* [PATCH 33/33] netfilter: ipv4: remove useless export_symbol
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
Only one caller; place it where needed and get rid of the EXPORT_SYMBOL.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/linux/netfilter_ipv4.h | 6 ------
net/ipv4/netfilter.c | 18 ------------------
net/netfilter/utils.c | 19 +++++++++++++++++++
3 files changed, 19 insertions(+), 24 deletions(-)
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index 95ab5cc64422..082e2c41b7ff 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -25,7 +25,6 @@ __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
unsigned int dataoff, u_int8_t protocol);
int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
bool strict);
-int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry);
#else
static inline __sum16 nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
unsigned int dataoff, u_int8_t protocol)
@@ -37,11 +36,6 @@ static inline int nf_ip_route(struct net *net, struct dst_entry **dst,
{
return -EOPNOTSUPP;
}
-static inline int nf_ip_reroute(struct sk_buff *skb,
- const struct nf_queue_entry *entry)
-{
- return -EOPNOTSUPP;
-}
#endif /* CONFIG_INET */
#endif /*__LINUX_IP_NETFILTER_H*/
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 8d2e5dc9a827..a058213b77a7 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -80,24 +80,6 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t
}
EXPORT_SYMBOL(ip_route_me_harder);
-int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry)
-{
- const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
-
- if (entry->state.hook == NF_INET_LOCAL_OUT) {
- const struct iphdr *iph = ip_hdr(skb);
-
- if (!(iph->tos == rt_info->tos &&
- skb->mark == rt_info->mark &&
- iph->daddr == rt_info->daddr &&
- iph->saddr == rt_info->saddr))
- return ip_route_me_harder(entry->state.net, skb,
- RTN_UNSPEC);
- }
- return 0;
-}
-EXPORT_SYMBOL_GPL(nf_ip_reroute);
-
int nf_ip_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
bool strict __always_unused)
{
diff --git a/net/netfilter/utils.c b/net/netfilter/utils.c
index e8da9a9bba73..55af9f247993 100644
--- a/net/netfilter/utils.c
+++ b/net/netfilter/utils.c
@@ -180,6 +180,25 @@ int nf_route(struct net *net, struct dst_entry **dst, struct flowi *fl,
}
EXPORT_SYMBOL_GPL(nf_route);
+static int nf_ip_reroute(struct sk_buff *skb, const struct nf_queue_entry *entry)
+{
+#ifdef CONFIG_INET
+ const struct ip_rt_info *rt_info = nf_queue_entry_reroute(entry);
+
+ if (entry->state.hook == NF_INET_LOCAL_OUT) {
+ const struct iphdr *iph = ip_hdr(skb);
+
+ if (!(iph->tos == rt_info->tos &&
+ skb->mark == rt_info->mark &&
+ iph->daddr == rt_info->daddr &&
+ iph->saddr == rt_info->saddr))
+ return ip_route_me_harder(entry->state.net, skb,
+ RTN_UNSPEC);
+ }
+#endif
+ return 0;
+}
+
int nf_reroute(struct sk_buff *skb, struct nf_queue_entry *entry)
{
const struct nf_ipv6_ops *v6ops;
--
2.11.0
^ permalink raw reply related
* [PATCH 27/33] netfilter: conntrack: fix IPV6=n builds
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
Stephen Rothwell reports:
After merging the netfilter-next tree, today's linux-next build
(powerpc ppc64_defconfig) failed like this:
ERROR: "nf_conntrack_invert_icmpv6_tuple" [nf_conntrack.ko] undefined!
ERROR: "nf_conntrack_icmpv6_packet" [nf_conntrack.ko] undefined!
ERROR: "nf_conntrack_icmpv6_init_net" [nf_conntrack.ko] undefined!
ERROR: "icmpv6_pkt_to_tuple" [nf_conntrack.ko] undefined!
ERROR: "nf_ct_gre_keymap_destroy" [nf_conntrack.ko] undefined!
icmpv6 related errors are due to lack of IS_ENABLED(CONFIG_IPV6) (no
icmpv6 support is builtin if kernel has CONFIG_IPV6=n), the
nf_ct_gre_keymap_destroy error is due to lack of PROTO_GRE check.
Fixes: a47c54048162 ("netfilter: conntrack: handle builtin l4proto packet functions via direct calls")
Fixes: e2e48b471634 ("netfilter: conntrack: handle icmp pkt_to_tuple helper via direct calls")
Fixes: 197c4300aec0 ("netfilter: conntrack: remove invert_tuple callback")
Fixes: 2a389de86e4a ("netfilter: conntrack: remove l4proto init and get_net callbacks")
Fixes: e56894356f60 ("netfilter: conntrack: remove l4proto destroy hook")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_core.c | 8 ++++++++
net/netfilter/nf_conntrack_proto.c | 2 ++
2 files changed, 10 insertions(+)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 171659aa69a1..a3e5232c2088 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -274,8 +274,10 @@ nf_ct_get_tuple(const struct sk_buff *skb,
tuple->dst.dir = IP_CT_DIR_ORIGINAL;
switch (protonum) {
+#if IS_ENABLED(CONFIG_IPV6)
case IPPROTO_ICMPV6:
return icmpv6_pkt_to_tuple(skb, dataoff, net, tuple);
+#endif
case IPPROTO_ICMP:
return icmp_pkt_to_tuple(skb, dataoff, net, tuple);
#ifdef CONFIG_NF_CT_PROTO_GRE
@@ -412,8 +414,10 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
switch (orig->dst.protonum) {
case IPPROTO_ICMP:
return nf_conntrack_invert_icmp_tuple(inverse, orig);
+#if IS_ENABLED(CONFIG_IPV6)
case IPPROTO_ICMPV6:
return nf_conntrack_invert_icmpv6_tuple(inverse, orig);
+#endif
}
inverse->src.u.all = orig->dst.u.all;
@@ -526,10 +530,12 @@ EXPORT_SYMBOL_GPL(nf_ct_tmpl_free);
static void destroy_gre_conntrack(struct nf_conn *ct)
{
+#ifdef CONFIG_NF_CT_PROTO_GRE
struct nf_conn *master = ct->master;
if (master)
nf_ct_gre_keymap_destroy(master);
+#endif
}
static void
@@ -1553,8 +1559,10 @@ static int nf_conntrack_handle_packet(struct nf_conn *ct,
ctinfo, state);
case IPPROTO_ICMP:
return nf_conntrack_icmp_packet(ct, skb, ctinfo, state);
+#if IS_ENABLED(CONFIG_IPV6)
case IPPROTO_ICMPV6:
return nf_conntrack_icmpv6_packet(ct, skb, ctinfo, state);
+#endif
#ifdef CONFIG_NF_CT_PROTO_UDPLITE
case IPPROTO_UDPLITE:
return nf_conntrack_udplite_packet(ct, skb, dataoff,
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index aa8d3fe0b37f..b9403a266a2e 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -597,7 +597,9 @@ void nf_conntrack_proto_pernet_init(struct net *net)
nf_conntrack_udp_init_net(net);
nf_conntrack_tcp_init_net(net);
nf_conntrack_icmp_init_net(net);
+#if IS_ENABLED(CONFIG_IPV6)
nf_conntrack_icmpv6_init_net(net);
+#endif
#ifdef CONFIG_NF_CT_PROTO_DCCP
nf_conntrack_dccp_init_net(net);
#endif
--
2.11.0
^ permalink raw reply related
* [PATCH 29/33] ipvs: avoid indirect calls when calculating checksums
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Matteo Croce <mcroce@redhat.com>
The function pointer ip_vs_protocol->csum_check is only used in protocol
specific code, and never in the generic one.
Remove the function pointer from struct ip_vs_protocol and call the
checksum functions directly.
This reduces the performance impact of the Spectre mitigation, and
should give a small improvement even with RETPOLINES disabled.
Signed-off-by: Matteo Croce <mcroce@redhat.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/ip_vs.h | 3 ---
net/netfilter/ipvs/ip_vs_proto_ah_esp.c | 2 --
net/netfilter/ipvs/ip_vs_proto_sctp.c | 8 +++++---
net/netfilter/ipvs/ip_vs_proto_tcp.c | 12 +++++++-----
net/netfilter/ipvs/ip_vs_proto_udp.c | 12 +++++++-----
5 files changed, 19 insertions(+), 18 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index a0d2e0bb9a94..047f9a5ccaad 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -453,9 +453,6 @@ struct ip_vs_protocol {
int (*dnat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp,
struct ip_vs_conn *cp, struct ip_vs_iphdr *iph);
- int (*csum_check)(int af, struct sk_buff *skb,
- struct ip_vs_protocol *pp);
-
const char *(*state_name)(int state);
void (*state_transition)(struct ip_vs_conn *cp, int direction,
diff --git a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
index 5320d39976e1..480598cb0f05 100644
--- a/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_ah_esp.c
@@ -129,7 +129,6 @@ struct ip_vs_protocol ip_vs_protocol_ah = {
.conn_out_get = ah_esp_conn_out_get,
.snat_handler = NULL,
.dnat_handler = NULL,
- .csum_check = NULL,
.state_transition = NULL,
.register_app = NULL,
.unregister_app = NULL,
@@ -152,7 +151,6 @@ struct ip_vs_protocol ip_vs_protocol_esp = {
.conn_out_get = ah_esp_conn_out_get,
.snat_handler = NULL,
.dnat_handler = NULL,
- .csum_check = NULL,
.state_transition = NULL,
.register_app = NULL,
.unregister_app = NULL,
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index b0cd7d08f2a7..bc3d1625ecc8 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -10,6 +10,9 @@
#include <net/ip_vs.h>
static int
+sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp);
+
+static int
sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
struct ip_vs_proto_data *pd,
int *verdict, struct ip_vs_conn **cpp,
@@ -105,7 +108,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
int ret;
/* Some checks before mangling */
- if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
+ if (!sctp_csum_check(cp->af, skb, pp))
return 0;
/* Call application helper if needed */
@@ -152,7 +155,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
int ret;
/* Some checks before mangling */
- if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
+ if (!sctp_csum_check(cp->af, skb, pp))
return 0;
/* Call application helper if needed */
@@ -587,7 +590,6 @@ struct ip_vs_protocol ip_vs_protocol_sctp = {
.conn_out_get = ip_vs_conn_out_get_proto,
.snat_handler = sctp_snat_handler,
.dnat_handler = sctp_dnat_handler,
- .csum_check = sctp_csum_check,
.state_name = sctp_state_name,
.state_transition = sctp_state_transition,
.app_conn_bind = sctp_app_conn_bind,
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index 1770fc6ce960..6a275f989085 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -32,6 +32,9 @@
#include <net/ip_vs.h>
static int
+tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp);
+
+static int
tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
struct ip_vs_proto_data *pd,
int *verdict, struct ip_vs_conn **cpp,
@@ -166,7 +169,7 @@ tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
int ret;
/* Some checks before mangling */
- if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
+ if (!tcp_csum_check(cp->af, skb, pp))
return 0;
/* Call application helper if needed */
@@ -192,7 +195,7 @@ tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
tcp_fast_csum_update(cp->af, tcph, &cp->daddr, &cp->vaddr,
cp->dport, cp->vport);
if (skb->ip_summed == CHECKSUM_COMPLETE)
- skb->ip_summed = (cp->app && pp->csum_check) ?
+ skb->ip_summed = cp->app ?
CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
} else {
/* full checksum calculation */
@@ -244,7 +247,7 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
int ret;
/* Some checks before mangling */
- if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
+ if (!tcp_csum_check(cp->af, skb, pp))
return 0;
/*
@@ -275,7 +278,7 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
tcp_fast_csum_update(cp->af, tcph, &cp->vaddr, &cp->daddr,
cp->vport, cp->dport);
if (skb->ip_summed == CHECKSUM_COMPLETE)
- skb->ip_summed = (cp->app && pp->csum_check) ?
+ skb->ip_summed = cp->app ?
CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
} else {
/* full checksum calculation */
@@ -736,7 +739,6 @@ struct ip_vs_protocol ip_vs_protocol_tcp = {
.conn_out_get = ip_vs_conn_out_get_proto,
.snat_handler = tcp_snat_handler,
.dnat_handler = tcp_dnat_handler,
- .csum_check = tcp_csum_check,
.state_name = tcp_state_name,
.state_transition = tcp_state_transition,
.app_conn_bind = tcp_app_conn_bind,
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index 0f53c49025f8..3285718264d5 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -29,6 +29,9 @@
#include <net/ip6_checksum.h>
static int
+udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp);
+
+static int
udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
struct ip_vs_proto_data *pd,
int *verdict, struct ip_vs_conn **cpp,
@@ -156,7 +159,7 @@ udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
int ret;
/* Some checks before mangling */
- if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
+ if (!udp_csum_check(cp->af, skb, pp))
return 0;
/*
@@ -186,7 +189,7 @@ udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
udp_fast_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
cp->dport, cp->vport);
if (skb->ip_summed == CHECKSUM_COMPLETE)
- skb->ip_summed = (cp->app && pp->csum_check) ?
+ skb->ip_summed = cp->app ?
CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
} else {
/* full checksum calculation */
@@ -239,7 +242,7 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
int ret;
/* Some checks before mangling */
- if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
+ if (!udp_csum_check(cp->af, skb, pp))
return 0;
/*
@@ -270,7 +273,7 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
udp_fast_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
cp->vport, cp->dport);
if (skb->ip_summed == CHECKSUM_COMPLETE)
- skb->ip_summed = (cp->app && pp->csum_check) ?
+ skb->ip_summed = cp->app ?
CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
} else {
/* full checksum calculation */
@@ -494,7 +497,6 @@ struct ip_vs_protocol ip_vs_protocol_udp = {
.conn_out_get = ip_vs_conn_out_get_proto,
.snat_handler = udp_snat_handler,
.dnat_handler = udp_dnat_handler,
- .csum_check = udp_csum_check,
.state_transition = udp_state_transition,
.state_name = udp_state_name,
.register_app = udp_register_app,
--
2.11.0
^ permalink raw reply related
* [PATCH 30/33] ipvs: use indirect call wrappers
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Matteo Croce <mcroce@redhat.com>
Use the new indirect call wrappers in IPVS when calling the TCP or UDP
protocol specific functions.
This avoids an indirect calls in IPVS, and reduces the performance
impact of the Spectre mitigation.
Signed-off-by: Matteo Croce <mcroce@redhat.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipvs/ip_vs_core.c | 49 ++++++++++++++++++++++++++++++------
net/netfilter/ipvs/ip_vs_proto_tcp.c | 3 ++-
net/netfilter/ipvs/ip_vs_proto_udp.c | 3 ++-
3 files changed, 45 insertions(+), 10 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index fe9abf3cc10a..e969dad66991 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -53,6 +53,7 @@
#endif
#include <net/ip_vs.h>
+#include <linux/indirect_call_wrapper.h>
EXPORT_SYMBOL(register_ip_vs_scheduler);
@@ -70,6 +71,29 @@ EXPORT_SYMBOL(ip_vs_get_debug_level);
#endif
EXPORT_SYMBOL(ip_vs_new_conn_out);
+#ifdef CONFIG_IP_VS_PROTO_TCP
+INDIRECT_CALLABLE_DECLARE(int
+ tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
+ struct ip_vs_conn *cp, struct ip_vs_iphdr *iph));
+#endif
+
+#ifdef CONFIG_IP_VS_PROTO_UDP
+INDIRECT_CALLABLE_DECLARE(int
+ udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
+ struct ip_vs_conn *cp, struct ip_vs_iphdr *iph));
+#endif
+
+#if defined(CONFIG_IP_VS_PROTO_TCP) && defined(CONFIG_IP_VS_PROTO_UDP)
+#define SNAT_CALL(f, ...) \
+ INDIRECT_CALL_2(f, tcp_snat_handler, udp_snat_handler, __VA_ARGS__)
+#elif defined(CONFIG_IP_VS_PROTO_TCP)
+#define SNAT_CALL(f, ...) INDIRECT_CALL_1(f, tcp_snat_handler, __VA_ARGS__)
+#elif defined(CONFIG_IP_VS_PROTO_UDP)
+#define SNAT_CALL(f, ...) INDIRECT_CALL_1(f, udp_snat_handler, __VA_ARGS__)
+#else
+#define SNAT_CALL(f, ...) f(__VA_ARGS__)
+#endif
+
static unsigned int ip_vs_net_id __read_mostly;
/* netns cnt used for uniqueness */
static atomic_t ipvs_netns_cnt = ATOMIC_INIT(0);
@@ -478,7 +502,9 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
*/
if ((!skb->dev || skb->dev->flags & IFF_LOOPBACK)) {
iph->hdr_flags ^= IP_VS_HDR_INVERSE;
- cp = pp->conn_in_get(svc->ipvs, svc->af, skb, iph);
+ cp = INDIRECT_CALL_1(pp->conn_in_get,
+ ip_vs_conn_in_get_proto, svc->ipvs,
+ svc->af, skb, iph);
iph->hdr_flags ^= IP_VS_HDR_INVERSE;
if (cp) {
@@ -972,7 +998,8 @@ static int ip_vs_out_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb,
ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, true, &ciph);
/* The embedded headers contain source and dest in reverse order */
- cp = pp->conn_out_get(ipvs, AF_INET, skb, &ciph);
+ cp = INDIRECT_CALL_1(pp->conn_out_get, ip_vs_conn_out_get_proto,
+ ipvs, AF_INET, skb, &ciph);
if (!cp)
return NF_ACCEPT;
@@ -1028,7 +1055,8 @@ static int ip_vs_out_icmp_v6(struct netns_ipvs *ipvs, struct sk_buff *skb,
return NF_ACCEPT;
/* The embedded headers contain source and dest in reverse order */
- cp = pp->conn_out_get(ipvs, AF_INET6, skb, &ciph);
+ cp = INDIRECT_CALL_1(pp->conn_out_get, ip_vs_conn_out_get_proto,
+ ipvs, AF_INET6, skb, &ciph);
if (!cp)
return NF_ACCEPT;
@@ -1263,7 +1291,8 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
goto drop;
/* mangle the packet */
- if (pp->snat_handler && !pp->snat_handler(skb, pp, cp, iph))
+ if (pp->snat_handler &&
+ !SNAT_CALL(pp->snat_handler, skb, pp, cp, iph))
goto drop;
#ifdef CONFIG_IP_VS_IPV6
@@ -1389,7 +1418,8 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
/*
* Check if the packet belongs to an existing entry
*/
- cp = pp->conn_out_get(ipvs, af, skb, &iph);
+ cp = INDIRECT_CALL_1(pp->conn_out_get, ip_vs_conn_out_get_proto,
+ ipvs, af, skb, &iph);
if (likely(cp)) {
if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
@@ -1644,7 +1674,8 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
/* The embedded headers contain source and dest in reverse order.
* For IPIP this is error for request, not for reply.
*/
- cp = pp->conn_in_get(ipvs, AF_INET, skb, &ciph);
+ cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto,
+ ipvs, AF_INET, skb, &ciph);
if (!cp) {
int v;
@@ -1796,7 +1827,8 @@ static int ip_vs_in_icmp_v6(struct netns_ipvs *ipvs, struct sk_buff *skb,
/* The embedded headers contain source and dest in reverse order
* if not from localhost
*/
- cp = pp->conn_in_get(ipvs, AF_INET6, skb, &ciph);
+ cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto,
+ ipvs, AF_INET6, skb, &ciph);
if (!cp) {
int v;
@@ -1925,7 +1957,8 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
/*
* Check if the packet belongs to an existing connection entry
*/
- cp = pp->conn_in_get(ipvs, af, skb, &iph);
+ cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto,
+ ipvs, af, skb, &iph);
conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) {
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index 6a275f989085..479419759983 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -28,6 +28,7 @@
#include <net/ip6_checksum.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
+#include <linux/indirect_call_wrapper.h>
#include <net/ip_vs.h>
@@ -146,7 +147,7 @@ tcp_partial_csum_update(int af, struct tcphdr *tcph,
}
-static int
+INDIRECT_CALLABLE_SCOPE int
tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
{
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index 3285718264d5..646c384910fb 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -23,6 +23,7 @@
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/udp.h>
+#include <linux/indirect_call_wrapper.h>
#include <net/ip_vs.h>
#include <net/ip.h>
@@ -136,7 +137,7 @@ udp_partial_csum_update(int af, struct udphdr *uhdr,
}
-static int
+INDIRECT_CALLABLE_SCOPE int
udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
{
--
2.11.0
^ permalink raw reply related
* [PATCH 31/33] netfilter: nft_counter: remove wrong __percpu of nft_counter_resest()'s arg
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
nft_counter_rest() has its first argument declared as
struct nft_counter_percpu_priv __percpu *priv
but this structure is not percpu (it only countains
a member 'counter' which is, correctly, a pointer to a
percpu struct nft_counter).
So, remove the '__percpu' from the argument's declaration.
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nft_counter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nft_counter.c b/net/netfilter/nft_counter.c
index a61d7edfc290..1a6b06ce6b5b 100644
--- a/net/netfilter/nft_counter.c
+++ b/net/netfilter/nft_counter.c
@@ -104,7 +104,7 @@ static void nft_counter_obj_destroy(const struct nft_ctx *ctx,
nft_counter_do_destroy(priv);
}
-static void nft_counter_reset(struct nft_counter_percpu_priv __percpu *priv,
+static void nft_counter_reset(struct nft_counter_percpu_priv *priv,
struct nft_counter *total)
{
struct nft_counter *this_cpu;
--
2.11.0
^ permalink raw reply related
* [PATCH 26/33] Revert "netfilter: nft_hash: add map lookups for hashing operations"
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Laura Garcia Liebana <nevola@gmail.com>
A better way to implement this from userspace has been found without
specific code in the kernel side, revert this.
Fixes: b9ccc07e3f31 ("netfilter: nft_hash: add map lookups for hashing operations")
Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/nf_tables.h | 4 +-
net/netfilter/nft_hash.c | 121 -------------------------------
2 files changed, 2 insertions(+), 123 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 0ba8f48bdf0b..030302893d96 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -877,8 +877,8 @@ enum nft_hash_attributes {
NFTA_HASH_SEED,
NFTA_HASH_OFFSET,
NFTA_HASH_TYPE,
- NFTA_HASH_SET_NAME,
- NFTA_HASH_SET_ID,
+ NFTA_HASH_SET_NAME, /* deprecated */
+ NFTA_HASH_SET_ID, /* deprecated */
__NFTA_HASH_MAX,
};
#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index c2d237144f74..ea658e6c53e3 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -25,7 +25,6 @@ struct nft_jhash {
u32 modulus;
u32 seed;
u32 offset;
- struct nft_set *map;
};
static void nft_jhash_eval(const struct nft_expr *expr,
@@ -42,33 +41,10 @@ static void nft_jhash_eval(const struct nft_expr *expr,
regs->data[priv->dreg] = h + priv->offset;
}
-static void nft_jhash_map_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
-{
- struct nft_jhash *priv = nft_expr_priv(expr);
- const void *data = ®s->data[priv->sreg];
- const struct nft_set *map = priv->map;
- const struct nft_set_ext *ext;
- u32 result;
- bool found;
-
- result = reciprocal_scale(jhash(data, priv->len, priv->seed),
- priv->modulus) + priv->offset;
-
- found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
- if (!found)
- return;
-
- nft_data_copy(®s->data[priv->dreg],
- nft_set_ext_data(ext), map->dlen);
-}
-
struct nft_symhash {
enum nft_registers dreg:8;
u32 modulus;
u32 offset;
- struct nft_set *map;
};
static void nft_symhash_eval(const struct nft_expr *expr,
@@ -84,28 +60,6 @@ static void nft_symhash_eval(const struct nft_expr *expr,
regs->data[priv->dreg] = h + priv->offset;
}
-static void nft_symhash_map_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
-{
- struct nft_symhash *priv = nft_expr_priv(expr);
- struct sk_buff *skb = pkt->skb;
- const struct nft_set *map = priv->map;
- const struct nft_set_ext *ext;
- u32 result;
- bool found;
-
- result = reciprocal_scale(__skb_get_hash_symmetric(skb),
- priv->modulus) + priv->offset;
-
- found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
- if (!found)
- return;
-
- nft_data_copy(®s->data[priv->dreg],
- nft_set_ext_data(ext), map->dlen);
-}
-
static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
[NFTA_HASH_SREG] = { .type = NLA_U32 },
[NFTA_HASH_DREG] = { .type = NLA_U32 },
@@ -114,9 +68,6 @@ static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
[NFTA_HASH_SEED] = { .type = NLA_U32 },
[NFTA_HASH_OFFSET] = { .type = NLA_U32 },
[NFTA_HASH_TYPE] = { .type = NLA_U32 },
- [NFTA_HASH_SET_NAME] = { .type = NLA_STRING,
- .len = NFT_SET_MAXNAMELEN - 1 },
- [NFTA_HASH_SET_ID] = { .type = NLA_U32 },
};
static int nft_jhash_init(const struct nft_ctx *ctx,
@@ -166,20 +117,6 @@ static int nft_jhash_init(const struct nft_ctx *ctx,
NFT_DATA_VALUE, sizeof(u32));
}
-static int nft_jhash_map_init(const struct nft_ctx *ctx,
- const struct nft_expr *expr,
- const struct nlattr * const tb[])
-{
- struct nft_jhash *priv = nft_expr_priv(expr);
- u8 genmask = nft_genmask_next(ctx->net);
-
- nft_jhash_init(ctx, expr, tb);
- priv->map = nft_set_lookup_global(ctx->net, ctx->table,
- tb[NFTA_HASH_SET_NAME],
- tb[NFTA_HASH_SET_ID], genmask);
- return PTR_ERR_OR_ZERO(priv->map);
-}
-
static int nft_symhash_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
@@ -206,20 +143,6 @@ static int nft_symhash_init(const struct nft_ctx *ctx,
NFT_DATA_VALUE, sizeof(u32));
}
-static int nft_symhash_map_init(const struct nft_ctx *ctx,
- const struct nft_expr *expr,
- const struct nlattr * const tb[])
-{
- struct nft_jhash *priv = nft_expr_priv(expr);
- u8 genmask = nft_genmask_next(ctx->net);
-
- nft_symhash_init(ctx, expr, tb);
- priv->map = nft_set_lookup_global(ctx->net, ctx->table,
- tb[NFTA_HASH_SET_NAME],
- tb[NFTA_HASH_SET_ID], genmask);
- return PTR_ERR_OR_ZERO(priv->map);
-}
-
static int nft_jhash_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
@@ -247,18 +170,6 @@ static int nft_jhash_dump(struct sk_buff *skb,
return -1;
}
-static int nft_jhash_map_dump(struct sk_buff *skb,
- const struct nft_expr *expr)
-{
- const struct nft_jhash *priv = nft_expr_priv(expr);
-
- if (nft_jhash_dump(skb, expr) ||
- nla_put_string(skb, NFTA_HASH_SET_NAME, priv->map->name))
- return -1;
-
- return 0;
-}
-
static int nft_symhash_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
@@ -279,18 +190,6 @@ static int nft_symhash_dump(struct sk_buff *skb,
return -1;
}
-static int nft_symhash_map_dump(struct sk_buff *skb,
- const struct nft_expr *expr)
-{
- const struct nft_symhash *priv = nft_expr_priv(expr);
-
- if (nft_symhash_dump(skb, expr) ||
- nla_put_string(skb, NFTA_HASH_SET_NAME, priv->map->name))
- return -1;
-
- return 0;
-}
-
static struct nft_expr_type nft_hash_type;
static const struct nft_expr_ops nft_jhash_ops = {
.type = &nft_hash_type,
@@ -300,14 +199,6 @@ static const struct nft_expr_ops nft_jhash_ops = {
.dump = nft_jhash_dump,
};
-static const struct nft_expr_ops nft_jhash_map_ops = {
- .type = &nft_hash_type,
- .size = NFT_EXPR_SIZE(sizeof(struct nft_jhash)),
- .eval = nft_jhash_map_eval,
- .init = nft_jhash_map_init,
- .dump = nft_jhash_map_dump,
-};
-
static const struct nft_expr_ops nft_symhash_ops = {
.type = &nft_hash_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_symhash)),
@@ -316,14 +207,6 @@ static const struct nft_expr_ops nft_symhash_ops = {
.dump = nft_symhash_dump,
};
-static const struct nft_expr_ops nft_symhash_map_ops = {
- .type = &nft_hash_type,
- .size = NFT_EXPR_SIZE(sizeof(struct nft_symhash)),
- .eval = nft_symhash_map_eval,
- .init = nft_symhash_map_init,
- .dump = nft_symhash_map_dump,
-};
-
static const struct nft_expr_ops *
nft_hash_select_ops(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
@@ -336,12 +219,8 @@ nft_hash_select_ops(const struct nft_ctx *ctx,
type = ntohl(nla_get_be32(tb[NFTA_HASH_TYPE]));
switch (type) {
case NFT_HASH_SYM:
- if (tb[NFTA_HASH_SET_NAME])
- return &nft_symhash_map_ops;
return &nft_symhash_ops;
case NFT_HASH_JENKINS:
- if (tb[NFTA_HASH_SET_NAME])
- return &nft_jhash_map_ops;
return &nft_jhash_ops;
default:
break;
--
2.11.0
^ permalink raw reply related
* [PATCH 18/33] netfilter: conntrack: unify sysctl handling
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
Due to historical reasons, all l4 trackers register their own
sysctls.
This leads to copy&pasted boilerplate code, that does exactly same
thing, just with different data structure.
Place all of this in a single file.
This allows to remove the various ctl_table pointers from the ct_netns
structure and reduces overall code size.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_conntrack_proto_dccp.c | 86 +------
net/netfilter/nf_conntrack_proto_generic.c | 30 +--
net/netfilter/nf_conntrack_proto_gre.c | 42 +--
net/netfilter/nf_conntrack_proto_icmp.c | 29 +--
net/netfilter/nf_conntrack_proto_icmpv6.c | 29 +--
net/netfilter/nf_conntrack_proto_sctp.c | 89 +------
net/netfilter/nf_conntrack_proto_tcp.c | 116 +--------
net/netfilter/nf_conntrack_proto_udp.c | 36 +--
net/netfilter/nf_conntrack_standalone.c | 394 ++++++++++++++++++++++++++++-
9 files changed, 391 insertions(+), 460 deletions(-)
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 84408ec80624..31ba88311bc4 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -724,90 +724,6 @@ dccp_timeout_nla_policy[CTA_TIMEOUT_DCCP_MAX+1] = {
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-#ifdef CONFIG_SYSCTL
-/* template, data assigned later */
-static struct ctl_table dccp_sysctl_table[] = {
- {
- .procname = "nf_conntrack_dccp_timeout_request",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_dccp_timeout_respond",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_dccp_timeout_partopen",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_dccp_timeout_open",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_dccp_timeout_closereq",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_dccp_timeout_closing",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_dccp_timeout_timewait",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_dccp_loose",
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec,
- },
- { }
-};
-#endif /* CONFIG_SYSCTL */
-
-static int dccp_kmemdup_sysctl_table(struct net *net, struct nf_proto_net *pn,
- struct nf_dccp_net *dn)
-{
-#ifdef CONFIG_SYSCTL
- if (pn->ctl_table)
- return 0;
-
- pn->ctl_table = kmemdup(dccp_sysctl_table,
- sizeof(dccp_sysctl_table),
- GFP_KERNEL);
- if (!pn->ctl_table)
- return -ENOMEM;
-
- pn->ctl_table[0].data = &dn->dccp_timeout[CT_DCCP_REQUEST];
- pn->ctl_table[1].data = &dn->dccp_timeout[CT_DCCP_RESPOND];
- pn->ctl_table[2].data = &dn->dccp_timeout[CT_DCCP_PARTOPEN];
- pn->ctl_table[3].data = &dn->dccp_timeout[CT_DCCP_OPEN];
- pn->ctl_table[4].data = &dn->dccp_timeout[CT_DCCP_CLOSEREQ];
- pn->ctl_table[5].data = &dn->dccp_timeout[CT_DCCP_CLOSING];
- pn->ctl_table[6].data = &dn->dccp_timeout[CT_DCCP_TIMEWAIT];
- pn->ctl_table[7].data = &dn->dccp_loose;
-
- /* Don't export sysctls to unprivileged users */
- if (net->user_ns != &init_user_ns)
- pn->ctl_table[0].procname = NULL;
-#endif
- return 0;
-}
-
static int dccp_init_net(struct net *net)
{
struct nf_dccp_net *dn = nf_dccp_pernet(net);
@@ -830,7 +746,7 @@ static int dccp_init_net(struct net *net)
dn->dccp_timeout[CT_DCCP_NONE] = dn->dccp_timeout[CT_DCCP_REQUEST];
}
- return dccp_kmemdup_sysctl_table(net, pn, dn);
+ return 0;
}
static struct nf_proto_net *dccp_get_net_proto(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index 78358d192c60..0edbf82594d0 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -60,41 +60,13 @@ generic_timeout_nla_policy[CTA_TIMEOUT_GENERIC_MAX+1] = {
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-#ifdef CONFIG_SYSCTL
-static struct ctl_table generic_sysctl_table[] = {
- {
- .procname = "nf_conntrack_generic_timeout",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- { }
-};
-#endif /* CONFIG_SYSCTL */
-
-static int generic_kmemdup_sysctl_table(struct nf_proto_net *pn,
- struct nf_generic_net *gn)
-{
-#ifdef CONFIG_SYSCTL
- pn->ctl_table = kmemdup(generic_sysctl_table,
- sizeof(generic_sysctl_table),
- GFP_KERNEL);
- if (!pn->ctl_table)
- return -ENOMEM;
-
- pn->ctl_table[0].data = &gn->timeout;
-#endif
- return 0;
-}
-
static int generic_init_net(struct net *net)
{
struct nf_generic_net *gn = nf_generic_pernet(net);
- struct nf_proto_net *pn = &gn->pn;
gn->timeout = nf_ct_generic_timeout;
- return generic_kmemdup_sysctl_table(pn, gn);
+ return 0;
}
static struct nf_proto_net *generic_get_net_proto(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index f6391991bcf6..e573ec0fa12b 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -313,46 +313,6 @@ gre_timeout_nla_policy[CTA_TIMEOUT_GRE_MAX+1] = {
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-#ifdef CONFIG_SYSCTL
-static struct ctl_table gre_sysctl_table[] = {
- {
- .procname = "nf_conntrack_gre_timeout",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_gre_timeout_stream",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {}
-};
-#endif
-
-static int gre_kmemdup_sysctl_table(struct net *net)
-{
-#ifdef CONFIG_SYSCTL
- struct nf_gre_net *net_gre = gre_pernet(net);
- struct nf_proto_net *nf = &net_gre->nf;
- int i;
-
- if (nf->ctl_table)
- return 0;
-
- nf->ctl_table = kmemdup(gre_sysctl_table,
- sizeof(gre_sysctl_table),
- GFP_KERNEL);
- if (!nf->ctl_table)
- return -ENOMEM;
-
- for (i = 0; i < GRE_CT_MAX; i++)
- nf->ctl_table[i].data = &net_gre->timeouts[i];
-#endif
- return 0;
-}
-
static int gre_init_net(struct net *net)
{
struct nf_gre_net *net_gre = gre_pernet(net);
@@ -362,7 +322,7 @@ static int gre_init_net(struct net *net)
for (i = 0; i < GRE_CT_MAX; i++)
net_gre->timeouts[i] = gre_timeouts[i];
- return gre_kmemdup_sysctl_table(net);
+ return 0;
}
/* protocol helper struct */
diff --git a/net/netfilter/nf_conntrack_proto_icmp.c b/net/netfilter/nf_conntrack_proto_icmp.c
index 1007efae741d..eb77f747759f 100644
--- a/net/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/netfilter/nf_conntrack_proto_icmp.c
@@ -298,41 +298,14 @@ icmp_timeout_nla_policy[CTA_TIMEOUT_ICMP_MAX+1] = {
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-#ifdef CONFIG_SYSCTL
-static struct ctl_table icmp_sysctl_table[] = {
- {
- .procname = "nf_conntrack_icmp_timeout",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- { }
-};
-#endif /* CONFIG_SYSCTL */
-
-static int icmp_kmemdup_sysctl_table(struct nf_proto_net *pn,
- struct nf_icmp_net *in)
-{
-#ifdef CONFIG_SYSCTL
- pn->ctl_table = kmemdup(icmp_sysctl_table,
- sizeof(icmp_sysctl_table),
- GFP_KERNEL);
- if (!pn->ctl_table)
- return -ENOMEM;
-
- pn->ctl_table[0].data = &in->timeout;
-#endif
- return 0;
-}
static int icmp_init_net(struct net *net)
{
struct nf_icmp_net *in = nf_icmp_pernet(net);
- struct nf_proto_net *pn = &in->pn;
in->timeout = nf_ct_icmp_timeout;
- return icmp_kmemdup_sysctl_table(pn, in);
+ return 0;
}
static struct nf_proto_net *icmp_get_net_proto(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_icmpv6.c b/net/netfilter/nf_conntrack_proto_icmpv6.c
index 6c93c091a8dd..d243ef8a128e 100644
--- a/net/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/netfilter/nf_conntrack_proto_icmpv6.c
@@ -309,41 +309,14 @@ icmpv6_timeout_nla_policy[CTA_TIMEOUT_ICMPV6_MAX+1] = {
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-#ifdef CONFIG_SYSCTL
-static struct ctl_table icmpv6_sysctl_table[] = {
- {
- .procname = "nf_conntrack_icmpv6_timeout",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- { }
-};
-#endif /* CONFIG_SYSCTL */
-
-static int icmpv6_kmemdup_sysctl_table(struct nf_proto_net *pn,
- struct nf_icmp_net *in)
-{
-#ifdef CONFIG_SYSCTL
- pn->ctl_table = kmemdup(icmpv6_sysctl_table,
- sizeof(icmpv6_sysctl_table),
- GFP_KERNEL);
- if (!pn->ctl_table)
- return -ENOMEM;
-
- pn->ctl_table[0].data = &in->timeout;
-#endif
- return 0;
-}
static int icmpv6_init_net(struct net *net)
{
struct nf_icmp_net *in = nf_icmpv6_pernet(net);
- struct nf_proto_net *pn = &in->pn;
in->timeout = nf_ct_icmpv6_timeout;
- return icmpv6_kmemdup_sysctl_table(pn, in);
+ return 0;
}
static struct nf_proto_net *icmpv6_get_net_proto(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 952f2cc0fd74..31130f218d8f 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -642,93 +642,6 @@ sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-
-#ifdef CONFIG_SYSCTL
-static struct ctl_table sctp_sysctl_table[] = {
- {
- .procname = "nf_conntrack_sctp_timeout_closed",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_sctp_timeout_cookie_wait",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_sctp_timeout_cookie_echoed",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_sctp_timeout_established",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_sctp_timeout_shutdown_sent",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_sctp_timeout_shutdown_recd",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_sctp_timeout_heartbeat_sent",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_sctp_timeout_heartbeat_acked",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- { }
-};
-#endif
-
-static int sctp_kmemdup_sysctl_table(struct nf_proto_net *pn,
- struct nf_sctp_net *sn)
-{
-#ifdef CONFIG_SYSCTL
- if (pn->ctl_table)
- return 0;
-
- pn->ctl_table = kmemdup(sctp_sysctl_table,
- sizeof(sctp_sysctl_table),
- GFP_KERNEL);
- if (!pn->ctl_table)
- return -ENOMEM;
-
- pn->ctl_table[0].data = &sn->timeouts[SCTP_CONNTRACK_CLOSED];
- pn->ctl_table[1].data = &sn->timeouts[SCTP_CONNTRACK_COOKIE_WAIT];
- pn->ctl_table[2].data = &sn->timeouts[SCTP_CONNTRACK_COOKIE_ECHOED];
- pn->ctl_table[3].data = &sn->timeouts[SCTP_CONNTRACK_ESTABLISHED];
- pn->ctl_table[4].data = &sn->timeouts[SCTP_CONNTRACK_SHUTDOWN_SENT];
- pn->ctl_table[5].data = &sn->timeouts[SCTP_CONNTRACK_SHUTDOWN_RECD];
- pn->ctl_table[6].data = &sn->timeouts[SCTP_CONNTRACK_SHUTDOWN_ACK_SENT];
- pn->ctl_table[7].data = &sn->timeouts[SCTP_CONNTRACK_HEARTBEAT_SENT];
- pn->ctl_table[8].data = &sn->timeouts[SCTP_CONNTRACK_HEARTBEAT_ACKED];
-#endif
- return 0;
-}
-
static int sctp_init_net(struct net *net)
{
struct nf_sctp_net *sn = nf_sctp_pernet(net);
@@ -746,7 +659,7 @@ static int sctp_init_net(struct net *net)
sn->timeouts[0] = sctp_timeouts[SCTP_CONNTRACK_CLOSED];
}
- return sctp_kmemdup_sysctl_table(pn, sn);
+ return 0;
}
static struct nf_proto_net *sctp_get_net_proto(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 32aac9a835d4..422bdedac0ed 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1387,120 +1387,6 @@ static const struct nla_policy tcp_timeout_nla_policy[CTA_TIMEOUT_TCP_MAX+1] = {
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-#ifdef CONFIG_SYSCTL
-static struct ctl_table tcp_sysctl_table[] = {
- {
- .procname = "nf_conntrack_tcp_timeout_syn_sent",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_timeout_syn_recv",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_timeout_established",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_timeout_fin_wait",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_timeout_close_wait",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_timeout_last_ack",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_timeout_time_wait",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_timeout_close",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_timeout_max_retrans",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_timeout_unacknowledged",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_tcp_loose",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec,
- },
- {
- .procname = "nf_conntrack_tcp_be_liberal",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec,
- },
- {
- .procname = "nf_conntrack_tcp_max_retrans",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec,
- },
- { }
-};
-#endif /* CONFIG_SYSCTL */
-
-static int tcp_kmemdup_sysctl_table(struct nf_proto_net *pn,
- struct nf_tcp_net *tn)
-{
-#ifdef CONFIG_SYSCTL
- if (pn->ctl_table)
- return 0;
-
- pn->ctl_table = kmemdup(tcp_sysctl_table,
- sizeof(tcp_sysctl_table),
- GFP_KERNEL);
- if (!pn->ctl_table)
- return -ENOMEM;
-
- pn->ctl_table[0].data = &tn->timeouts[TCP_CONNTRACK_SYN_SENT];
- pn->ctl_table[1].data = &tn->timeouts[TCP_CONNTRACK_SYN_RECV];
- pn->ctl_table[2].data = &tn->timeouts[TCP_CONNTRACK_ESTABLISHED];
- pn->ctl_table[3].data = &tn->timeouts[TCP_CONNTRACK_FIN_WAIT];
- pn->ctl_table[4].data = &tn->timeouts[TCP_CONNTRACK_CLOSE_WAIT];
- pn->ctl_table[5].data = &tn->timeouts[TCP_CONNTRACK_LAST_ACK];
- pn->ctl_table[6].data = &tn->timeouts[TCP_CONNTRACK_TIME_WAIT];
- pn->ctl_table[7].data = &tn->timeouts[TCP_CONNTRACK_CLOSE];
- pn->ctl_table[8].data = &tn->timeouts[TCP_CONNTRACK_RETRANS];
- pn->ctl_table[9].data = &tn->timeouts[TCP_CONNTRACK_UNACK];
- pn->ctl_table[10].data = &tn->tcp_loose;
- pn->ctl_table[11].data = &tn->tcp_be_liberal;
- pn->ctl_table[12].data = &tn->tcp_max_retrans;
-#endif
- return 0;
-}
-
static int tcp_init_net(struct net *net)
{
struct nf_tcp_net *tn = nf_tcp_pernet(net);
@@ -1521,7 +1407,7 @@ static int tcp_init_net(struct net *net)
tn->tcp_max_retrans = nf_ct_tcp_max_retrans;
}
- return tcp_kmemdup_sysctl_table(pn, tn);
+ return 0;
}
static struct nf_proto_net *tcp_get_net_proto(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index e1f409aa0006..6e81e79844d7 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -260,40 +260,6 @@ udp_timeout_nla_policy[CTA_TIMEOUT_UDP_MAX+1] = {
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-#ifdef CONFIG_SYSCTL
-static struct ctl_table udp_sysctl_table[] = {
- {
- .procname = "nf_conntrack_udp_timeout",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- {
- .procname = "nf_conntrack_udp_timeout_stream",
- .maxlen = sizeof(unsigned int),
- .mode = 0644,
- .proc_handler = proc_dointvec_jiffies,
- },
- { }
-};
-#endif /* CONFIG_SYSCTL */
-
-static int udp_kmemdup_sysctl_table(struct nf_proto_net *pn,
- struct nf_udp_net *un)
-{
-#ifdef CONFIG_SYSCTL
- if (pn->ctl_table)
- return 0;
- pn->ctl_table = kmemdup(udp_sysctl_table,
- sizeof(udp_sysctl_table),
- GFP_KERNEL);
- if (!pn->ctl_table)
- return -ENOMEM;
- pn->ctl_table[0].data = &un->timeouts[UDP_CT_UNREPLIED];
- pn->ctl_table[1].data = &un->timeouts[UDP_CT_REPLIED];
-#endif
- return 0;
-}
static int udp_init_net(struct net *net)
{
@@ -307,7 +273,7 @@ static int udp_init_net(struct net *net)
un->timeouts[i] = udp_timeouts[i];
}
- return udp_kmemdup_sysctl_table(pn, un);
+ return 0;
}
static struct nf_proto_net *udp_get_net_proto(struct net *net)
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index b6177fd73304..d848de713dc0 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -547,8 +547,55 @@ enum nf_ct_sysctl_index {
#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
NF_SYSCTL_CT_TIMESTAMP,
#endif
+ NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_SENT,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_RECV,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_ESTABLISHED,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_FIN_WAIT,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE_WAIT,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_LAST_ACK,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_TIME_WAIT,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_RETRANS,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_UNACK,
+ NF_SYSCTL_CT_PROTO_TCP_LOOSE,
+ NF_SYSCTL_CT_PROTO_TCP_LIBERAL,
+ NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_UDP,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6,
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+ NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_CLOSED,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_WAIT,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_ECHOED,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_ESTABLISHED,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_SENT,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_RECD,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_SENT,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_ACKED,
+#endif
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+ NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_REQUEST,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_RESPOND,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_PARTOPEN,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_OPEN,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_CLOSEREQ,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_CLOSING,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_TIMEWAIT,
+ NF_SYSCTL_CT_PROTO_DCCP_LOOSE,
+#endif
+#ifdef CONFIG_NF_CT_PROTO_GRE
+ NF_SYSCTL_CT_PROTO_TIMEOUT_GRE,
+ NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM,
+#endif
+
+ __NF_SYSCTL_CT_LAST_SYSCTL,
};
+#define NF_SYSCTL_CT_LAST_SYSCTL (__NF_SYSCTL_CT_LAST_SYSCTL + 1)
+
static struct ctl_table nf_ct_sysctl_table[] = {
[NF_SYSCTL_CT_MAX] = {
.procname = "nf_conntrack_max",
@@ -626,7 +673,235 @@ static struct ctl_table nf_ct_sysctl_table[] = {
.proc_handler = proc_dointvec,
},
#endif
- { }
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC] = {
+ .procname = "nf_conntrack_generic_timeout",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_SENT] = {
+ .procname = "nf_conntrack_tcp_timeout_syn_sent",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_SYN_RECV] = {
+ .procname = "nf_conntrack_tcp_timeout_syn_recv",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_ESTABLISHED] = {
+ .procname = "nf_conntrack_tcp_timeout_established",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_FIN_WAIT] = {
+ .procname = "nf_conntrack_tcp_timeout_fin_wait",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE_WAIT] = {
+ .procname = "nf_conntrack_tcp_timeout_close_wait",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_LAST_ACK] = {
+ .procname = "nf_conntrack_tcp_timeout_last_ack",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_TIME_WAIT] = {
+ .procname = "nf_conntrack_tcp_timeout_time_wait",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE] = {
+ .procname = "nf_conntrack_tcp_timeout_close",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_RETRANS] = {
+ .procname = "nf_conntrack_tcp_timeout_max_retrans",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_UNACK] = {
+ .procname = "nf_conntrack_tcp_timeout_unacknowledged",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TCP_LOOSE] = {
+ .procname = "nf_conntrack_tcp_loose",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
+ [NF_SYSCTL_CT_PROTO_TCP_LIBERAL] = {
+ .procname = "nf_conntrack_tcp_be_liberal",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
+ [NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS] = {
+ .procname = "nf_conntrack_tcp_max_retrans",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP] = {
+ .procname = "nf_conntrack_udp_timeout",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM] = {
+ .procname = "nf_conntrack_udp_timeout_stream",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP] = {
+ .procname = "nf_conntrack_icmp_timeout",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6] = {
+ .procname = "nf_conntrack_icmpv6_timeout",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_CLOSED] = {
+ .procname = "nf_conntrack_sctp_timeout_closed",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_WAIT] = {
+ .procname = "nf_conntrack_sctp_timeout_cookie_wait",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_COOKIE_ECHOED] = {
+ .procname = "nf_conntrack_sctp_timeout_cookie_echoed",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_ESTABLISHED] = {
+ .procname = "nf_conntrack_sctp_timeout_established",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_SENT] = {
+ .procname = "nf_conntrack_sctp_timeout_shutdown_sent",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_RECD] = {
+ .procname = "nf_conntrack_sctp_timeout_shutdown_recd",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT] = {
+ .procname = "nf_conntrack_sctp_timeout_shutdown_ack_sent",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_SENT] = {
+ .procname = "nf_conntrack_sctp_timeout_heartbeat_sent",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_ACKED] = {
+ .procname = "nf_conntrack_sctp_timeout_heartbeat_acked",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+#endif
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_REQUEST] = {
+ .procname = "nf_conntrack_dccp_timeout_request",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_RESPOND] = {
+ .procname = "nf_conntrack_dccp_timeout_respond",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_PARTOPEN] = {
+ .procname = "nf_conntrack_dccp_timeout_partopen",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_OPEN] = {
+ .procname = "nf_conntrack_dccp_timeout_open",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_CLOSEREQ] = {
+ .procname = "nf_conntrack_dccp_timeout_closereq",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_CLOSING] = {
+ .procname = "nf_conntrack_dccp_timeout_closing",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_TIMEWAIT] = {
+ .procname = "nf_conntrack_dccp_timeout_timewait",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_DCCP_LOOSE] = {
+ .procname = "nf_conntrack_dccp_loose",
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
+#endif
+#ifdef CONFIG_NF_CT_PROTO_GRE
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_GRE] = {
+ .procname = "nf_conntrack_gre_timeout",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ [NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM] = {
+ .procname = "nf_conntrack_gre_timeout_stream",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+#endif
+ {}
};
static struct ctl_table nf_ct_netfilter_table[] = {
@@ -640,14 +915,103 @@ static struct ctl_table nf_ct_netfilter_table[] = {
{ }
};
+static void nf_conntrack_standalone_init_tcp_sysctl(struct net *net,
+ struct ctl_table *table)
+{
+ struct nf_tcp_net *tn = nf_tcp_pernet(net);
+
+#define XASSIGN(XNAME, tn) \
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_ ## XNAME].data = \
+ &(tn)->timeouts[TCP_CONNTRACK_ ## XNAME]
+
+ XASSIGN(SYN_SENT, tn);
+ XASSIGN(SYN_RECV, tn);
+ XASSIGN(ESTABLISHED, tn);
+ XASSIGN(FIN_WAIT, tn);
+ XASSIGN(CLOSE_WAIT, tn);
+ XASSIGN(LAST_ACK, tn);
+ XASSIGN(TIME_WAIT, tn);
+ XASSIGN(CLOSE, tn);
+ XASSIGN(RETRANS, tn);
+ XASSIGN(UNACK, tn);
+#undef XASSIGN
+#define XASSIGN(XNAME, rval) \
+ table[NF_SYSCTL_CT_PROTO_TCP_ ## XNAME].data = (rval)
+
+ XASSIGN(LOOSE, &tn->tcp_loose);
+ XASSIGN(LIBERAL, &tn->tcp_be_liberal);
+ XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans);
+#undef XASSIGN
+}
+
+static void nf_conntrack_standalone_init_sctp_sysctl(struct net *net,
+ struct ctl_table *table)
+{
+#ifdef CONFIG_NF_CT_PROTO_SCTP
+ struct nf_sctp_net *sn = nf_sctp_pernet(net);
+
+#define XASSIGN(XNAME, sn) \
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_ ## XNAME].data = \
+ &(sn)->timeouts[SCTP_CONNTRACK_ ## XNAME]
+
+ XASSIGN(CLOSED, sn);
+ XASSIGN(COOKIE_WAIT, sn);
+ XASSIGN(COOKIE_ECHOED, sn);
+ XASSIGN(ESTABLISHED, sn);
+ XASSIGN(SHUTDOWN_SENT, sn);
+ XASSIGN(SHUTDOWN_RECD, sn);
+ XASSIGN(SHUTDOWN_ACK_SENT, sn);
+ XASSIGN(HEARTBEAT_SENT, sn);
+ XASSIGN(HEARTBEAT_ACKED, sn);
+#undef XASSIGN
+#endif
+}
+
+static void nf_conntrack_standalone_init_dccp_sysctl(struct net *net,
+ struct ctl_table *table)
+{
+#ifdef CONFIG_NF_CT_PROTO_DCCP
+ struct nf_dccp_net *dn = nf_dccp_pernet(net);
+
+#define XASSIGN(XNAME, dn) \
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_ ## XNAME].data = \
+ &(dn)->dccp_timeout[CT_DCCP_ ## XNAME]
+
+ XASSIGN(REQUEST, dn);
+ XASSIGN(RESPOND, dn);
+ XASSIGN(PARTOPEN, dn);
+ XASSIGN(OPEN, dn);
+ XASSIGN(CLOSEREQ, dn);
+ XASSIGN(CLOSING, dn);
+ XASSIGN(TIMEWAIT, dn);
+#undef XASSIGN
+
+ table[NF_SYSCTL_CT_PROTO_DCCP_LOOSE].data = &dn->dccp_loose;
+#endif
+}
+
+static void nf_conntrack_standalone_init_gre_sysctl(struct net *net,
+ struct ctl_table *table)
+{
+#ifdef CONFIG_NF_CT_PROTO_GRE
+ struct nf_gre_net *gn = nf_gre_pernet(net);
+
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_GRE].data = &gn->timeouts[GRE_CT_UNREPLIED];
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM].data = &gn->timeouts[GRE_CT_REPLIED];
+#endif
+}
+
static int nf_conntrack_standalone_init_sysctl(struct net *net)
{
+ struct nf_udp_net *un = nf_udp_pernet(net);
struct ctl_table *table;
+ BUILD_BUG_ON(ARRAY_SIZE(nf_ct_sysctl_table) != NF_SYSCTL_CT_LAST_SYSCTL);
+
table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table),
GFP_KERNEL);
if (!table)
- goto out_kmemdup;
+ return -ENOMEM;
table[NF_SYSCTL_CT_COUNT].data = &net->ct.count;
table[NF_SYSCTL_CT_CHECKSUM].data = &net->ct.sysctl_checksum;
@@ -655,6 +1019,16 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
#ifdef CONFIG_NF_CONNTRACK_EVENTS
table[NF_SYSCTL_CT_EVENTS].data = &net->ct.sysctl_events;
#endif
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC].data = &nf_generic_pernet(net)->timeout;
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP].data = &nf_icmp_pernet(net)->timeout;
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6].data = &nf_icmpv6_pernet(net)->timeout;
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP].data = &un->timeouts[UDP_CT_UNREPLIED];
+ table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM].data = &un->timeouts[UDP_CT_REPLIED];
+
+ nf_conntrack_standalone_init_tcp_sysctl(net, table);
+ nf_conntrack_standalone_init_sctp_sysctl(net, table);
+ nf_conntrack_standalone_init_dccp_sysctl(net, table);
+ nf_conntrack_standalone_init_gre_sysctl(net, table);
/* Don't export sysctls to unprivileged users */
if (net->user_ns != &init_user_ns) {
@@ -680,7 +1054,6 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
out_unregister_netfilter:
kfree(table);
-out_kmemdup:
return -ENOMEM;
}
@@ -707,27 +1080,26 @@ static int nf_conntrack_pernet_init(struct net *net)
{
int ret;
- ret = nf_conntrack_init_net(net);
+ net->ct.sysctl_checksum = 1;
+
+ ret = nf_conntrack_standalone_init_sysctl(net);
if (ret < 0)
- goto out_init;
+ return ret;
ret = nf_conntrack_standalone_init_proc(net);
if (ret < 0)
goto out_proc;
- net->ct.sysctl_checksum = 1;
- net->ct.sysctl_log_invalid = 0;
- ret = nf_conntrack_standalone_init_sysctl(net);
+ ret = nf_conntrack_init_net(net);
if (ret < 0)
- goto out_sysctl;
+ goto out_init_net;
return 0;
-out_sysctl:
+out_init_net:
nf_conntrack_standalone_fini_proc(net);
out_proc:
nf_conntrack_cleanup_net(net);
-out_init:
return ret;
}
--
2.11.0
^ permalink raw reply related
* [PATCH 21/33] netfilter: conntrack: remove l4proto destroy hook
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
Only one user (gre), add a direct call and remove this facility.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_conntrack_l4proto.h | 3 ---
net/netfilter/nf_conntrack_core.c | 15 +++++++++++----
net/netfilter/nf_conntrack_proto_gre.c | 14 --------------
3 files changed, 11 insertions(+), 21 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index d5909e51ca92..5d1419ac6a38 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -27,9 +27,6 @@ struct nf_conntrack_l4proto {
/* protoinfo nlattr size, closes a hole */
u16 nlattr_size;
- /* Called when a conntrack entry is destroyed */
- void (*destroy)(struct nf_conn *ct);
-
/* called by gc worker if table is full */
bool (*can_early_drop)(const struct nf_conn *ct);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 728d2b5bdb1a..52e6c5c6f202 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -524,11 +524,18 @@ void nf_ct_tmpl_free(struct nf_conn *tmpl)
}
EXPORT_SYMBOL_GPL(nf_ct_tmpl_free);
+static void destroy_gre_conntrack(struct nf_conn *ct)
+{
+ struct nf_conn *master = ct->master;
+
+ if (master)
+ nf_ct_gre_keymap_destroy(master);
+}
+
static void
destroy_conntrack(struct nf_conntrack *nfct)
{
struct nf_conn *ct = (struct nf_conn *)nfct;
- const struct nf_conntrack_l4proto *l4proto;
pr_debug("destroy_conntrack(%p)\n", ct);
WARN_ON(atomic_read(&nfct->use) != 0);
@@ -537,9 +544,9 @@ destroy_conntrack(struct nf_conntrack *nfct)
nf_ct_tmpl_free(ct);
return;
}
- l4proto = __nf_ct_l4proto_find(nf_ct_protonum(ct));
- if (l4proto->destroy)
- l4proto->destroy(ct);
+
+ if (unlikely(nf_ct_protonum(ct) == IPPROTO_GRE))
+ destroy_gre_conntrack(ct);
local_bh_disable();
/* Expectations will have been removed in clean_from_lists,
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index fa765d2fd586..ee9ab10a32e4 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -249,19 +249,6 @@ int nf_conntrack_gre_packet(struct nf_conn *ct,
return NF_ACCEPT;
}
-/* Called when a conntrack entry has already been removed from the hashes
- * and is about to be deleted from memory */
-static void gre_destroy(struct nf_conn *ct)
-{
- struct nf_conn *master = ct->master;
- pr_debug(" entering\n");
-
- if (!master)
- pr_debug("no master !?!\n");
- else
- nf_ct_gre_keymap_destroy(master);
-}
-
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
#include <linux/netfilter/nfnetlink.h>
@@ -329,7 +316,6 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_gre = {
#ifdef CONFIG_NF_CONNTRACK_PROCFS
.print_conntrack = gre_print_conntrack,
#endif
- .destroy = gre_destroy,
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
.tuple_to_nlattr = nf_ct_port_tuple_to_nlattr,
.nlattr_tuple_size = nf_ct_port_nlattr_tuple_size,
--
2.11.0
^ permalink raw reply related
* [PATCH 16/33] netfilter: conntrack: remove pernet l4 proto register interface
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
No used anymore.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_conntrack_l4proto.h | 12 ------------
net/netfilter/nf_conntrack_proto.c | 28 ++++++++++++----------------
2 files changed, 12 insertions(+), 28 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index dda028996559..87d9c198c05e 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -144,18 +144,6 @@ const struct nf_conntrack_l4proto *__nf_ct_l4proto_find(u8 l4proto);
const struct nf_conntrack_l4proto *nf_ct_l4proto_find_get(u8 l4proto);
-/* Protocol pernet registration. */
-int nf_ct_l4proto_pernet_register_one(struct net *net,
- const struct nf_conntrack_l4proto *proto);
-void nf_ct_l4proto_pernet_unregister_one(struct net *net,
- const struct nf_conntrack_l4proto *proto);
-int nf_ct_l4proto_pernet_register(struct net *net,
- const struct nf_conntrack_l4proto *const proto[],
- unsigned int num_proto);
-void nf_ct_l4proto_pernet_unregister(struct net *net,
- const struct nf_conntrack_l4proto *const proto[],
- unsigned int num_proto);
-
/* Protocol global registration. */
int nf_ct_l4proto_register_one(const struct nf_conntrack_l4proto *proto);
void nf_ct_l4proto_unregister_one(const struct nf_conntrack_l4proto *proto);
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 3455f993cc68..13b782cc6a7a 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -221,8 +221,8 @@ int nf_ct_l4proto_register_one(const struct nf_conntrack_l4proto *l4proto)
}
EXPORT_SYMBOL_GPL(nf_ct_l4proto_register_one);
-int nf_ct_l4proto_pernet_register_one(struct net *net,
- const struct nf_conntrack_l4proto *l4proto)
+static int nf_ct_l4proto_pernet_register_one(struct net *net,
+ const struct nf_conntrack_l4proto *l4proto)
{
int ret = 0;
struct nf_proto_net *pn = NULL;
@@ -245,7 +245,6 @@ int nf_ct_l4proto_pernet_register_one(struct net *net,
out:
return ret;
}
-EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_register_one);
static void __nf_ct_l4proto_unregister_one(const struct nf_conntrack_l4proto *l4proto)
@@ -272,7 +271,7 @@ void nf_ct_l4proto_unregister_one(const struct nf_conntrack_l4proto *l4proto)
}
EXPORT_SYMBOL_GPL(nf_ct_l4proto_unregister_one);
-void nf_ct_l4proto_pernet_unregister_one(struct net *net,
+static void nf_ct_l4proto_pernet_unregister_one(struct net *net,
const struct nf_conntrack_l4proto *l4proto)
{
struct nf_proto_net *pn = nf_ct_l4proto_net(net, l4proto);
@@ -283,7 +282,6 @@ void nf_ct_l4proto_pernet_unregister_one(struct net *net,
pn->users--;
nf_ct_l4proto_unregister_sysctl(pn);
}
-EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_unregister_one);
static void
nf_ct_l4proto_unregister(const struct nf_conntrack_l4proto * const l4proto[],
@@ -322,7 +320,15 @@ nf_ct_l4proto_register(const struct nf_conntrack_l4proto * const l4proto[],
return ret;
}
-int nf_ct_l4proto_pernet_register(struct net *net,
+static void nf_ct_l4proto_pernet_unregister(struct net *net,
+ const struct nf_conntrack_l4proto *const l4proto[],
+ unsigned int num_proto)
+{
+ while (num_proto-- != 0)
+ nf_ct_l4proto_pernet_unregister_one(net, l4proto[num_proto]);
+}
+
+static int nf_ct_l4proto_pernet_register(struct net *net,
const struct nf_conntrack_l4proto *const l4proto[],
unsigned int num_proto)
{
@@ -341,16 +347,6 @@ int nf_ct_l4proto_pernet_register(struct net *net,
}
return ret;
}
-EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_register);
-
-void nf_ct_l4proto_pernet_unregister(struct net *net,
- const struct nf_conntrack_l4proto *const l4proto[],
- unsigned int num_proto)
-{
- while (num_proto-- != 0)
- nf_ct_l4proto_pernet_unregister_one(net, l4proto[num_proto]);
-}
-EXPORT_SYMBOL_GPL(nf_ct_l4proto_pernet_unregister);
static unsigned int nf_confirm(struct sk_buff *skb,
unsigned int protoff,
--
2.11.0
^ permalink raw reply related
* [PATCH 13/33] netfilter: conntrack: remove invert_tuple callback
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
Only used by icmp(v6). Prefer a direct call and remove this
function from the l4proto struct.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_conntrack_l4proto.h | 11 +++++------
net/netfilter/nf_conntrack_core.c | 8 ++++++--
net/netfilter/nf_conntrack_proto_icmp.c | 5 ++---
net/netfilter/nf_conntrack_proto_icmpv6.c | 5 ++---
4 files changed, 15 insertions(+), 14 deletions(-)
diff --git a/include/net/netfilter/nf_conntrack_l4proto.h b/include/net/netfilter/nf_conntrack_l4proto.h
index 0d4b0398aeb9..6cec8337e684 100644
--- a/include/net/netfilter/nf_conntrack_l4proto.h
+++ b/include/net/netfilter/nf_conntrack_l4proto.h
@@ -27,12 +27,6 @@ struct nf_conntrack_l4proto {
/* protoinfo nlattr size, closes a hole */
u16 nlattr_size;
- /* Invert the per-proto part of the tuple: ie. turn xmit into reply.
- * Only used by icmp, most protocols use a generic version.
- */
- bool (*invert_tuple)(struct nf_conntrack_tuple *inverse,
- const struct nf_conntrack_tuple *orig);
-
/* Returns verdict for packet, or -1 for invalid. */
int (*packet)(struct nf_conn *ct,
struct sk_buff *skb,
@@ -95,6 +89,11 @@ bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
struct net *net,
struct nf_conntrack_tuple *tuple);
+bool nf_conntrack_invert_icmp_tuple(struct nf_conntrack_tuple *tuple,
+ const struct nf_conntrack_tuple *orig);
+bool nf_conntrack_invert_icmpv6_tuple(struct nf_conntrack_tuple *tuple,
+ const struct nf_conntrack_tuple *orig);
+
int nf_conntrack_icmpv4_error(struct nf_conn *tmpl,
struct sk_buff *skb,
unsigned int dataoff,
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index b71e271f2b44..d56cb0fc82b6 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -423,8 +423,12 @@ nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
inverse->dst.protonum = orig->dst.protonum;
- if (unlikely(l4proto->invert_tuple))
- return l4proto->invert_tuple(inverse, orig);
+ switch (orig->dst.protonum) {
+ case IPPROTO_ICMP:
+ return nf_conntrack_invert_icmp_tuple(inverse, orig);
+ case IPPROTO_ICMPV6:
+ return nf_conntrack_invert_icmpv6_tuple(inverse, orig);
+ }
inverse->src.u.all = orig->dst.u.all;
inverse->dst.u.all = orig->src.u.all;
diff --git a/net/netfilter/nf_conntrack_proto_icmp.c b/net/netfilter/nf_conntrack_proto_icmp.c
index 805c1fe5b837..d28c1d7633b2 100644
--- a/net/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/netfilter/nf_conntrack_proto_icmp.c
@@ -54,8 +54,8 @@ static const u_int8_t invmap[] = {
[ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1
};
-static bool icmp_invert_tuple(struct nf_conntrack_tuple *tuple,
- const struct nf_conntrack_tuple *orig)
+bool nf_conntrack_invert_icmp_tuple(struct nf_conntrack_tuple *tuple,
+ const struct nf_conntrack_tuple *orig)
{
if (orig->dst.u.icmp.type >= sizeof(invmap) ||
!invmap[orig->dst.u.icmp.type])
@@ -347,7 +347,6 @@ static struct nf_proto_net *icmp_get_net_proto(struct net *net)
const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp =
{
.l4proto = IPPROTO_ICMP,
- .invert_tuple = icmp_invert_tuple,
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
.tuple_to_nlattr = icmp_tuple_to_nlattr,
.nlattr_tuple_size = icmp_nlattr_tuple_size,
diff --git a/net/netfilter/nf_conntrack_proto_icmpv6.c b/net/netfilter/nf_conntrack_proto_icmpv6.c
index 20cd55e55e41..2910dcdea134 100644
--- a/net/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/netfilter/nf_conntrack_proto_icmpv6.c
@@ -67,8 +67,8 @@ static const u_int8_t noct_valid_new[] = {
[ICMPV6_MLD2_REPORT - 130] = 1
};
-static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
- const struct nf_conntrack_tuple *orig)
+bool nf_conntrack_invert_icmpv6_tuple(struct nf_conntrack_tuple *tuple,
+ const struct nf_conntrack_tuple *orig)
{
int type = orig->dst.u.icmp.type - 128;
if (type < 0 || type >= sizeof(invmap) || !invmap[type])
@@ -358,7 +358,6 @@ static struct nf_proto_net *icmpv6_get_net_proto(struct net *net)
const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 =
{
.l4proto = IPPROTO_ICMPV6,
- .invert_tuple = icmpv6_invert_tuple,
#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
.tuple_to_nlattr = icmpv6_tuple_to_nlattr,
.nlattr_tuple_size = icmpv6_nlattr_tuple_size,
--
2.11.0
^ permalink raw reply related
* [PATCH 03/33] netfilter: nf_tables: add direct calls for all builtin expressions
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
With CONFIG_RETPOLINE its faster to add an if (ptr == &foo_func)
check and and use direct calls for all the built-in expressions.
~15% improvement in pathological cases.
checkpatch doesn't like the X macro due to the embedded return statement,
but the macro has a very limited scope so I don't think its a problem.
I would like to avoid bugs of the form
If (e->ops->eval == (unsigned long)nft_foo_eval)
nft_bar_eval();
and open-coded if ()/else if()/else cascade, thus the macro.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables_core.h | 16 ++++++++++++++++
net/netfilter/nf_tables_core.c | 25 ++++++++++++++++++-------
net/netfilter/nft_bitwise.c | 5 ++---
net/netfilter/nft_byteorder.c | 6 +++---
net/netfilter/nft_cmp.c | 6 +++---
net/netfilter/nft_dynset.c | 5 ++---
net/netfilter/nft_immediate.c | 6 +++---
net/netfilter/nft_payload.c | 6 +++---
net/netfilter/nft_range.c | 5 ++---
net/netfilter/nft_rt.c | 6 +++---
10 files changed, 55 insertions(+), 31 deletions(-)
diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h
index 2046d104f323..7281895fa6d9 100644
--- a/include/net/netfilter/nf_tables_core.h
+++ b/include/net/netfilter/nf_tables_core.h
@@ -80,6 +80,22 @@ struct nft_regs;
struct nft_pktinfo;
void nft_meta_get_eval(const struct nft_expr *expr,
struct nft_regs *regs, const struct nft_pktinfo *pkt);
+void nft_cmp_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt);
void nft_lookup_eval(const struct nft_expr *expr,
struct nft_regs *regs, const struct nft_pktinfo *pkt);
+void nft_payload_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt);
+void nft_immediate_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt);
+void nft_bitwise_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt);
+void nft_range_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt);
+void nft_byteorder_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt);
+void nft_dynset_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt);
+void nft_rt_get_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt);
#endif /* _NET_NF_TABLES_CORE_H */
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index a50500232b0a..2a00aef7b6d4 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -124,14 +124,25 @@ static void expr_call_ops_eval(const struct nft_expr *expr,
struct nft_regs *regs,
struct nft_pktinfo *pkt)
{
+#ifdef CONFIG_RETPOLINE
unsigned long e = (unsigned long)expr->ops->eval;
-
- if (e == (unsigned long)nft_meta_get_eval)
- nft_meta_get_eval(expr, regs, pkt);
- else if (e == (unsigned long)nft_lookup_eval)
- nft_lookup_eval(expr, regs, pkt);
- else
- expr->ops->eval(expr, regs, pkt);
+#define X(e, fun) \
+ do { if ((e) == (unsigned long)(fun)) \
+ return fun(expr, regs, pkt); } while (0)
+
+ X(e, nft_payload_eval);
+ X(e, nft_cmp_eval);
+ X(e, nft_meta_get_eval);
+ X(e, nft_lookup_eval);
+ X(e, nft_range_eval);
+ X(e, nft_immediate_eval);
+ X(e, nft_byteorder_eval);
+ X(e, nft_dynset_eval);
+ X(e, nft_rt_get_eval);
+ X(e, nft_bitwise_eval);
+#undef X
+#endif /* CONFIG_RETPOLINE */
+ expr->ops->eval(expr, regs, pkt);
}
unsigned int
diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index fff8073e2a56..2c75b9e0474e 100644
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -25,9 +25,8 @@ struct nft_bitwise {
struct nft_data xor;
};
-static void nft_bitwise_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
+void nft_bitwise_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt)
{
const struct nft_bitwise *priv = nft_expr_priv(expr);
const u32 *src = ®s->data[priv->sreg];
diff --git a/net/netfilter/nft_byteorder.c b/net/netfilter/nft_byteorder.c
index 13d4e421a6b3..19dbc34cc75e 100644
--- a/net/netfilter/nft_byteorder.c
+++ b/net/netfilter/nft_byteorder.c
@@ -26,9 +26,9 @@ struct nft_byteorder {
u8 size;
};
-static void nft_byteorder_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
+void nft_byteorder_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
{
const struct nft_byteorder *priv = nft_expr_priv(expr);
u32 *src = ®s->data[priv->sreg];
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index 79d48c1d06f4..f9f1fa66a16e 100644
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -24,9 +24,9 @@ struct nft_cmp_expr {
enum nft_cmp_ops op:8;
};
-static void nft_cmp_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
+void nft_cmp_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
{
const struct nft_cmp_expr *priv = nft_expr_priv(expr);
int d;
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 07d4efd3d851..9658493d37d4 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -62,9 +62,8 @@ static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,
return NULL;
}
-static void nft_dynset_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
+void nft_dynset_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt)
{
const struct nft_dynset *priv = nft_expr_priv(expr);
struct nft_set *set = priv->set;
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 0777a93211e2..3e5ed787b1d4 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -17,9 +17,9 @@
#include <net/netfilter/nf_tables_core.h>
#include <net/netfilter/nf_tables.h>
-static void nft_immediate_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
+void nft_immediate_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
{
const struct nft_immediate_expr *priv = nft_expr_priv(expr);
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index e110b0ebbf58..54e15de4b79a 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -70,9 +70,9 @@ nft_payload_copy_vlan(u32 *d, const struct sk_buff *skb, u8 offset, u8 len)
return skb_copy_bits(skb, offset + mac_off, dst_u8, len) == 0;
}
-static void nft_payload_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
+void nft_payload_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
{
const struct nft_payload *priv = nft_expr_priv(expr);
const struct sk_buff *skb = pkt->skb;
diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
index cedb96c3619f..529ac8acb19d 100644
--- a/net/netfilter/nft_range.c
+++ b/net/netfilter/nft_range.c
@@ -23,9 +23,8 @@ struct nft_range_expr {
enum nft_range_ops op:8;
};
-static void nft_range_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
+void nft_range_eval(const struct nft_expr *expr,
+ struct nft_regs *regs, const struct nft_pktinfo *pkt)
{
const struct nft_range_expr *priv = nft_expr_priv(expr);
int d1, d2;
diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c
index f35fa33913ae..c48daed5c46b 100644
--- a/net/netfilter/nft_rt.c
+++ b/net/netfilter/nft_rt.c
@@ -53,9 +53,9 @@ static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skb
return mtu - minlen;
}
-static void nft_rt_get_eval(const struct nft_expr *expr,
- struct nft_regs *regs,
- const struct nft_pktinfo *pkt)
+void nft_rt_get_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
{
const struct nft_rt *priv = nft_expr_priv(expr);
const struct sk_buff *skb = pkt->skb;
--
2.11.0
^ permalink raw reply related
* [PATCH 00/33] Netfilter/IPVS updates for net-next
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
Hi David,
The following patchset contains Netfilter/IPVS updates for your net-next tree:
1) Introduce a hashtable to speed up object lookups, from Florian Westphal.
2) Make direct calls to built-in extension, also from Florian.
3) Call helper before confirming the conntrack as it used to be originally,
from Florian.
4) Call request_module() to autoload br_netfilter when physdev is used
to relax the dependency, also from Florian.
5) Allow to insert rules at a given position ID that is internal to the
batch, from Phil Sutter.
6) Several patches to replace conntrack indirections by direct calls,
and to reduce modularization, from Florian. This also includes
several follow up patches to deal with minor fallout from this
rework.
7) Use RCU from conntrack gre helper, from Florian.
8) GRE conntrack module becomes built-in into nf_conntrack, from Florian.
9) Replace nf_ct_invert_tuplepr() by calls to nf_ct_invert_tuple(),
from Florian.
10) Unify sysctl handling at the core of nf_conntrack, from Florian.
11) Provide modparam to register conntrack hooks.
12) Allow to match on the interface kind string, from wenxu.
13) Remove several exported symbols, not required anymore now after
a bit of de-modulatization work has been done, from Florian.
14) Remove built-in map support in the hash extension, this can be
done with the existing userspace infrastructure, from laura.
15) Remove indirection to calculate checksums in IPVS, from Matteo Croce.
16) Use call wrappers for indirection in IPVS, also from Matteo.
17) Remove superfluous __percpu parameter in nft_counter, patch from
Luc Van Oostenryck.
You can pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git
Thanks!
----------------------------------------------------------------
The following changes since commit 435f3f267780321a1aff41bdade257722328ead5:
Merge branch 'tcp_openreq_child' (2019-01-17 22:19:05 -0800)
are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git HEAD
for you to fetch changes up to 83f529281d7aa42b10c2c5cb64fcbd2c7cab4409:
netfilter: ipv4: remove useless export_symbol (2019-01-28 11:32:58 +0100)
----------------------------------------------------------------
Cong Wang (1):
netfilter: conntrack: fix error path in nf_conntrack_pernet_init()
Florian Westphal (25):
netfilter: nf_tables: prepare nft_object for lookups via hashtable
netfilter: nf_tables: handle nft_object lookups via rhltable
netfilter: nf_tables: add direct calls for all builtin expressions
netfilter: conntrack: remove helper hook again
netfilter: physdev: relax br_netfilter dependency
netfilter: conntrack: handle builtin l4proto packet functions via direct calls
netfilter: conntrack: handle icmp pkt_to_tuple helper via direct calls
netfilter: conntrack: gre: convert rwlock to rcu
netfilter: conntrack: gre: switch module to be built-in
netfilter: conntrack: remove net_id
netfilter: conntrack: remove pkt_to_tuple callback
netfilter: conntrack: remove invert_tuple callback
netfilter: conntrack: remove module owner field
netfilter: conntrack: remove remaining l4proto indirect packet calls
netfilter: conntrack: remove pernet l4 proto register interface
netfilter: conntrack: avoid unneeded nf_conntrack_l4proto lookups
netfilter: conntrack: unify sysctl handling
netfilter: conntrack: remove sysctl registration helpers
netfilter: conntrack: remove l4proto init and get_net callbacks
netfilter: conntrack: remove l4proto destroy hook
netfilter: conntrack: remove nf_ct_l4proto_find_get
netfilter: nat: un-export nf_nat_used_tuple
netfilter: conntrack: fix IPV6=n builds
netfilter: conntrack: fix bogus port values for other l4 protocols
netfilter: ipv4: remove useless export_symbol
Laura Garcia Liebana (1):
Revert "netfilter: nft_hash: add map lookups for hashing operations"
Luc Van Oostenryck (1):
netfilter: nft_counter: remove wrong __percpu of nft_counter_resest()'s arg
Matteo Croce (2):
ipvs: avoid indirect calls when calculating checksums
ipvs: use indirect call wrappers
Pablo Neira Ayuso (1):
netfilter: nf_conntrack: provide modparam to always register conntrack hooks
Phil Sutter (1):
netfilter: nf_tables: Support RULE_ID reference in new rule
wenxu (1):
netfilter: nft_meta: Add NFT_META_I/OIFKIND meta type
include/linux/netfilter/nf_conntrack_proto_gre.h | 17 +-
include/linux/netfilter_ipv4.h | 6 -
include/net/ip_vs.h | 3 -
include/net/netfilter/br_netfilter.h | 1 -
include/net/netfilter/ipv4/nf_conntrack_ipv4.h | 3 +
include/net/netfilter/nf_conntrack.h | 2 -
include/net/netfilter/nf_conntrack_core.h | 5 +-
include/net/netfilter/nf_conntrack_l4proto.h | 122 +++---
include/net/netfilter/nf_nat.h | 4 -
include/net/netfilter/nf_tables.h | 26 +-
include/net/netfilter/nf_tables_core.h | 16 +
include/net/netns/conntrack.h | 30 +-
include/uapi/linux/netfilter/nf_tables.h | 10 +-
net/bridge/br_netfilter_hooks.c | 5 -
net/ipv4/netfilter.c | 18 -
net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 2 +-
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 2 +-
net/netfilter/Kconfig | 2 +-
net/netfilter/Makefile | 3 +-
net/netfilter/ipvs/ip_vs_core.c | 49 ++-
net/netfilter/ipvs/ip_vs_proto_ah_esp.c | 2 -
net/netfilter/ipvs/ip_vs_proto_sctp.c | 8 +-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 15 +-
net/netfilter/ipvs/ip_vs_proto_udp.c | 15 +-
net/netfilter/nf_conntrack_core.c | 210 +++++----
net/netfilter/nf_conntrack_expect.c | 2 +-
net/netfilter/nf_conntrack_netlink.c | 14 +-
net/netfilter/nf_conntrack_pptp.c | 2 +-
net/netfilter/nf_conntrack_proto.c | 514 ++++-------------------
net/netfilter/nf_conntrack_proto_dccp.c | 134 +-----
net/netfilter/nf_conntrack_proto_generic.c | 85 +---
net/netfilter/nf_conntrack_proto_gre.c | 196 ++-------
net/netfilter/nf_conntrack_proto_icmp.c | 67 +--
net/netfilter/nf_conntrack_proto_icmpv6.c | 69 +--
net/netfilter/nf_conntrack_proto_sctp.c | 128 +-----
net/netfilter/nf_conntrack_proto_tcp.c | 160 +------
net/netfilter/nf_conntrack_proto_udp.c | 80 +---
net/netfilter/nf_conntrack_standalone.c | 427 ++++++++++++++++++-
net/netfilter/nf_flow_table_core.c | 2 +-
net/netfilter/nf_nat_core.c | 15 +-
net/netfilter/nf_tables_api.c | 137 +++++-
net/netfilter/nf_tables_core.c | 25 +-
net/netfilter/nfnetlink_cttimeout.c | 19 +-
net/netfilter/nft_bitwise.c | 5 +-
net/netfilter/nft_byteorder.c | 6 +-
net/netfilter/nft_cmp.c | 6 +-
net/netfilter/nft_counter.c | 2 +-
net/netfilter/nft_ct.c | 4 +-
net/netfilter/nft_dynset.c | 5 +-
net/netfilter/nft_hash.c | 121 ------
net/netfilter/nft_immediate.c | 6 +-
net/netfilter/nft_meta.c | 12 +
net/netfilter/nft_objref.c | 5 +-
net/netfilter/nft_payload.c | 6 +-
net/netfilter/nft_quota.c | 2 +-
net/netfilter/nft_range.c | 5 +-
net/netfilter/nft_rt.c | 6 +-
net/netfilter/utils.c | 19 +
net/netfilter/xt_CT.c | 2 +-
net/netfilter/xt_physdev.c | 9 +-
net/openvswitch/conntrack.c | 2 +-
61 files changed, 1178 insertions(+), 1697 deletions(-)
^ permalink raw reply
* [PATCH 01/33] netfilter: nf_tables: prepare nft_object for lookups via hashtable
From: Pablo Neira Ayuso @ 2019-01-28 23:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: davem, netdev
In-Reply-To: <20190128235750.18412-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
Add a 'key' structure for object, so we can look them up by name + table
combination (the name can be the same in each table).
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables.h | 19 ++++++++++++++-----
net/netfilter/nf_tables_api.c | 27 ++++++++++++++++-----------
net/netfilter/nft_objref.c | 2 +-
net/netfilter/nft_quota.c | 2 +-
4 files changed, 32 insertions(+), 18 deletions(-)
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 841835a387e1..325d0a6b808b 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1012,11 +1012,21 @@ int nft_verdict_dump(struct sk_buff *skb, int type,
const struct nft_verdict *v);
/**
+ * struct nft_object_hash_key - key to lookup nft_object
+ *
+ * @name: name of the stateful object to look up
+ * @table: table the object belongs to
+ */
+struct nft_object_hash_key {
+ const char *name;
+ const struct nft_table *table;
+};
+
+/**
* struct nft_object - nf_tables stateful object
*
* @list: table stateful object list node
- * @table: table this object belongs to
- * @name: name of this stateful object
+ * @key: keys that identify this object
* @genmask: generation mask
* @use: number of references to this stateful object
* @handle: unique object handle
@@ -1025,8 +1035,7 @@ int nft_verdict_dump(struct sk_buff *skb, int type,
*/
struct nft_object {
struct list_head list;
- char *name;
- struct nft_table *table;
+ struct nft_object_hash_key key;
u32 genmask:2,
use:30;
u64 handle;
@@ -1047,7 +1056,7 @@ struct nft_object *nft_obj_lookup(const struct nft_table *table,
const struct nlattr *nla, u32 objtype,
u8 genmask);
-void nft_obj_notify(struct net *net, struct nft_table *table,
+void nft_obj_notify(struct net *net, const struct nft_table *table,
struct nft_object *obj, u32 portid, u32 seq,
int event, int family, int report, gfp_t gfp);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2b0a93300dd7..5e213941e85b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3853,7 +3853,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
- (*nft_set_ext_obj(ext))->name) < 0)
+ (*nft_set_ext_obj(ext))->key.name) < 0)
goto nla_put_failure;
if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
@@ -4826,7 +4826,7 @@ struct nft_object *nft_obj_lookup(const struct nft_table *table,
struct nft_object *obj;
list_for_each_entry_rcu(obj, &table->objects, list) {
- if (!nla_strcmp(nla, obj->name) &&
+ if (!nla_strcmp(nla, obj->key.name) &&
objtype == obj->ops->type->type &&
nft_active_genmask(obj, genmask))
return obj;
@@ -5014,11 +5014,11 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
err = PTR_ERR(obj);
goto err1;
}
- obj->table = table;
+ obj->key.table = table;
obj->handle = nf_tables_alloc_handle(table);
- obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
- if (!obj->name) {
+ obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
+ if (!obj->key.name) {
err = -ENOMEM;
goto err2;
}
@@ -5031,7 +5031,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
table->use++;
return 0;
err3:
- kfree(obj->name);
+ kfree(obj->key.name);
err2:
if (obj->ops->destroy)
obj->ops->destroy(&ctx, obj);
@@ -5060,7 +5060,7 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
- nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
+ nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
@@ -5246,7 +5246,7 @@ static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
obj->ops->destroy(ctx, obj);
module_put(obj->ops->type->owner);
- kfree(obj->name);
+ kfree(obj->key.name);
kfree(obj);
}
@@ -5297,7 +5297,7 @@ static int nf_tables_delobj(struct net *net, struct sock *nlsk,
return nft_delobj(&ctx, obj);
}
-void nft_obj_notify(struct net *net, struct nft_table *table,
+void nft_obj_notify(struct net *net, const struct nft_table *table,
struct nft_object *obj, u32 portid, u32 seq, int event,
int family, int report, gfp_t gfp)
{
@@ -6404,6 +6404,11 @@ static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
nf_tables_commit_chain_free_rules_old(g0);
}
+static void nft_obj_del(struct nft_object *obj)
+{
+ list_del_rcu(&obj->list);
+}
+
static void nft_chain_del(struct nft_chain *chain)
{
struct nft_table *table = chain->table;
@@ -6580,7 +6585,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
nft_trans_destroy(trans);
break;
case NFT_MSG_DELOBJ:
- list_del_rcu(&nft_trans_obj(trans)->list);
+ nft_obj_del(nft_trans_obj(trans));
nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
NFT_MSG_DELOBJ);
break;
@@ -7330,7 +7335,7 @@ static void __nft_release_tables(struct net *net)
nft_set_destroy(set);
}
list_for_each_entry_safe(obj, ne, &table->objects, list) {
- list_del(&obj->list);
+ nft_obj_del(obj);
table->use--;
nft_obj_destroy(&ctx, obj);
}
diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
index a3185ca2a3a9..58eb75ad61bf 100644
--- a/net/netfilter/nft_objref.c
+++ b/net/netfilter/nft_objref.c
@@ -53,7 +53,7 @@ static int nft_objref_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
const struct nft_object *obj = nft_objref_priv(expr);
- if (nla_put_string(skb, NFTA_OBJREF_IMM_NAME, obj->name) ||
+ if (nla_put_string(skb, NFTA_OBJREF_IMM_NAME, obj->key.name) ||
nla_put_be32(skb, NFTA_OBJREF_IMM_TYPE,
htonl(obj->ops->type->type)))
goto nla_put_failure;
diff --git a/net/netfilter/nft_quota.c b/net/netfilter/nft_quota.c
index 0ed124a93fcf..354cde67bca9 100644
--- a/net/netfilter/nft_quota.c
+++ b/net/netfilter/nft_quota.c
@@ -61,7 +61,7 @@ static void nft_quota_obj_eval(struct nft_object *obj,
if (overquota &&
!test_and_set_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags))
- nft_obj_notify(nft_net(pkt), obj->table, obj, 0, 0,
+ nft_obj_notify(nft_net(pkt), obj->key.table, obj, 0, 0,
NFT_MSG_NEWOBJ, nft_pf(pkt), 0, GFP_ATOMIC);
}
--
2.11.0
^ permalink raw reply related
* Re: [PATCH] bpf/core.c - silence warning messages
From: Daniel Borkmann @ 2019-01-28 23:54 UTC (permalink / raw)
To: valdis.kletnieks; +Cc: Song Liu, Alexei Starovoitov, Networking, open list
In-Reply-To: <10399.1548719293@turing-police.cc.vt.edu>
On 01/29/2019 12:48 AM, valdis.kletnieks@vt.edu wrote:
> On Tue, 29 Jan 2019 00:22:26 +0100, Daniel Borkmann said:
>> I think moving in separate file would be overkill, imho. However, lets get
>> the kdoc and prototype warning fixed.
>
> I have a bunch of spare time at the moment, so the kdoc and prototype
> warnings are on my to-do list.
Great, thanks!
^ permalink raw reply
* Re: [PATCH] bpf/core.c - silence warning messages
From: valdis.kletnieks @ 2019-01-28 23:48 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: Song Liu, Alexei Starovoitov, Networking, open list
In-Reply-To: <3c8c866f-c665-ff82-a0ab-a4eafd28b20f@iogearbox.net>
On Tue, 29 Jan 2019 00:22:26 +0100, Daniel Borkmann said:
> I think moving in separate file would be overkill, imho. However, lets get
> the kdoc and prototype warning fixed.
I have a bunch of spare time at the moment, so the kdoc and prototype
warnings are on my to-do list.
^ permalink raw reply
* [RFC 14/14] Documentation: networking: describe new hstat API
From: Jakub Kicinski @ 2019-01-28 23:45 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
Add hstat documentation for users and driver developers.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
Documentation/networking/hstats.rst | 590 ++++++++++++++++++
.../networking/hstats_flow_example.dot | 11 +
Documentation/networking/index.rst | 1 +
3 files changed, 602 insertions(+)
create mode 100644 Documentation/networking/hstats.rst
create mode 100644 Documentation/networking/hstats_flow_example.dot
diff --git a/Documentation/networking/hstats.rst b/Documentation/networking/hstats.rst
new file mode 100644
index 000000000000..8856770a4909
--- /dev/null
+++ b/Documentation/networking/hstats.rst
@@ -0,0 +1,590 @@
+.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+
+=================================
+Netlink device hierarchical stats
+=================================
+
+Overview
+========
+
+*hstats* are standardized driver statistics. Both device and host driver
+statistics can be exposed.
+
+*hstats* are a partial replacement for `ethtool -S`, standard-based statistics
+and statistics common across many drivers should be added to *hstats*.
+Once statistic is exposed via *hstats* it should not be added to `ethtool -S`
+(drivers which already expose it can keep doing so, but no new driver allowed).
+
+Apart from common statistics identifiers *hstats* provide:
+ - clear indication if statistic is maintained (unlike more compact
+ fixed-structure stats, e.g. `struct rtnl_link_stats64`);
+ - hierarchical structure (see :ref:`groups` and :ref:`hierarchies`);
+ - exposes :ref:`qualifiers` - these are attributes of the statistics which
+ help determine the source of the statistics;
+ - provide flexible grouping mechanism which should reduce code duplication
+ amongst drivers.
+
+Netlink message structure
+=========================
+
+Basic structure of the `IFLA_STATS_LINK_HSTATS` attribute looks like this:
+
+::
+
+ [IFLA_STATS_LINK_HSTATS]
+ [IFLA_HSTATS_GROUP]
+ [IFLA_HSTATS_QUAL_xxx]
+ [IFLA_HSTATS_QUAL_yyy]
+ [IFLA_HSTATS_STATS]
+ [IFLA_HSTATS_STAT_a]
+ [IFLA_HSTATS_STAT_b]
+ [IFLA_HSTATS_GROUP]
+ [IFLA_HSTATS_QUAL_zzz]
+ [IFLA_HSTATS_STATS]
+ [IFLA_HSTATS_STAT_c]
+ [IFLA_HSTATS_STAT_d]
+ [IFLA_HSTATS_GROUP]
+ [IFLA_HSTATS_QUAL_zzz]
+ [IFLA_HSTATS_STATS]
+ [IFLA_HSTATS_STAT_c]
+ [IFLA_HSTATS_STAT_d]
+
+.. _groups:
+
+Groups
+------
+
+`IFLA_STATS_LINK_HSTATS` may contain zero or more `IFLA_HSTATS_GROUP`.
+
+The statistics within a root level `IFLA_HSTATS_GROUP` must not count
+events multiple times.
+
+The statistics within a root level `IFLA_HSTATS_GROUP` must include all
+of the events, excluding groups where `IFLA_HSTATS_PARTIAL` attribute is
+present and set to non-zero value or children of such groups
+(see :ref:`partials`). This removes the need to sum up statistics in the
+kernel, for example statistics maintained per queue by the driver can
+be reported only per queue and user space can do the adding.
+
+The purpose of multiple root level groups is to allow users tracking the flow
+of packets through pipelines. Let's consider the following RX NIC pipeline:
+
+.. _example_flow:
+
+.. kernel-figure:: hstats_flow_example.dot
+ :alt: statistics flow
+
+ Example device statistics flow diagram
+
+Each rectangle represents a root level `IFLA_STATS_LINK_HSTATS`. Users should
+be able to add all `IFLA_HSTATS_STAT_IEEE8023_FramesOK` within each of those
+groups, and compare them to see at which stage of the processing pipeline
+packets disappear.
+
+.. _qualifiers:
+
+Qualifiers
+----------
+
+Each `IFLA_HSTATS_GROUP` may have a set of qualifiers. Qualifiers are
+attributes which apply to the statistics like being a device statistic,
+being an RX statistic, or counting events/packets of a specific queue.
+See :ref:`qualifiers_list`.
+
+.. _hierarchies:
+
+Hierarchies
+-----------
+
+Each `IFLA_HSTATS_GROUP` can have further `IFLA_HSTATS_GROUP` s nested inside.
+Qualifiers of a parent group apply to the child group. The hierarchies have no
+perscribed meaning, or set structure. They are mostly present for the
+convenience of the driver authors.
+
+.. _partials:
+
+Partial groups
+--------------
+
+`IFLA_HSTATS_PARTIAL` attribute declares groups contents as incomplete.
+As explained in :ref:`groups` if a statistic is present it's sum within
+a root group must add up to total number of events seen at a given stage
+of processing. This mostly relates to iterative qualifiers like
+:ref:`qual_queue` or :ref:`qual_prio`.
+
+Counting events multiple times towards different statistics, including
+similar statistics from different families (e.g. IEEE stats vs IETF stats)
+is perfectly normal and acceptable.
+
+`IFLA_HSTATS_PARTIAL` is inherited to children the same as :ref:`qualifiers`.
+It can carry one of the following flags:
+
+IFLA_HSTATS_PARTIAL_CLASSIFIER
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Statistics from this group contain more detailed breakdown which may not
+be complete.
+
+For example, HW may maintain the number of packets received per priority,
+but packets received without a priority tag may not be counted separately.
+Since non-tagged packets are not counted the sum of statistics will not
+be complete.
+
+IFLA_HSTATS_PARTIAL_SLOWPATH
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Statistics from this group count slow path events. This attribute is used
+if hardware is capable of offload packet forwarding. Some packets may still
+reach the CPU for example if they were purposefully trapped for monitoring,
+or no forwarding rule matched.
+
+User space guidelines
+=====================
+
+User space `hstat` tool can be used to query statistics. This tools is part
+of the `iproute2` package.
+
+Device driver guidelines
+========================
+
+Defining groups
+---------------
+
+The definition of a group of statistics has four sections:
+
+.. code-block:: c
+
+ static const struct rtnl_hstat_group my_group = {
+ /* Qualifiers */
+ .qualifiers = {
+ [RTNL_HSTATS_QUAL_TYPE] = {
+ .constant = IFLA_HSTATS_QUAL_TYPE_DEV,
+ },
+ [RTNL_HSTATS_QUAL_DIRECTION] = {
+ .constant = IFLA_HSTATS_QUAL_DIR_RX,
+ },
+ },
+ /* Partials */
+ .partial_flags = IFLA_HSTATS_PARTIAL_CLASSIFIER,
+
+ /* Statistics */
+ .get_stats = nfp_hstat_vnic_nfd_basic_get,
+ .stats = {
+ /* Word 0 stats */
+ [0] = RTNL_HSTATS_STAT_LINUX_CSUM_COMPLETE_BIT,
+ /* Word 1 stats */
+ [1] = RTNL_HSTATS_STAT_RFC2819_etherStatsPkts_BIT |
+ RTNL_HSTATS_STAT_RFC2819_etherStatsOctets_BIT,
+ },
+ .stats_cnt = 3,
+
+ /* Child groups */
+ .has_children = true,
+ .children = {
+ &my_child_group,
+ NULL
+ },
+ };
+
+Each section can be omitted, i.e. group may not specify any qualifiers,
+statistics or have no children. :ref:`qual_type` and :ref:`qual_direction`
+qualifiers must be specified before any statistics is declared, that is to
+say current group or one of parent groups must set them before any statistics
+are reported.
+
+If any qualifier is iterative (`max` or `get_max` set instead of `constant`)
+the group will be dumped `max` times, the driver can find out about parameters
+of current invocation with `rtnl_hstat_qual_get` helper.
+
+Partial flags are optional, and mark group as incomplete (see :ref:`partials`).
+
+Statistics are dumped by invoking `get_stats` callback. Driver should report
+the statistics with `rtnl_hstat_dump` helper. The list of reported statistics
+contains all the statistics driver will dump. It is used for sizing netlink
+replies and filtering. Drivers must not dump more statistics or different
+statistics than defined. The definition of the bitmap requires a little bit
+of care, as there is currently no automatic way to assign statistics to the
+correct 64 bit word.
+
+.. note::
+ Qualifier constants and parameters to `rtnl_hstat_dump` take constants
+ defined in include/uapi/linux/if_link.h, other constants come from
+ include/net/hstats.h and have the `RTNL_` prefix.
+
+If any child groups are attached the `has_children` member must be set to `true`
+and `children` table must be NULL-terminated. Child groups may be used in
+different parent groups, but care has to be taken to never create loops.
+
+Root groups should generally not have the direction set as a constant.
+Most root groups should contain both RX and TX subgroups, rather than having
+RX-only root groups and TX-only root groups.
+
+Reporting groups
+----------------
+
+Drivers have to define one or more `rtnl_hstat_group`.
+
+They should then implement `ndo_hstat_get_groups` callback. Inside the callback
+they can report every statistic group via `rtnl_hstat_add_grp` helper.
+
+Counter resets
+--------------
+
+Counters should not reset their values while the driver is bound to the device,
+e.g. when link is brought down.
+
+Counters may reset on driver load/probe or when device is explicitly reset
+via devlink.
+
+For iterative qualifiers like queues or priorities drivers should maintain
+statistics for all queues ever allocated (or simply always report for max).
+
+.. _qualifiers_list:
+
+List of qualifiers
+==================
+
+.. _qual_type:
+
+Type
+----
+
+Indicates the source of the statistic. Statistics can either be maintained
+by the device or the driver. Statistics may be calculated based on multiple
+counters (e.g. two counters may need to be added), but such calculation must
+not include statistics of different types.
+
+IFLA_HSTATS_QUAL_TYPE_DEV
+~~~~~~~~~~~~~~~~~~~~~~~~~
+Device statistic, counter is maintained by the device and only reported by
+the driver. There is currently no distinction between hardware and
+microcode/firmware statistics.
+
+IFLA_HSTATS_QUAL_TYPE_DRV
+~~~~~~~~~~~~~~~~~~~~~~~~~
+Driver statistic, fully maintained by software.
+
+.. _qual_direction:
+
+Direction
+---------
+
+Direction allows drivers to indicate whether statistics is counting incoming
+or outgoing frames. This is useful as it limmits the number of statistic IDs
+which have to be defined, but also often allows drivers to simplify the
+reporting if HW maintains the statitics for both directions in the same format,
+just in a different location.
+
+Direction and PCIe ports
+~~~~~~~~~~~~~~~~~~~~~~~~
+For PCIe port netdevs (representors) all statistics are expressed from
+device's prespective. If frame is submitted for transmission on a PCIe
+interface it will be seen as "received" by the port (representor).
+
+This means it is possible to see transmission side-only statistics in receive
+direction and vice versa (e.g. `IFLA_HSTATS_STAT_LINUX_CSUM_PARTIAL`).
+
+Device statistics reported on port (representor) interfaces, count the total
+number of events on given device port. This includes both frames forwarded
+via the "fast path" and explicitly directed to the device port from the
+port (representor) interface.
+
+Driver statistics necessarily count only the "fallback path" frames, and
+should always be reported with `IFLA_HSTATS_PARTIAL` set to
+`IFLA_HSTATS_PARTIAL_SLOWPATH`.
+
+IFLA_HSTATS_QUAL_DIR_RX
+~~~~~~~~~~~~~~~~~~~~~~~
+received
+
+IFLA_HSTATS_QUAL_DIR_TX
+~~~~~~~~~~~~~~~~~~~~~~~
+transmitted
+
+.. _qual_queue:
+
+Queue
+-----
+
+Queue (or channel) is a Receive Side Scaling construct allowing multiple
+consumers and producers to communicate with the device. It is usually
+applicable to the PCIe interface "side" of the device.
+
+Number of reported queues is in no way indicative of how many queues are
+currently enabled on the system.
+
+.. _qual_prio:
+
+Priority
+--------
+
+Priority is defined as Layer 2 IEEE 802.1Q frame priority.
+
+Traffic class
+-------------
+
+Traffic class is any non-Layer 2 queuing and priritization.
+
+List of statistics
+==================
+
+All statistics are 64 bits.
+
+Common statistics
+-----------------
+
+Statistics from this section are not based on any standard but rather ones
+which commonly appear in Linux drivers.
+
+The fact that statistic ID is assigned for some event does not constitute
+a recommendation that given statistic is implemented by drivers. Maintaining
+statistics has a performance cost associated and should be considered carefully.
+
+.. _stat_linux_pkts:
+
+IFLA_HSTATS_STAT_LINUX_PKTS
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Number of packets which were successfully handed over to the next layer.
+This means packets passed up during reception and passed down during
+transmission. This differs from both IETF and IEEE definition of basic
+packet counters, which generally count at the same layer boundary in both
+directions.
+
+No error or discard counters are included in this counter.
+
+IFLA_HSTATS_STAT_LINUX_BYTES
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Same as :ref:`stat_linux_pkts` but counts bytes instead of packets.
+
+IFLA_HSTATS_STAT_LINUX_BUSY
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Number of times the driver returned `NETDEV_TX_BUSY` to the stack from
+in TX handler.
+
+This statistic is defined in to-device direction only.
+
+IFLA_HSTATS_STAT_LINUX_CSUM_PARTIAL
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Number of successfully handled descriptors with CHECKSUM_PARTIAL offload to
+the hardware.
+
+This statistic is defined in to-device direction only.
+
+IFLA_HSTATS_STAT_LINUX_CSUM_COMPLETE
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Number of successfully handled descriptors indicating CHECKSUM_COMPLETE.
+
+This statistic is defined in from-device direction only.
+
+IFLA_HSTATS_STAT_LINUX_CSUM_UNNECESSARY
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Number of successfully handled descriptors indicating CHECKSUM_UNNECESSARY.
+
+This statistic is defined in from-device direction only.
+
+IFLA_HSTATS_STAT_LINUX_SEGMENTATION_OFFLOAD_PKTS
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Number of successfully handled segmentation- and reassembly-offload descriptors,
+regardless of transport protocol (TSO, USO, etc.)
+
+For transmission it means the number of frames requiring segmentation submitted
+successfully to the device's transmission function (driver) or number of
+correctly parsed descriptors for such packets (device).
+
+For reception it can be used to count Generic Receive Offload frames, but *not*
+Large Receive Offload frames.
+
+This statistic is incremented once per each frame pre-segmentation as seen
+by the Linux stack, not once per each frame on the wire.
+
+IETF RFC2819 statistics
+-----------------------
+IETF RFC2819 ("Remote Network Monitoring MIB")-compatible statistics.
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsDropEvents
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsDropEvents counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsOctets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsOctets counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsPkts
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsPkts counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsBroadcastPkts
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsBroadcastPkts counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsMulticastPkts
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsMulticastPkts counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsCRCAlignErrors
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsCRCAlignErrors counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsUndersizePkts
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsUndersizePkts counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsOversizePkts
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsOversizePkts counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsFragments
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsFragments counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsJabbers
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsJabbers counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsCollisions
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsCollisions counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsPkts64Octets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsPkts64Octets counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsPkts65to127Octets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsPkts65to127Octets counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsPkts128to255Octets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsPkts128to255Octets counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsPkts256to511Octets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsPkts256to511Octets counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsPkts512to1023Octets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsPkts512to1023Octets counter
+
+IFLA_HSTATS_STAT_RFC2819_etherStatsPkts1024to1518Octets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+etherStatsPkts1024to1518Octets counter
+
+Extended size statistics
+------------------------
+IETF RFC2819 defines simple packet-size based statistics for packets between
+64 and 1518 octets. However, larger frames are commonly supported. This
+sroup defines additional packet-size based statistics.
+
+IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts1024toMaxOctets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Definition follows etherStatsPkts65to127Octets with lower range bound of 1024,
+and no higher bound.
+
+IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts1519toMaxOctets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Definition follows etherStatsPkts65to127Octets with lower range bound of 1519,
+and no higher bound.
+
+IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts1024to2047Octets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Definition follows etherStatsPkts65to127Octets with lower range bound of 1024,
+and higher bound of 2047.
+
+IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts2048to4095Octets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Definition follows etherStatsPkts65to127Octets with lower range bound of 2048,
+and higher bound of 4095.
+
+IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts4096to8191Octets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Definition follows etherStatsPkts65to127Octets with lower range bound of 4096,
+and higher bound of 8191.
+
+IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts8192toMaxOctets
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Definition follows etherStatsPkts65to127Octets with lower range bound of 8192,
+and no higher bound.
+
+IETF RFC2863 statistics
+-----------------------
+IETF RFC2863 ("The Interfaces Group MIB")-compatible statistics.
+
+IFLA_HSTATS_STAT_RFC2863_errors
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`ifInErrors` or `ifOutErrors` depending on :ref:`qual_direction`.
+
+IFLA_HSTATS_STAT_RFC2863_discards
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`ifInDiscards` or `ifOutDiscards` depending on :ref:`qual_direction`.
+
+IEEE 802.3 statistics
+---------------------
+IEEE 802.3 standard statistics. Statistics which indicate two corresponding
+IEEE 802.3 attributes can be used in both directions, those which only
+mention a single attribute are undefined in the other direction.
+
+IFLA_HSTATS_STAT_IEEE8023_FramesOK
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aFramesReceivedOK` or `aFramesTransmittedOK` depending
+on :ref:`qual_direction`.
+
+IFLA_HSTATS_STAT_IEEE8023_OctetsOK
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aOctetsReceivedOK` or `aOctetsTransmittedOK` depending
+on :ref:`qual_direction`.
+
+IFLA_HSTATS_STAT_IEEE8023_MulticastFramesOK
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aMulticastFramesReceivedOK` or `aMulticastFramesXmittedOK` depending
+on :ref:`qual_direction`.
+
+IFLA_HSTATS_STAT_IEEE8023_BroadcastFramesOK
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aBroadcastFramesReceivedOK` or `aBroadcastFramesXmittedOK` depending
+on :ref:`qual_direction`.
+
+IFLA_HSTATS_STAT_IEEE8023_FrameCheckSequenceErrors
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aFrameCheckSequenceErrors`
+
+IFLA_HSTATS_STAT_IEEE8023_AlignmentErrors
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aAlignmentErrors`
+
+IFLA_HSTATS_STAT_IEEE8023_InRangeLengthErrors
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aInRangeLengthErrors`
+
+IFLA_HSTATS_STAT_IEEE8023_OutOfRangeLengthField
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aOutOfRangeLengthField`
+
+IFLA_HSTATS_STAT_IEEE8023_FrameTooLongErrors
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aFrameTooLongErrors`
+
+IFLA_HSTATS_STAT_IEEE8023_SymbolErrorDuringCarrier
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aSymbolErrorDuringCarrier`
+
+IFLA_HSTATS_STAT_IEEE8023_MACControlFrames
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aMACControlFramesReceived` or `aMACControlFramesTransmitted` depending
+on :ref:`qual_direction`.
+
+IFLA_HSTATS_STAT_IEEE8023_UnsupportedOpcodes
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aUnsupportedOpcodesReceived`
+
+IFLA_HSTATS_STAT_IEEE8023_PAUSEMACCtrlFrames
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aPAUSEMACCtrlFramesReceived` or `aPAUSEMACCtrlFramesTransmitted` depending
+on :ref:`qual_direction`.
+
+IFLA_HSTATS_STAT_IEEE8023_FECCorrectedBlocks
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aFECCorrectedBlocks`
+
+IFLA_HSTATS_STAT_IEEE8023_FECUncorrectableBlocks
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+`aFECUncorrectableBlocks`
diff --git a/Documentation/networking/hstats_flow_example.dot b/Documentation/networking/hstats_flow_example.dot
new file mode 100644
index 000000000000..7dbb41adf5f6
--- /dev/null
+++ b/Documentation/networking/hstats_flow_example.dot
@@ -0,0 +1,11 @@
+digraph L {
+ node [shape=record];
+ rankdir=RL;
+
+ a [label="Device\n\nbasic ingress\nstats",color=blue]
+ b [label="Device\n\nper-priority\nstats",color=blue]
+ c [label="Device\n\nper-queue\nPCI interface\nstats",color=blue]
+ d [label="Host\n\nper-queue\nstats",color=forestgreen]
+
+ a -> b -> c -> d
+}
\ No newline at end of file
diff --git a/Documentation/networking/index.rst b/Documentation/networking/index.rst
index 59e86de662cd..b075de41e401 100644
--- a/Documentation/networking/index.rst
+++ b/Documentation/networking/index.rst
@@ -32,6 +32,7 @@ Linux Networking Documentation
alias
bridge
snmp_counter
+ hstats
.. only:: subproject
--
2.19.2
^ permalink raw reply related
* [RFC 13/14] nfp: hstats: add a partial group of per-8021Q prio stats
From: Jakub Kicinski @ 2019-01-28 23:45 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
The MAC maintains counts of PFC per-prio pause frames. Unfortunately,
I couldn't find such counters in any standard, so add a partial
group (HW doesn't give us "non-PFC" count) with those counters.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
.../net/ethernet/netronome/nfp/nfp_hstat.c | 44 +++++++++++++++++++
1 file changed, 44 insertions(+)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_hstat.c b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
index cd97cd2676f6..ced4edca8b73 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
@@ -216,6 +216,49 @@ static const struct rtnl_hstat_group nfp_hstat_tm = {
.stats_cnt = 1,
};
+static int
+nfp_hstat_mac_pp_pause(struct net_device *netdev, struct rtnl_hstat_req *req,
+ const struct rtnl_hstat_group *grp)
+{
+ static const u32 remap_rx[] = {
+ 0xe0, 0xe8, 0xb0, 0xb8, 0xf0, 0xf7, 0x100, 0x108
+ };
+ static const u32 remap_tx[] = {
+ 0x1c0, 0x1c8, 0x1e0, 0x1e8, 0x1d0, 0x1d8, 0x1f0, 0x1f8
+ };
+ struct nfp_port *port;
+ const u32 *remap;
+ u8 dir, prio;
+
+ port = nfp_port_from_netdev(netdev);
+ if (!__nfp_port_get_eth_port(port) || !port->eth_stats)
+ return -EINVAL;
+
+ prio = rtnl_hstat_qual_get(req, RTNL_HSTATS_QUAL_PRIORITY);
+ dir = rtnl_hstat_qual_get(req, RTNL_HSTATS_QUAL_DIRECTION);
+ remap = dir == IFLA_HSTATS_QUAL_DIR_RX ? remap_rx : remap_tx;
+
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_IEEE8023_PAUSEMACCtrlFrames,
+ readq(port->eth_stats + remap[prio]));
+ return 0;
+}
+
+static const struct rtnl_hstat_group nfp_hstat_pp_pause = {
+ .qualifiers = {
+ RTNL_HSTATS_QUALS_BASIC_BIDIR(DEV),
+ [RTNL_HSTATS_QUAL_PRIORITY] = {
+ .max = 8,
+ },
+ },
+ .partial_flags = IFLA_HSTATS_PARTIAL_CLASSIFIER,
+
+ .get_stats = nfp_hstat_mac_pp_pause,
+ .stats = {
+ [1] = RTNL_HSTATS_STAT_IEEE8023_PAUSEMACCtrlFrames_BIT,
+ },
+ .stats_cnt = 1,
+};
+
/* NFD per-vNIC stats */
static int
nfp_hstat_vnic_nfd_basic_get(struct net_device *netdev,
@@ -402,6 +445,7 @@ int nfp_net_hstat_get_groups(const struct net_device *netdev,
port = nfp_port_from_netdev(netdev);
if (__nfp_port_get_eth_port(port) && port->eth_stats) {
rtnl_hstat_add_grp(req, &nfp_hstat_tm);
+ rtnl_hstat_add_grp(req, &nfp_hstat_pp_pause);
rtnl_hstat_add_grp(req, &nfp_hstat_mac);
}
--
2.19.2
^ permalink raw reply related
* [RFC 12/14] net: hstats: add markers for partial groups
From: Jakub Kicinski @ 2019-01-28 23:45 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
Hstats try to be hierarchy-neutral to the consumer, i.e. if users
only care about total statistics they should be able to add given
statistic throughout the hierarchy. Events can't be counted
multiple times (inside one root group, that's why multiple are
allowed), and they can't be missing.
Sometimes, however, HW doesn't give use enough information, or
software may not see all events it wants to count. Add an attribute
to indicate to user space that given statistic group does not report
all events reliably.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
include/net/hstats.h | 2 ++
include/uapi/linux/if_link.h | 9 +++++++++
net/core/hstats.c | 17 +++++++++++++++++
3 files changed, 28 insertions(+)
diff --git a/include/net/hstats.h b/include/net/hstats.h
index dd6d5dc567cb..3e10694d3d66 100644
--- a/include/net/hstats.h
+++ b/include/net/hstats.h
@@ -45,6 +45,7 @@ struct rtnl_hstat_qualifier {
* struct rtnl_hstat_group - node in the hstat hierarchy
* @qualifiers: attributes describing this group
* @has_children: @children array is present and NULL-terminated
+ * @partial_flags: partial flags
* @stats_cnt: number of stats in the bitmask
* @stats: bitmask of stats present
* @get_stats: driver callback for dumping the stats
@@ -54,6 +55,7 @@ struct rtnl_hstat_qualifier {
struct rtnl_hstat_group {
/* Note: this is *not* indexed with IFLA_* attributes! */
struct rtnl_hstat_qualifier qualifiers[RTNL_HSTATS_QUAL_CNT];
+ u8 partial_flags;
bool has_children;
/* Can't use bitmaps - words are variable length */
unsigned int stats_cnt;
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index c58468100a06..28ac4574bb0e 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -946,6 +946,7 @@ enum {
IFLA_HSTATS_UNSPEC,
IFLA_HSTATS_GROUP,
IFLA_HSTATS_STATS,
+ IFLA_HSTATS_PARTIAL,
IFLA_HSTATS_QUAL_TYPE,
IFLA_HSTATS_QUAL_DIRECTION,
IFLA_HSTATS_QUAL_QUEUE,
@@ -955,6 +956,14 @@ enum {
};
#define IFLA_HSTATS_MAX (__IFLA_HSTATS_MAX - 1)
+enum {
+ IFLA_HSTATS_PARTIAL_UNSPEC,
+ IFLA_HSTATS_PARTIAL_CLASSIFIER = 1,
+ IFLA_HSTATS_PARTIAL_SLOWPATH = 2,
+ __IFLA_HSTATS_PARTIAL_MAX,
+};
+#define IFLA_HSTATS_PARTIAL_MAX (__IFLA_HSTATS_PARTIAL_MAX - 1)
+
enum {
IFLA_HSTATS_QUAL_TYPE_UNSPEC,
IFLA_HSTATS_QUAL_TYPE_DEV,
diff --git a/net/core/hstats.c b/net/core/hstats.c
index c689ebfdaeaa..c9b7264d98dc 100644
--- a/net/core/hstats.c
+++ b/net/core/hstats.c
@@ -358,6 +358,17 @@ hstat_dumper_put_qual(struct hstat_dumper *dumper, int i, u32 val)
return nla_put_u32(dumper->skb, rtnl_qual2ifla[i], val);
}
+static int
+hstat_dumper_put_partials(struct hstat_dumper *dumper, u32 val)
+{
+ if (dumper->sizing) {
+ dumper->size += nla_total_size(sizeof(u32));
+ return 0;
+ }
+
+ return nla_put_u32(dumper->skb, IFLA_HSTATS_PARTIAL, val);
+}
+
/* Dumper handlers */
static int hstat_dumper_grp_load(struct hstat_dumper *dumper)
{
@@ -378,6 +389,12 @@ static int hstat_dumper_grp_load(struct hstat_dumper *dumper)
if (err)
return err;
+ if (cmd.grp->partial_flags) {
+ err = hstat_dumper_put_partials(dumper, cmd.grp->partial_flags);
+ if (err)
+ return err;
+ }
+
for (i = 0; i < RTNL_HSTATS_QUAL_CNT; i++) {
const struct rtnl_hstat_qualifier *q;
--
2.19.2
^ permalink raw reply related
* [RFC 11/14] nfp: hstats: add IEEE/RMON ethernet port/MAC stats
From: Jakub Kicinski @ 2019-01-28 23:45 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
Add groups for MAC statistics, NFP's MAC/PHY maintains a mix
of IEEE 802.3 and RMON-compatible statistics. Use the RMON
stats for driver drops and error counters as well.
Since the MAC stats are quite large initialize the hstat
bitmap when driver is loaded.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
.../net/ethernet/netronome/nfp/nfp_hstat.c | 257 +++++++++++++++++-
drivers/net/ethernet/netronome/nfp/nfp_main.c | 1 +
drivers/net/ethernet/netronome/nfp/nfp_main.h | 2 +
3 files changed, 257 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_hstat.c b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
index 9300996e756c..cd97cd2676f6 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
@@ -4,6 +4,217 @@
#include <net/hstats.h>
#include "nfp_net.h"
+#include "nfp_port.h"
+
+/* MAC stats */
+static const struct nfp_stat_pair {
+ u32 attr;
+ u32 offset;
+} nfp_mac_stats_rx[] = {
+ {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsOctets,
+ NFP_MAC_STATS_RX_IN_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_IEEE8023_FrameTooLongErrors,
+ NFP_MAC_STATS_RX_FRAME_TOO_LONG_ERRORS
+ }, {
+ IFLA_HSTATS_STAT_IEEE8023_InRangeLengthErrors,
+ NFP_MAC_STATS_RX_RANGE_LENGTH_ERRORS
+ },
+ /* missing NFP_MAC_STATS_RX_VLAN_RECEIVED_OK, no standard counter */
+ {
+ IFLA_HSTATS_STAT_RFC2863_Errors,
+ NFP_MAC_STATS_RX_IN_ERRORS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsBroadcastPkts,
+ NFP_MAC_STATS_RX_IN_BROADCAST_PKTS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsDropEvents,
+ NFP_MAC_STATS_RX_DROP_EVENTS
+ }, {
+ IFLA_HSTATS_STAT_IEEE8023_AlignmentErrors,
+ NFP_MAC_STATS_RX_ALIGNMENT_ERRORS
+ }, {
+ IFLA_HSTATS_STAT_IEEE8023_PAUSEMACCtrlFrames,
+ NFP_MAC_STATS_RX_PAUSE_MAC_CTRL_FRAMES
+ }, {
+ IFLA_HSTATS_STAT_IEEE8023_FramesOK,
+ NFP_MAC_STATS_RX_FRAMES_RECEIVED_OK
+ }, {
+ IFLA_HSTATS_STAT_IEEE8023_FrameCheckSequenceErrors,
+ NFP_MAC_STATS_RX_FRAME_CHECK_SEQUENCE_ERRORS
+ }, {
+ IFLA_HSTATS_STAT_RFC2863_UcastPkts,
+ NFP_MAC_STATS_RX_UNICAST_PKTS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsMulticastPkts,
+ NFP_MAC_STATS_RX_MULTICAST_PKTS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts,
+ NFP_MAC_STATS_RX_PKTS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsUndersizePkts,
+ NFP_MAC_STATS_RX_UNDERSIZE_PKTS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts64Octets,
+ NFP_MAC_STATS_RX_PKTS_64_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts65to127Octets,
+ NFP_MAC_STATS_RX_PKTS_65_TO_127_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts512to1023Octets,
+ NFP_MAC_STATS_RX_PKTS_512_TO_1023_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts1024to1518Octets,
+ NFP_MAC_STATS_RX_PKTS_1024_TO_1518_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsJabbers,
+ NFP_MAC_STATS_RX_JABBERS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsFragments,
+ NFP_MAC_STATS_RX_FRAGMENTS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts128to255Octets,
+ NFP_MAC_STATS_RX_PKTS_128_TO_255_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts256to511Octets,
+ NFP_MAC_STATS_RX_PKTS_256_TO_511_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts1519toMaxOctets,
+ NFP_MAC_STATS_RX_PKTS_1519_TO_MAX_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsOversizePkts,
+ NFP_MAC_STATS_RX_OVERSIZE_PKTS
+ }, {
+ IFLA_HSTATS_STAT_IEEE8023_MACControlFrames,
+ NFP_MAC_STATS_RX_MAC_CTRL_FRAMES_RECEIVED
+ }
+}, nfp_mac_stats_tx[] = {
+ {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsOctets,
+ NFP_MAC_STATS_TX_OUT_OCTETS
+ },
+ /* missing NFP_MAC_STATS_TX_VLAN_TRANSMITTED_OK, no standard counter */
+ {
+ IFLA_HSTATS_STAT_RFC2863_Errors,
+ NFP_MAC_STATS_TX_OUT_ERRORS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsBroadcastPkts,
+ NFP_MAC_STATS_TX_BROADCAST_PKTS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts64Octets,
+ NFP_MAC_STATS_TX_PKTS_64_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts256to511Octets,
+ NFP_MAC_STATS_TX_PKTS_256_TO_511_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts512to1023Octets,
+ NFP_MAC_STATS_TX_PKTS_512_TO_1023_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_IEEE8023_PAUSEMACCtrlFrames,
+ NFP_MAC_STATS_TX_PAUSE_MAC_CTRL_FRAMES
+ }, {
+ IFLA_HSTATS_STAT_IEEE8023_FramesOK,
+ NFP_MAC_STATS_TX_FRAMES_TRANSMITTED_OK
+ }, {
+ IFLA_HSTATS_STAT_RFC2863_UcastPkts,
+ NFP_MAC_STATS_TX_UNICAST_PKTS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsMulticastPkts,
+ NFP_MAC_STATS_TX_MULTICAST_PKTS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts65to127Octets,
+ NFP_MAC_STATS_TX_PKTS_65_TO_127_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts128to255Octets,
+ NFP_MAC_STATS_TX_PKTS_128_TO_255_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts1024to1518Octets,
+ NFP_MAC_STATS_TX_PKTS_1024_TO_1518_OCTETS
+ }, {
+ IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts1519toMaxOctets,
+ NFP_MAC_STATS_TX_PKTS_1519_TO_MAX_OCTETS
+ }
+};
+
+static int
+nfp_hstat_mac_get(struct net_device *netdev, struct rtnl_hstat_req *req,
+ const struct rtnl_hstat_group *grp)
+{
+ const struct nfp_stat_pair *pairs;
+ struct nfp_port *port;
+ unsigned int dir, i;
+
+ port = nfp_port_from_netdev(netdev);
+ if (!__nfp_port_get_eth_port(port) || !port->eth_stats)
+ return -EINVAL;
+
+ dir = rtnl_hstat_qual_get(req, RTNL_HSTATS_QUAL_DIRECTION);
+ pairs = dir == IFLA_HSTATS_QUAL_DIR_RX ?
+ nfp_mac_stats_rx : nfp_mac_stats_tx;
+
+ for (i = 0; i < grp->stats_cnt; i++)
+ rtnl_hstat_dump(req, pairs[i].attr,
+ readq(port->eth_stats + pairs[i].offset));
+ return 0;
+}
+
+static struct rtnl_hstat_group nfp_hstat_mac_rx __ro_after_init = {
+ .qualifiers = {
+ RTNL_HSTATS_QUALS_BASIC(DEV, RX),
+ },
+
+ .get_stats = nfp_hstat_mac_get,
+};
+
+static struct rtnl_hstat_group nfp_hstat_mac_tx __ro_after_init = {
+ .qualifiers = {
+ RTNL_HSTATS_QUALS_BASIC(DEV, TX),
+ },
+
+ .get_stats = nfp_hstat_mac_get,
+};
+
+static const struct rtnl_hstat_group nfp_hstat_mac = {
+ .has_children = true,
+ .children = {
+ &nfp_hstat_mac_rx,
+ &nfp_hstat_mac_tx,
+ NULL,
+ },
+};
+
+static int
+nfp_hstat_mac_head_drop(struct net_device *netdev, struct rtnl_hstat_req *req,
+ const struct rtnl_hstat_group *grp)
+{
+ struct nfp_port *port;
+ unsigned int off, dir;
+
+ port = nfp_port_from_netdev(netdev);
+ if (!__nfp_port_get_eth_port(port) || !port->eth_stats)
+ return -EINVAL;
+
+ dir = rtnl_hstat_qual_get(req, RTNL_HSTATS_QUAL_DIRECTION);
+ off = dir == IFLA_HSTATS_QUAL_DIR_RX ?
+ NFP_MAC_STATS_RX_MAC_HEAD_DROP : NFP_MAC_STATS_TX_QUEUE_DROP;
+
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_RFC2819_etherStatsDropEvents,
+ readq(port->eth_stats + off));
+ return 0;
+}
+
+static const struct rtnl_hstat_group nfp_hstat_tm = {
+ .qualifiers = {
+ RTNL_HSTATS_QUALS_BASIC_BIDIR(DEV),
+ },
+
+ .get_stats = nfp_hstat_mac_head_drop,
+ .stats = {
+ [1] = RTNL_HSTATS_STAT_RFC2819_etherStatsDropEvents_BIT,
+ },
+ .stats_cnt = 1,
+};
/* NFD per-vNIC stats */
static int
@@ -21,6 +232,10 @@ nfp_hstat_vnic_nfd_basic_get(struct net_device *netdev,
nn_readq(nn, NFP_NET_CFG_STATS_RX_FRAMES + off));
rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_BYTES,
nn_readq(nn, NFP_NET_CFG_STATS_RX_OCTETS + off));
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_RFC2863_Errors,
+ nn_readq(nn, NFP_NET_CFG_STATS_RX_ERRORS + off));
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_RFC2863_Discards,
+ nn_readq(nn, NFP_NET_CFG_STATS_RX_DISCARDS + off));
return 0;
}
@@ -33,8 +248,10 @@ static const struct rtnl_hstat_group nfp_hstat_vnic_nfd = {
.stats = {
[0] = RTNL_HSTATS_STAT_LINUX_PKTS_BIT |
RTNL_HSTATS_STAT_LINUX_BYTES_BIT,
+ [2] = RTNL_HSTATS_STAT_RFC2863_Errors_BIT |
+ RTNL_HSTATS_STAT_RFC2863_Discards_BIT,
},
- .stats_cnt = 2,
+ .stats_cnt = 4,
};
/* NFD per-Q stats */
@@ -99,6 +316,8 @@ nfp_hstat_vnic_sw_rx_get(struct net_device *dev, struct rtnl_hstat_req *req,
r_vec->hw_csum_rx_complete);
rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_CSUM_UNNECESSARY,
r_vec->hw_csum_rx_ok + r_vec->hw_csum_rx_inner_ok);
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_RFC2819_etherStatsDropEvents,
+ r_vec->rx_drops);
return 0;
}
@@ -116,9 +335,10 @@ static const struct rtnl_hstat_group nfp_hstat_vnic_sw_rx = {
RTNL_HSTATS_STAT_LINUX_BYTES_BIT |
RTNL_HSTATS_STAT_LINUX_CSUM_PARTIAL_BIT |
RTNL_HSTATS_STAT_LINUX_CSUM_UNNECESSARY_BIT,
+ [1] = RTNL_HSTATS_STAT_RFC2819_etherStatsDropEvents_BIT,
},
- .stats_cnt = 4,
+ .stats_cnt = 5,
};
static int
@@ -137,6 +357,7 @@ nfp_hstat_vnic_sw_tx_get(struct net_device *dev, struct rtnl_hstat_req *req,
r_vec->hw_csum_tx + r_vec->hw_csum_tx_inner);
rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_SEGMENTATION_OFFLOAD_PKTS,
r_vec->tx_lso);
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_RFC2863_Errors, r_vec->tx_errors);
return 0;
}
@@ -155,8 +376,9 @@ static const struct rtnl_hstat_group nfp_hstat_vnic_sw_tx = {
RTNL_HSTATS_STAT_LINUX_BUSY_BIT |
RTNL_HSTATS_STAT_LINUX_CSUM_PARTIAL_BIT |
RTNL_HSTATS_STAT_LINUX_SEGMENTATION_OFFLOAD_PKTS_BIT,
+ [1] = RTNL_HSTATS_STAT_RFC2863_Errors_BIT,
},
- .stats_cnt = 5,
+ .stats_cnt = 6,
};
static const struct rtnl_hstat_group nfp_hstat_vnic_sw = {
@@ -171,9 +393,38 @@ static const struct rtnl_hstat_group nfp_hstat_vnic_sw = {
int nfp_net_hstat_get_groups(const struct net_device *netdev,
struct rtnl_hstat_req *req)
{
+ struct nfp_port *port;
+
rtnl_hstat_add_grp(req, &nfp_hstat_vnic_sw);
rtnl_hstat_add_grp(req, &nfp_hstat_vnic_nfd_pq);
rtnl_hstat_add_grp(req, &nfp_hstat_vnic_nfd);
+ port = nfp_port_from_netdev(netdev);
+ if (__nfp_port_get_eth_port(port) && port->eth_stats) {
+ rtnl_hstat_add_grp(req, &nfp_hstat_tm);
+ rtnl_hstat_add_grp(req, &nfp_hstat_mac);
+ }
+
return 0;
}
+
+void __init nfp_net_hstat_init(void)
+{
+ unsigned int i;
+
+ for (i = 0; i < ARRAY_SIZE(nfp_mac_stats_rx); i++) {
+ unsigned int attr;
+
+ attr = nfp_mac_stats_rx[i].attr;
+ nfp_hstat_mac_rx.stats[attr / 64] |= BIT_ULL(attr % 64);
+ }
+ nfp_hstat_mac_rx.stats_cnt = ARRAY_SIZE(nfp_mac_stats_rx);
+
+ for (i = 0; i < ARRAY_SIZE(nfp_mac_stats_tx); i++) {
+ unsigned int attr;
+
+ attr = nfp_mac_stats_tx[i].attr;
+ nfp_hstat_mac_tx.stats[attr / 64] |= BIT_ULL(attr % 64);
+ }
+ nfp_hstat_mac_tx.stats_cnt = ARRAY_SIZE(nfp_mac_stats_tx);
+}
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.c b/drivers/net/ethernet/netronome/nfp/nfp_main.c
index 6c10e8d119e4..4e366fde3478 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_main.c
@@ -724,6 +724,7 @@ static int __init nfp_main_init(void)
nfp_driver_name);
nfp_net_debugfs_create();
+ nfp_net_hstat_init();
err = pci_register_driver(&nfp_pci_driver);
if (err < 0)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.h b/drivers/net/ethernet/netronome/nfp/nfp_main.h
index a3613a2e0aa5..367afb869df6 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_main.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_main.h
@@ -145,6 +145,8 @@ extern struct pci_driver nfp_netvf_pci_driver;
extern const struct devlink_ops nfp_devlink_ops;
+void nfp_net_hstat_init(void);
+
int nfp_net_pci_probe(struct nfp_pf *pf);
void nfp_net_pci_remove(struct nfp_pf *pf);
--
2.19.2
^ permalink raw reply related
* [RFC 10/14] net: hstats: add IEEE 802.3 and common IETF MIB/RMON stats
From: Jakub Kicinski @ 2019-01-28 23:45 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
Add IDs for standard-based counters commonly maintained by ethernet
hardware (IEEE 802.3, IETF RFC2819, IETF RFC2863). The lists are
not intended to be complete, reserve some ID space for adding
more stats in the middle if they are found useful later.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
include/net/hstats.h | 50 ++++++++++++++++++++++++++++++++++++
include/uapi/linux/if_link.h | 50 ++++++++++++++++++++++++++++++++++++
2 files changed, 100 insertions(+)
diff --git a/include/net/hstats.h b/include/net/hstats.h
index bb83f50768b1..dd6d5dc567cb 100644
--- a/include/net/hstats.h
+++ b/include/net/hstats.h
@@ -101,6 +101,56 @@ enum {
RTNL_HSTAT_BIT(LINUX_CSUM_COMPLETE, 0),
RTNL_HSTAT_BIT(LINUX_CSUM_UNNECESSARY, 0),
RTNL_HSTAT_BIT(LINUX_SEGMENTATION_OFFLOAD_PKTS, 0),
+
+ /* IETF RFC2819 ("Remote Network Monitoring MIB") */
+ RTNL_HSTAT_BIT(RFC2819_etherStatsDropEvents, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsOctets, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsPkts, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsBroadcastPkts, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsMulticastPkts, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsCRCAlignErrors, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsUndersizePkts, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsOversizePkts, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsFragments, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsJabbers, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsCollisions, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsPkts64Octets, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsPkts65to127Octets, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsPkts128to255Octets, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsPkts256to511Octets, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsPkts512to1023Octets, 1),
+ RTNL_HSTAT_BIT(RFC2819_etherStatsPkts1024to1518Octets, 1),
+ /* Extensions to IETF RFC2819 */
+ RTNL_HSTAT_BIT(RFC2819EXT_etherStatsPkts1024toMaxOctets, 1),
+ RTNL_HSTAT_BIT(RFC2819EXT_etherStatsPkts1519toMaxOctets, 1),
+ RTNL_HSTAT_BIT(RFC2819EXT_etherStatsPkts1024to2047Octets, 1),
+ RTNL_HSTAT_BIT(RFC2819EXT_etherStatsPkts2048to4095Octets, 1),
+ RTNL_HSTAT_BIT(RFC2819EXT_etherStatsPkts4096to8191Octets, 1),
+ RTNL_HSTAT_BIT(RFC2819EXT_etherStatsPkts8192toMaxOctets, 1),
+
+ /* IETF RFC2863 ("The Interfaces Group MIB") */
+ RTNL_HSTAT_BIT(RFC2863_UcastPkts, 1),
+ RTNL_HSTAT_BIT(RFC2863_Errors, 1),
+ RTNL_HSTAT_BIT(RFC2863_Discards, 1),
+
+ /* IEEE 802.3 */
+ RTNL_HSTAT_BIT(IEEE8023_FramesOK, 2),
+ RTNL_HSTAT_BIT(IEEE8023_OctetsOK, 2),
+ RTNL_HSTAT_BIT(IEEE8023_MulticastFramesOK, 2),
+ RTNL_HSTAT_BIT(IEEE8023_BroadcastFramesOK, 2),
+ RTNL_HSTAT_BIT(IEEE8023_FrameCheckSequenceErrors, 2),
+ RTNL_HSTAT_BIT(IEEE8023_AlignmentErrors, 2),
+ RTNL_HSTAT_BIT(IEEE8023_InRangeLengthErrors, 2),
+ RTNL_HSTAT_BIT(IEEE8023_OutOfRangeLengthField, 2),
+ RTNL_HSTAT_BIT(IEEE8023_FrameTooLongErrors, 2),
+ RTNL_HSTAT_BIT(IEEE8023_CollisionFrames, 2),
+ RTNL_HSTAT_BIT(IEEE8023_SQETestErrors, 2),
+ RTNL_HSTAT_BIT(IEEE8023_SymbolErrorDuringCarrier, 2),
+ RTNL_HSTAT_BIT(IEEE8023_MACControlFrames, 2),
+ RTNL_HSTAT_BIT(IEEE8023_UnsupportedOpcodes, 2),
+ RTNL_HSTAT_BIT(IEEE8023_PAUSEMACCtrlFrames, 2),
+ RTNL_HSTAT_BIT(IEEE8023_FECCorrectedBlocks, 2),
+ RTNL_HSTAT_BIT(IEEE8023_FECUncorrectableBlocks, 2),
#undef RTNL_HSTAT_BIT
};
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index b33d38ff5b47..c58468100a06 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -982,6 +982,56 @@ enum {
IFLA_HSTATS_STAT_LINUX_CSUM_UNNECESSARY,
IFLA_HSTATS_STAT_LINUX_SEGMENTATION_OFFLOAD_PKTS,
+ /* IETF RFC2819 ("Remote Network Monitoring MIB") */
+ IFLA_HSTATS_STAT_RFC2819_etherStatsDropEvents = 65, /* 1 */
+ IFLA_HSTATS_STAT_RFC2819_etherStatsOctets,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsBroadcastPkts,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsMulticastPkts,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsCRCAlignErrors,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsUndersizePkts,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsOversizePkts,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsFragments,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsJabbers,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsCollisions,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts64Octets,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts65to127Octets,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts128to255Octets,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts256to511Octets,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts512to1023Octets,
+ IFLA_HSTATS_STAT_RFC2819_etherStatsPkts1024to1518Octets,
+ /* Extensions to IETF RFC2819 */
+ IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts1024toMaxOctets,
+ IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts1519toMaxOctets,
+ IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts1024to2047Octets,
+ IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts2048to4095Octets,
+ IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts4096to8191Octets,
+ IFLA_HSTATS_STAT_RFC2819EXT_etherStatsPkts8192toMaxOctets,
+
+ /* IETF RFC2863 ("The Interfaces Group MIB") */
+ IFLA_HSTATS_STAT_RFC2863_UcastPkts = 97,
+ IFLA_HSTATS_STAT_RFC2863_Errors,
+ IFLA_HSTATS_STAT_RFC2863_Discards,
+
+ /* IEEE 802.3 */
+ IFLA_HSTATS_STAT_IEEE8023_FramesOK = 129, /* 2 */
+ IFLA_HSTATS_STAT_IEEE8023_OctetsOK,
+ IFLA_HSTATS_STAT_IEEE8023_MulticastFramesOK,
+ IFLA_HSTATS_STAT_IEEE8023_BroadcastFramesOK,
+ IFLA_HSTATS_STAT_IEEE8023_FrameCheckSequenceErrors,
+ IFLA_HSTATS_STAT_IEEE8023_AlignmentErrors,
+ IFLA_HSTATS_STAT_IEEE8023_InRangeLengthErrors,
+ IFLA_HSTATS_STAT_IEEE8023_OutOfRangeLengthField,
+ IFLA_HSTATS_STAT_IEEE8023_FrameTooLongErrors,
+ IFLA_HSTATS_STAT_IEEE8023_CollisionFrames,
+ IFLA_HSTATS_STAT_IEEE8023_SQETestErrors,
+ IFLA_HSTATS_STAT_IEEE8023_SymbolErrorDuringCarrier,
+ IFLA_HSTATS_STAT_IEEE8023_MACControlFrames,
+ IFLA_HSTATS_STAT_IEEE8023_UnsupportedOpcodes,
+ IFLA_HSTATS_STAT_IEEE8023_PAUSEMACCtrlFrames,
+ IFLA_HSTATS_STAT_IEEE8023_FECCorrectedBlocks,
+ IFLA_HSTATS_STAT_IEEE8023_FECUncorrectableBlocks,
+
__IFLA_HSTATS_STAT_MAX,
};
#define IFLA_HSTATS_STAT_MAX (__IFLA_HSTATS_STAT_MAX - 1)
--
2.19.2
^ permalink raw reply related
* [RFC 09/14] nfp: hstats: add driver and device per queue statistics
From: Jakub Kicinski @ 2019-01-28 23:45 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
Report basic stats for all queues, per-queue. Separate
device and driver statistics into different groups.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
.../net/ethernet/netronome/nfp/nfp_hstat.c | 133 ++++++++++++++++++
1 file changed, 133 insertions(+)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_hstat.c b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
index d339008333bc..9300996e756c 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
@@ -37,9 +37,142 @@ static const struct rtnl_hstat_group nfp_hstat_vnic_nfd = {
.stats_cnt = 2,
};
+/* NFD per-Q stats */
+static int
+nfp_hstat_vnic_nfd_get_queues(const struct net_device *dev,
+ const struct rtnl_hstat_group *grp)
+{
+ struct nfp_net *nn = netdev_priv(dev);
+
+ return nn->max_r_vecs;
+}
+
+static int
+nfp_hstat_vnic_nfd_pq_get(struct net_device *dev,
+ struct rtnl_hstat_req *req,
+ const struct rtnl_hstat_group *grp)
+{
+ struct nfp_net *nn = netdev_priv(dev);
+ u32 queue, off;
+
+ queue = rtnl_hstat_qual_get(req, RTNL_HSTATS_QUAL_QUEUE);
+
+ off = NFP_NET_CFG_TXR_STATS(queue);
+ off += rtnl_hstat_is_rx(req) ?
+ 0 : NFP_NET_CFG_RXR_STATS_BASE - NFP_NET_CFG_TXR_STATS_BASE;
+
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_PKTS, nn_readq(nn, off));
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_BYTES,
+ nn_readq(nn, off + 8));
+ return 0;
+}
+
+static const struct rtnl_hstat_group nfp_hstat_vnic_nfd_pq = {
+ .qualifiers = {
+ RTNL_HSTATS_QUALS_BASIC_BIDIR(DEV),
+ [RTNL_HSTATS_QUAL_QUEUE] = {
+ .get_max = nfp_hstat_vnic_nfd_get_queues,
+ },
+ },
+
+ .get_stats = nfp_hstat_vnic_nfd_pq_get,
+ .stats = {
+ [0] = RTNL_HSTATS_STAT_LINUX_PKTS_BIT |
+ RTNL_HSTATS_STAT_LINUX_BYTES_BIT,
+ },
+ .stats_cnt = 2,
+};
+
+/* vNIC software stats */
+static int
+nfp_hstat_vnic_sw_rx_get(struct net_device *dev, struct rtnl_hstat_req *req,
+ const struct rtnl_hstat_group *grp)
+{
+ struct nfp_net *nn = netdev_priv(dev);
+ struct nfp_net_r_vector *r_vec;
+
+ r_vec = &nn->r_vecs[rtnl_hstat_qual_get(req, RTNL_HSTATS_QUAL_QUEUE)];
+
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_PKTS, r_vec->rx_pkts);
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_BYTES, r_vec->rx_bytes);
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_CSUM_PARTIAL,
+ r_vec->hw_csum_rx_complete);
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_CSUM_UNNECESSARY,
+ r_vec->hw_csum_rx_ok + r_vec->hw_csum_rx_inner_ok);
+ return 0;
+}
+
+static const struct rtnl_hstat_group nfp_hstat_vnic_sw_rx = {
+ .qualifiers = {
+ RTNL_HSTATS_QUALS_BASIC(DRV, RX),
+ [RTNL_HSTATS_QUAL_QUEUE] = {
+ .get_max = nfp_hstat_vnic_nfd_get_queues,
+ },
+ },
+
+ .get_stats = nfp_hstat_vnic_sw_rx_get,
+ .stats = {
+ [0] = RTNL_HSTATS_STAT_LINUX_PKTS_BIT |
+ RTNL_HSTATS_STAT_LINUX_BYTES_BIT |
+ RTNL_HSTATS_STAT_LINUX_CSUM_PARTIAL_BIT |
+ RTNL_HSTATS_STAT_LINUX_CSUM_UNNECESSARY_BIT,
+
+ },
+ .stats_cnt = 4,
+};
+
+static int
+nfp_hstat_vnic_sw_tx_get(struct net_device *dev, struct rtnl_hstat_req *req,
+ const struct rtnl_hstat_group *grp)
+{
+ struct nfp_net *nn = netdev_priv(dev);
+ struct nfp_net_r_vector *r_vec;
+
+ r_vec = &nn->r_vecs[rtnl_hstat_qual_get(req, RTNL_HSTATS_QUAL_QUEUE)];
+
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_PKTS, r_vec->tx_pkts);
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_BYTES, r_vec->tx_bytes);
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_BUSY, r_vec->tx_busy);
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_CSUM_PARTIAL,
+ r_vec->hw_csum_tx + r_vec->hw_csum_tx_inner);
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_SEGMENTATION_OFFLOAD_PKTS,
+ r_vec->tx_lso);
+ return 0;
+}
+
+static const struct rtnl_hstat_group nfp_hstat_vnic_sw_tx = {
+ .qualifiers = {
+ RTNL_HSTATS_QUALS_BASIC(DRV, TX),
+ [RTNL_HSTATS_QUAL_QUEUE] = {
+ .get_max = nfp_hstat_vnic_nfd_get_queues,
+ },
+ },
+
+ .get_stats = nfp_hstat_vnic_sw_tx_get,
+ .stats = {
+ [0] = RTNL_HSTATS_STAT_LINUX_PKTS_BIT |
+ RTNL_HSTATS_STAT_LINUX_BYTES_BIT |
+ RTNL_HSTATS_STAT_LINUX_BUSY_BIT |
+ RTNL_HSTATS_STAT_LINUX_CSUM_PARTIAL_BIT |
+ RTNL_HSTATS_STAT_LINUX_SEGMENTATION_OFFLOAD_PKTS_BIT,
+ },
+ .stats_cnt = 5,
+};
+
+static const struct rtnl_hstat_group nfp_hstat_vnic_sw = {
+ .has_children = true,
+ .children = {
+ &nfp_hstat_vnic_sw_rx,
+ &nfp_hstat_vnic_sw_tx,
+ NULL,
+ },
+};
+
int nfp_net_hstat_get_groups(const struct net_device *netdev,
struct rtnl_hstat_req *req)
{
+ rtnl_hstat_add_grp(req, &nfp_hstat_vnic_sw);
+ rtnl_hstat_add_grp(req, &nfp_hstat_vnic_nfd_pq);
rtnl_hstat_add_grp(req, &nfp_hstat_vnic_nfd);
return 0;
--
2.19.2
^ permalink raw reply related
* [RFC 07/14] net: hstats: help in iteration over directions
From: Jakub Kicinski @ 2019-01-28 23:45 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
Devices (or drivers) often keep the same statistics in both
directions, aid iterating over such statistics with some
helpers.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
include/net/hstats.h | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/include/net/hstats.h b/include/net/hstats.h
index 00f4d9334422..bb83f50768b1 100644
--- a/include/net/hstats.h
+++ b/include/net/hstats.h
@@ -69,6 +69,12 @@ void rtnl_hstat_add_grp(struct rtnl_hstat_req *req,
bool rtnl_hstat_qual_is_set(struct rtnl_hstat_req *req, int qual);
int rtnl_hstat_qual_get(struct rtnl_hstat_req *req, int qual);
+static inline bool rtnl_hstat_is_rx(struct rtnl_hstat_req *req)
+{
+ return rtnl_hstat_qual_get(req, RTNL_HSTATS_QUAL_DIRECTION) ==
+ IFLA_HSTATS_QUAL_DIR_RX;
+}
+
static inline void
rtnl_hstat_dump(struct rtnl_hstat_req *req, const int id, const u64 val)
{
@@ -106,4 +112,13 @@ enum {
[RTNL_HSTATS_QUAL_DIRECTION] = { \
.constant = IFLA_HSTATS_QUAL_DIR_ ##dir, \
}
+
+#define RTNL_HSTATS_QUALS_BASIC_BIDIR(type) \
+ [RTNL_HSTATS_QUAL_TYPE] = { \
+ .constant = IFLA_HSTATS_QUAL_TYPE_ ##type, \
+ }, \
+ [RTNL_HSTATS_QUAL_DIRECTION] = { \
+ .min = IFLA_HSTATS_QUAL_DIR_RX, \
+ .max = IFLA_HSTATS_QUAL_DIR_TX + 1, \
+ }
#endif
--
2.19.2
^ permalink raw reply related
* [RFC 08/14] nfp: hstats: make use of iteration for direction
From: Jakub Kicinski @ 2019-01-28 23:45 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
Basic RX and TX stats are the same, just at a slightly different
offset, use iteration to save code.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
.../net/ethernet/netronome/nfp/nfp_hstat.c | 48 +++++--------------
1 file changed, 12 insertions(+), 36 deletions(-)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_hstat.c b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
index 9480d3b6caa5..d339008333bc 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
@@ -7,52 +7,29 @@
/* NFD per-vNIC stats */
static int
-nfp_hstat_vnic_nfd_basic_get_rx(struct net_device *netdev,
- struct rtnl_hstat_req *req,
- const struct rtnl_hstat_group *grp)
+nfp_hstat_vnic_nfd_basic_get(struct net_device *netdev,
+ struct rtnl_hstat_req *req,
+ const struct rtnl_hstat_group *grp)
{
struct nfp_net *nn = netdev_priv(netdev);
+ u32 off;
- rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_PKTS,
- nn_readq(nn, NFP_NET_CFG_STATS_RX_FRAMES));
- rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_BYTES,
- nn_readq(nn, NFP_NET_CFG_STATS_RX_OCTETS));
- return 0;
-}
-
-static const struct rtnl_hstat_group nfp_hstat_vnic_nfd_rx = {
- .qualifiers = {
- RTNL_HSTATS_QUALS_BASIC(DEV, RX),
- },
-
- .get_stats = nfp_hstat_vnic_nfd_basic_get_rx,
- .stats = {
- [0] = RTNL_HSTATS_STAT_LINUX_PKTS_BIT |
- RTNL_HSTATS_STAT_LINUX_BYTES_BIT,
- },
- .stats_cnt = 2,
-};
-
-static int
-nfp_hstat_vnic_nfd_basic_get_tx(struct net_device *netdev,
- struct rtnl_hstat_req *req,
- const struct rtnl_hstat_group *grp)
-{
- struct nfp_net *nn = netdev_priv(netdev);
+ off = rtnl_hstat_is_rx(req) ?
+ 0 : NFP_NET_CFG_STATS_TX_OCTETS - NFP_NET_CFG_STATS_RX_OCTETS;
rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_PKTS,
- nn_readq(nn, NFP_NET_CFG_STATS_TX_FRAMES));
+ nn_readq(nn, NFP_NET_CFG_STATS_RX_FRAMES + off));
rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_BYTES,
- nn_readq(nn, NFP_NET_CFG_STATS_TX_OCTETS));
+ nn_readq(nn, NFP_NET_CFG_STATS_RX_OCTETS + off));
return 0;
}
-static const struct rtnl_hstat_group nfp_hstat_vnic_nfd_tx = {
+static const struct rtnl_hstat_group nfp_hstat_vnic_nfd = {
.qualifiers = {
- RTNL_HSTATS_QUALS_BASIC(DEV, TX),
+ RTNL_HSTATS_QUALS_BASIC_BIDIR(DEV),
},
- .get_stats = nfp_hstat_vnic_nfd_basic_get_tx,
+ .get_stats = nfp_hstat_vnic_nfd_basic_get,
.stats = {
[0] = RTNL_HSTATS_STAT_LINUX_PKTS_BIT |
RTNL_HSTATS_STAT_LINUX_BYTES_BIT,
@@ -63,8 +40,7 @@ static const struct rtnl_hstat_group nfp_hstat_vnic_nfd_tx = {
int nfp_net_hstat_get_groups(const struct net_device *netdev,
struct rtnl_hstat_req *req)
{
- rtnl_hstat_add_grp(req, &nfp_hstat_vnic_nfd_rx);
- rtnl_hstat_add_grp(req, &nfp_hstat_vnic_nfd_tx);
+ rtnl_hstat_add_grp(req, &nfp_hstat_vnic_nfd);
return 0;
}
--
2.19.2
^ permalink raw reply related
* [RFC 06/14] net: hstats: allow iterators
From: Jakub Kicinski @ 2019-01-28 23:44 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
Add support for iterative type of qualifiers. User can set
min/max values in the group and the group will be dumped
multiple times, each time driver can read the current state
of the qualifier with rtnl_hstat_qual_get() to access the
right statistics.
Dump will look like this:
[group]
[const qualifiers]
[group (iter #0)]
[iter qualifiers]
[stats]
[group (iter #1)]
[iter qualifiers]
[stats]
...
This means that if group contains iterative qualifiers it
will itself never contain statistics, its statistics will
only be reported in its subgroups where iterators have
a value assigned.
Dumper needs to keep track of which qualifiers where set
in a given group (iterations may nest).
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
include/net/hstats.h | 9 ++
include/uapi/linux/if_link.h | 3 +
net/core/hstats.c | 168 +++++++++++++++++++++++++++++++++--
3 files changed, 173 insertions(+), 7 deletions(-)
diff --git a/include/net/hstats.h b/include/net/hstats.h
index cbbdaf93d408..00f4d9334422 100644
--- a/include/net/hstats.h
+++ b/include/net/hstats.h
@@ -17,6 +17,9 @@ struct sk_buff;
enum {
RTNL_HSTATS_QUAL_TYPE,
RTNL_HSTATS_QUAL_DIRECTION,
+ RTNL_HSTATS_QUAL_QUEUE,
+ RTNL_HSTATS_QUAL_PRIORITY,
+ RTNL_HSTATS_QUAL_TC,
RTNL_HSTATS_QUAL_CNT
};
@@ -32,6 +35,10 @@ struct rtnl_hstat_req {
struct rtnl_hstat_qualifier {
unsigned int constant;
+ unsigned int min;
+ unsigned int max;
+ int (*get_max)(const struct net_device *dev,
+ const struct rtnl_hstat_group *grp);
};
/**
@@ -59,6 +66,8 @@ struct rtnl_hstat_group {
void rtnl_hstat_add_grp(struct rtnl_hstat_req *req,
const struct rtnl_hstat_group *grp);
+bool rtnl_hstat_qual_is_set(struct rtnl_hstat_req *req, int qual);
+int rtnl_hstat_qual_get(struct rtnl_hstat_req *req, int qual);
static inline void
rtnl_hstat_dump(struct rtnl_hstat_req *req, const int id, const u64 val)
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 55fcef81e142..b33d38ff5b47 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -948,6 +948,9 @@ enum {
IFLA_HSTATS_STATS,
IFLA_HSTATS_QUAL_TYPE,
IFLA_HSTATS_QUAL_DIRECTION,
+ IFLA_HSTATS_QUAL_QUEUE,
+ IFLA_HSTATS_QUAL_PRIORITY,
+ IFLA_HSTATS_QUAL_TC,
__IFLA_HSTATS_MAX,
};
#define IFLA_HSTATS_MAX (__IFLA_HSTATS_MAX - 1)
diff --git a/net/core/hstats.c b/net/core/hstats.c
index b409dd40e0c9..c689ebfdaeaa 100644
--- a/net/core/hstats.c
+++ b/net/core/hstats.c
@@ -22,14 +22,28 @@
* ============== <---- top of the stack before current handler
*/
enum hstat_dumper_cmd {
- /* open grp
- * put const quals
- * ---------------
- * | DUMP STATS |
- * | CLOSE grp |
- * ===============
+ /* Non-iterative group: Iterative group:
+ *
+ * open grp open grp
+ * put const quals put const quals
+ * --------------- ---------------
+ * | DUMP STATS | | ITER |
+ * | CLOSE grp | | CLOSE grp |
+ * =============== ===============
*/
HSTAT_DCMD_GRP_LOAD,
+ /* Non-last iteration: Last iteration:
+ *
+ * open grp open grp
+ * put current quals put current quals
+ * increment quals ---------------
+ * --------------- | DUMP STATS |
+ * | DUMP STATS | | CLOSE grp |
+ * | CLOSE grp | ===============
+ * | ITER |
+ * ===============
+ */
+ HSTAT_DCMD_GRP_ITER,
/* dump all statitics
* ---------------
* | LOAD child0 |
@@ -48,6 +62,8 @@ struct hstat_dumper {
struct net_device *dev;
/* For sizing we only have a const pointer to dev */
const struct net_device *const_dev;
+ u32 quals[RTNL_HSTATS_QUAL_CNT];
+ unsigned long quals_set;
int err;
/* For calculating skb size */
@@ -62,6 +78,12 @@ struct hstat_dumper {
size_t cmd_stack_len;
};
+struct hstat_qualifier_state {
+ u32 cur;
+ u32 min;
+ u32 max;
+};
+
struct hstat_dumper_cmd_simple {
u64 cmd;
};
@@ -71,12 +93,19 @@ struct hstat_dumper_cmd_grp_load {
u64 cmd;
};
+struct hstat_dumper_cmd_grp_iter {
+ struct hstat_qualifier_state *quals;
+ const struct rtnl_hstat_group *grp;
+ u64 cmd;
+};
+
struct hstat_dumper_cmd_grp_dump {
const struct rtnl_hstat_group *grp;
u64 cmd;
};
struct hstat_dumper_cmd_grp_close {
+ unsigned long quals_set;
struct nlattr *nl_attr;
u64 cmd;
};
@@ -85,11 +114,14 @@ struct hstat_dumper_cmd_grp_close {
static const int rtnl_qual2ifla[RTNL_HSTATS_QUAL_CNT] = {
[RTNL_HSTATS_QUAL_TYPE] = IFLA_HSTATS_QUAL_TYPE,
[RTNL_HSTATS_QUAL_DIRECTION] = IFLA_HSTATS_QUAL_DIRECTION,
+ [RTNL_HSTATS_QUAL_QUEUE] = IFLA_HSTATS_QUAL_QUEUE,
+ [RTNL_HSTATS_QUAL_PRIORITY] = IFLA_HSTATS_QUAL_PRIORITY,
+ [RTNL_HSTATS_QUAL_TC] = IFLA_HSTATS_QUAL_TC,
};
static bool rtnl_hstat_qualifier_present(const struct rtnl_hstat_qualifier *q)
{
- return q->constant;
+ return q->constant || q->max || q->get_max;
}
/* Dumper basics */
@@ -197,6 +229,20 @@ hstat_dumper_push_grp_load(struct hstat_dumper *dumper,
return __hstat_dumper_push_cmd(dumper, &cmd, sizeof(cmd));
}
+static int
+hstat_dumper_push_grp_iter(struct hstat_dumper *dumper,
+ const struct rtnl_hstat_group *grp,
+ struct hstat_qualifier_state *quals)
+{
+ struct hstat_dumper_cmd_grp_iter cmd = {
+ .cmd = HSTAT_DCMD_GRP_ITER,
+ .grp = grp,
+ .quals = quals,
+ };
+
+ return __hstat_dumper_push_cmd(dumper, &cmd, sizeof(cmd));
+}
+
static int
hstat_dumper_push_dump(struct hstat_dumper *dumper,
const struct rtnl_hstat_group *grp)
@@ -215,6 +261,7 @@ hstat_dumper_push_grp_close(struct hstat_dumper *dumper, struct nlattr *nl_grp)
struct hstat_dumper_cmd_grp_close cmd = {
.cmd = HSTAT_DCMD_GRP_CLOSE,
.nl_attr = nl_grp,
+ .quals_set = dumper->quals_set,
};
return __hstat_dumper_push_cmd(dumper, &cmd, sizeof(cmd));
@@ -303,12 +350,18 @@ hstat_dumper_put_qual(struct hstat_dumper *dumper, int i, u32 val)
return 0;
}
+ /* Qualifiers cannot be overwritten once set */
+ if (WARN_ON_ONCE(__test_and_set_bit(i, &dumper->quals_set)))
+ return -EINVAL;
+ dumper->quals[i] = val;
+
return nla_put_u32(dumper->skb, rtnl_qual2ifla[i], val);
}
/* Dumper handlers */
static int hstat_dumper_grp_load(struct hstat_dumper *dumper)
{
+ struct hstat_qualifier_state *quals = NULL;
struct hstat_dumper_cmd_grp_load cmd;
int i, err;
@@ -336,7 +389,89 @@ static int hstat_dumper_grp_load(struct hstat_dumper *dumper)
err = hstat_dumper_put_qual(dumper, i, q->constant);
if (err)
return err;
+ } else {
+ int max;
+
+ /* Each iteration point has its own set of iterators,
+ * this allows iterating different group over different
+ * sets of qualifiers.
+ */
+ if (!quals) {
+ quals = kcalloc(RTNL_HSTATS_QUAL_CNT,
+ sizeof(*quals), GFP_KERNEL);
+ if (!quals)
+ return -ENOMEM;
+ }
+
+ max = q->max ?: q->get_max(dumper->const_dev, cmd.grp);
+ if (max < 0)
+ return max;
+
+ if (WARN_ON_ONCE(q->min > max))
+ return -EINVAL;
+ quals[i].min = q->min;
+ quals[i].cur = q->min;
+ quals[i].max = max;
+ }
+ }
+
+ if (quals)
+ return hstat_dumper_push_grp_iter(dumper, cmd.grp, quals);
+ else
+ return hstat_dumper_push_dump(dumper, cmd.grp);
+}
+
+static int hstat_dumper_grp_iter(struct hstat_dumper *dumper)
+{
+ struct hstat_dumper_cmd_grp_iter cmd;
+ int i, err;
+ bool done;
+
+ err = hstat_dumper_pop(dumper, &cmd, sizeof(cmd));
+ if (err)
+ return err;
+ if (dumper->err) {
+ kfree(cmd.quals);
+ return 0;
+ }
+
+ /* Find out if iteration is done */
+ for (i = 0; i < RTNL_HSTATS_QUAL_CNT; i++)
+ if (cmd.quals[i].cur + 1 < cmd.quals[i].max)
+ break;
+ done = i == RTNL_HSTATS_QUAL_CNT;
+ if (!done) {
+ err = hstat_dumper_push_grp_iter(dumper, cmd.grp, cmd.quals);
+ if (err)
+ return err;
+ }
+
+ err = hstat_dumper_open_grp(dumper);
+ if (err)
+ return err;
+
+ for (i = 0; i < RTNL_HSTATS_QUAL_CNT; i++) {
+ if (!cmd.quals[i].max)
+ continue;
+
+ err = hstat_dumper_put_qual(dumper, i, cmd.quals[i].cur);
+ if (err)
+ return err;
+ }
+
+ if (!done) {
+ for (i = 0; i < RTNL_HSTATS_QUAL_CNT; i++) {
+ if (cmd.quals[i].cur >= cmd.quals[i].max)
+ continue;
+
+ cmd.quals[i].cur++;
+ if (cmd.quals[i].cur == cmd.quals[i].max)
+ cmd.quals[i].cur = cmd.quals[i].min;
+ else
+ break;
}
+ } else {
+ kfree(cmd.quals);
}
return hstat_dumper_push_dump(dumper, cmd.grp);
@@ -379,6 +514,7 @@ static int hstat_dumper_grp_close(struct hstat_dumper *dumper)
if (err)
return err;
+ dumper->quals_set = cmd.quals_set;
if (!dumper->err)
nla_nest_end(dumper->skb, cmd.nl_attr);
else
@@ -417,6 +553,9 @@ static int hstat_dumper_run(struct hstat_dumper *dumper)
case HSTAT_DCMD_ROOT_GRP_DONE:
err = hstat_dumper_root_grp_done(dumper);
break;
+ case HSTAT_DCMD_GRP_ITER:
+ err = hstat_dumper_grp_iter(dumper);
+ break;
case HSTAT_DCMD_GRP_LOAD:
err = hstat_dumper_grp_load(dumper);
break;
@@ -449,6 +588,21 @@ rtnl_hstat_add_grp(struct rtnl_hstat_req *req,
}
EXPORT_SYMBOL(rtnl_hstat_add_grp);
+bool rtnl_hstat_qual_is_set(struct rtnl_hstat_req *req, int qual)
+{
+ return test_bit(qual, &req->dumper->quals_set);
+}
+EXPORT_SYMBOL(rtnl_hstat_qual_is_set);
+
+int rtnl_hstat_qual_get(struct rtnl_hstat_req *req, int qual)
+{
+ if (!test_bit(qual, &req->dumper->quals_set))
+ return U32_MAX;
+
+ return req->dumper->quals[qual];
+}
+EXPORT_SYMBOL(rtnl_hstat_qual_get);
+
/* Stack call points */
static size_t
__rtnl_get_link_hstats(struct sk_buff *skb, const struct net_device *const_dev,
--
2.19.2
^ permalink raw reply related
* [RFC 05/14] nfp: very basic hstat support
From: Jakub Kicinski @ 2019-01-28 23:44 UTC (permalink / raw)
To: davem
Cc: oss-drivers, netdev, jiri, f.fainelli, andrew, mkubecek, dsahern,
simon.horman, jesse.brandeburg, maciejromanfijalkowski,
vasundhara-v.volam, michael.chan, shalomt, idosch, Jakub Kicinski
In-Reply-To: <20190128234507.32028-1-jakub.kicinski@netronome.com>
Expose basic vNIC device statistics via hstat.
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
drivers/net/ethernet/netronome/nfp/Makefile | 1 +
.../net/ethernet/netronome/nfp/nfp_hstat.c | 70 +++++++++++++++++++
drivers/net/ethernet/netronome/nfp/nfp_net.h | 3 +
.../ethernet/netronome/nfp/nfp_net_common.c | 1 +
4 files changed, 75 insertions(+)
create mode 100644 drivers/net/ethernet/netronome/nfp/nfp_hstat.c
diff --git a/drivers/net/ethernet/netronome/nfp/Makefile b/drivers/net/ethernet/netronome/nfp/Makefile
index 47c708f08ade..4721abe9bfbf 100644
--- a/drivers/net/ethernet/netronome/nfp/Makefile
+++ b/drivers/net/ethernet/netronome/nfp/Makefile
@@ -19,6 +19,7 @@ nfp-objs := \
nfp_app.o \
nfp_app_nic.o \
nfp_devlink.o \
+ nfp_hstat.o \
nfp_hwmon.o \
nfp_main.o \
nfp_net_common.o \
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_hstat.c b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
new file mode 100644
index 000000000000..9480d3b6caa5
--- /dev/null
+++ b/drivers/net/ethernet/netronome/nfp/nfp_hstat.c
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/* Copyright (C) 2019 Netronome Systems, Inc. */
+
+#include <net/hstats.h>
+
+#include "nfp_net.h"
+
+/* NFD per-vNIC stats */
+static int
+nfp_hstat_vnic_nfd_basic_get_rx(struct net_device *netdev,
+ struct rtnl_hstat_req *req,
+ const struct rtnl_hstat_group *grp)
+{
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_PKTS,
+ nn_readq(nn, NFP_NET_CFG_STATS_RX_FRAMES));
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_BYTES,
+ nn_readq(nn, NFP_NET_CFG_STATS_RX_OCTETS));
+ return 0;
+}
+
+static const struct rtnl_hstat_group nfp_hstat_vnic_nfd_rx = {
+ .qualifiers = {
+ RTNL_HSTATS_QUALS_BASIC(DEV, RX),
+ },
+
+ .get_stats = nfp_hstat_vnic_nfd_basic_get_rx,
+ .stats = {
+ [0] = RTNL_HSTATS_STAT_LINUX_PKTS_BIT |
+ RTNL_HSTATS_STAT_LINUX_BYTES_BIT,
+ },
+ .stats_cnt = 2,
+};
+
+static int
+nfp_hstat_vnic_nfd_basic_get_tx(struct net_device *netdev,
+ struct rtnl_hstat_req *req,
+ const struct rtnl_hstat_group *grp)
+{
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_PKTS,
+ nn_readq(nn, NFP_NET_CFG_STATS_TX_FRAMES));
+ rtnl_hstat_dump(req, IFLA_HSTATS_STAT_LINUX_BYTES,
+ nn_readq(nn, NFP_NET_CFG_STATS_TX_OCTETS));
+ return 0;
+}
+
+static const struct rtnl_hstat_group nfp_hstat_vnic_nfd_tx = {
+ .qualifiers = {
+ RTNL_HSTATS_QUALS_BASIC(DEV, TX),
+ },
+
+ .get_stats = nfp_hstat_vnic_nfd_basic_get_tx,
+ .stats = {
+ [0] = RTNL_HSTATS_STAT_LINUX_PKTS_BIT |
+ RTNL_HSTATS_STAT_LINUX_BYTES_BIT,
+ },
+ .stats_cnt = 2,
+};
+
+int nfp_net_hstat_get_groups(const struct net_device *netdev,
+ struct rtnl_hstat_req *req)
+{
+ rtnl_hstat_add_grp(req, &nfp_hstat_vnic_nfd_rx);
+ rtnl_hstat_add_grp(req, &nfp_hstat_vnic_nfd_tx);
+
+ return 0;
+}
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net.h b/drivers/net/ethernet/netronome/nfp/nfp_net.h
index 93de25b39bc1..08396a23edeb 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net.h
@@ -105,6 +105,7 @@ struct nfp_eth_table_port;
struct nfp_net;
struct nfp_net_r_vector;
struct nfp_port;
+struct rtnl_hstat_req;
/* Convenience macro for wrapping descriptor index on ring size */
#define D_IDX(ring, idx) ((idx) & ((ring)->cnt - 1))
@@ -910,4 +911,6 @@ static inline void nfp_net_debugfs_dir_clean(struct dentry **dir)
}
#endif /* CONFIG_NFP_DEBUG */
+int nfp_net_hstat_get_groups(const struct net_device *dev,
+ struct rtnl_hstat_req *req);
#endif /* _NFP_NET_H_ */
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 7d2d4241498f..87ebfc3f0471 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -3531,6 +3531,7 @@ const struct net_device_ops nfp_net_netdev_ops = {
.ndo_udp_tunnel_add = nfp_net_add_vxlan_port,
.ndo_udp_tunnel_del = nfp_net_del_vxlan_port,
.ndo_bpf = nfp_net_xdp,
+ .ndo_hstat_get_groups = nfp_net_hstat_get_groups,
};
/**
--
2.19.2
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox