* Re: [PATCH v6 3/4] Bluetooth: Allow driver specific cmd timeout handling
From: Marcel Holtmann @ 2019-01-25 7:51 UTC (permalink / raw)
To: Rajat Jain
Cc: Johan Hedberg, Greg Kroah-Hartman, David S. Miller,
Dmitry Torokhov, Alex Hung, linux-bluetooth, linux-kernel,
linux-usb, netdev, rajatxjain, dtor, raghuram.hegde,
chethan.tumkur.narayan, sukumar.ghorai
In-Reply-To: <20190124232814.252661-3-rajatja@google.com>
Hi Rajat,
> Add a hook to allow the BT driver to do device or command specific
> handling in case of timeouts. This is to be used by Intel driver to
> reset the device after certain number of timeouts.
>
> Signed-off-by: Rajat Jain <rajatja@google.com>
> ---
> v6: Dropped the "sent command" parameter from cmd_timeout()
> v5: Drop the quirk, and rename the hook function to cmd_timeout()
> v4: same as v1
> v3: same as v1
> v2: same as v1
>
> include/net/bluetooth/hci_core.h | 1 +
> net/bluetooth/hci_core.c | 3 +++
> 2 files changed, 4 insertions(+)
patch has been applied to bluetooth-next tree.
Regards
Marcel
^ permalink raw reply
* Re: [PATCH v6 4/4] Bluetooth: btusb: Use the cmd_timeout method to reset the Intel BT chip
From: Marcel Holtmann @ 2019-01-25 7:51 UTC (permalink / raw)
To: Rajat Jain
Cc: Johan Hedberg, Greg Kroah-Hartman, David S. Miller,
Dmitry Torokhov, Alex Hung, linux-bluetooth, linux-kernel,
linux-usb, netdev, rajatxjain, dtor, raghuram.hegde,
chethan.tumkur.narayan, sukumar.ghorai
In-Reply-To: <20190124232814.252661-4-rajatja@google.com>
Hi Rajat,
> If the platform provides it, use the reset gpio to reset the Intel BT
> chip, as part of cmd_timeout handling. This has been found helpful on
> Intel bluetooth controllers where the firmware gets stuck and the only
> way out is a hard reset pin provided by the platform.
>
> Signed-off-by: Rajat Jain <rajatja@google.com>
> ---
> v6: Move the cmd_timeout() hook assignment with other hooks, move the
> reset_gpio check in the timeout function.
> v5: Rename the hook to cmd_timeout, and wait for 5 timeouts before
> resetting the device.
> v4: Use data->flags instead of clearing the quirk in btusb_hw_reset()
> v3: Better error handling for gpiod_get_optional()
> v2: Handle the EPROBE_DEFER case.
>
> drivers/bluetooth/btusb.c | 54 +++++++++++++++++++++++++++++++++++++++
> 1 file changed, 54 insertions(+)
patch has been applied to bluetooth-next tree.
Regards
Marcel
^ permalink raw reply
* [PATCH 03/10] xfrm: policy: increment xfrm_hash_generation on hash rebuild
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Florian Westphal <fw@strlen.de>
Hash rebuild will re-set all the inexact entries, then re-insert them.
Lookups that can occur in parallel will therefore not find any policies.
This was safe when lookups were still guarded by rwlock.
After rcu-ification, lookups check the hash_generation seqcount to detect
when a hash resize takes place. Hash rebuild missed the needed increment.
Hash resizes and hash rebuilds cannot occur in parallel (both acquire
hash_resize_mutex), so just increment xfrm_hash_generation, like resize.
Fixes: a7c44247f704e3 ("xfrm: policy: make xfrm_policy_lookup_bytype lockless")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_policy.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 628b389af2ba..d8fba27a4bfb 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1235,6 +1235,7 @@ static void xfrm_hash_rebuild(struct work_struct *work)
} while (read_seqretry(&net->xfrm.policy_hthresh.lock, seq));
spin_lock_bh(&net->xfrm.xfrm_policy_lock);
+ write_seqcount_begin(&xfrm_policy_hash_generation);
/* make sure that we can insert the indirect policies again before
* we start with destructive action.
@@ -1334,6 +1335,7 @@ static void xfrm_hash_rebuild(struct work_struct *work)
out_unlock:
__xfrm_policy_inexact_flush(net);
+ write_seqcount_end(&xfrm_policy_hash_generation);
spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
mutex_unlock(&hash_resize_mutex);
--
2.17.1
^ permalink raw reply related
* pull request (net): ipsec 2019-01-25
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
1) Several patches to fix the fallout from the recent
tree based policy lookup work. From Florian Westphal.
2) Fix VTI for IPCOMP for 'not compressed' IPCOMP packets.
We need an extra IPIP handler to process these packets
correctly. From Su Yanjun.
3) Fix validation of template and selector families for
MODE_ROUTEOPTIMIZATION with ipv4-in-ipv6 packets.
This can lead to a stack-out-of-bounds because
flowi4 struct is treated as flowi6 struct.
Fix from Florian Westphal.
4) Restore the default behaviour of the xfrm set-mark
in the output path. This was changed accidentally
when mark setting was extended to the input path.
From Benedict Wong.
Please pull or let me know if there are problems.
Thanks!
The following changes since commit d972f3dce8d161e2142da0ab1ef25df00e2f21a9:
packet: Do not leak dev refcounts on error exit (2019-01-08 21:41:40 -0500)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git master
for you to fetch changes up to e2612cd496e7b465711d219ea6118893d7253f52:
xfrm: Make set-mark default behavior backward compatible (2019-01-16 13:10:55 +0100)
----------------------------------------------------------------
Benedict Wong (1):
xfrm: Make set-mark default behavior backward compatible
Florian Westphal (8):
selftests: xfrm: add block rules with adjacent/overlapping subnets
xfrm: policy: use hlist rcu variants on inexact insert, part 2
xfrm: policy: increment xfrm_hash_generation on hash rebuild
xfrm: policy: delete inexact policies from inexact list on hash rebuild
xfrm: policy: fix reinsertion on node merge
selftests: xfrm: alter htresh to trigger move of policies to hash table
xfrm: policy: fix infinite loop when merging src-nodes
xfrm: refine validation of template and selector families
Su Yanjun (1):
vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
net/ipv4/ip_vti.c | 50 ++++++++++
net/xfrm/xfrm_policy.c | 63 ++++++------
net/xfrm/xfrm_user.c | 13 ++-
tools/testing/selftests/net/xfrm_policy.sh | 153 ++++++++++++++++++++++++-----
4 files changed, 223 insertions(+), 56 deletions(-)
^ permalink raw reply
* [PATCH 04/10] xfrm: policy: delete inexact policies from inexact list on hash rebuild
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Florian Westphal <fw@strlen.de>
An xfrm hash rebuild has to reset the inexact policy list before the
policies get re-inserted: A change of hash thresholds will result in
policies to get moved from inexact tree to the policy hash table.
If the thresholds are increased again later, they get moved from hash
table to inexact tree.
We must unlink all policies from the inexact tree before re-insertion.
Otherwise 'migrate' may find policies that are in main hash table a
second time, when it searches the inexact lists.
Furthermore, re-insertion without deletion can cause elements ->next to
point back to itself, causing soft lockups or double-frees.
Reported-by: syzbot+9d971dd21eb26567036b@syzkaller.appspotmail.com
Fixes: 9cf545ebd591da ("xfrm: policy: store inexact policies in a tree ordered by destination address")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_policy.c | 23 ++++++++++-------------
1 file changed, 10 insertions(+), 13 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index d8fba27a4bfb..24dfd1e47cf0 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -680,16 +680,6 @@ static void xfrm_hash_resize(struct work_struct *work)
mutex_unlock(&hash_resize_mutex);
}
-static void xfrm_hash_reset_inexact_table(struct net *net)
-{
- struct xfrm_pol_inexact_bin *b;
-
- lockdep_assert_held(&net->xfrm.xfrm_policy_lock);
-
- list_for_each_entry(b, &net->xfrm.inexact_bins, inexact_bins)
- INIT_HLIST_HEAD(&b->hhead);
-}
-
/* Make sure *pol can be inserted into fastbin.
* Useful to check that later insert requests will be sucessful
* (provided xfrm_policy_lock is held throughout).
@@ -1279,10 +1269,14 @@ static void xfrm_hash_rebuild(struct work_struct *work)
}
/* reset the bydst and inexact table in all directions */
- xfrm_hash_reset_inexact_table(net);
-
for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
- INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]);
+ struct hlist_node *n;
+
+ hlist_for_each_entry_safe(policy, n,
+ &net->xfrm.policy_inexact[dir],
+ bydst_inexact_list)
+ hlist_del_init(&policy->bydst_inexact_list);
+
hmask = net->xfrm.policy_bydst[dir].hmask;
odst = net->xfrm.policy_bydst[dir].table;
for (i = hmask; i >= 0; i--)
@@ -1314,6 +1308,9 @@ static void xfrm_hash_rebuild(struct work_struct *work)
newpos = NULL;
chain = policy_hash_bysel(net, &policy->selector,
policy->family, dir);
+
+ hlist_del_rcu(&policy->bydst);
+
if (!chain) {
void *p = xfrm_policy_inexact_insert(policy, dir, 0);
--
2.17.1
^ permalink raw reply related
* [PATCH 07/10] xfrm: policy: fix infinite loop when merging src-nodes
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Florian Westphal <fw@strlen.de>
With very small change to test script we can trigger softlockup due to
bogus assignment of 'p' (policy to be examined) on restart.
Previously the two to-be-merged nodes had same address/prefixlength pair,
so no erase/reinsert was necessary, we only had to append the list from
node a to b.
If prefix lengths are different, the node has to be deleted and re-inserted
into the tree, with the updated prefix length. This was broken; due to
bogus update to 'p' this loops forever.
Add a 'restart' label and use that instead.
While at it, don't perform the unneeded reinserts of the policies that
are already sorted into the 'new' node.
A previous patch in this series made xfrm_policy_inexact_list_reinsert()
use the relative position indicator to sort policies according to age in
case priorities are identical.
Fixes: 6ac098b2a9d30 ("xfrm: policy: add 2nd-level saddr trees for inexact policies")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_policy.c | 15 +++++++--------
tools/testing/selftests/net/xfrm_policy.sh | 4 ++--
2 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index e691683223ee..8cfd75b62396 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -886,12 +886,13 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
struct rb_root *new,
u16 family)
{
- struct rb_node **p, *parent = NULL;
struct xfrm_pol_inexact_node *node;
+ struct rb_node **p, *parent;
/* we should not have another subtree here */
WARN_ON_ONCE(!RB_EMPTY_ROOT(&n->root));
-
+restart:
+ parent = NULL;
p = &new->rb_node;
while (*p) {
u8 prefixlen;
@@ -911,12 +912,11 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
} else {
struct xfrm_policy *tmp;
- hlist_for_each_entry(tmp, &node->hhead, bydst)
- tmp->bydst_reinsert = true;
- hlist_for_each_entry(tmp, &n->hhead, bydst)
+ hlist_for_each_entry(tmp, &n->hhead, bydst) {
tmp->bydst_reinsert = true;
+ hlist_del_rcu(&tmp->bydst);
+ }
- INIT_HLIST_HEAD(&node->hhead);
xfrm_policy_inexact_list_reinsert(net, node, family);
if (node->prefixlen == n->prefixlen) {
@@ -928,8 +928,7 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
kfree_rcu(n, rcu);
n = node;
n->prefixlen = prefixlen;
- *p = new->rb_node;
- parent = NULL;
+ goto restart;
}
}
diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
index 8ce54600d4d1..71d7fdc513c1 100755
--- a/tools/testing/selftests/net/xfrm_policy.sh
+++ b/tools/testing/selftests/net/xfrm_policy.sh
@@ -78,8 +78,8 @@ do_overlap()
# adds a new node in the 10.0.0.0/24 tree (dst node exists).
ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
- # adds a 10.2.0.0/24 node, but for different dst.
- ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.1.0/24 dir fwd priority 200 action block
+ # adds a 10.2.0.0/23 node, but for different dst.
+ ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
# dst now overlaps with the 10.0.1.0/24 ESP policy in fwd.
# kernel must 'promote' existing one (10.0.0.0/24) to 10.0.0.0/23.
--
2.17.1
^ permalink raw reply related
* [PATCH 08/10] vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Su Yanjun <suyj.fnst@cn.fujitsu.com>
Recently we run a network test over ipcomp virtual tunnel.We find that
if a ipv4 packet needs fragment, then the peer can't receive
it.
We deep into the code and find that when packet need fragment the smaller
fragment will be encapsulated by ipip not ipcomp. So when the ipip packet
goes into xfrm, it's skb->dev is not properly set. The ipv4 reassembly code
always set skb'dev to the last fragment's dev. After ipv4 defrag processing,
when the kernel rp_filter parameter is set, the skb will be drop by -EXDEV
error.
This patch adds compatible support for the ipip process in ipcomp virtual tunnel.
Signed-off-by: Su Yanjun <suyj.fnst@cn.fujitsu.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/ipv4/ip_vti.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index d7b43e700023..68a21bf75dd0 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -74,6 +74,33 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
return 0;
}
+static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi,
+ int encap_type)
+{
+ struct ip_tunnel *tunnel;
+ const struct iphdr *iph = ip_hdr(skb);
+ struct net *net = dev_net(skb->dev);
+ struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
+
+ tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
+ iph->saddr, iph->daddr, 0);
+ if (tunnel) {
+ if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+ goto drop;
+
+ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
+
+ skb->dev = tunnel->dev;
+
+ return xfrm_input(skb, nexthdr, spi, encap_type);
+ }
+
+ return -EINVAL;
+drop:
+ kfree_skb(skb);
+ return 0;
+}
+
static int vti_rcv(struct sk_buff *skb)
{
XFRM_SPI_SKB_CB(skb)->family = AF_INET;
@@ -82,6 +109,14 @@ static int vti_rcv(struct sk_buff *skb)
return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
}
+static int vti_rcv_ipip(struct sk_buff *skb)
+{
+ XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+
+ return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0);
+}
+
static int vti_rcv_cb(struct sk_buff *skb, int err)
{
unsigned short family;
@@ -435,6 +470,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
.priority = 100,
};
+static struct xfrm_tunnel ipip_handler __read_mostly = {
+ .handler = vti_rcv_ipip,
+ .err_handler = vti4_err,
+ .priority = 0,
+};
+
static int __net_init vti_init_net(struct net *net)
{
int err;
@@ -603,6 +644,13 @@ static int __init vti_init(void)
if (err < 0)
goto xfrm_proto_comp_failed;
+ msg = "ipip tunnel";
+ err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
+ if (err < 0) {
+ pr_info("%s: cant't register tunnel\n",__func__);
+ goto xfrm_tunnel_failed;
+ }
+
msg = "netlink interface";
err = rtnl_link_register(&vti_link_ops);
if (err < 0)
@@ -612,6 +660,8 @@ static int __init vti_init(void)
rtnl_link_failed:
xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
+xfrm_tunnel_failed:
+ xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
xfrm_proto_comp_failed:
xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
xfrm_proto_ah_failed:
--
2.17.1
^ permalink raw reply related
* [PATCH 01/10] selftests: xfrm: add block rules with adjacent/overlapping subnets
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Florian Westphal <fw@strlen.de>
The existing script lacks a policy pattern that triggers 'tree node
merges' in the kernel.
Consider adding policy affecting following subnet:
pol1: dst 10.0.0.0/22
pol2: dst 10.0.0.0/23 # adds to existing 10.0.0.0/22 node
-> no problems here. But now, lets consider reverse order:
pol1: dst 10.0.0.0/24
pol2: dst 10.0.0.0/23 # CANNOT add to existing node
When second policy gets added, the kernel must check that the new node
("10.0.0.0/23") doesn't overlap with any existing subnet.
Example:
dst 10.0.0.0/24
dst 10.0.0.1/24
dst 10.0.0.0/23
When the third policy gets added, the kernel must replace the nodes for
the 10.0.0.0/24 and 10.0.0.1/24 policies with a single one and must merge
all the subtrees/lists stored in those nodes into the new node.
The existing test cases only have overlaps with a single node, so no
merging takes place (we can always remove the 'old' node and replace
it with the new subnet prefix).
Add a few 'block policies' in a pattern that triggers this, with a priority
that will make kernel prefer the 'esp' rules.
Make sure the 'tunnel ping' tests still pass after they have been added.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
tools/testing/selftests/net/xfrm_policy.sh | 109 +++++++++++++++++----
1 file changed, 91 insertions(+), 18 deletions(-)
diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
index 8db35b99457c..b5a1b565a7e6 100755
--- a/tools/testing/selftests/net/xfrm_policy.sh
+++ b/tools/testing/selftests/net/xfrm_policy.sh
@@ -46,6 +46,58 @@ do_esp() {
ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
}
+# add policies with different netmasks, to make sure kernel carries
+# the policies contained within new netmask over when search tree is
+# re-built.
+# peer netns that are supposed to be encapsulated via esp have addresses
+# in the 10.0.1.0/24 and 10.0.2.0/24 subnets, respectively.
+#
+# Adding a policy for '10.0.1.0/23' will make it necessary to
+# alter the prefix of 10.0.1.0 subnet.
+# In case new prefix overlaps with existing node, the node and all
+# policies it carries need to be merged with the existing one(s).
+#
+# Do that here.
+do_overlap()
+{
+ local ns=$1
+
+ # adds new nodes to tree (neither network exists yet in policy database).
+ ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+
+ # adds a new node in the 10.0.0.0/24 tree (dst node exists).
+ ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+
+ # adds a 10.2.0.0/24 node, but for different dst.
+ ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.1.0/24 dir fwd priority 200 action block
+
+ # dst now overlaps with the 10.0.1.0/24 ESP policy in fwd.
+ # kernel must 'promote' existing one (10.0.0.0/24) to 10.0.0.0/23.
+ # But 10.0.0.0/23 also includes existing 10.0.1.0/24, so that node
+ # also has to be merged too, including source-sorted subtrees.
+ # old:
+ # 10.0.0.0/24 (node 1 in dst tree of the bin)
+ # 10.1.0.0/24 (node in src tree of dst node 1)
+ # 10.2.0.0/24 (node in src tree of dst node 1)
+ # 10.0.1.0/24 (node 2 in dst tree of the bin)
+ # 10.0.2.0/24 (node in src tree of dst node 2)
+ # 10.2.0.0/24 (node in src tree of dst node 2)
+ #
+ # The next 'policy add' adds dst '10.0.0.0/23', which means
+ # that dst node 1 and dst node 2 have to be merged including
+ # the sub-tree. As no duplicates are allowed, policies in
+ # the two '10.0.2.0/24' are also merged.
+ #
+ # after the 'add', internal search tree should look like this:
+ # 10.0.0.0/23 (node in dst tree of bin)
+ # 10.0.2.0/24 (node in src tree of dst node)
+ # 10.1.0.0/24 (node in src tree of dst node)
+ # 10.2.0.0/24 (node in src tree of dst node)
+ #
+ # 10.0.0.0/24 and 10.0.1.0/24 nodes have been merged as 10.0.0.0/23.
+ ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
+}
+
do_esp_policy_get_check() {
local ns=$1
local lnet=$2
@@ -160,6 +212,41 @@ check_xfrm() {
return $lret
}
+check_exceptions()
+{
+ logpostfix="$1"
+ local lret=0
+
+ # ping to .254 should be excluded from the tunnel (exception is in place).
+ check_xfrm 0 254
+ if [ $? -ne 0 ]; then
+ echo "FAIL: expected ping to .254 to fail ($logpostfix)"
+ lret=1
+ else
+ echo "PASS: ping to .254 bypassed ipsec tunnel ($logpostfix)"
+ fi
+
+ # ping to .253 should use use ipsec due to direct policy exception.
+ check_xfrm 1 253
+ if [ $? -ne 0 ]; then
+ echo "FAIL: expected ping to .253 to use ipsec tunnel ($logpostfix)"
+ lret=1
+ else
+ echo "PASS: direct policy matches ($logpostfix)"
+ fi
+
+ # ping to .2 should use ipsec.
+ check_xfrm 1 2
+ if [ $? -ne 0 ]; then
+ echo "FAIL: expected ping to .2 to use ipsec tunnel ($logpostfix)"
+ lret=1
+ else
+ echo "PASS: policy matches ($logpostfix)"
+ fi
+
+ return $lret
+}
+
#check for needed privileges
if [ "$(id -u)" -ne 0 ];then
echo "SKIP: Need root privileges"
@@ -270,31 +357,17 @@ do_exception ns4 10.0.3.10 10.0.3.1 10.0.1.253 10.0.1.240/28
do_exception ns3 dead:3::1 dead:3::10 dead:2::fd dead:2:f0::/96
do_exception ns4 dead:3::10 dead:3::1 dead:1::fd dead:1:f0::/96
-# ping to .254 should now be excluded from the tunnel
-check_xfrm 0 254
+check_exceptions "exceptions"
if [ $? -ne 0 ]; then
- echo "FAIL: expected ping to .254 to fail"
ret=1
-else
- echo "PASS: ping to .254 bypassed ipsec tunnel"
fi
-# ping to .253 should use use ipsec due to direct policy exception.
-check_xfrm 1 253
-if [ $? -ne 0 ]; then
- echo "FAIL: expected ping to .253 to use ipsec tunnel"
- ret=1
-else
- echo "PASS: direct policy matches"
-fi
+# insert block policies with adjacent/overlapping netmasks
+do_overlap ns3
-# ping to .2 should use ipsec.
-check_xfrm 1 2
+check_exceptions "exceptions and block policies"
if [ $? -ne 0 ]; then
- echo "FAIL: expected ping to .2 to use ipsec tunnel"
ret=1
-else
- echo "PASS: policy matches"
fi
for i in 1 2 3 4;do ip netns del ns$i;done
--
2.17.1
^ permalink raw reply related
* [PATCH 10/10] xfrm: Make set-mark default behavior backward compatible
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Benedict Wong <benedictwong@google.com>
Fixes 9b42c1f179a6, which changed the default route lookup behavior for
tunnel mode SAs in the outbound direction to use the skb mark, whereas
previously mark=0 was used if the output mark was unspecified. In
mark-based routing schemes such as Android’s, this change in default
behavior causes routing loops or lookup failures.
This patch restores the default behavior of using a 0 mark while still
incorporating the skb mark if the SET_MARK (and SET_MARK_MASK) is
specified.
Tested with additions to Android's kernel unit test suite:
https://android-review.googlesource.com/c/kernel/tests/+/860150
Fixes: 9b42c1f179a6 ("xfrm: Extend the output_mark to support input direction and masking")
Signed-off-by: Benedict Wong <benedictwong@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_policy.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 8cfd75b62396..ba0a4048c846 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2600,7 +2600,10 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
dst_copy_metrics(dst1, dst);
if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
- __u32 mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
+ __u32 mark = 0;
+
+ if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m)
+ mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
family = xfrm[i]->props.family;
dst = xfrm_dst_lookup(xfrm[i], tos, fl->flowi_oif,
--
2.17.1
^ permalink raw reply related
* [PATCH 09/10] xfrm: refine validation of template and selector families
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Florian Westphal <fw@strlen.de>
The check assumes that in transport mode, the first templates family
must match the address family of the policy selector.
Syzkaller managed to build a template using MODE_ROUTEOPTIMIZATION,
with ipv4-in-ipv6 chain, leading to following splat:
BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x1db/0x1854
Read of size 4 at addr ffff888063e57aa0 by task a.out/2050
xfrm_state_find+0x1db/0x1854
xfrm_tmpl_resolve+0x100/0x1d0
xfrm_resolve_and_create_bundle+0x108/0x1000 [..]
Problem is that addresses point into flowi4 struct, but xfrm_state_find
treats them as being ipv6 because it uses templ->encap_family is used
(AF_INET6 in case of reproducer) rather than family (AF_INET).
This patch inverts the logic: Enforce 'template family must match
selector' EXCEPT for tunnel and BEET mode.
In BEET and Tunnel mode, xfrm_tmpl_resolve_one will have remote/local
address pointers changed to point at the addresses found in the template,
rather than the flowi ones, so no oob read will occur.
Reported-by: 3ntr0py1337@gmail.com
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_user.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 277c1c46fe94..c6d26afcf89d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1488,10 +1488,15 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
if (!ut[i].family)
ut[i].family = family;
- if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
- (ut[i].family != prev_family))
- return -EINVAL;
-
+ switch (ut[i].mode) {
+ case XFRM_MODE_TUNNEL:
+ case XFRM_MODE_BEET:
+ break;
+ default:
+ if (ut[i].family != prev_family)
+ return -EINVAL;
+ break;
+ }
if (ut[i].mode >= XFRM_MODE_MAX)
return -EINVAL;
--
2.17.1
^ permalink raw reply related
* [PATCH 05/10] xfrm: policy: fix reinsertion on node merge
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Florian Westphal <fw@strlen.de>
"newpos" has wrong scope. It must be NULL on each iteration of the loop.
Otherwise, when policy is to be inserted at the start, we would instead
insert at point found by the previous loop-iteration instead.
Also, we need to unlink the policy before we reinsert it to the new node,
else we can get next-points-to-self loops.
Because policies are only ordered by priority it is irrelevant which policy
is "more recent" except when two policies have same priority.
(the more recent one is placed after the older one).
In these cases, we can use the ->pos id number to know which one is the
'older': the higher the id, the more recent the policy.
So we only need to unlink all policies from the node that is about to be
removed, and insert them to the replacement node.
Fixes: 9cf545ebd591da ("xfrm: policy: store inexact policies in a tree ordered by destination address")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_policy.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 24dfd1e47cf0..e691683223ee 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -823,13 +823,13 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,
u16 family)
{
unsigned int matched_s, matched_d;
- struct hlist_node *newpos = NULL;
struct xfrm_policy *policy, *p;
matched_s = 0;
matched_d = 0;
list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
+ struct hlist_node *newpos = NULL;
bool matches_s, matches_d;
if (!policy->bydst_reinsert)
@@ -839,7 +839,10 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,
policy->bydst_reinsert = false;
hlist_for_each_entry(p, &n->hhead, bydst) {
- if (policy->priority >= p->priority)
+ if (policy->priority > p->priority)
+ newpos = &p->bydst;
+ else if (policy->priority == p->priority &&
+ policy->pos > p->pos)
newpos = &p->bydst;
else
break;
@@ -955,12 +958,11 @@ static void xfrm_policy_inexact_node_merge(struct net *net,
family);
}
- hlist_for_each_entry(tmp, &v->hhead, bydst)
- tmp->bydst_reinsert = true;
- hlist_for_each_entry(tmp, &n->hhead, bydst)
+ hlist_for_each_entry(tmp, &v->hhead, bydst) {
tmp->bydst_reinsert = true;
+ hlist_del_rcu(&tmp->bydst);
+ }
- INIT_HLIST_HEAD(&n->hhead);
xfrm_policy_inexact_list_reinsert(net, n, family);
}
--
2.17.1
^ permalink raw reply related
* [PATCH 06/10] selftests: xfrm: alter htresh to trigger move of policies to hash table
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Florian Westphal <fw@strlen.de>
... and back to inexact tree.
Repeat ping test after each htresh change: lookup results must not change.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
tools/testing/selftests/net/xfrm_policy.sh | 44 ++++++++++++++++++++--
1 file changed, 40 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
index b5a1b565a7e6..8ce54600d4d1 100755
--- a/tools/testing/selftests/net/xfrm_policy.sh
+++ b/tools/testing/selftests/net/xfrm_policy.sh
@@ -28,6 +28,19 @@ KEY_AES=0x0123456789abcdef0123456789012345
SPI1=0x1
SPI2=0x2
+do_esp_policy() {
+ local ns=$1
+ local me=$2
+ local remote=$3
+ local lnet=$4
+ local rnet=$5
+
+ # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
+ ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
+ # to fwd decrypted packets after esp processing:
+ ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+}
+
do_esp() {
local ns=$1
local me=$2
@@ -40,10 +53,7 @@ do_esp() {
ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $rnet dst $lnet
ip -net $ns xfrm state add src $me dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet
- # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
- ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
- # to fwd decrypted packets after esp processing:
- ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+ do_esp_policy $ns $me $remote $lnet $rnet
}
# add policies with different netmasks, to make sure kernel carries
@@ -370,6 +380,32 @@ if [ $? -ne 0 ]; then
ret=1
fi
+for n in ns3 ns4;do
+ ip -net $n xfrm policy set hthresh4 28 24 hthresh6 126 125
+ sleep $((RANDOM%5))
+done
+
+check_exceptions "exceptions and block policies after hresh changes"
+
+# full flush of policy db, check everything gets freed incl. internal meta data
+ip -net ns3 xfrm policy flush
+
+do_esp_policy ns3 10.0.3.1 10.0.3.10 10.0.1.0/24 10.0.2.0/24
+do_exception ns3 10.0.3.1 10.0.3.10 10.0.2.253 10.0.2.240/28
+
+# move inexact policies to hash table
+ip -net ns3 xfrm policy set hthresh4 16 16
+
+sleep $((RANDOM%5))
+check_exceptions "exceptions and block policies after hthresh change in ns3"
+
+# restore original hthresh settings -- move policies back to tables
+for n in ns3 ns4;do
+ ip -net $n xfrm policy set hthresh4 32 32 hthresh6 128 128
+ sleep $((RANDOM%5))
+done
+check_exceptions "exceptions and block policies after hresh change to normal"
+
for i in 1 2 3 4;do ip netns del ns$i;done
exit $ret
--
2.17.1
^ permalink raw reply related
* [PATCH 02/10] xfrm: policy: use hlist rcu variants on inexact insert, part 2
From: Steffen Klassert @ 2019-01-25 7:44 UTC (permalink / raw)
To: David Miller; +Cc: Herbert Xu, Steffen Klassert, netdev
In-Reply-To: <20190125074426.31053-1-steffen.klassert@secunet.com>
From: Florian Westphal <fw@strlen.de>
This function was modeled on the 'exact' insert one, which did not use
the rcu variant either.
When I fixed the 'exact' insert I forgot to propagate this to my
development tree, so the inexact variant retained the bug.
Fixes: 9cf545ebd591d ("xfrm: policy: store inexact policies in a tree ordered by destination address")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/xfrm/xfrm_policy.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 934492bad8e0..628b389af2ba 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -856,9 +856,9 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,
}
if (newpos)
- hlist_add_behind(&policy->bydst, newpos);
+ hlist_add_behind_rcu(&policy->bydst, newpos);
else
- hlist_add_head(&policy->bydst, &n->hhead);
+ hlist_add_head_rcu(&policy->bydst, &n->hhead);
/* paranoia checks follow.
* Check that the reinserted policy matches at least
--
2.17.1
^ permalink raw reply related
* [PATCH iproute2-next 2/2] ss: add AF_XDP support
From: bjorn.topel @ 2019-01-25 7:18 UTC (permalink / raw)
To: netdev, stephen; +Cc: Björn Töpel, magnus.karlsson, magnus.karlsson
In-Reply-To: <20190125071848.25959-1-bjorn.topel@gmail.com>
From: Björn Töpel <bjorn.topel@intel.com>
AF_XDP is an address family that is optimized for high performance
packet processing.
This patch adds AF_XDP support to ss(8) so that sockets can be queried
and monitored.
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
---
man/man8/ss.8 | 9 ++-
misc/ss.c | 168 +++++++++++++++++++++++++++++++++++++++++++++++++-
2 files changed, 172 insertions(+), 5 deletions(-)
diff --git a/man/man8/ss.8 b/man/man8/ss.8
index 553a6cf46f0e..bc120fd78716 100644
--- a/man/man8/ss.8
+++ b/man/man8/ss.8
@@ -324,16 +324,19 @@ Display SCTP sockets.
.B \-\-vsock
Display vsock sockets (alias for -f vsock).
.TP
+.B \-\-xdp
+Display XDP sockets (alias for -f xdp).
+.TP
.B \-f FAMILY, \-\-family=FAMILY
Display sockets of type FAMILY.
-Currently the following families are supported: unix, inet, inet6, link, netlink, vsock.
+Currently the following families are supported: unix, inet, inet6, link, netlink, vsock, xdp.
.TP
.B \-A QUERY, \-\-query=QUERY, \-\-socket=QUERY
List of socket tables to dump, separated by commas. The following identifiers
are understood: all, inet, tcp, udp, raw, unix, packet, netlink, unix_dgram,
unix_stream, unix_seqpacket, packet_raw, packet_dgram, dccp, sctp,
-vsock_stream, vsock_dgram. Any item in the list may optionally be prefixed by
-an exclamation mark
+vsock_stream, vsock_dgram, xdp Any item in the list may optionally be
+prefixed by an exclamation mark
.RB ( ! )
to exclude that socket table from being dumped.
.TP
diff --git a/misc/ss.c b/misc/ss.c
index 3589ebedc5a0..8e5cc16b6f52 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -42,6 +42,7 @@
#include <linux/unix_diag.h>
#include <linux/netdevice.h> /* for MAX_ADDR_LEN */
#include <linux/filter.h>
+#include <linux/xdp_diag.h>
#include <linux/packet_diag.h>
#include <linux/netlink_diag.h>
#include <linux/sctp.h>
@@ -198,6 +199,7 @@ enum {
VSOCK_ST_DB,
VSOCK_DG_DB,
TIPC_DB,
+ XDP_DB,
MAX_DB
};
@@ -309,6 +311,10 @@ static const struct filter default_dbs[MAX_DB] = {
.states = TIPC_SS_CONN,
.families = FAMILY_MASK(AF_TIPC),
},
+ [XDP_DB] = {
+ .states = (1 << SS_CLOSE),
+ .families = FAMILY_MASK(AF_XDP),
+ },
};
static const struct filter default_afs[AF_MAX] = {
@@ -340,6 +346,10 @@ static const struct filter default_afs[AF_MAX] = {
.dbs = (1 << TIPC_DB),
.states = TIPC_SS_CONN,
},
+ [AF_XDP] = {
+ .dbs = (1 << XDP_DB),
+ .states = (1 << SS_CLOSE),
+ },
};
static int do_default = 1;
@@ -366,7 +376,7 @@ static int filter_db_parse(struct filter *f, const char *s)
ENTRY(all, UDP_DB, DCCP_DB, TCP_DB, RAW_DB,
UNIX_ST_DB, UNIX_DG_DB, UNIX_SQ_DB,
PACKET_R_DB, PACKET_DG_DB, NETLINK_DB,
- SCTP_DB, VSOCK_ST_DB, VSOCK_DG_DB),
+ SCTP_DB, VSOCK_ST_DB, VSOCK_DG_DB, XDP_DB),
ENTRY(inet, UDP_DB, DCCP_DB, TCP_DB, SCTP_DB, RAW_DB),
ENTRY(udp, UDP_DB),
ENTRY(dccp, DCCP_DB),
@@ -391,6 +401,7 @@ static int filter_db_parse(struct filter *f, const char *s)
ENTRY(v_str, VSOCK_ST_DB), /* alias for vsock_stream */
ENTRY(vsock_dgram, VSOCK_DG_DB),
ENTRY(v_dgr, VSOCK_DG_DB), /* alias for vsock_dgram */
+ ENTRY(xdp, XDP_DB),
#undef ENTRY
};
bool enable = true;
@@ -1331,6 +1342,9 @@ static void sock_state_print(struct sockstat *s)
case AF_VSOCK:
sock_name = vsock_netid_name(s->type);
break;
+ case AF_XDP:
+ sock_name = "xdp";
+ break;
default:
sock_name = "unknown";
}
@@ -4055,6 +4069,142 @@ static int packet_show(struct filter *f)
return rc;
}
+static int xdp_stats_print(struct sockstat *s, const struct filter *f)
+{
+ const char *addr, *port;
+ char q_str[16];
+
+ s->local.family = s->remote.family = AF_XDP;
+
+ if (f->f) {
+ if (run_ssfilter(f->f, s) == 0)
+ return 1;
+ }
+
+ sock_state_print(s);
+
+ if (s->iface) {
+ addr = xll_index_to_name(s->iface);
+ snprintf(q_str, sizeof(q_str), "q%d", s->lport);
+ port = q_str;
+ sock_addr_print(addr, ":", port, NULL);
+ } else {
+ sock_addr_print("", "*", "", NULL);
+ }
+
+ sock_addr_print("", "*", "", NULL);
+
+ proc_ctx_print(s);
+
+ if (show_details)
+ sock_details_print(s);
+
+ return 0;
+}
+
+static void xdp_show_ring(const char *name, struct xdp_diag_ring *ring)
+{
+ out("\n\t%s(", name);
+ out("entries:%u", ring->entries);
+ out(")");
+}
+
+static void xdp_show_umem(struct xdp_diag_umem *umem, struct xdp_diag_ring *fr,
+ struct xdp_diag_ring *cr)
+{
+ out("\n\tumem(");
+ out("id:%u", umem->id);
+ out(",size:%llu", umem->size);
+ out(",num_pages:%u", umem->num_pages);
+ out(",chunk_size:%u", umem->chunk_size);
+ out(",headroom:%u", umem->headroom);
+ out(",ifindex:%u", umem->ifindex);
+ out(",qid:%u", umem->queue_id);
+ out(",zc:%u", umem->flags & XDP_DU_F_ZEROCOPY);
+ out(",refs:%u", umem->refs);
+ out(")");
+
+ if (fr)
+ xdp_show_ring("fr", fr);
+ if (cr)
+ xdp_show_ring("cr", cr);
+}
+
+static int xdp_show_sock(struct nlmsghdr *nlh, void *arg)
+{
+ struct xdp_diag_ring *rx = NULL, *tx = NULL, *fr = NULL, *cr = NULL;
+ struct xdp_diag_msg *msg = NLMSG_DATA(nlh);
+ struct rtattr *tb[XDP_DIAG_MAX + 1];
+ struct xdp_diag_info *info = NULL;
+ struct xdp_diag_umem *umem = NULL;
+ const struct filter *f = arg;
+ struct sockstat stat = {};
+
+ parse_rtattr(tb, XDP_DIAG_MAX, (struct rtattr *)(msg + 1),
+ nlh->nlmsg_len - NLMSG_LENGTH(sizeof(*msg)));
+
+ stat.type = msg->xdiag_type;
+ stat.ino = msg->xdiag_ino;
+ stat.state = SS_CLOSE;
+ stat.sk = cookie_sk_get(&msg->xdiag_cookie[0]);
+
+ if (tb[XDP_DIAG_INFO]) {
+ info = RTA_DATA(tb[XDP_DIAG_INFO]);
+ stat.iface = info->ifindex;
+ stat.lport = info->queue_id;
+ }
+
+ if (tb[XDP_DIAG_UID])
+ stat.uid = rta_getattr_u32(tb[XDP_DIAG_UID]);
+ if (tb[XDP_DIAG_RX_RING])
+ rx = RTA_DATA(tb[XDP_DIAG_RX_RING]);
+ if (tb[XDP_DIAG_TX_RING])
+ tx = RTA_DATA(tb[XDP_DIAG_TX_RING]);
+ if (tb[XDP_DIAG_UMEM])
+ umem = RTA_DATA(tb[XDP_DIAG_UMEM]);
+ if (tb[XDP_DIAG_UMEM_FILL_RING])
+ fr = RTA_DATA(tb[XDP_DIAG_UMEM_FILL_RING]);
+ if (tb[XDP_DIAG_UMEM_COMPLETION_RING])
+ cr = RTA_DATA(tb[XDP_DIAG_UMEM_COMPLETION_RING]);
+ if (tb[XDP_DIAG_MEMINFO]) {
+ __u32 *skmeminfo = RTA_DATA(tb[XDP_DIAG_MEMINFO]);
+
+ stat.rq = skmeminfo[SK_MEMINFO_RMEM_ALLOC];
+ }
+
+ if (xdp_stats_print(&stat, f))
+ return 0;
+
+ if (show_details) {
+ if (rx)
+ xdp_show_ring("rx", rx);
+ if (tx)
+ xdp_show_ring("tx", tx);
+ if (umem)
+ xdp_show_umem(umem, fr, cr);
+ }
+
+ if (show_mem)
+ print_skmeminfo(tb, XDP_DIAG_MEMINFO); // really?
+
+
+ return 0;
+}
+
+static int xdp_show(struct filter *f)
+{
+ DIAG_REQUEST(req, struct xdp_diag_req r);
+
+ if (!filter_af_get(f, AF_XDP) || !(f->states & (1 << SS_CLOSE)))
+ return 0;
+
+ req.r.sdiag_family = AF_XDP;
+ req.r.xdiag_show = XDP_SHOW_INFO | XDP_SHOW_RING_CFG | XDP_SHOW_UMEM |
+ XDP_SHOW_MEMINFO;
+
+ return handle_netlink_request(f, &req.nlh, sizeof(req), xdp_show_sock);
+}
+
static int netlink_show_one(struct filter *f,
int prot, int pid, unsigned int groups,
int state, int dst_pid, unsigned int dst_group,
@@ -4442,6 +4592,9 @@ static int generic_show_sock(struct nlmsghdr *nlh, void *arg)
case AF_VSOCK:
ret = vsock_show_sock(nlh, arg);
break;
+ case AF_XDP:
+ ret = xdp_show_sock(nlh, arg);
+ break;
default:
ret = -1;
}
@@ -4679,7 +4832,7 @@ static void _usage(FILE *dest)
" --tipc display only TIPC sockets\n"
" --vsock display only vsock sockets\n"
" -f, --family=FAMILY display sockets of type FAMILY\n"
-" FAMILY := {inet|inet6|link|unix|netlink|vsock|tipc|help}\n"
+" FAMILY := {inet|inet6|link|unix|netlink|vsock|tipc|xdp|help}\n"
"\n"
" -K, --kill forcibly close sockets, display what was closed\n"
" -H, --no-header Suppress header line\n"
@@ -4765,6 +4918,9 @@ static int scan_state(const char *state)
#define OPT_TIPCSOCK 257
#define OPT_TIPCINFO 258
+/* Values of 'x' are already used so a non-character is used */
+#define OPT_XDPSOCK 259
+
static const struct option long_opts[] = {
{ "numeric", 0, 0, 'n' },
{ "resolve", 0, 0, 'r' },
@@ -4802,6 +4958,7 @@ static const struct option long_opts[] = {
{ "tipcinfo", 0, 0, OPT_TIPCINFO},
{ "kill", 0, 0, 'K' },
{ "no-header", 0, 0, 'H' },
+ { "xdp", 0, 0, OPT_XDPSOCK},
{ 0 }
};
@@ -4889,6 +5046,9 @@ int main(int argc, char *argv[])
case '0':
filter_af_set(¤t_filter, AF_PACKET);
break;
+ case OPT_XDPSOCK:
+ filter_af_set(¤t_filter, AF_XDP);
+ break;
case 'f':
if (strcmp(optarg, "inet") == 0)
filter_af_set(¤t_filter, AF_INET);
@@ -4904,6 +5064,8 @@ int main(int argc, char *argv[])
filter_af_set(¤t_filter, AF_TIPC);
else if (strcmp(optarg, "vsock") == 0)
filter_af_set(¤t_filter, AF_VSOCK);
+ else if (strcmp(optarg, "xdp") == 0)
+ filter_af_set(¤t_filter, AF_XDP);
else if (strcmp(optarg, "help") == 0)
help();
else {
@@ -5101,6 +5263,8 @@ int main(int argc, char *argv[])
vsock_show(¤t_filter);
if (current_filter.dbs & (1<<TIPC_DB))
tipc_show(¤t_filter);
+ if (current_filter.dbs & (1<<XDP_DB))
+ xdp_show(¤t_filter);
if (show_users || show_proc_ctx || show_sock_ctx)
user_ent_destroy();
--
2.19.1
^ permalink raw reply related
* [PATCH iproute2-next 1/2] uapi: add xdp_diag.h
From: bjorn.topel @ 2019-01-25 7:18 UTC (permalink / raw)
To: netdev, stephen; +Cc: Björn Töpel, magnus.karlsson, magnus.karlsson
In-Reply-To: <20190125071848.25959-1-bjorn.topel@gmail.com>
From: Björn Töpel <bjorn.topel@intel.com>
Import xdp_diag.h that was introduced in Linux kernel commit
a36b38aa2af6 ("xsk: add sock_diag interface for AF_XDP").
Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
---
include/uapi/linux/xdp_diag.h | 72 +++++++++++++++++++++++++++++++++++
1 file changed, 72 insertions(+)
create mode 100644 include/uapi/linux/xdp_diag.h
diff --git a/include/uapi/linux/xdp_diag.h b/include/uapi/linux/xdp_diag.h
new file mode 100644
index 000000000000..78b2591a7782
--- /dev/null
+++ b/include/uapi/linux/xdp_diag.h
@@ -0,0 +1,72 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * xdp_diag: interface for query/monitor XDP sockets
+ * Copyright(c) 2019 Intel Corporation.
+ */
+
+#ifndef _LINUX_XDP_DIAG_H
+#define _LINUX_XDP_DIAG_H
+
+#include <linux/types.h>
+
+struct xdp_diag_req {
+ __u8 sdiag_family;
+ __u8 sdiag_protocol;
+ __u16 pad;
+ __u32 xdiag_ino;
+ __u32 xdiag_show;
+ __u32 xdiag_cookie[2];
+};
+
+struct xdp_diag_msg {
+ __u8 xdiag_family;
+ __u8 xdiag_type;
+ __u16 pad;
+ __u32 xdiag_ino;
+ __u32 xdiag_cookie[2];
+};
+
+#define XDP_SHOW_INFO (1 << 0) /* Basic information */
+#define XDP_SHOW_RING_CFG (1 << 1)
+#define XDP_SHOW_UMEM (1 << 2)
+#define XDP_SHOW_MEMINFO (1 << 3)
+
+enum {
+ XDP_DIAG_NONE,
+ XDP_DIAG_INFO,
+ XDP_DIAG_UID,
+ XDP_DIAG_RX_RING,
+ XDP_DIAG_TX_RING,
+ XDP_DIAG_UMEM,
+ XDP_DIAG_UMEM_FILL_RING,
+ XDP_DIAG_UMEM_COMPLETION_RING,
+ XDP_DIAG_MEMINFO,
+ __XDP_DIAG_MAX,
+};
+
+#define XDP_DIAG_MAX (__XDP_DIAG_MAX - 1)
+
+struct xdp_diag_info {
+ __u32 ifindex;
+ __u32 queue_id;
+};
+
+struct xdp_diag_ring {
+ __u32 entries; /*num descs */
+};
+
+#define XDP_DU_F_ZEROCOPY (1 << 0)
+
+struct xdp_diag_umem {
+ __u64 size;
+ __u32 id;
+ __u32 num_pages;
+ __u32 chunk_size;
+ __u32 headroom;
+ __u32 ifindex;
+ __u32 queue_id;
+ __u32 flags;
+ __u32 refs;
+};
+
+#endif /* _LINUX_XDP_DIAG_H */
--
2.19.1
^ permalink raw reply related
* [PATCH iproute2-next 0/2] ss: AF_XDP monitoring support
From: bjorn.topel @ 2019-01-25 7:18 UTC (permalink / raw)
To: netdev, stephen; +Cc: Björn Töpel, magnus.karlsson, magnus.karlsson
From: Björn Töpel <bjorn.topel@gmail.com>
Hi!
This short series teaches ss about AF_XDP monitoring support using the
sock_diag interface.
The AF_XDP monitoring support was merged to kernel in commit
dbbd79ae166f ("Merge branch 'af-xdp-sock-diag'"), via the bpf-next
tree.
Note libc has to know about AF_XDP for iproute2 to build properly
after this series. For glibc, AF_XDP was added in commit 38b0593e9a86
("Add PF_XDP, AF_XDP and SOL_XDP from Linux 4.18 to bits/socket.h.")
and for musl AF_XDP was introduced in commit 0a9a5c20c7eb ("add AF_XDP
to sys/socket.h from linux v4.18").
Thanks,
Björn
Björn Töpel (2):
uapi: add xdp_diag.h
ss: add AF_XDP support
include/uapi/linux/xdp_diag.h | 72 +++++++++++++++
man/man8/ss.8 | 9 +-
misc/ss.c | 168 +++++++++++++++++++++++++++++++++-
3 files changed, 244 insertions(+), 5 deletions(-)
create mode 100644 include/uapi/linux/xdp_diag.h
--
2.19.1
^ permalink raw reply
* Re: [PATCH stable 4.4 05/11] ip: use rb trees for IP frag queue.
From: Greg KH @ 2019-01-25 7:07 UTC (permalink / raw)
To: maowenan; +Cc: netdev, eric.dumazet, davem, stable, edumazet
In-Reply-To: <3975b7f9-eb04-e288-276d-f8871f94bc22@huawei.com>
On Fri, Jan 25, 2019 at 09:50:35AM +0800, maowenan wrote:
>
>
> On 2019/1/25 1:58, Greg KH wrote:
> > On Wed, Jan 23, 2019 at 10:19:40AM +0800, Mao Wenan wrote:
> >> From: Peter Oskolkov <posk@google.com>
> >>
> >> [ Upstream commit fa0f527358bd900ef92f925878ed6bfbd51305cc ]
> >
> > This commit is not in the 4.14.y tree, any specific reason why not?
>
> I found the commit 6b921536f1707a240e6f53843f1f26231016fda5 net: sk_buff rbnode reorg in v4.14.y
> including the fixes.
Yes, that commit is really bffa72cf7f9d ("net: sk_buff rbnode reorg"),
which is upstream in 4.14.15 and 4.15. But fa0f527358bd ("ip: use rb
trees for IP frag queue.") is not in 4.14 at all, it showed up in
4.9.134 and 4.19. Why did the 4.14 tree not need it and 4.9 and 4.4
does?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH net-next] bridge: remove duplicated include from br_multicast.c
From: David Miller @ 2019-01-25 6:52 UTC (permalink / raw)
To: yuehaibing; +Cc: nikolay, roopa, linux-kernel, netdev, bridge
In-Reply-To: <20190125025909.11924-1-yuehaibing@huawei.com>
From: YueHaibing <yuehaibing@huawei.com>
Date: Fri, 25 Jan 2019 10:59:09 +0800
> Remove duplicated include.
>
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Applied.
^ permalink raw reply
* Re: WoL broken in r8169.c since kernel 4.19
From: Heiner Kallweit @ 2019-01-25 6:49 UTC (permalink / raw)
To: Marc Haber; +Cc: netdev@vger.kernel.org
In-Reply-To: <20190125055919.GB27062@torres.zugschlus.de>
Hi Marc,
thanks a lot for the detailed analysis. That this ethtool sequence
ethtool -s <if> wol d
ethtool -s <if> wol g
helps makes me think that the following patch should help too.
Could you please test?
There's an old story why this call is missing. Certain notebooks immediately
woke up again if WoL was enabled and they were suspended. I think they
should disable WoL instead of having this hack in the driver.
Heiner
---
drivers/net/ethernet/realtek/r8169.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 04c403539..1d101659f 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7423,6 +7423,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
}
tp->saved_wolopts = __rtl8169_get_wol(tp);
+ device_set_wakeup_enable(&pdev->dev, tp->saved_wolopts);
mutex_init(&tp->wk.mutex);
INIT_WORK(&tp->wk.work, rtl_task);
--
2.20.1
On 25.01.2019 06:59, Marc Haber wrote:
> Hi Heiner,
>
> On Tue, Jan 22, 2019 at 07:47:45PM +0100, Heiner Kallweit wrote:
>> Which version of 4.18 are you running that is ok? To check the code ..
>
> I pull over drivers/net/ethernet/realtek/r8169.c from an unpacked
> 4.18.16 source tree. It sets RTL8169_VERSION "2.3LK-NAPI". The last
> commit in this file's history is
>
> commit 241e5a13a5ad75fd0b5a47b583e098fa08917d5c
> Author: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
> Date: Thu Oct 11 16:02:10 2018 +0200
>
> r8169: set RX_MULTI_EN bit in RxConfig for 8168F-family chips
>
> Unfortunately, very different r8169.c in 4.20.3 also sets RTL8169_VERSION "2.3LK-NAPI", so we cannot use this as identification.
>
>> Based on what I wrote above, could you try the following sequence and
>> check whether wake from S3 works then?
>>
>> ethtool -s <if> wol d
>> ethtool -s <if> wol g
>
> This test was done with the Debian kernel package 4.20.0-trunk-amd64,
> which contains a kernel 4.20.1 compiled on 2018-12-24, from Debian's
> experimental repository.
>
> This are my steps:
> (1) ethtool -s lanc0 wol d
> (2) ethtool -s lanc0 wol g
> (3) systemctl suspend
> (4) system gows down into Suspend to RAM, an audible *click* from a
> relay, power LED blinking, Switch reporting that the ethernet link state
> changed from 1000Full to down and then to 10Full.
> (5) sent a magic packet
> (6) *click* system up again. This is good.
> (7) switch reported link state change from 10Full to down and then to
> 1000Full
> (8) system and network operational
> (9) shut down the system completely, remove power. all LEDs off, link
> down
> (10) re-plug power, all LEDs off, link 10Full
> (11) push power button, bring system up again with Debian's 4.20 kernel
> (12) link up at 1000Full
> (12a) take register dump, exhibit 12a
> (13) systemctl suspend
> (14) system gows down into Suspend to RAM, an audible *click* from a
> relay, power LED blinking, Switch reporting that the ethernet link state
> changed from 1000Full to down and then to 10Full.
> (15) send magic packet identical to step (5)
> (16) system remains suspended, blinking LED; link 10Full
> (17) push any key on keyboard
> (18) *click* system up again. This is good.
> (19) switch reported link state change from 10Full to down and then to
> 1000Full
> (19a) take register dump, exhibit 19a
> (20) system and network operational
> (21) repeat steps (1) through (5)
> (22) system reacts to magic packet and wakes up
> (23) ethtool -s lanc0 wol d
> (24) ethtool -s lanc0 wol g
> (25) take register dump, exhibit 25
> (26) systemctl suspend
> (27) system gows down into Suspend to RAM, an audible *click* from a
> relay, power LED blinking, Switch reporting that the ethernet link state
> changed from 1000Full to down and then to 10Full.
> (28) sent a magic packet
> (29) *click* system up again. This is good.
> (30) switch reported link state change from 10Full to down and then to
> 1000Full
> (31) take register dump, exhibit 31
> (32) system and network operational
>
> So, our hypothesis is now that the older driver does "something" that
> the new driver doesn't, but what is needed for my machine to wake up on
> magic packet from suspend to RAM. the two ethtool calls do seem to fix
> that.
>
> Unfortunately, exhibits 19a, 25 and 31 are identical, and exhibit 12a
> only differs in a single line, PHY access holding 0x8001796d instead of
> 0x80040de1. So, whatever the two ethtools do, it is not visible in the
> register dump.
>
> I repaeted the experiment with stock 4.20.4, with the same results, and
> 4.20.4 with a r8169.c transplant from 4.18.16, with the result of
> ethtool not needed.
>
> Exhibits from the stock 4.20.4 experiments:
> exhibit-4.20.4-preeth-presleep - direct after boot
> exhibit-4.20.4-preeth-postsleep - after suspend with manual wakeup needed
> exhibit-4.20.4-posteth-presleep - after the two ethtool calls
> exhibit-4.20.4-posteth-postsleep - after successful wake on lan
>
> Exhibits from the 4.20.4+transplant experiments:
> exhibit-4.18-presleep - direct after boot
> exhibit-4.18-postsleep - after successful wake on LAN.
>
> I hope this helps. Let me know if additional data is helpful.
>
> Greetings
> Marc
>
^ permalink raw reply related
* Re: [PATCH net] ibmveth: Do not process frames after calling napi_reschedule
From: David Miller @ 2019-01-25 6:48 UTC (permalink / raw)
To: tlfalcon; +Cc: netdev
In-Reply-To: <1548350221-8512-1-git-send-email-tlfalcon@linux.ibm.com>
From: Thomas Falcon <tlfalcon@linux.ibm.com>
Date: Thu, 24 Jan 2019 11:17:01 -0600
> The IBM virtual ethernet driver's polling function continues
> to process frames after rescheduling NAPI, resulting in a warning
> if it exhausted its budget. Do not restart polling after calling
> napi_reschedule. Instead let frames be processed in the following
> instance.
>
> Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
Applied.
^ permalink raw reply
* Re: [PATCH] net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP
From: David Miller @ 2019-01-25 6:45 UTC (permalink / raw)
To: zenczykowski; +Cc: maze, ast, daniel, linux-kernel, netdev
In-Reply-To: <20190124110702.140834-1-zenczykowski@gmail.com>
From: Maciej Żenczykowski <zenczykowski@gmail.com>
Date: Thu, 24 Jan 2019 03:07:02 -0800
> From: Maciej Żenczykowski <maze@google.com>
>
> __bpf_redirect() and act_mirred checks this boolean
> to determine whether to prefix an ethernet header.
>
> Signed-off-by: Maciej Żenczykowski <maze@google.com>
Applied.
^ permalink raw reply
* Re: [PATCH net-next] mlxfw: Replace license text with SPDX identifiers and adjust copyrights
From: David Miller @ 2019-01-25 6:34 UTC (permalink / raw)
To: shalomt; +Cc: netdev, idosch, jiri, mlxsw, slavash
In-Reply-To: <20190124073253.30929-1-shalomt@mellanox.com>
From: Shalom Toledo <shalomt@mellanox.com>
Date: Thu, 24 Jan 2019 07:33:05 +0000
> Signed-off-by: Shalom Toledo <shalomt@mellanox.com>
> Acked-by: Jiri Pirko <jiri@mellanox.com>
Applied.
^ permalink raw reply
* Re: [PATCH] net: usb: asix: ax88772_bind return error when hw_reset fail
From: David Miller @ 2019-01-25 6:33 UTC (permalink / raw)
To: zhang.run
Cc: marcel.ziswiler, lynxis, linux-usb, netdev, linux-kernel,
xue.zhihong, wang.yi59
In-Reply-To: <1548308929-7727-1-git-send-email-zhang.run@zte.com.cn>
From: Zhang Run <zhang.run@zte.com.cn>
Date: Thu, 24 Jan 2019 13:48:49 +0800
> The ax88772_bind() should return error code immediately when the PHY
> was not reset properly through ax88772a_hw_reset().
> Otherwise, The asix_get_phyid() will block when get the PHY
> Identifier from the PHYSID1 MII registers through asix_mdio_read()
> due to the PHY isn't ready. Furthermore, it will produce a lot of
> error message cause system crash.As follows:
> asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write
> reg index 0x0000: -71
> asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to send
> software reset: ffffffb9
> asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write
> reg index 0x0000: -71
> asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable
> software MII access
> asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read
> reg index 0x0000: -71
> asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write
> reg index 0x0000: -71
> asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable
> software MII access
> asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read
> reg index 0x0000: -71
> ...
>
> Signed-off-by: Zhang Run <zhang.run@zte.com.cn>
> Reviewed-by: Yang Wei <yang.wei9@zte.com.cn>
Applied.
^ permalink raw reply
* Re: [PATCH] tipc: remove dead code in struct tipc_topsrv
From: David Miller @ 2019-01-25 6:31 UTC (permalink / raw)
To: zhangzl2013; +Cc: jon.maloy, ying.xue, netdev, tipc-discussion, linux-kernel
In-Reply-To: <1548295601-23063-1-git-send-email-zhangzl2013@126.com>
From: Zhaolong Zhang <zhangzl2013@126.com>
Date: Thu, 24 Jan 2019 10:06:41 +0800
> max_rcvbuf_size is no longer used since commit "414574a0af36".
>
> Signed-off-by: Zhaolong Zhang <zhangzl2013@126.com>
Applied.
^ permalink raw reply
* Re: [PATCH net 1/1] MAINTAINERS: Update cavium networking drivers
From: David Miller @ 2019-01-25 6:31 UTC (permalink / raw)
To: sudarsana.kalluru; +Cc: netdev, Ameen.Rahman
In-Reply-To: <20190124020320.31400-1-sudarsana.kalluru@cavium.com>
From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
Date: Wed, 23 Jan 2019 18:03:20 -0800
> Following Marvell's acquisition of Cavium, we need to update all the
> Cavium drivers maintainer's entries to point to our new e-mail addresses.
>
> Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
> Signed-off-by: Ameen Rahman <Ameen.Rahman@cavium.com>
Applied.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox