From 8d497b65704f62294a4bbc0e1f5aa4eb1dbf9e24 Mon Sep 17 00:00:00 2001 From: Alexander Couzens Date: Tue, 1 Jun 2021 21:09:26 +0000 Subject: [PATCH 01/11] ramips: add support for minew g1-c The minew g1-c is a smart home gateway / BLE gateway. A Nordic nRF52832 is available via USB UART (cp210x) to support BLE. The LED ring is a ring of 24x ws2812b connect to a generic GPIO (unsupported). There is a small LED which is only visible when the device is open which will be used as LED until the ws2812b is supported. The board has also a micro sdcard/tfcard slot (untested). The Nordic nRF52832 exposes SWD over a 5pin header (GND, VCC, SWD, SWC, RST). The vendor uses an older OpenWrt version, sysupgrade can be used via serial or ssh. CPU: MT7628AN / 580MHz RAM: DDR2 128 MiB RAM Flash: SPI NOR 16 MiB W25Q128 Ethernet: 1x 100 mbit (Port 0) (PoE in) USB: USB hub, 2x external, 1x internal to USB UART Power: via micro usb or PoE 802.11af UART: 3.3V, 115200 8n1 Signed-off-by: Alexander Couzens --- .../linux/ramips/dts/mt7628an_minew_g1-c.dts | 146 ++++++++++++++++++ target/linux/ramips/image/mt76x8.mk | 8 + .../mt76x8/base-files/etc/board.d/02_network | 5 + 3 files changed, 159 insertions(+) create mode 100644 target/linux/ramips/dts/mt7628an_minew_g1-c.dts diff --git a/target/linux/ramips/dts/mt7628an_minew_g1-c.dts b/target/linux/ramips/dts/mt7628an_minew_g1-c.dts new file mode 100644 index 0000000000..74ea47aee0 --- /dev/null +++ b/target/linux/ramips/dts/mt7628an_minew_g1-c.dts @@ -0,0 +1,146 @@ +// SPDX-License-Identifier: GPL-2.0-or-later OR MIT + +#include "mt7628an.dtsi" + +#include +#include + +/ { + model = "Minew G1-C"; + compatible = "minew,g1-c", "mediatek,mt7628an-soc"; + + aliases { + led-boot = &led_system; + led-failsafe = &led_system; + led-running = &led_system; + led-upgrade = &led_system; + }; + + chosen { + bootargs = "console=ttyS0,57600"; + }; + + memory@0 { + device_type = "memory"; + reg = <0x0 0x8000000>; + }; + + keys { + compatible = "gpio-keys-polled"; + poll-interval = <20>; + + reset { + label = "reset"; + gpios = <&gpio 38 GPIO_ACTIVE_LOW>; + linux,code = ; + }; + }; + + leds { + compatible = "gpio-leds"; + + led_system: system { + label = "red:system"; + gpios = <&gpio 43 GPIO_ACTIVE_HIGH>; + default-state = "on"; + }; + }; + + gpio-export { + compatible = "gpio-export"; + #size-cells = <0>; + + ws2812 { + gpio-export,name = "ws2812"; + gpio-export,output = <1>; + gpios = <&gpio 11 GPIO_ACTIVE_HIGH>; + }; + + nrf_power { + gpio-export,name = "nrf_power"; + gpio-export,output = <1>; + gpios = <&gpio 45 GPIO_ACTIVE_HIGH>; + }; + }; +}; + +&state_default { + gpio { + groups = "gpio"; + function = "gpio"; + }; + + p0led_an { + groups = "p0led_an"; + function = "gpio"; + }; + + uart1 { + groups = "uart1"; + function = "gpio"; + }; + + wdt { + groups = "wdt"; + function = "gpio"; + }; +}; + +&spi0 { + status = "okay"; + + pinctrl-names = "default"; + pinctrl-0 = <&spi_pins>, <&spi_cs1_pins>; + + m25p80@0 { + compatible = "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <40000000>; + + partitions { + compatible = "fixed-partitions"; + #address-cells = <1>; + #size-cells = <1>; + + partition@0 { + label = "u-boot"; + reg = <0x0 0x30000>; + read-only; + }; + + partition@30000 { + label = "u-boot-env"; + reg = <0x30000 0x10000>; + }; + + factory: partition@40000 { + label = "factory"; + reg = <0x40000 0x10000>; + read-only; + }; + + partition@50000 { + compatible = "denx,uimage"; + label = "firmware"; + reg = <0x50000 0xfb0000>; + }; + }; + }; +}; + +ðernet { + mtd-mac-address = <&factory 0x28>; +}; + +&esw { + mediatek,portmap = <0x3e>; +}; + +&wmac { + status = "okay"; +}; + +&sdhci { + status = "okay"; + mediatek,cd-high; +}; diff --git a/target/linux/ramips/image/mt76x8.mk b/target/linux/ramips/image/mt76x8.mk index 3ba4d658be..3f738fc488 100644 --- a/target/linux/ramips/image/mt76x8.mk +++ b/target/linux/ramips/image/mt76x8.mk @@ -269,6 +269,14 @@ define Device/mercury_mac1200r-v2 endef TARGET_DEVICES += mercury_mac1200r-v2 +define Device/minew_g1-c + IMAGE_SIZE := 15744k + DEVICE_VENDOR := Minew + DEVICE_MODEL := G1-C + DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport kmod-usb-serial-cp210x +endef +TARGET_DEVICES += minew_g1-c + define Device/netgear_r6020 $(Device/netgear_sercomm_nor) IMAGE_SIZE := 7104k diff --git a/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network b/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network index 703936f217..032d7e75b2 100644 --- a/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network +++ b/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network @@ -32,6 +32,11 @@ ramips_setup_interfaces() ucidef_add_switch_attr "switch0" "enable" "false" ucidef_set_interface_lan "eth0" ;; + minew,g1-c) + ucidef_add_switch "switch0" + ucidef_add_switch_attr "switch0" "enable" "false" + ucidef_set_interface_lan "eth0" "dhcp" + ;; asus,rt-n10p-v3|\ asus,rt-n11p-b1|\ asus,rt-n12-vp-b1|\ From e4cfefa9fc3d22da5705b554785ba9c533c373d0 Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Thu, 1 Jul 2021 19:50:22 +0100 Subject: [PATCH 02/11] dnsmasq: use local option for local domain parameter '--local' is a synonym for '--server' so let's use '--local' in the resultant config file for uci's 'local' instead of uci's local parameter being turned into '--server'. Slightly less confusion all round. Signed-off-by: Kevin Darbyshire-Bryant --- package/network/services/dnsmasq/files/dnsmasq.init | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/network/services/dnsmasq/files/dnsmasq.init b/package/network/services/dnsmasq/files/dnsmasq.init index c4c262ad69..f86b4b04f3 100644 --- a/package/network/services/dnsmasq/files/dnsmasq.init +++ b/package/network/services/dnsmasq/files/dnsmasq.init @@ -915,7 +915,7 @@ dnsmasq_start() append_parm "$cfg" "minport" "--min-port" append_parm "$cfg" "maxport" "--max-port" append_parm "$cfg" "domain" "--domain" - append_parm "$cfg" "local" "--server" + append_parm "$cfg" "local" "--local" config_list_foreach "$cfg" "listen_address" append_listenaddress config_list_foreach "$cfg" "server" append_server config_list_foreach "$cfg" "rev_server" append_rev_server From 64ce35bfafb14a0d0e86990037be5c437babead0 Mon Sep 17 00:00:00 2001 From: Ansuel Smith Date: Tue, 6 Jul 2021 00:59:40 +0200 Subject: [PATCH 03/11] scripts: check if dl directory exist in dl_cleanup script Check if the provided dl directory exist and return on error. Signed-off-by: Ansuel Smith --- scripts/dl_cleanup.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/dl_cleanup.py b/scripts/dl_cleanup.py index d086761dc7..1acb049582 100755 --- a/scripts/dl_cleanup.py +++ b/scripts/dl_cleanup.py @@ -169,6 +169,11 @@ def main(argv): usage() return 1 directory = args[0] + + if not os.path.exists(directory): + print("Can't find dl path", directory) + return 1 + for (o, v) in opts: if o in ("-h", "--help"): usage() From 398df6275674b637bc950e4f946f84c2bc5e09ff Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sat, 26 Jun 2021 00:01:07 +0200 Subject: [PATCH 04/11] hostapd: report bssid, ssid and channel over ubus Imports a function from iw to convert frequencies to channel numbers. Co-authored-by: David Bauer Signed-off-by: Martin Weinelt [fix potential out of bounds read] Signed-off-by: David Bauer --- .../services/hostapd/src/src/ap/ubus.c | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c index 7cc2059fc1..289c8ff7a4 100644 --- a/package/network/services/hostapd/src/src/ap/ubus.c +++ b/package/network/services/hostapd/src/src/ap/ubus.c @@ -372,6 +372,32 @@ hostapd_bss_get_features(struct ubus_context *ctx, struct ubus_object *obj, return 0; } +/* Imported from iw/util.c + * https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/tree/util.c?id=4b25ae3537af48dbf9d0abf94132e5ba01b32c18#n200 + */ +int ieee80211_frequency_to_channel(int freq) +{ + /* see 802.11-2007 17.3.8.3.2 and Annex J */ + if (freq == 2484) + return 14; + /* see 802.11ax D6.1 27.3.23.2 and Annex E */ + else if (freq == 5935) + return 2; + else if (freq < 2484) + return (freq - 2407) / 5; + else if (freq >= 4910 && freq <= 4980) + return (freq - 4000) / 5; + else if (freq < 5950) + return (freq - 5000) / 5; + else if (freq <= 45000) /* DMG band lower limit */ + /* see 802.11ax D6.1 27.3.23.2 */ + return (freq - 5950) / 5; + else if (freq >= 58320 && freq <= 70200) + return (freq - 56160) / 2160; + else + return 0; +} + static int hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj, struct ubus_request_data *req, const char *method, @@ -380,12 +406,24 @@ hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj, struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj); void *airtime_table, *dfs_table; struct os_reltime now; + char ssid[SSID_MAX_LEN + 1]; char phy_name[17]; char mac_buf[20]; + size_t ssid_len = SSID_MAX_LEN; + + if (hapd->conf->ssid.ssid_len < SSID_MAX_LEN) + ssid_len = hapd->conf->ssid.ssid_len; blob_buf_init(&b, 0); blobmsg_add_string(&b, "status", hostapd_state_text(hapd->iface->state)); + blobmsg_printf(&b, "bssid", MACSTR, MAC2STR(hapd->conf->bssid)); + + memset(ssid, 0, SSID_MAX_LEN + 1); + memcpy(ssid, hapd->conf->ssid.ssid, ssid_len); + blobmsg_add_string(&b, "ssid", ssid); + blobmsg_add_u32(&b, "freq", hapd->iface->freq); + blobmsg_add_u32(&b, "channel", ieee80211_frequency_to_channel(hapd->iface->freq)); snprintf(phy_name, 17, "%s", hapd->iface->phy); blobmsg_add_string(&b, "phy", phy_name); From cde154c8712255d13658317b116d4fc341ed89f2 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sat, 26 Jun 2021 00:01:08 +0200 Subject: [PATCH 05/11] hostapd: remove unused mac_buff allocation Signed-off-by: Martin Weinelt --- package/network/services/hostapd/src/src/ap/ubus.c | 1 - 1 file changed, 1 deletion(-) diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c index 289c8ff7a4..fb568f9e7b 100644 --- a/package/network/services/hostapd/src/src/ap/ubus.c +++ b/package/network/services/hostapd/src/src/ap/ubus.c @@ -408,7 +408,6 @@ hostapd_bss_get_status(struct ubus_context *ctx, struct ubus_object *obj, struct os_reltime now; char ssid[SSID_MAX_LEN + 1]; char phy_name[17]; - char mac_buf[20]; size_t ssid_len = SSID_MAX_LEN; if (hapd->conf->ssid.ssid_len < SSID_MAX_LEN) From b0483b19f981bbe024cd447cfe469765f49cc587 Mon Sep 17 00:00:00 2001 From: David Bauer Date: Wed, 30 Jun 2021 00:12:00 +0200 Subject: [PATCH 06/11] hostapd: add HE flag to get_clients Expose the hostapd HE flag via ubus to indicate HE capable devices. Signed-off-by: David Bauer --- package/network/services/hostapd/src/src/ap/ubus.c | 1 + 1 file changed, 1 insertion(+) diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c index fb568f9e7b..6201dfd524 100644 --- a/package/network/services/hostapd/src/src/ap/ubus.c +++ b/package/network/services/hostapd/src/src/ap/ubus.c @@ -297,6 +297,7 @@ hostapd_bss_get_clients(struct ubus_context *ctx, struct ubus_object *obj, { "wmm", WLAN_STA_WMM }, { "ht", WLAN_STA_HT }, { "vht", WLAN_STA_VHT }, + { "he", WLAN_STA_HE }, { "wps", WLAN_STA_WPS }, { "mfp", WLAN_STA_MFP }, }; From 8a3f19023bc379d1ec1fdb0d768b24589f028e2e Mon Sep 17 00:00:00 2001 From: David Bauer Date: Tue, 6 Jul 2021 02:59:03 +0200 Subject: [PATCH 07/11] ath79: increase WS-AP3610 SPI frequency The M25P80 used on the Siemens WS-AP3610 supports clock speeds up to 54 MHz. Thus, we can safely increase the maximum SPI frequency the flash chip is controlled at to 50 MHz, increasing transfer speed. Signed-off-by: David Bauer --- target/linux/ath79/dts/ar7161_siemens_ws-ap3610.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/linux/ath79/dts/ar7161_siemens_ws-ap3610.dts b/target/linux/ath79/dts/ar7161_siemens_ws-ap3610.dts index 9eaf5aaa1d..2cdcce0d15 100644 --- a/target/linux/ath79/dts/ar7161_siemens_ws-ap3610.dts +++ b/target/linux/ath79/dts/ar7161_siemens_ws-ap3610.dts @@ -110,7 +110,7 @@ flash@0 { compatible = "jedec,spi-nor"; reg = <0>; - spi-max-frequency = <25000000>; + spi-max-frequency = <50000000>; partitions { compatible = "fixed-partitions"; From 5b58545f4470989b0e2243df5007e5fb29a85d21 Mon Sep 17 00:00:00 2001 From: David Bauer Date: Tue, 6 Jul 2021 03:07:58 +0200 Subject: [PATCH 08/11] ath79: increase SPI frequency for OCEDO boards The MX25L12805D used on all ath79 OCEDO boards supports clock speeds up to 50 MHz. Thus, we can increase the maximum SPI frequency the flash chip is controlled at to 50 MHz, increasing transfer speed. Signed-off-by: David Bauer --- target/linux/ath79/dts/ar9344_ocedo_raccoon.dts | 2 +- target/linux/ath79/dts/qca9558_ocedo_koala.dts | 2 +- target/linux/ath79/dts/qca9558_ocedo_ursus.dts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts b/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts index e7ef02054e..cf02b711fa 100644 --- a/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts +++ b/target/linux/ath79/dts/ar9344_ocedo_raccoon.dts @@ -72,7 +72,7 @@ flash@0 { compatible = "jedec,spi-nor"; reg = <0>; - spi-max-frequency = <25000000>; + spi-max-frequency = <50000000>; partitions { compatible = "fixed-partitions"; diff --git a/target/linux/ath79/dts/qca9558_ocedo_koala.dts b/target/linux/ath79/dts/qca9558_ocedo_koala.dts index aa3876acb1..fd54a6e8c2 100644 --- a/target/linux/ath79/dts/qca9558_ocedo_koala.dts +++ b/target/linux/ath79/dts/qca9558_ocedo_koala.dts @@ -69,7 +69,7 @@ flash@0 { compatible = "jedec,spi-nor"; reg = <0>; - spi-max-frequency = <25000000>; + spi-max-frequency = <50000000>; partitions { compatible = "fixed-partitions"; diff --git a/target/linux/ath79/dts/qca9558_ocedo_ursus.dts b/target/linux/ath79/dts/qca9558_ocedo_ursus.dts index dc8329f976..05c2d2d1dc 100644 --- a/target/linux/ath79/dts/qca9558_ocedo_ursus.dts +++ b/target/linux/ath79/dts/qca9558_ocedo_ursus.dts @@ -40,7 +40,7 @@ flash@0 { compatible = "jedec,spi-nor"; reg = <0>; - spi-max-frequency = <25000000>; + spi-max-frequency = <50000000>; partitions { compatible = "fixed-partitions"; From 0fac6f5562acca15f62f6484317ba4aca2de34be Mon Sep 17 00:00:00 2001 From: Alexander Couzens Date: Wed, 7 Jul 2021 17:57:45 +0200 Subject: [PATCH 09/11] ramips: minew g1-c: add the old device name to the supported devices Allow to use the sysupgrade image as factory image without additional force. Signed-off-by: Alexander Couzens --- target/linux/ramips/image/mt76x8.mk | 1 + 1 file changed, 1 insertion(+) diff --git a/target/linux/ramips/image/mt76x8.mk b/target/linux/ramips/image/mt76x8.mk index 3f738fc488..3f6f842db7 100644 --- a/target/linux/ramips/image/mt76x8.mk +++ b/target/linux/ramips/image/mt76x8.mk @@ -274,6 +274,7 @@ define Device/minew_g1-c DEVICE_VENDOR := Minew DEVICE_MODEL := G1-C DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport kmod-usb-serial-cp210x + SUPPORTED_DEVICES += minew-g1c endef TARGET_DEVICES += minew_g1-c From 64ed3d80567280e5cccb4c4642464223862dabc6 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Wed, 7 Jul 2021 17:36:21 +0200 Subject: [PATCH 10/11] kernel: backport a few upstream flow offloading fixes Signed-off-by: Felix Fietkau --- ...t-ethernet-mtk_eth_soc-missing-mutex.patch | 63 +++++++ ...t-mtk_eth_soc-handle-VLAN-pop-action.patch | 22 +++ ...ble-dst_check-from-garbage-collector.patch | 159 ++++++++++++++++++ ...ack-Introduce-tcp-offload-timeout-co.patch | 94 +++++++++++ ...ack-Introduce-udp-offload-timeout-co.patch | 92 ++++++++++ ...ble-Set-offload-timeouts-according-t.patch | 134 +++++++++++++++ ...-netfilter-add-xt_FLOWOFFLOAD-target.patch | 8 +- ...-netfilter_optional_tcp_window_check.patch | 4 +- 8 files changed, 570 insertions(+), 6 deletions(-) create mode 100644 target/linux/generic/backport-5.10/610-v5.13-52-net-ethernet-mtk_eth_soc-missing-mutex.patch create mode 100644 target/linux/generic/backport-5.10/610-v5.13-53-net-ethernet-mtk_eth_soc-handle-VLAN-pop-action.patch create mode 100644 target/linux/generic/backport-5.10/610-v5.13-54-netfilter-flowtable-dst_check-from-garbage-collector.patch create mode 100644 target/linux/generic/backport-5.10/610-v5.13-55-netfilter-conntrack-Introduce-tcp-offload-timeout-co.patch create mode 100644 target/linux/generic/backport-5.10/610-v5.13-56-netfilter-conntrack-Introduce-udp-offload-timeout-co.patch create mode 100644 target/linux/generic/backport-5.10/610-v5.13-57-netfilter-flowtable-Set-offload-timeouts-according-t.patch diff --git a/target/linux/generic/backport-5.10/610-v5.13-52-net-ethernet-mtk_eth_soc-missing-mutex.patch b/target/linux/generic/backport-5.10/610-v5.13-52-net-ethernet-mtk_eth_soc-missing-mutex.patch new file mode 100644 index 0000000000..a846ce43e2 --- /dev/null +++ b/target/linux/generic/backport-5.10/610-v5.13-52-net-ethernet-mtk_eth_soc-missing-mutex.patch @@ -0,0 +1,63 @@ +From: Pablo Neira Ayuso +Date: Sun, 18 Apr 2021 23:11:44 +0200 +Subject: [PATCH] net: ethernet: mtk_eth_soc: missing mutex + +Patch 2ed37183abb7 ("netfilter: flowtable: separate replace, destroy and +stats to different workqueues") splits the workqueue per event type. Add +a mutex to serialize updates. + +Fixes: 502e84e2382d ("net: ethernet: mtk_eth_soc: add flow offloading support") +Reported-by: Frank Wunderlich +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: David S. Miller +--- + +--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c +@@ -392,6 +392,8 @@ mtk_flow_offload_stats(struct mtk_eth *e + return 0; + } + ++static DEFINE_MUTEX(mtk_flow_offload_mutex); ++ + static int + mtk_eth_setup_tc_block_cb(enum tc_setup_type type, void *type_data, void *cb_priv) + { +@@ -399,6 +401,7 @@ mtk_eth_setup_tc_block_cb(enum tc_setup_ + struct net_device *dev = cb_priv; + struct mtk_mac *mac = netdev_priv(dev); + struct mtk_eth *eth = mac->hw; ++ int err; + + if (!tc_can_offload(dev)) + return -EOPNOTSUPP; +@@ -406,18 +409,24 @@ mtk_eth_setup_tc_block_cb(enum tc_setup_ + if (type != TC_SETUP_CLSFLOWER) + return -EOPNOTSUPP; + ++ mutex_lock(&mtk_flow_offload_mutex); + switch (cls->command) { + case FLOW_CLS_REPLACE: +- return mtk_flow_offload_replace(eth, cls); ++ err = mtk_flow_offload_replace(eth, cls); ++ break; + case FLOW_CLS_DESTROY: +- return mtk_flow_offload_destroy(eth, cls); ++ err = mtk_flow_offload_destroy(eth, cls); ++ break; + case FLOW_CLS_STATS: +- return mtk_flow_offload_stats(eth, cls); ++ err = mtk_flow_offload_stats(eth, cls); ++ break; + default: +- return -EOPNOTSUPP; ++ err = -EOPNOTSUPP; ++ break; + } ++ mutex_unlock(&mtk_flow_offload_mutex); + +- return 0; ++ return err; + } + + static int diff --git a/target/linux/generic/backport-5.10/610-v5.13-53-net-ethernet-mtk_eth_soc-handle-VLAN-pop-action.patch b/target/linux/generic/backport-5.10/610-v5.13-53-net-ethernet-mtk_eth_soc-handle-VLAN-pop-action.patch new file mode 100644 index 0000000000..806fd0dcdf --- /dev/null +++ b/target/linux/generic/backport-5.10/610-v5.13-53-net-ethernet-mtk_eth_soc-handle-VLAN-pop-action.patch @@ -0,0 +1,22 @@ +From: Pablo Neira Ayuso +Date: Sun, 18 Apr 2021 23:11:45 +0200 +Subject: [PATCH] net: ethernet: mtk_eth_soc: handle VLAN pop action + +Do not hit EOPNOTSUPP when flowtable offload provides a VLAN pop action. + +Fixes: efce49dfe6a8 ("netfilter: flowtable: add vlan pop action offload support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: David S. Miller +--- + +--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c +@@ -233,6 +233,8 @@ mtk_flow_offload_replace(struct mtk_eth + data.vlan.proto = act->vlan.proto; + data.vlan.num++; + break; ++ case FLOW_ACTION_VLAN_POP: ++ break; + case FLOW_ACTION_PPPOE_PUSH: + if (data.pppoe.num == 1) + return -EOPNOTSUPP; diff --git a/target/linux/generic/backport-5.10/610-v5.13-54-netfilter-flowtable-dst_check-from-garbage-collector.patch b/target/linux/generic/backport-5.10/610-v5.13-54-netfilter-flowtable-dst_check-from-garbage-collector.patch new file mode 100644 index 0000000000..42b55f021a --- /dev/null +++ b/target/linux/generic/backport-5.10/610-v5.13-54-netfilter-flowtable-dst_check-from-garbage-collector.patch @@ -0,0 +1,159 @@ +From: Pablo Neira Ayuso +Date: Sun, 28 Mar 2021 23:08:55 +0200 +Subject: [PATCH] netfilter: flowtable: dst_check() from garbage collector path + +Move dst_check() to the garbage collector path. Stale routes trigger the +flow entry teardown state which makes affected flows go back to the +classic forwarding path to re-evaluate flow offloading. + +IPv6 requires the dst cookie to work, store it in the flow_tuple, +otherwise dst_check() always fails. + +Fixes: e5075c0badaa ("netfilter: flowtable: call dst_check() to fall back to classic forwarding") +Signed-off-by: Pablo Neira Ayuso +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -129,7 +129,10 @@ struct flow_offload_tuple { + in_vlan_ingress:2; + u16 mtu; + union { +- struct dst_entry *dst_cache; ++ struct { ++ struct dst_entry *dst_cache; ++ u32 dst_cookie; ++ }; + struct { + u32 ifidx; + u32 hw_ifidx; +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -74,6 +74,18 @@ err_ct_refcnt: + } + EXPORT_SYMBOL_GPL(flow_offload_alloc); + ++static u32 flow_offload_dst_cookie(struct flow_offload_tuple *flow_tuple) ++{ ++ const struct rt6_info *rt; ++ ++ if (flow_tuple->l3proto == NFPROTO_IPV6) { ++ rt = (const struct rt6_info *)flow_tuple->dst_cache; ++ return rt6_get_cookie(rt); ++ } ++ ++ return 0; ++} ++ + static int flow_offload_fill_route(struct flow_offload *flow, + const struct nf_flow_route *route, + enum flow_offload_tuple_dir dir) +@@ -116,6 +128,7 @@ static int flow_offload_fill_route(struc + return -1; + + flow_tuple->dst_cache = dst; ++ flow_tuple->dst_cookie = flow_offload_dst_cookie(flow_tuple); + break; + } + flow_tuple->xmit_type = route->tuple[dir].xmit_type; +@@ -389,11 +402,33 @@ nf_flow_table_iterate(struct nf_flowtabl + return err; + } + ++static bool flow_offload_stale_dst(struct flow_offload_tuple *tuple) ++{ ++ struct dst_entry *dst; ++ ++ if (tuple->xmit_type == FLOW_OFFLOAD_XMIT_NEIGH || ++ tuple->xmit_type == FLOW_OFFLOAD_XMIT_XFRM) { ++ dst = tuple->dst_cache; ++ if (!dst_check(dst, tuple->dst_cookie)) ++ return true; ++ } ++ ++ return false; ++} ++ ++static bool nf_flow_has_stale_dst(struct flow_offload *flow) ++{ ++ return flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple) || ++ flow_offload_stale_dst(&flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple); ++} ++ + static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data) + { + struct nf_flowtable *flow_table = data; + +- if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct)) ++ if (nf_flow_has_expired(flow) || ++ nf_ct_is_dying(flow->ct) || ++ nf_flow_has_stale_dst(flow)) + set_bit(NF_FLOW_TEARDOWN, &flow->flags); + + if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) { +--- a/net/netfilter/nf_flow_table_ip.c ++++ b/net/netfilter/nf_flow_table_ip.c +@@ -364,15 +364,6 @@ nf_flow_offload_ip_hook(void *priv, stru + if (nf_flow_state_check(flow, iph->protocol, skb, thoff)) + return NF_ACCEPT; + +- if (tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_NEIGH || +- tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM) { +- rt = (struct rtable *)tuplehash->tuple.dst_cache; +- if (!dst_check(&rt->dst, 0)) { +- flow_offload_teardown(flow); +- return NF_ACCEPT; +- } +- } +- + if (skb_try_make_writable(skb, thoff + hdrsize)) + return NF_DROP; + +@@ -391,6 +382,7 @@ nf_flow_offload_ip_hook(void *priv, stru + nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len); + + if (unlikely(tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)) { ++ rt = (struct rtable *)tuplehash->tuple.dst_cache; + memset(skb->cb, 0, sizeof(struct inet_skb_parm)); + IPCB(skb)->iif = skb->dev->ifindex; + IPCB(skb)->flags = IPSKB_FORWARDED; +@@ -399,6 +391,7 @@ nf_flow_offload_ip_hook(void *priv, stru + + switch (tuplehash->tuple.xmit_type) { + case FLOW_OFFLOAD_XMIT_NEIGH: ++ rt = (struct rtable *)tuplehash->tuple.dst_cache; + outdev = rt->dst.dev; + skb->dev = outdev; + nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr); +@@ -607,15 +600,6 @@ nf_flow_offload_ipv6_hook(void *priv, st + if (nf_flow_state_check(flow, ip6h->nexthdr, skb, thoff)) + return NF_ACCEPT; + +- if (tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_NEIGH || +- tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM) { +- rt = (struct rt6_info *)tuplehash->tuple.dst_cache; +- if (!dst_check(&rt->dst, 0)) { +- flow_offload_teardown(flow); +- return NF_ACCEPT; +- } +- } +- + if (skb_try_make_writable(skb, thoff + hdrsize)) + return NF_DROP; + +@@ -633,6 +617,7 @@ nf_flow_offload_ipv6_hook(void *priv, st + nf_ct_acct_update(flow->ct, tuplehash->tuple.dir, skb->len); + + if (unlikely(tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)) { ++ rt = (struct rt6_info *)tuplehash->tuple.dst_cache; + memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); + IP6CB(skb)->iif = skb->dev->ifindex; + IP6CB(skb)->flags = IP6SKB_FORWARDED; +@@ -641,6 +626,7 @@ nf_flow_offload_ipv6_hook(void *priv, st + + switch (tuplehash->tuple.xmit_type) { + case FLOW_OFFLOAD_XMIT_NEIGH: ++ rt = (struct rt6_info *)tuplehash->tuple.dst_cache; + outdev = rt->dst.dev; + skb->dev = outdev; + nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6); diff --git a/target/linux/generic/backport-5.10/610-v5.13-55-netfilter-conntrack-Introduce-tcp-offload-timeout-co.patch b/target/linux/generic/backport-5.10/610-v5.13-55-netfilter-conntrack-Introduce-tcp-offload-timeout-co.patch new file mode 100644 index 0000000000..e5a346cac4 --- /dev/null +++ b/target/linux/generic/backport-5.10/610-v5.13-55-netfilter-conntrack-Introduce-tcp-offload-timeout-co.patch @@ -0,0 +1,94 @@ +From: Oz Shlomo +Date: Thu, 3 Jun 2021 15:12:33 +0300 +Subject: [PATCH] netfilter: conntrack: Introduce tcp offload timeout + configuration + +TCP connections may be offloaded from nf conntrack to nf flow table. +Offloaded connections are aged after 30 seconds of inactivity. +Once aged, ownership is returned to conntrack with a hard coded pickup +time of 120 seconds, after which the connection may be deleted. +eted. The current aging intervals may be too aggressive for some users. + +Provide users with the ability to control the nf flow table offload +aging and pickup time intervals via sysctl parameter as a pre-step for +configuring the nf flow table GC timeout intervals. + +Signed-off-by: Oz Shlomo +Reviewed-by: Paul Blakey +Signed-off-by: Pablo Neira Ayuso +--- + +--- a/include/net/netns/conntrack.h ++++ b/include/net/netns/conntrack.h +@@ -27,6 +27,10 @@ struct nf_tcp_net { + int tcp_loose; + int tcp_be_liberal; + int tcp_max_retrans; ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) ++ unsigned int offload_timeout; ++ unsigned int offload_pickup; ++#endif + }; + + enum udp_conntrack { +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -1438,6 +1438,11 @@ void nf_conntrack_tcp_init_net(struct ne + tn->tcp_loose = nf_ct_tcp_loose; + tn->tcp_be_liberal = nf_ct_tcp_be_liberal; + tn->tcp_max_retrans = nf_ct_tcp_max_retrans; ++ ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) ++ tn->offload_timeout = 30 * HZ; ++ tn->offload_pickup = 120 * HZ; ++#endif + } + + const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp = +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -567,6 +567,10 @@ enum nf_ct_sysctl_index { + NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_CLOSE, + NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_RETRANS, + NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_UNACK, ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) ++ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_OFFLOAD, ++ NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_OFFLOAD_PICKUP, ++#endif + NF_SYSCTL_CT_PROTO_TCP_LOOSE, + NF_SYSCTL_CT_PROTO_TCP_LIBERAL, + NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS, +@@ -758,6 +762,20 @@ static struct ctl_table nf_ct_sysctl_tab + .mode = 0644, + .proc_handler = proc_dointvec_jiffies, + }, ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) ++ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_OFFLOAD] = { ++ .procname = "nf_flowtable_tcp_timeout", ++ .maxlen = sizeof(unsigned int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_jiffies, ++ }, ++ [NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_OFFLOAD_PICKUP] = { ++ .procname = "nf_flowtable_tcp_pickup", ++ .maxlen = sizeof(unsigned int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_jiffies, ++ }, ++#endif + [NF_SYSCTL_CT_PROTO_TCP_LOOSE] = { + .procname = "nf_conntrack_tcp_loose", + .maxlen = sizeof(int), +@@ -967,6 +985,12 @@ static void nf_conntrack_standalone_init + XASSIGN(LIBERAL, &tn->tcp_be_liberal); + XASSIGN(MAX_RETRANS, &tn->tcp_max_retrans); + #undef XASSIGN ++ ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) ++ table[NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_OFFLOAD].data = &tn->offload_timeout; ++ table[NF_SYSCTL_CT_PROTO_TIMEOUT_TCP_OFFLOAD_PICKUP].data = &tn->offload_pickup; ++#endif ++ + } + + static void nf_conntrack_standalone_init_sctp_sysctl(struct net *net, diff --git a/target/linux/generic/backport-5.10/610-v5.13-56-netfilter-conntrack-Introduce-udp-offload-timeout-co.patch b/target/linux/generic/backport-5.10/610-v5.13-56-netfilter-conntrack-Introduce-udp-offload-timeout-co.patch new file mode 100644 index 0000000000..8a70f375ed --- /dev/null +++ b/target/linux/generic/backport-5.10/610-v5.13-56-netfilter-conntrack-Introduce-udp-offload-timeout-co.patch @@ -0,0 +1,92 @@ +From: Oz Shlomo +Date: Thu, 3 Jun 2021 15:12:34 +0300 +Subject: [PATCH] netfilter: conntrack: Introduce udp offload timeout + configuration + +UDP connections may be offloaded from nf conntrack to nf flow table. +Offloaded connections are aged after 30 seconds of inactivity. +Once aged, ownership is returned to conntrack with a hard coded pickup +time of 30 seconds, after which the connection may be deleted. +eted. The current aging intervals may be too aggressive for some users. + +Provide users with the ability to control the nf flow table offload +aging and pickup time intervals via sysctl parameter as a pre-step for +configuring the nf flow table GC timeout intervals. + +Signed-off-by: Oz Shlomo +Reviewed-by: Paul Blakey +Signed-off-by: Pablo Neira Ayuso +--- + +--- a/include/net/netns/conntrack.h ++++ b/include/net/netns/conntrack.h +@@ -41,6 +41,10 @@ enum udp_conntrack { + + struct nf_udp_net { + unsigned int timeouts[UDP_CT_MAX]; ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) ++ unsigned int offload_timeout; ++ unsigned int offload_pickup; ++#endif + }; + + struct nf_icmp_net { +--- a/net/netfilter/nf_conntrack_proto_udp.c ++++ b/net/netfilter/nf_conntrack_proto_udp.c +@@ -270,6 +270,11 @@ void nf_conntrack_udp_init_net(struct ne + + for (i = 0; i < UDP_CT_MAX; i++) + un->timeouts[i] = udp_timeouts[i]; ++ ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) ++ un->offload_timeout = 30 * HZ; ++ un->offload_pickup = 30 * HZ; ++#endif + } + + const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp = +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -576,6 +576,10 @@ enum nf_ct_sysctl_index { + NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS, + NF_SYSCTL_CT_PROTO_TIMEOUT_UDP, + NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM, ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) ++ NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD, ++ NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD_PICKUP, ++#endif + NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP, + NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6, + #ifdef CONFIG_NF_CT_PROTO_SCTP +@@ -810,6 +814,20 @@ static struct ctl_table nf_ct_sysctl_tab + .mode = 0644, + .proc_handler = proc_dointvec_jiffies, + }, ++#if IS_ENABLED(CONFIG_NFT_FLOW_OFFLOAD) ++ [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD] = { ++ .procname = "nf_flowtable_udp_timeout", ++ .maxlen = sizeof(unsigned int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_jiffies, ++ }, ++ [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD_PICKUP] = { ++ .procname = "nf_flowtable_udp_pickup", ++ .maxlen = sizeof(unsigned int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_jiffies, ++ }, ++#endif + [NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP] = { + .procname = "nf_conntrack_icmp_timeout", + .maxlen = sizeof(unsigned int), +@@ -1078,6 +1096,10 @@ static int nf_conntrack_standalone_init_ + table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6].data = &nf_icmpv6_pernet(net)->timeout; + table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP].data = &un->timeouts[UDP_CT_UNREPLIED]; + table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM].data = &un->timeouts[UDP_CT_REPLIED]; ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) ++ table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD].data = &un->offload_timeout; ++ table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD_PICKUP].data = &un->offload_pickup; ++#endif + + nf_conntrack_standalone_init_tcp_sysctl(net, table); + nf_conntrack_standalone_init_sctp_sysctl(net, table); diff --git a/target/linux/generic/backport-5.10/610-v5.13-57-netfilter-flowtable-Set-offload-timeouts-according-t.patch b/target/linux/generic/backport-5.10/610-v5.13-57-netfilter-flowtable-Set-offload-timeouts-according-t.patch new file mode 100644 index 0000000000..5410e2751a --- /dev/null +++ b/target/linux/generic/backport-5.10/610-v5.13-57-netfilter-flowtable-Set-offload-timeouts-according-t.patch @@ -0,0 +1,134 @@ +From: Oz Shlomo +Date: Thu, 3 Jun 2021 15:12:35 +0300 +Subject: [PATCH] netfilter: flowtable: Set offload timeouts according to proto + values + +Currently the aging period for tcp/udp connections is hard coded to +30 seconds. Aged tcp/udp connections configure a hard coded 120/30 +seconds pickup timeout for conntrack. +This configuration may be too aggressive or permissive for some users. + +Dynamically configure the nf flow table GC timeout intervals according +to the user defined values. + +Signed-off-by: Oz Shlomo +Reviewed-by: Paul Blakey +Signed-off-by: Pablo Neira Ayuso +--- + +--- a/include/net/netfilter/nf_flow_table.h ++++ b/include/net/netfilter/nf_flow_table.h +@@ -174,6 +174,8 @@ struct flow_offload { + #define NF_FLOW_TIMEOUT (30 * HZ) + #define nf_flowtable_time_stamp (u32)jiffies + ++unsigned long flow_offload_get_timeout(struct flow_offload *flow); ++ + static inline __s32 nf_flow_timeout_delta(unsigned int timeout) + { + return (__s32)(timeout - nf_flowtable_time_stamp); +--- a/net/netfilter/nf_flow_table_core.c ++++ b/net/netfilter/nf_flow_table_core.c +@@ -175,12 +175,10 @@ static void flow_offload_fixup_tcp(struc + tcp->seen[1].td_maxwin = 0; + } + +-#define NF_FLOWTABLE_TCP_PICKUP_TIMEOUT (120 * HZ) +-#define NF_FLOWTABLE_UDP_PICKUP_TIMEOUT (30 * HZ) +- + static void flow_offload_fixup_ct_timeout(struct nf_conn *ct) + { + const struct nf_conntrack_l4proto *l4proto; ++ struct net *net = nf_ct_net(ct); + int l4num = nf_ct_protonum(ct); + unsigned int timeout; + +@@ -188,12 +186,17 @@ static void flow_offload_fixup_ct_timeou + if (!l4proto) + return; + +- if (l4num == IPPROTO_TCP) +- timeout = NF_FLOWTABLE_TCP_PICKUP_TIMEOUT; +- else if (l4num == IPPROTO_UDP) +- timeout = NF_FLOWTABLE_UDP_PICKUP_TIMEOUT; +- else ++ if (l4num == IPPROTO_TCP) { ++ struct nf_tcp_net *tn = nf_tcp_pernet(net); ++ ++ timeout = tn->offload_pickup; ++ } else if (l4num == IPPROTO_UDP) { ++ struct nf_udp_net *tn = nf_udp_pernet(net); ++ ++ timeout = tn->offload_pickup; ++ } else { + return; ++ } + + if (nf_flow_timeout_delta(ct->timeout) > (__s32)timeout) + ct->timeout = nfct_time_stamp + timeout; +@@ -265,11 +268,35 @@ static const struct rhashtable_params nf + .automatic_shrinking = true, + }; + ++unsigned long flow_offload_get_timeout(struct flow_offload *flow) ++{ ++ const struct nf_conntrack_l4proto *l4proto; ++ unsigned long timeout = NF_FLOW_TIMEOUT; ++ struct net *net = nf_ct_net(flow->ct); ++ int l4num = nf_ct_protonum(flow->ct); ++ ++ l4proto = nf_ct_l4proto_find(l4num); ++ if (!l4proto) ++ return timeout; ++ ++ if (l4num == IPPROTO_TCP) { ++ struct nf_tcp_net *tn = nf_tcp_pernet(net); ++ ++ timeout = tn->offload_timeout; ++ } else if (l4num == IPPROTO_UDP) { ++ struct nf_udp_net *tn = nf_udp_pernet(net); ++ ++ timeout = tn->offload_timeout; ++ } ++ ++ return timeout; ++} ++ + int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) + { + int err; + +- flow->timeout = nf_flowtable_time_stamp + NF_FLOW_TIMEOUT; ++ flow->timeout = nf_flowtable_time_stamp + flow_offload_get_timeout(flow); + + err = rhashtable_insert_fast(&flow_table->rhashtable, + &flow->tuplehash[0].node, +@@ -301,7 +328,7 @@ EXPORT_SYMBOL_GPL(flow_offload_add); + void flow_offload_refresh(struct nf_flowtable *flow_table, + struct flow_offload *flow) + { +- flow->timeout = nf_flowtable_time_stamp + NF_FLOW_TIMEOUT; ++ flow->timeout = nf_flowtable_time_stamp + flow_offload_get_timeout(flow); + + if (likely(!nf_flowtable_hw_offload(flow_table))) + return; +--- a/net/netfilter/nf_flow_table_offload.c ++++ b/net/netfilter/nf_flow_table_offload.c +@@ -885,7 +885,7 @@ static void flow_offload_work_stats(stru + + lastused = max_t(u64, stats[0].lastused, stats[1].lastused); + offload->flow->timeout = max_t(u64, offload->flow->timeout, +- lastused + NF_FLOW_TIMEOUT); ++ lastused + flow_offload_get_timeout(offload->flow)); + + if (offload->flowtable->flags & NF_FLOWTABLE_COUNTER) { + if (stats[0].pkts) +@@ -989,7 +989,7 @@ void nf_flow_offload_stats(struct nf_flo + __s32 delta; + + delta = nf_flow_timeout_delta(flow->timeout); +- if ((delta >= (9 * NF_FLOW_TIMEOUT) / 10)) ++ if ((delta >= (9 * flow_offload_get_timeout(flow)) / 10)) + return; + + offload = nf_flow_offload_work_alloc(flowtable, flow, FLOW_CLS_STATS); diff --git a/target/linux/generic/hack-5.10/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-5.10/650-netfilter-add-xt_FLOWOFFLOAD-target.patch index 44e897f10a..77c24ccc7a 100644 --- a/target/linux/generic/hack-5.10/650-netfilter-add-xt_FLOWOFFLOAD-target.patch +++ b/target/linux/generic/hack-5.10/650-netfilter-add-xt_FLOWOFFLOAD-target.patch @@ -767,7 +767,7 @@ Signed-off-by: Felix Fietkau #include #include #include -@@ -355,8 +354,7 @@ flow_offload_lookup(struct nf_flowtable +@@ -395,8 +394,7 @@ flow_offload_lookup(struct nf_flowtable } EXPORT_SYMBOL_GPL(flow_offload_lookup); @@ -777,13 +777,13 @@ Signed-off-by: Felix Fietkau void (*iter)(struct flow_offload *flow, void *data), void *data) { -@@ -388,6 +386,7 @@ nf_flow_table_iterate(struct nf_flowtabl +@@ -428,6 +426,7 @@ nf_flow_table_iterate(struct nf_flowtabl return err; } +EXPORT_SYMBOL_GPL(nf_flow_table_iterate); - static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data) + static bool flow_offload_stale_dst(struct flow_offload_tuple *tuple) { --- /dev/null +++ b/include/uapi/linux/netfilter/xt_FLOWOFFLOAD.h @@ -807,7 +807,7 @@ Signed-off-by: Felix Fietkau +#endif /* _XT_FLOWOFFLOAD_H */ --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h -@@ -265,6 +265,10 @@ void nf_flow_table_free(struct nf_flowta +@@ -270,6 +270,10 @@ void nf_flow_table_free(struct nf_flowta void flow_offload_teardown(struct flow_offload *flow); diff --git a/target/linux/generic/pending-5.10/613-netfilter_optional_tcp_window_check.patch b/target/linux/generic/pending-5.10/613-netfilter_optional_tcp_window_check.patch index b70ef886b1..97e449510d 100644 --- a/target/linux/generic/pending-5.10/613-netfilter_optional_tcp_window_check.patch +++ b/target/linux/generic/pending-5.10/613-netfilter_optional_tcp_window_check.patch @@ -49,7 +49,7 @@ Signed-off-by: Felix Fietkau static bool enable_hooks __read_mostly; MODULE_PARM_DESC(enable_hooks, "Always enable conntrack hooks"); module_param(enable_hooks, bool, 0000); -@@ -652,6 +655,7 @@ enum nf_ct_sysctl_index { +@@ -660,6 +663,7 @@ enum nf_ct_sysctl_index { NF_SYSCTL_CT_PROTO_TIMEOUT_GRE_STREAM, #endif @@ -57,7 +57,7 @@ Signed-off-by: Felix Fietkau __NF_SYSCTL_CT_LAST_SYSCTL, }; -@@ -978,6 +982,13 @@ static struct ctl_table nf_ct_sysctl_tab +@@ -1014,6 +1018,13 @@ static struct ctl_table nf_ct_sysctl_tab .proc_handler = proc_dointvec_jiffies, }, #endif From f4e3ff5b075bbab279bd06a7d3e0d9c950ee098c Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Thu, 8 Jul 2021 07:32:39 +0200 Subject: [PATCH 11/11] mediatek: prevent duplicate hardware flow offload entries Signed-off-by: Felix Fietkau --- ..._eth_soc-avoid-creating-duplicate-of.patch | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 target/linux/generic/pending-5.10/700-net-ethernet-mtk_eth_soc-avoid-creating-duplicate-of.patch diff --git a/target/linux/generic/pending-5.10/700-net-ethernet-mtk_eth_soc-avoid-creating-duplicate-of.patch b/target/linux/generic/pending-5.10/700-net-ethernet-mtk_eth_soc-avoid-creating-duplicate-of.patch new file mode 100644 index 0000000000..ff090f07f1 --- /dev/null +++ b/target/linux/generic/pending-5.10/700-net-ethernet-mtk_eth_soc-avoid-creating-duplicate-of.patch @@ -0,0 +1,26 @@ +From: Felix Fietkau +Date: Thu, 8 Jul 2021 07:08:29 +0200 +Subject: [PATCH] net: ethernet: mtk_eth_soc: avoid creating duplicate offload + entries + +Sometimes multiple CLS_REPLACE calls are issued for the same connection. +rhashtable_insert_fast does not check for these duplicates, so multiple +hardware flow entries can be created. +Fix this by checking for an existing entry early + +Fixes: 502e84e2382d ("net: ethernet: mtk_eth_soc: add flow offloading support") +Signed-off-by: Felix Fietkau +--- + +--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c ++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c +@@ -187,6 +187,9 @@ mtk_flow_offload_replace(struct mtk_eth + int hash; + int i; + ++ if (rhashtable_lookup(ð->flow_table, &f->cookie, mtk_flow_ht_params)) ++ return -EEXIST; ++ + if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META)) { + struct flow_match_meta match; +