diff options
Diffstat (limited to 'target/linux/generic/pending-5.4/640-netfilter-nf_flow_table-add-hardware-offload-support.patch')
| -rw-r--r-- | target/linux/generic/pending-5.4/640-netfilter-nf_flow_table-add-hardware-offload-support.patch | 68 |
1 files changed, 34 insertions, 34 deletions
diff --git a/target/linux/generic/pending-5.4/640-netfilter-nf_flow_table-add-hardware-offload-support.patch b/target/linux/generic/pending-5.4/640-netfilter-nf_flow_table-add-hardware-offload-support.patch index f0946e8dd2..b36b64f13a 100644 --- a/target/linux/generic/pending-5.4/640-netfilter-nf_flow_table-add-hardware-offload-support.patch +++ b/target/linux/generic/pending-5.4/640-netfilter-nf_flow_table-add-hardware-offload-support.patch @@ -23,9 +23,9 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h -@@ -918,6 +918,13 @@ struct dev_ifalias { - char ifalias[]; - }; +@@ -926,6 +926,13 @@ struct devlink; + struct tlsdev_ops; + +struct flow_offload; + @@ -37,7 +37,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> /* * This structure defines the management hooks for network devices. * The following hooks can be defined; unless noted otherwise, they are -@@ -1150,6 +1157,10 @@ struct dev_ifalias { +@@ -1158,6 +1165,10 @@ struct tlsdev_ops; * int (*ndo_bridge_dellink)(struct net_device *dev, struct nlmsghdr *nlh, * u16 flags); * @@ -48,7 +48,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier); * Called to change device carrier. Soft-devices (like dummy, team, etc) * which do not represent real hardware may define this to allow their -@@ -1377,6 +1388,8 @@ struct net_device_ops { +@@ -1405,6 +1416,8 @@ struct net_device_ops { int (*ndo_bridge_dellink)(struct net_device *dev, struct nlmsghdr *nlh, u16 flags); @@ -59,7 +59,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> int (*ndo_get_phys_port_id)(struct net_device *dev, --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h -@@ -20,11 +20,17 @@ struct nf_flowtable_type { +@@ -21,11 +21,17 @@ struct nf_flowtable_type { struct module *owner; }; @@ -77,7 +77,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> }; enum flow_offload_tuple_dir { -@@ -69,6 +75,7 @@ struct flow_offload_tuple_rhash { +@@ -68,6 +74,7 @@ struct flow_offload_tuple_rhash { #define FLOW_OFFLOAD_DNAT 0x2 #define FLOW_OFFLOAD_DYING 0x4 #define FLOW_OFFLOAD_TEARDOWN 0x8 @@ -85,7 +85,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> struct flow_offload { struct flow_offload_tuple_rhash tuplehash[FLOW_OFFLOAD_DIR_MAX]; -@@ -125,6 +132,22 @@ unsigned int nf_flow_offload_ip_hook(voi +@@ -120,6 +127,22 @@ unsigned int nf_flow_offload_ip_hook(voi unsigned int nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state); @@ -110,7 +110,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h -@@ -1464,6 +1464,7 @@ enum nft_object_attributes { +@@ -1516,6 +1516,7 @@ enum nft_object_attributes { * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64) @@ -118,7 +118,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> */ enum nft_flowtable_attributes { NFTA_FLOWTABLE_UNSPEC, -@@ -1473,6 +1474,7 @@ enum nft_flowtable_attributes { +@@ -1525,6 +1526,7 @@ enum nft_flowtable_attributes { NFTA_FLOWTABLE_USE, NFTA_FLOWTABLE_HANDLE, NFTA_FLOWTABLE_PAD, @@ -128,7 +128,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> #define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1) --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig -@@ -714,6 +714,15 @@ config NF_FLOW_TABLE +@@ -723,6 +723,15 @@ config NF_FLOW_TABLE To compile it as a module, choose M here. @@ -152,13 +152,13 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o +obj-$(CONFIG_NF_FLOW_TABLE_HW) += nf_flow_table_hw.o - # generic X tables + # generic X tables obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c -@@ -228,10 +228,16 @@ int flow_offload_add(struct nf_flowtable +@@ -248,10 +248,16 @@ static inline bool nf_flow_has_expired(c + return nf_flow_timeout_delta(flow->timeout) <= 0; } - EXPORT_SYMBOL_GPL(flow_offload_add); +static inline bool nf_flow_in_hw(const struct flow_offload *flow) +{ @@ -173,7 +173,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> rhashtable_remove_fast(&flow_table->rhashtable, &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node, -@@ -246,6 +252,9 @@ static void flow_offload_del(struct nf_f +@@ -271,6 +277,9 @@ static void flow_offload_del(struct nf_f if (!(flow->flags & FLOW_OFFLOAD_TEARDOWN)) flow_offload_fixup_ct_state(e->ct); @@ -183,17 +183,17 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> flow_offload_free(flow); } -@@ -359,6 +368,9 @@ static int nf_flow_offload_gc_step(struc - if (!teardown) - nf_ct_offload_timeout(flow); +@@ -361,6 +370,9 @@ static void nf_flow_offload_gc_step(stru + if (!teardown) + nf_ct_offload_timeout(flow); -+ if (nf_flow_in_hw(flow) && !teardown) -+ continue; ++ if (nf_flow_in_hw(flow) && !teardown) ++ return; + - if (nf_flow_has_expired(flow) || teardown) - flow_offload_del(flow_table, flow); - } -@@ -494,10 +506,43 @@ int nf_flow_dnat_port(const struct flow_ + if (nf_flow_has_expired(flow) || teardown) + flow_offload_del(flow_table, flow); + } +@@ -490,10 +502,43 @@ int nf_flow_dnat_port(const struct flow_ } EXPORT_SYMBOL_GPL(nf_flow_dnat_port); @@ -237,7 +237,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> INIT_DEFERRABLE_WORK(&flowtable->gc_work, nf_flow_offload_work_gc); err = rhashtable_init(&flowtable->rhashtable, -@@ -538,6 +583,8 @@ static void nf_flow_table_iterate_cleanu +@@ -534,6 +579,8 @@ static void nf_flow_table_iterate_cleanu { nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, dev); flush_delayed_work(&flowtable->gc_work); @@ -245,8 +245,8 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> + flush_work(&nf_flow_offload_hw_work); } - void nf_flow_table_cleanup(struct net *net, struct net_device *dev) -@@ -551,6 +598,26 @@ void nf_flow_table_cleanup(struct net *n + void nf_flow_table_cleanup(struct net_device *dev) +@@ -547,6 +594,26 @@ void nf_flow_table_cleanup(struct net_de } EXPORT_SYMBOL_GPL(nf_flow_table_cleanup); @@ -273,9 +273,9 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> void nf_flow_table_free(struct nf_flowtable *flow_table) { mutex_lock(&flowtable_lock); -@@ -560,9 +627,58 @@ void nf_flow_table_free(struct nf_flowta +@@ -556,9 +623,58 @@ void nf_flow_table_free(struct nf_flowta nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL); - WARN_ON(!nf_flow_offload_gc_step(flow_table)); + nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, flow_table); rhashtable_destroy(&flow_table->rhashtable); + if (flow_table->flags & NF_FLOWTABLE_F_HW) + nf_flow_offload_hw_free(flow_table); @@ -506,7 +506,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +MODULE_ALIAS("nf-flow-table-hw"); --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c -@@ -5503,6 +5503,13 @@ static int nf_tables_flowtable_parse_hoo +@@ -5740,6 +5740,13 @@ static int nf_tables_flowtable_parse_hoo if (err < 0) return err; @@ -520,7 +520,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL); if (!ops) return -ENOMEM; -@@ -5634,10 +5641,19 @@ static int nf_tables_newflowtable(struct +@@ -5870,10 +5877,19 @@ static int nf_tables_newflowtable(struct } flowtable->data.type = type; @@ -540,7 +540,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK], flowtable); if (err < 0) -@@ -5763,7 +5779,8 @@ static int nf_tables_fill_flowtable_info +@@ -5999,7 +6015,8 @@ static int nf_tables_fill_flowtable_info nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle), @@ -549,10 +549,10 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> + nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags))) goto nla_put_failure; - nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK); + nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK); --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c -@@ -126,6 +126,9 @@ static void nft_flow_offload_eval(const +@@ -128,6 +128,9 @@ static void nft_flow_offload_eval(const if (ret < 0) goto err_flow_add; |