, rta_getattr_str(tb[FRA_IFNAME])) != 0)
+ return false;
+ } else {
+ return false;
+ }
+ }
+
+ if (filter.oifmask) {
+ if (tb[FRA_OIFNAME]) {
+ if (strcmp(filter.oif, rta_getattr_str(tb[FRA_OIFNAME])) != 0)
+ return false;
+ } else {
+ return false;
+ }
+ }
+
+ if (filter.l3mdev && !(tb[FRA_L3MDEV] && rta_getattr_u8(tb[FRA_L3MDEV])))
+ return false;
+
+ table = rtm_get_table(r, tb);
+ if (filter.tb > 0 && filter.tb ^ table)
+ return false;
+
+ return true;
+}
+
int print_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
{
FILE *fp = (FILE *)arg;
@@ -77,6 +177,9 @@ int print_rule(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
host_len = af_bit_len(r->rtm_family);
+ if(!filter_nlmsg(n, tb, host_len))
+ return 0;
+
if (n->nlmsg_type == RTM_DELRULE)
fprintf(fp, "Deleted ");
@@ -287,9 +390,9 @@ static int iprule_list_flush_or_save(int argc, char **argv, int action)
if (af == AF_UNSPEC)
af = AF_INET;
- if (argc > 0) {
- fprintf(stderr,
- "\"ip rule list/flush/save\" does not take any arguments\n");
+ if (action != IPRULE_LIST && argc > 0) {
+ fprintf(stderr, "\"ip rule %s\" does not take any arguments.\n",
+ action == IPRULE_SAVE ? "save" : "flush");
return -1;
}
@@ -306,6 +409,75 @@ static int iprule_list_flush_or_save(int argc, char **argv, int action)
filter_fn = print_rule;
}
+ memset(&filter, 0, sizeof(filter));
+
+ while (argc > 0) {
+ if (matches(*argv, "preference") == 0 ||
+ matches(*argv, "order") == 0 ||
+ matches(*argv, "priority") == 0) {
+ __u32 pref;
+ NEXT_ARG();
+ if (get_u32(&pref, *argv, 0))
+ invarg("preference value is invalid\n", *argv);
+ filter.pref = pref;
+ filter.prefmask = 1;
+ } else if (strcmp(*argv, "not") == 0) {
+ filter.not = 1;
+ } else if (strcmp(*argv, "tos") == 0) {
+ __u32 tos;
+ NEXT_ARG();
+ if (rtnl_dsfield_a2n(&tos, *argv))
+ invarg("TOS value is invalid\n", *argv);
+ filter.tos = tos;
+ filter.tosmask = 1;
+ } else if (strcmp(*argv, "fwmark") == 0) {
+ char *slash;
+ __u32 fwmark, fwmask;
+ NEXT_ARG();
+ slash = strchr(*argv, '/');
+ if (slash != NULL)
+ *slash = '\0';
+ if (get_u32(&fwmark, *argv, 0))
+ invarg("fwmark value is invalid\n", *argv);
+ filter.fwmark = fwmark;
+ if (slash) {
+ if (get_u32(&fwmask, slash+1, 0))
+ invarg("fwmask value is invalid\n",
+ slash+1);
+ filter.fwmask = fwmask;
+ }
+ } else if (strcmp(*argv, "dev") == 0 ||
+ strcmp(*argv, "iif") == 0) {
+ NEXT_ARG();
+ strncpy(filter.iif, *argv, IFNAMSIZ);
+ filter.iifmask = 1;
+ } else if (strcmp(*argv, "oif") == 0) {
+ NEXT_ARG();
+ strncpy(filter.oif, *argv, IFNAMSIZ);
+ filter.oifmask = 1;
+ } else if (strcmp(*argv, "l3mdev") == 0) {
+ filter.l3mdev = 1;
+ } else if (matches(*argv, "lookup") == 0 ||
+ matches(*argv, "table") == 0 ) {
+ __u32 tid;
+ NEXT_ARG();
+ if (rtnl_rttable_a2n(&tid, *argv))
+ invarg("table id value is invalid\n", *argv);
+ filter.tb = tid;
+ } else if (matches(*argv, "from") == 0 ||
+ matches(*argv, "src") == 0) {
+ NEXT_ARG();
+ get_prefix(&filter.src, *argv, af);
+ } else {
+ if (matches(*argv, "dst") == 0 ||
+ matches(*argv, "to") == 0) {
+ NEXT_ARG();
+ }
+ get_prefix(&filter.dst, *argv, af);
+ }
+ argc--; argv++;
+ }
+
if (rtnl_wilddump_request(&rth, af, RTM_GETRULE) < 0) {
perror("Cannot send dump request");
return 1;
diff --git a/man/man8/ip-rule.8 b/man/man8/ip-rule.8
index 3508d80..48e4490 100644
--- a/man/man8/ip-rule.8
+++ b/man/man8/ip-rule.8
@@ -15,7 +15,8 @@ ip-rule \- routing policy database management
.ti -8
.B ip rule
-.RB "[ " list " ]"
+.RB "[ " list
+.RI "[ " SELECTOR " ]]"
.ti -8
.B ip rule
@@ -42,7 +43,8 @@ ip-rule \- routing policy database management
.B oif
.IR STRING " ] [ "
.B pref
-.IR NUMBER " ]"
+.IR NUMBER " ] [ "
+.BR l3mdev " ]"
.ti -8
.IR ACTION " := [ "
--
2.5.5
^ permalink raw reply related
* Re: [PATCH net-next v2 1/3] net: ethernet: mediatek: add extension of phy-mode for TRGMII
From: Sean Wang @ 2016-09-23 3:32 UTC (permalink / raw)
To: sergei.shtylyov
Cc: john, davem, nbd, netdev, linux-kernel, linux-mediatek, keyhaede,
objelf
In-Reply-To: <9e375cf6-8283-b6fb-f21f-5d013c3172fa@cogentembedded.com>
Date: Thu, 22 Sep 2016 14:30:53 +0300, Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> wrote:
>>Hello.
>
>On 9/22/2016 5:33 AM, sean.wang@mediatek.com wrote:
>
>> From: Sean Wang <sean.wang@mediatek.com>
>>
>> adds PHY-mode "trgmii" as an extension for the operation mode of the
>> PHY interface for PHY_INTERFACE_MODE_TRGMII.
.. deleted
>> switch (of_get_phy_mode(np)) {
>> + case PHY_INTERFACE_MODE_TRGMII:
>> + mac->trgmii = true;
>> case PHY_INTERFACE_MODE_RGMII_TXID:
>> case PHY_INTERFACE_MODE_RGMII_RXID:
>> case PHY_INTERFACE_MODE_RGMII_ID:
>> diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
>> b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
>> index 7c5e534..e3b9525 100644
>> --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
>> +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
>> @@ -529,6 +529,8 @@ struct mtk_eth {
>> * @hw: Backpointer to our main datastruture
>> * @hw_stats: Packet statistics counter
>> * @phy_dev: The attached PHY if available
>> + * @trgmii Indicate if the MAC uses TRGMII connected to internal
>> + switch
>> */
>> struct mtk_mac {
>> int id;
>> @@ -539,6 +541,7 @@ struct mtk_mac {
>> struct phy_device *phy_dev;
>> __be32 hwlro_ip[MTK_MAX_LRO_IP_CNT];
>> int hwlro_ip_cnt;
>> + bool trgmii;
>
> I don't see where this is used.
I set trgmii as below
switch (of_get_phy_mode(np)) {
case PHY_INTERFACE_MODE_TRGMII:
mac->trgmii = true;
case PHY_INTERFACE_MODE_RGMII_TXID:
>[...]
>> diff --git a/include/linux/phy.h b/include/linux/phy.h index
>> 2d24b28..e25f183 100644
>> --- a/include/linux/phy.h
>> +++ b/include/linux/phy.h
>> @@ -80,6 +80,7 @@ typedef enum {
>> PHY_INTERFACE_MODE_XGMII,
>> PHY_INTERFACE_MODE_MOCA,
>> PHY_INTERFACE_MODE_QSGMII,
>> + PHY_INTERFACE_MODE_TRGMII,
>> PHY_INTERFACE_MODE_MAX,
>> } phy_interface_t;
>>
>> @@ -123,6 +124,8 @@ static inline const char *phy_modes(phy_interface_t interface)
>> return "moca";
>> case PHY_INTERFACE_MODE_QSGMII:
>> return "qsgmii";
>> + case PHY_INTERFACE_MODE_TRGMII:
>> + return "trgmii";
>> default:
>> return "unknown";
>> }
>
> I think this should be done in a separate phylib patch.
this patch is applied, so I am so little confused how to do this.
next time I will note placing modification for generic layer
into separate patch.
>
>MBR, Sergei
>
^ permalink raw reply
* Re: [PATCH net-next 4/4] net/sched: act_mirred: Implement ingress actions
From: Shmulik Ladkani @ 2016-09-23 5:11 UTC (permalink / raw)
To: Jamal Hadi Salim
Cc: David S. Miller, WANG Cong, Eric Dumazet, netdev, Shmulik Ladkani
In-Reply-To: <4387324a-de66-aa1b-86f0-1a9a2f8294f5@mojatatu.com>
Hi,
On Thu, 22 Sep 2016 19:40:15 -0400 Jamal Hadi Salim <jhs@mojatatu.com> wrote:
> On 16-09-22 09:21 AM, Shmulik Ladkani wrote:
> > From: Shmulik Ladkani <shmulik.ladkani@gmail.com>
> >
> > Up until now, 'action mirred' supported only egress actions (either
> > TCA_EGRESS_REDIR or TCA_EGRESS_MIRROR).
> >
> > This patch implements the corresponding ingress actions
> > TCA_INGRESS_REDIR and TCA_INGRESS_MIRROR.
> >
> > This allows attaching filters whose target is to hand matching skbs into
> > the rx processing of a specified device.
>
> Thank you for doing this. There was something that made me remove
> initial support for this feature - I am blanking out right now but
> will find my notes and give more details.
Thanks Jamal, appreciate any details.
Was wondering why it's missing, googled a bit with no meaningful
results, so speculated the following:
Some time long ago, initial 'mirred' purpose was to facilitate ifb.
Therefore 'egress redirect' was implemented. Jamal probably left the
'ingress' support for a later time :)
One interesting usecase for 'ingress redirect' is creating "rx bouncing"
construct (like macvlan/macvtap/ipvlan) but applied according to custom
logic.
> It may be around preventing loops maybe.
Could be, but personally, I treat these constructs as (powerful)
building blocks, and "with great power comes great responsibility".
Even today, one may create loops using existing 'egress redirect',
e.g. this rediculously errorneous construct:
# ip l add v0 type veth peer name v0p
# tc filter add dev v0p parent ffff: basic \
action mirred egress redirect dev v0
Regards,
Shmulik
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox