summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-01-16i40e: AQ API updatesJeff Kirsher
Fix up NVM config read and write data structs. Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Kamil Krawczyk <kamil.krawczyk@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: add more struct size checksShannon Nelson
Add struct size checks to many of the indirect structs and a few command structs that were left out previously. Change-ID: I7810b9af0f04e3ced670639f8671daf7df9b3f4d Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Acked-by: Greg Rose <gregory.v.rose@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: Issue "Stop LLDP" command for firmware older than v4.3Neerav Parikh
Disable firmware LLDP agent for NICs with firmware version lower than v4.3. Added a message when driver disables the firmware LLDP agent on such NICs. Change-ID: Ia8abf89439c70cb50e23db82753d7d282265506b Signed-off-by: Neerav Parikh <neerav.parikh@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: check I40E_FLAG_PTP before handling Tx or Rx timestampsJacob Keller
We should not be doing Tx or Rx timestamps if we do not have PTP enabled. Add checks to ensure that we don't attempt to handle any PTP related timestamping code if we have not enabled PTP on that PF. Change-ID: I4335942ae2d5c5f91abfdbeeea02bcace49e7677 Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: only enable PTP interrupt cause if PTP is enabledJacob Keller
We should not blindly enable the PTP interrupt flags for all PFs. We should only enable the PTP interrupt in PFs which have enabled PTP. Change-ID: I051a17cae4c199a2f3cf7852266e27eda6630525 Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e/i40evf: Bump i40e/i40evf versionsCatherine Sullivan
Bump i40e to 1.2.5 and i40evf to 1.0.7. Change-ID: I622556829056e3ed42d3b9d285fc5ffb693b21cc Signed-off-by: Catherine Sullivan <catherine.sullivan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: Dump Stats string removed from debugfs help commandSravanthi Tangeda
Dump Stats string has been removed from functional debugfs help message. Now it does not show up when we echo command to debugfs/Fortville queue. Change-ID: I9333473826b574f1afa6ddb785fd7adfbdcb2884 Signed-off-by: Sravanthi Tangeda <sravanthi.tangeda@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: Add define for interrupt name string lenCarolyn Wyborny
This patch creates a define for interrupt name string configuration that is large enough to contain full bus/slot info, rather than just netdev->name. Change-ID: Iaac0d23dfb8526defeed69d91cea85ed4a50ddb2 Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: don't give up on DCB error after resetShannon Nelson
We don't need to give up in the reset/rebuild process if the DCB setup failed, so handle it here the same as in the probe setup. Also adjust the log strings a little to look less scary. Change-ID: I57308d703047e61d3f1a5e471ea77be232444ca0 Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e: fix proc/int descriptionsCarolyn Wyborny
This patch fixes a problem where the /proc/interrupts descriptions from the msix configuration were truncating the needed bus info, making it hard to distinguish configuration from port to port. This patch increases the string buffer size in order to allow the full data to be displayed and sync's the text formatting of the misc and fdir interrupt names Change-ID: Ib01d6c61fb3f4ac70fbdf5bcc520b22638ea54b7 Signed-off-by: Carolyn Wyborny <carolyn.wyborny@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e/i40evf: Increase ASQ timeoutKevin Scott
Increase ASQ timeout for some scenarios with multi-function devices Change-ID: I2d7655b19e6c6f9a7ad04deacb106ca8d53886db Signed-off-by: Kevin Scott <kevin.c.scott@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16i40e/i40evf: AdminQ updates ww36Shannon Nelson
Several little tweaks to keep FW, SV, and SW in line together - Remove the unused and deprecated i40e_aqc_opc_debug_modify_internals - Add define for iSCSI capability - Fix queue mask size - Adjust i40e_aqc_oem_param_change for ease-of-use Change-ID: I51f250b367912968a7cec61b3a68110d9796e914 Signed-off-by: Shannon Nelson <shannon.nelson@intel.com> Signed-off-by: Kamil Kacperski <kamil.kacperski@intel.com> Acked-by: Greg Rose <gregory.v.rose@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
2015-01-16Bluetooth: Remove unused functionRickard Strandqvist
Remove the function hci_conn_change_link_key() that is not used anywhere. This was partially found by using a static code analysis program called cppcheck. Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-01-16netlink: Fix netlink_insert EADDRINUSE errorHerbert Xu
The patch c5adde9468b0714a051eac7f9666f23eb10b61f7 ("netlink: eliminate nl_sk_hash_lock") introduced a bug where the EADDRINUSE error has been replaced by ENOMEM. This patch rectifies that problem. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16rhashtable: Fix race in rhashtable_destroy() and use regular work_structYing Xue
When we put our declared work task in the global workqueue with schedule_delayed_work(), its delay parameter is always zero. Therefore, we should define a regular work in rhashtable structure instead of a delayed work. By the way, we add a condition to check whether resizing functions are NULL before cancelling the work, avoiding to cancel an uninitialized work. Lastly, while we wait for all work items we submitted before to run to completion with cancel_delayed_work(), ht->mutex has been taken in rhashtable_destroy(). Moreover, cancel_delayed_work() doesn't return until all work items are accomplished, and when work items are scheduled, the work's function - rht_deferred_worker() will be called. However, as rht_deferred_worker() also needs to acquire the lock, deadlock might happen at the moment as the lock is already held before. So if the cancel work function is moved out of the lock covered scope, this will avoid the deadlock. Fixes: 97defe1 ("rhashtable: Per bucket locks & deferred expansion/shrinking") Signed-off-by: Ying Xue <ying.xue@windriver.com> Cc: Thomas Graf <tgraf@suug.ch> Acked-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16Merge branch 'iw_cxgb4-next'David S. Miller
Hariprasad Shenai says: ==================== Refactor macros to conform to uniform standards This patch series cleansup macros/register defines, defined in t4.h and t4fw_ri_api.h and all the affected files. This patch series is created against net-next tree and includes patches on iw_cxgb4 tree. Since the patches are dependent on previous cleanup patched we would line to get this series merged through net-next tree. We have included all the maintainers of respective drivers. Kindly review the change and let us know in case of any review comments. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16iw_cxgb4: Cleanup register defines/MACROS defined in t4fw_ri_api.hHariprasad Shenai
Cleanup all the MACROS that are defined in t4fw_ri_api.h and affected files Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16iw_cxgb4: Cleanup register defines/MACROS defined in t4.hHariprasad Shenai
Cleanup all the MACROS defined in t4.h and the affected files Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16iw_cxgb4: Cleanup register defines/MACROS defined in t4fw_ri_api.hHariprasad Shenai
Cleanup all the MACROS that are defined in t4fw_ri_api.h and affected files Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16iw_cxgb4: Cleanup register defines/MACROS defined in t4.hHariprasad Shenai
Cleanup all the MACROS defined in t4.h and the affected files Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16net/macb: Create gem_ethtool_ops for new statistics functionsXander Huff
10/100 MACB does not have the same statistics possibilities as GEM. Separate macb_ethtool_ops to make a new GEM-specific struct with the new statistics functions included. Signed-off-by: Xander Huff <xander.huff@ni.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16net/macb: Add whitespace around arithmetic operatorsXander Huff
Spaces should surround add, multiply, and bitshift operators. Signed-off-by: Xander Huff <xander.huff@ni.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16net/macb: Fix comments to meet style guidelinesXander Huff
Change comments to not exceed 80 characters per line. Update block comments in macb.h to start on the line after /*. Signed-off-by: Xander Huff <xander.huff@ni.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-16Driver: Vmxnet3: Fix ethtool -S to return correct rx queue statsShrikrishna Khare
Signed-off-by: Gao Zhenyu <gzhenyu@vmware.com> Signed-off-by: Shrikrishna Khare <skhare@vmware.com> Reviewed-by: Shreyas N Bhatewara <sbhatewara@vmware.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15bridge: use MDBA_SET_ENTRY_MAX for maxtype in nlmsg_parse()Nicolas Dichtel
This is just a cleanup, because in the current code MDBA_SET_ENTRY_MAX == MDBA_SET_ENTRY. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15net: smc91x: Add Atari EtherNAT supportMichael Schmitz
Add Atari specific code to the smc91x Ethernet driver. This code is used on the EtherNAT adapter card for the Atari Falcon extension port. Signed-off-by: Michael Schmitz <schmitz@debian.org> Tested-by: Christian Steigies <cts@debian.org> [geert: Sort Kconfig entries, split in hard and soft dependencies] Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Nicolas Pitre <nico@fluxnic.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15Merge tag 'mac80211-next-for-davem-2015-01-15' of ↵David S. Miller
git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Here's a big pile of changes for this round. We have * a lot of regulatory code changes to deal with the way newer Intel devices handle this * a change to drop packets while disconnecting from an AP instead of trying to wait for them * a new attempt at improving the tailroom accounting to not kick in too much for performance reasons * improvements in wireless link statistics * many other small improvements and small fixes that didn't seem necessary for 3.19 (e.g. in hwsim which is testing only code) Conflicts: drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c Minor overlapping changes. Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15Merge branch 'cxgb4-next'David S. Miller
Anish Bhatt says: ==================== cxgb4/cxgb4i : Update & use ipv6 handling api This patch series consolidates and updates the ipv6 api, as well as exports it for use by upper level drivers dependent on cxgb4 v2: Fix formatting issues in clip_tbl.c ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15cxgb4i : Call into recently added cxgb4 ipv6 apiAnish Bhatt
Get a reference on every ipv6 address we offload to hardware so that it cannot be prematurely cleared out before cleanup. Signed-off-by: Anish Bhatt <anish@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15cxgb4 : Update ipv6 address handling apiAnish Bhatt
This patch improves on previously added support for ipv6 addresses. The code is consolidated to a single file and adds an api for use by dependent upper level drivers such as cxgb4i/iw_cxgb4 etc. Signed-off-by: Anish Bhatt <anish@chelsio.com> Signed-off-by: Deepak Singh <deepak.s@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15ipv4: per cpu uncached listEric Dumazet
RAW sockets with hdrinc suffer from contention on rt_uncached_lock spinlock. One solution is to use percpu lists, since most routes are destroyed by the cpu that created them. It is unclear why we even have to put these routes in uncached_list, as all outgoing packets should be freed when a device is dismantled. Signed-off-by: Eric Dumazet <edumazet@google.com> Fixes: caacf05e5ad1 ("ipv4: Properly purge netdev references on uncached routes.") Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15Bluetooth: Add paranoid check for existing LE and BR/EDR SMP channelsMarcel Holtmann
When the SMP channels have been already registered, then print out a clear WARN_ON message that something went wrong. Also unregister the existing channels in this case before trying to register new ones. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-01-15net: sh_eth: Use u32 for 32-bit register dataGeert Uytterhoeven
Replace "unsigned long" by "u32" when handling 32-bit register data. A.o., this saves 11 * 36 bytes in the static sh_eth_cpu_data structures when compiling for 64-bit. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15dm9000: Add regulator and reset support to dm9000Zubair Lutfullah Kakakhel
In boards, the dm9000 chip's power and reset can be controlled by gpio. It makes sense to add them to the dm9000 driver and let dt be used to enable power and reset the phy. Signed-off-by: Zubair Lutfullah Kakakhel <Zubair.Kakakhel@imgtec.com> Signed-off-by: Paul Burton <paul.burton@imgtec.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15socket: use iov_length()Nicolas Dichtel
Better to use available helpers. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15Bluetooth: Fix lookup of fixed channels by local bdaddrJohan Hedberg
The comparing of chan->src should always be done against the local identity address, represented by hcon->src and hcon->src_type. This patch modifies l2cap_global_fixed_chan() to take the full hci_conn so that we can easily compare against hcon->src and hcon->src_type. Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-01-15Bluetooth: Add helpers for src/dst bdaddr type conversionJohan Hedberg
The current bdaddr_type() usage in l2cap_core.c is a bit funny in that it's always passed a hci_conn + a hci_conn member. Because of this only the hci_conn is really needed. Since the second parameter is always either hcon->src_type or hcon->dst type this patch adds two helper functions for each purpose: bdaddr_src_type() and bdaddr_dst_type(). Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-01-15Bluetooth: Bind the SMP channel registration to management power stateMarcel Holtmann
When the controller gets powered on via the management interface, then register the supported SMP channels. There is no point in registering these channels earlier since it is not know what identity address the controller is going to operate with. When powering down a controller unregister all SMP channels. This is required since a powered down controller is allowed to change its identity address. In addition the SMP channels are only available when the controller is powered via the management interface. When using legacy ioctl, then Bluetooth Low Energy is not supported and registering kernel side SMP integration may actually cause confusion. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-01-15Bluetooth: Don't register any SMP channel if LE is not supportedMarcel Holtmann
When LE features are not supported, then do not bother registering any kind of SMP channel. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-01-15Bluetooth: Fix LE SMP channel source address and source address typeMarcel Holtmann
The source address and source address type of the LE SMP channel can either be the public address of the controller or the static random address configured by the host. Right now the public address is used for the LE SMP channel and obviously that is not correct if the controller operates with the configured static random address. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-01-15Bluetooth: Fix issue with switching BR/EDR back on when disabledMarcel Holtmann
For dual-mode controllers it is possible to disable BR/EDR and operate as LE single mode controllers with a static random address. If that is the case, then refuse switching BR/EDR back on after the controller has been powered. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-01-15Bluetooth: Show device address type for L2CAP debugfs entriesMarcel Holtmann
The devices address types are BR/EDR Public, LE Public and LE Random and any of these three is valid for L2CAP connections. So show the correct type in the debugfs list. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2015-01-15Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-nextDavid S. Miller
Pablo Neira Ayuso says: ==================== netfilter updates for net-next The following patchset contains netfilter updates for net-next, just a bunch of cleanups and small enhancement to selectively flush conntracks in ctnetlink, more specifically the patches are: 1) Rise default number of buckets in conntrack from 16384 to 65536 in systems with >= 4GBytes, patch from Marcelo Leitner. 2) Small refactor to save one level on indentation in xt_osf, from Joe Perches. 3) Remove unnecessary sizeof(char) in nf_log, from Fabian Frederick. 4) Another small cleanup to remove redundant variable in nfnetlink, from Duan Jiong. 5) Fix compilation warning in nfnetlink_cthelper on parisc, from Chen Gang. 6) Fix wrong format in debugging for ctseqadj, from Gao feng. 7) Selective conntrack flushing through the mark for ctnetlink, patch from Kristian Evensen. 8) Remove nf_ct_conntrack_flush_report() exported symbol now that is not required anymore after the selective flushing patch, again from Kristian. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15Merge branch 'vxlan_group_policy_extension'David S. Miller
Thomas Graf says: ==================== VXLAN Group Policy Extension Implements supports for the Group Policy VXLAN extension [0] to provide a lightweight and simple security label mechanism across network peers based on VXLAN. The security context and associated metadata is mapped to/from skb->mark. This allows further mapping to a SELinux context using SECMARK, to implement ACLs directly with nftables, iptables, OVS, tc, etc. The extension is disabled by default and should be run on a distinct port in mixed Linux VXLAN VTEP environments. Liberal VXLAN VTEPs which ignore unknown reserved bits will be able to receive VXLAN-GBP frames. Simple usage example: 10.1.1.1: # ip link add vxlan0 type vxlan id 10 remote 10.1.1.2 gbp # iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200 10.1.1.2: # ip link add vxlan0 type vxlan id 10 remote 10.1.1.1 gbp # iptables -I INPUT -m mark --mark 0x200 -j DROP iproute2 [1] and OVS [2] support will be provided in separate patches. [0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy [1] https://github.com/tgraf/iproute2/tree/vxlan-gbp [2] https://github.com/tgraf/ovs/tree/vxlan-gbp ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15openvswitch: Support VXLAN Group Policy extensionThomas Graf
Introduces support for the group policy extension to the VXLAN virtual port. The extension is disabled by default and only enabled if the user has provided the respective configuration. ovs-vsctl add-port br0 vxlan0 -- \ set Interface vxlan0 type=vxlan options:exts=gbp The configuration interface to enable the extension is based on a new attribute OVS_VXLAN_EXT_GBP nested inside OVS_TUNNEL_ATTR_EXTENSION which can carry additional extensions as needed in the future. The group policy metadata is stored as binary blob (struct ovs_vxlan_opts) internally just like Geneve options but transported as nested Netlink attributes to user space. Renames the existing TUNNEL_OPTIONS_PRESENT to TUNNEL_GENEVE_OPT with the binary value kept intact, a new flag TUNNEL_VXLAN_OPT is introduced. The attributes OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS and existing OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS are implemented mutually exclusive. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15openvswitch: Allow for any level of nesting in flow attributesThomas Graf
nlattr_set() is currently hardcoded to two levels of nesting. This change introduces struct ovs_len_tbl to define minimal length requirements plus next level nesting tables to traverse the key attributes to arbitrary depth. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15openvswitch: Rename GENEVE_TUN_OPTS() to TUN_METADATA_OPTS()Thomas Graf
Also factors out Geneve validation code into a new separate function validate_and_copy_geneve_opts(). A subsequent patch will introduce VXLAN options. Rename the existing GENEVE_TUN_OPTS() to reflect its extended purpose of carrying generic tunnel metadata options. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15vxlan: Only bind to sockets with compatible flags enabledThomas Graf
A VXLAN net_device looking for an appropriate socket may only consider a socket which has a matching set of flags/extensions enabled. If incompatible flags are enabled, return a conflict to have the caller create a distinct socket with distinct port. The OVS VXLAN port is kept unaware of extensions at this point. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15vxlan: Group Policy extensionThomas Graf
Implements supports for the Group Policy VXLAN extension [0] to provide a lightweight and simple security label mechanism across network peers based on VXLAN. The security context and associated metadata is mapped to/from skb->mark. This allows further mapping to a SELinux context using SECMARK, to implement ACLs directly with nftables, iptables, OVS, tc, etc. The group membership is defined by the lower 16 bits of skb->mark, the upper 16 bits are used for flags. SELinux allows to manage label to secure local resources. However, distributed applications require ACLs to implemented across hosts. This is typically achieved by matching on L2-L4 fields to identify the original sending host and process on the receiver. On top of that, netlabel and specifically CIPSO [1] allow to map security contexts to universal labels. However, netlabel and CIPSO are relatively complex. This patch provides a lightweight alternative for overlay network environments with a trusted underlay. No additional control protocol is required. Host 1: Host 2: Group A Group B Group B Group A +-----+ +-------------+ +-------+ +-----+ | lxc | | SELinux CTX | | httpd | | VM | +--+--+ +--+----------+ +---+---+ +--+--+ \---+---/ \----+---/ | | +---+---+ +---+---+ | vxlan | | vxlan | +---+---+ +---+---+ +------------------------------+ Backwards compatibility: A VXLAN-GBP socket can receive standard VXLAN frames and will assign the default group 0x0000 to such frames. A Linux VXLAN socket will drop VXLAN-GBP frames. The extension is therefore disabled by default and needs to be specifically enabled: ip link add [...] type vxlan [...] gbp In a mixed environment with VXLAN and VXLAN-GBP sockets, the GBP socket must run on a separate port number. Examples: iptables: host1# iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200 host2# iptables -I INPUT -m mark --mark 0x200 -j DROP OVS: # ovs-ofctl add-flow br0 'in_port=1,actions=load:0x200->NXM_NX_TUN_GBP_ID[],NORMAL' # ovs-ofctl add-flow br0 'in_port=2,tun_gbp_id=0x200,actions=drop' [0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy [1] http://lwn.net/Articles/204905/ Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-15Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller
Conflicts: drivers/net/xen-netfront.c Minor overlapping changes in xen-netfront.c, mostly to do with some buffer management changes alongside the split of stats into TX and RX. Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-29 09:15:14 +0000