summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2015-01-18niu: remove one compound_head() callEric Dumazet1-2/+1
After a "page = alloc_page(mask);", we do not need to use compound_head() : page already points to the right place. This would be true even if using alloc_pages(). Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-18qeth: Remove unneeded structure memberThomas Richter1-1/+0
The member irq_tasklet in the qeth_channel structure is not referenced anymore and is removed from the structure. Signed-off-by: Thomas Richter <tmricht@linux.vnet.ibm.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-18qeth: sysfs: replace strcmp() with sysfs_streq()Eugene Crosser2-48/+32
Replace combination of strsep() and a temporary char * followed by a series of "if (!strcmp(...))" with a series of "if (sysfs_streq(...))". Signed-off-by: Eugene Crosser <Eugene.Crosser@ru.ibm.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Reviewed-by: Thomas-Mich Richter <tmricht@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-18qeth: use qeth_card_hw_is_reachable() everywhereEugene Crosser4-15/+8
qeth_card_hw_is_reachable() was introduced as part of a new functionality, but it is a useful abstraction that can replace verbose checks througout the rest of the `qeth` driver. Signed-off-by: Eugene Crosser <Eugene.Crosser@ru.ibm.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Reviewed-by: Thomas-Mich Richter <tmricht@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-18s390/net: Delete useless checks before function callsMarkus Elfring3-14/+7
The function debug_unregister() tests whether its argument is NULL and then returns immediately. Thus the test around the call is not needed. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-18s390/ctcm, netiucv: migrate variables to handle y2038 problemAya Mahfouz5-19/+15
This patch is concerned with migrating the time variables for the s390 network drivers. The changes handle the y2038 problem where timespec will overflow in the year 2038. timespec was replaced by unsigned long and all time variables get their values from the jiffies global variable. This was done for the sake of speed and efficiency. Signed-off-by: Aya Mahfouz <mahfouz.saif.elyazal@gmail.com> Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-18Merge branch 'master' of ↵David S. Miller13-81/+365
git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-next Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2015-01-16 This series contains updates to i40e and i40evf. This series is a little bit larger than normal because two of the patches are version bumps. Shannon provides tweaks to i40e and i40evf to keep the firmware, software and silicon validation in line together by removing unused and deprecated code, adding define for iSCSI and fix queue mask size. Fix i40e so we do not give up in the reset/rebuild process if DCB setup fails, just handle it the same as in the probe setup. Cleans up PTP log messages by removing the use of __func__ as we are not using that any longer and removes the netdev name, since that can change and can be misleading. Adds struct size checks to indirect and command structs that were left out previously. Added admin queue API updates (LLDP control, OEM OCSD and OCBB commands). Kevin increases ASQ timeout for scenarios with multi-function devices. Carolyn fixes a problem where the interrupts descriptions from the MSIx configuration were truncating the needed bus info, which makes it hard to distinguish configurations from port to port. Increased the string buffer size in order to allow the full data to be displayed. Sravanthi cleans up the dump stats string from debugfs. Jacob updates i40e to only enable the PTP interrupt in PFs which have PTP enabled, instead of blindly enabling the PTP interrupt flags for all PFs. Also updated i40e so that we do not do Tx or Rx timestamps if we do not have PTP enabled. Added the same check against pf->ptp_rx as we have in Rx timestamp code path because it is possible that the user can configure only Tx hardware timestamping so we do not want to check for Rx timestamp hang since the software won't be handling them. Neerav updates the driver to disable firmware LLDP agent for NICs with a firmware version lower than v4.3 and added a message when this happens. Adds parsing and reporting of iSCSI capability for a given device or function, as well as adding support for iSCSI partition type with DCB in NPAR mode. v2: - Dropped patch 10 "i40e: clean up PTP log messages" based on feedback from David Laight and David Miller - Split up the original patch 13 "i40e: AQ API updates for new commands" into 2 patches (now #12 & #13) based on feedback from Or Gerlitz ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe-phy: Allow certain PHY settings to be set by UEFILendacky, Thomas1-23/+136
Certain PHY settings need to be configurable by UEFI depending on the platform being used. Add new device tree / ACPI properties that, if present, will override the pre-determined values currently used. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe: Add ACPI supportLendacky, Thomas8-106/+273
Add support for ACPI to the amd-xgbe and amd-xgbe-phy drivers. This support converts many of the device tree APIs to the new device_property APIs. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe-phy: Use the proper auto-negotiation XNP registersLendacky, Thomas1-2/+6
When receiving and processing extended next pages the base registers were used instead of the XNP registers. Update the code to use the device XNP and link partner XNP registers. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe-phy: Properly support the FEC auto-negotiationLendacky, Thomas1-11/+33
Advertise and apply the Forward Error Correction capabilities of the device based on the FEC ability of the device. Also, remove the use of some hard coded values related to KR and FEC in preference of some #defines. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe-phy: Change auto-negotiation logicLendacky, Thomas2-266/+388
The auto negotiation logic was geared to being the initiator of the auto negotiation. This presented problems when auto negotiation was initiated by the remote end. Change the auto negotiation logic to make use of the auto negotiation event interrupt thus allowing the auto negotiation state machine to function properly in either scenario. This also removes the polling during auto-negotiation. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe: Remove need for Tx path spinlockLendacky, Thomas2-28/+10
Since the Tx ring cleanup can run at the same time that data is being transmitted, a spin lock was used to protect the ring. This patch eliminates the need for Tx spinlocks by updating the current ring position only after all ownership bits for data being transmitted have been set. This will insure that ring operations in the Tx cleanup path do not interfere with the ring operations in the Tx transmit path. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe: Simplify the Rx desciptor ring trackingLendacky, Thomas3-43/+25
Make the Rx descriptor ring processing similar to the Tx descriptor ring processing. Remove the realloc_index and realloc_threshold variables and base everything on the current index counter and the dirty index counter. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe: Clear all state during a device restartLendacky, Thomas3-6/+24
When performing a device restart, like during an MTU change, sometimes the device queues still have data and get hung up trying to flush resulting in the device becoming unresponsive until brought down and back up. To prevent this, always perform a device reset during a restart. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe-phy: On suspend, save CTRL1 reg for use on resumeLendacky, Thomas1-11/+9
Reads to registers are undefined when the PCS is powered down. To be safe, save the CTRL1 register used for power down during suspend and restore that value during resume. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe: Add check to be sure amd-xgbe-phy driver is usedLendacky, Thomas1-2/+6
The amd-xgbe driver relies on the amd-xgbe-phy phylib driver. Add a check to be sure that if any errors occur during probing of the amd-xgbe-phy driver then the amd-xgbe driver returns an error. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe-phy: Checkpatch fixesLendacky, Thomas1-3/+4
This set of patches resolves some checks reported by the checkpatch tool. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-17amd-xgbe: Checkpatch fixesLendacky, Thomas3-3/+3
This set of patches resolves some checks reported by the checkpatch tool. Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16i40e/i40evf: Bump i40e and i40evf versionsSravanthi Tangeda2-2/+2
Bump i40e to 1.2.6 and i40evf to 1.2.0 version. Change-ID: Ice127eee3a5a5d1b8765d83cff8c30f9f3b1bc32 Signed-off-by: Sravanthi Tangeda <sravanthi.tangeda@intel.com> Tested-by: Jim Young <james.m.young@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: Support for NPAR iSCSI partition with DCBNeerav Parikh4-18/+62
Add parsing and reporting of iSCSI capability for a given device or function. Also add support for iSCSI partition type with DCB in NPAR mode. In this mode it is expected that software would configure both the LAN and iSCSI traffic classes for the iSCSI partition; whereas all the NIC type partitions will use LAN TC (TC0) only. Hence, the patch enables querying of DCB configuration in MFP mode and configures TCs for iSCSI partition type. Though NIC type partitions may not have more than 1 TC enabled for them the port may have multiple TCs enabled and hence I40E_FLAG_DCB_ENABLED will be set/reset on all the partitions based on number of TCs on the port. This is required as in DCB environment it is expected that all traffic will be priority tagged. Change-ID: I8c6e1cfd46c46d8a39c57d9020d9ff8d42ed8a7d Signed-off-by: Neerav Parikh <neerav.parikh@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: when Rx timestamps disabled set specific modeJacob Keller1-11/+17
Instead of leaving the Rx timestamps in the same mode as before if we disable the Rx logic, we can set it into a mode that has the fewest possible timestamps generated. To do this, select only V1 mode, but do not enable UDP packet recognition. This should eliminate all (or at least almost all) Rx timestamps, since V1 packets are always over UDP. Change-ID: If847288e0030a716e059c4c33ab114f2cf038f05 Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Acked-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: use same check for Rx hang as for Rx timestampsJacob Keller1-1/+6
It's possible that the user configured only Tx hardware timestamping, and thus we might be receiving PTP traffic which we timestamp but which software never reads. In this case we don't want to check for Rx timestamp hang, because we already know that software won't be handling them. Thus, we add the same check against pf->ptp_rx as we have in the Rx timestamp code path. Change-ID: I66486c8dba307facbff8eace4e52e2f083789d1b Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Acked-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: AQ API updates for new commandsShannon Nelson2-10/+126
Add lldp control commands, add oem ocsd and ocbb commands. Change-ID: I89eba2bd02013d0a44e1ce900559c54bb15f4a66 Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Kamil Krawczyk <kamil.krawczyk@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: AQ API updatesJeff Kirsher2-10/+10
Fix up NVM config read and write data structs. Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Kamil Krawczyk <kamil.krawczyk@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: add more struct size checksShannon Nelson2-0/+86
Add struct size checks to many of the indirect structs and a few command structs that were left out previously. Change-ID: I7810b9af0f04e3ced670639f8671daf7df9b3f4d Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Acked-by: Greg Rose <gregory.v.rose@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: Issue "Stop LLDP" command for firmware older than v4.3Neerav Parikh1-0/+10
Disable firmware LLDP agent for NICs with firmware version lower than v4.3. Added a message when driver disables the firmware LLDP agent on such NICs. Change-ID: Ia8abf89439c70cb50e23db82753d7d282265506b Signed-off-by: Neerav Parikh <neerav.parikh@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: check I40E_FLAG_PTP before handling Tx or Rx timestampsJacob Keller2-1/+11
We should not be doing Tx or Rx timestamps if we do not have PTP enabled. Add checks to ensure that we don't attempt to handle any PTP related timestamping code if we have not enabled PTP on that PF. Change-ID: I4335942ae2d5c5f91abfdbeeea02bcace49e7677 Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: only enable PTP interrupt cause if PTP is enabledJacob Keller1-4/+7
We should not blindly enable the PTP interrupt flags for all PFs. We should only enable the PTP interrupt in PFs which have enabled PTP. Change-ID: I051a17cae4c199a2f3cf7852266e27eda6630525 Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e/i40evf: Bump i40e/i40evf versionsCatherine Sullivan2-2/+2
Bump i40e to 1.2.5 and i40evf to 1.0.7. Change-ID: I622556829056e3ed42d3b9d285fc5ffb693b21cc Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: Dump Stats string removed from debugfs help commandSravanthi Tangeda1-1/+0
Dump Stats string has been removed from functional debugfs help message. Now it does not show up when we echo command to debugfs/Fortville queue. Change-ID: I9333473826b574f1afa6ddb785fd7adfbdcb2884 Signed-off-by: Sravanthi Tangeda <sravanthi.tangeda@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: Add define for interrupt name string lenCarolyn Wyborny2-8/+9
This patch creates a define for interrupt name string configuration that is large enough to contain full bus/slot info, rather than just netdev->name. Change-ID: Iaac0d23dfb8526defeed69d91cea85ed4a50ddb2 Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: don't give up on DCB error after resetShannon Nelson1-4/+6
We don't need to give up in the reset/rebuild process if the DCB setup failed, so handle it here the same as in the probe setup. Also adjust the log strings a little to look less scary. Change-ID: I57308d703047e61d3f1a5e471ea77be232444ca0 Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: fix proc/int descriptionsCarolyn Wyborny1-2/+2
This patch fixes a problem where the /proc/interrupts descriptions from the msix configuration were truncating the needed bus info, making it hard to distinguish configuration from port to port. This patch increases the string buffer size in order to allow the full data to be displayed and sync's the text formatting of the misc and fdir interrupt names Change-ID: Ib01d6c61fb3f4ac70fbdf5bcc520b22638ea54b7 Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e/i40evf: Increase ASQ timeoutKevin Scott2-2/+2
Increase ASQ timeout for some scenarios with multi-function devices Change-ID: I2d7655b19e6c6f9a7ad04deacb106ca8d53886db Signed-off-by: Kevin Scott <kevin.c.scott@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e/i40evf: AdminQ updates ww36Shannon Nelson2-8/+10
Several little tweaks to keep FW, SV, and SW in line together - Remove the unused and deprecated i40e_aqc_opc_debug_modify_internals - Add define for iSCSI capability - Fix queue mask size - Adjust i40e_aqc_oem_param_change for ease-of-use Change-ID: I51f250b367912968a7cec61b3a68110d9796e914 Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Kamil Kacperski <kamil.kacperski@intel.com> Acked-by: Greg Rose <gregory.v.rose@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16iw_cxgb4: Cleanup register defines/MACROS defined in t4fw_ri_api.hHariprasad Shenai7-483/+483
Cleanup all the MACROS that are defined in t4fw_ri_api.h and affected files Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16iw_cxgb4: Cleanup register defines/MACROS defined in t4.hHariprasad Shenai3-70/+70
Cleanup all the MACROS defined in t4.h and the affected files Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16net/macb: Create gem_ethtool_ops for new statistics functionsXander Huff1-2/+13
10/100 MACB does not have the same statistics possibilities as GEM. Separate macb_ethtool_ops to make a new GEM-specific struct with the new statistics functions included. Signed-off-by: Xander Huff <xander.huff@ni.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16net/macb: Add whitespace around arithmetic operatorsXander Huff1-5/+5
Spaces should surround add, multiply, and bitshift operators. Signed-off-by: Xander Huff <xander.huff@ni.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16net/macb: Fix comments to meet style guidelinesXander Huff1-450/+284
Change comments to not exceed 80 characters per line. Update block comments in macb.h to start on the line after /*. Signed-off-by: Xander Huff <xander.huff@ni.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16Driver: Vmxnet3: Fix ethtool -S to return correct rx queue statsShrikrishna Khare2-3/+3
Signed-off-by: Gao Zhenyu <gzhenyu@vmware.com> Signed-off-by: Shrikrishna Khare <skhare@vmware.com> Reviewed-by: Shreyas N Bhatewara <sbhatewara@vmware.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16net: smc91x: Add Atari EtherNAT supportMichael Schmitz2-4/+27
Add Atari specific code to the smc91x Ethernet driver. This code is used on the EtherNAT adapter card for the Atari Falcon extension port. Signed-off-by: Michael Schmitz <schmitz@debian.org> Tested-by: Christian Steigies <cts@debian.org> [geert: Sort Kconfig entries, split in hard and soft dependencies] Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Nicolas Pitre <nico@fluxnic.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16Merge tag 'mac80211-next-for-davem-2015-01-15' of ↵David S. Miller29-142/+145
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Here's a big pile of changes for this round. We have * a lot of regulatory code changes to deal with the way newer Intel devices handle this * a change to drop packets while disconnecting from an AP instead of trying to wait for them * a new attempt at improving the tailroom accounting to not kick in too much for performance reasons * improvements in wireless link statistics * many other small improvements and small fixes that didn't seem necessary for 3.19 (e.g. in hwsim which is testing only code) Conflicts: drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c Minor overlapping changes. Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16cxgb4i : Call into recently added cxgb4 ipv6 apiAnish Bhatt1-1/+22
Get a reference on every ipv6 address we offload to hardware so that it cannot be prematurely cleared out before cleanup. Signed-off-by: Anish Bhatt <anish@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16cxgb4 : Update ipv6 address handling apiAnish Bhatt7-163/+447
This patch improves on previously added support for ipv6 addresses. The code is consolidated to a single file and adds an api for use by dependent upper level drivers such as cxgb4i/iw_cxgb4 etc. Signed-off-by: Anish Bhatt <anish@chelsio.com> Signed-off-by: Deepak Singh <deepak.s@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15net: sh_eth: Use u32 for 32-bit register dataGeert Uytterhoeven2-23/+21
Replace "unsigned long" by "u32" when handling 32-bit register data. A.o., this saves 11 * 36 bytes in the static sh_eth_cpu_data structures when compiling for 64-bit. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15dm9000: Add regulator and reset support to dm9000Zubair Lutfullah Kakakhel1-0/+40
In boards, the dm9000 chip's power and reset can be controlled by gpio. It makes sense to add them to the dm9000 driver and let dt be used to enable power and reset the phy. Signed-off-by: Zubair Lutfullah Kakakhel <Zubair.Kakakhel@imgtec.com> Signed-off-by: Paul Burton <paul.burton@imgtec.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15vxlan: Only bind to sockets with compatible flags enabledThomas Graf1-11/+18
A VXLAN net_device looking for an appropriate socket may only consider a socket which has a matching set of flags/extensions enabled. If incompatible flags are enabled, return a conflict to have the caller create a distinct socket with distinct port. The OVS VXLAN port is kept unaware of extensions at this point. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15vxlan: Group Policy extensionThomas Graf1-13/+71
Implements supports for the Group Policy VXLAN extension [0] to provide a lightweight and simple security label mechanism across network peers based on VXLAN. The security context and associated metadata is mapped to/from skb->mark. This allows further mapping to a SELinux context using SECMARK, to implement ACLs directly with nftables, iptables, OVS, tc, etc. The group membership is defined by the lower 16 bits of skb->mark, the upper 16 bits are used for flags. SELinux allows to manage label to secure local resources. However, distributed applications require ACLs to implemented across hosts. This is typically achieved by matching on L2-L4 fields to identify the original sending host and process on the receiver. On top of that, netlabel and specifically CIPSO [1] allow to map security contexts to universal labels. However, netlabel and CIPSO are relatively complex. This patch provides a lightweight alternative for overlay network environments with a trusted underlay. No additional control protocol is required. Host 1: Host 2: Group A Group B Group B Group A +-----+ +-------------+ +-------+ +-----+ | lxc | | SELinux CTX | | httpd | | VM | +--+--+ +--+----------+ +---+---+ +--+--+ \---+---/ \----+---/ | | +---+---+ +---+---+ | vxlan | | vxlan | +---+---+ +---+---+ +------------------------------+ Backwards compatibility: A VXLAN-GBP socket can receive standard VXLAN frames and will assign the default group 0x0000 to such frames. A Linux VXLAN socket will drop VXLAN-GBP frames. The extension is therefore disabled by default and needs to be specifically enabled: ip link add [...] type vxlan [...] gbp In a mixed environment with VXLAN and VXLAN-GBP sockets, the GBP socket must run on a separate port number. Examples: iptables: host1# iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200 host2# iptables -I INPUT -m mark --mark 0x200 -j DROP OVS: # ovs-ofctl add-flow br0 'in_port=1,actions=load:0x200->NXM_NX_TUN_GBP_ID[],NORMAL' # ovs-ofctl add-flow br0 'in_port=2,tun_gbp_id=0x200,actions=drop' [0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy [1] http://lwn.net/Articles/204905/ Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.0) at 2024-11-17 12:52:17 +0300