linux-next: manual merge of the netfilter-next tree with the net tree

linux-next: manual merge of the netfilter-next tree with the net tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1765 bytes --]

Hi all,

Today's linux-next merge of the netfilter-next tree got a conflict in:

  include/net/netfilter/nf_tables_core.h

between commit:

  e240cd0df481 ("netfilter: nf_tables: place all set backends in one single module")

from the net tree and commit:

  da8f7d227adc ("netfilter: nf_tables: handle meta/lookup with direct call")

from the netfilter-next tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

-- 
Cheers,
Stephen Rothwell

diff --cc include/net/netfilter/nf_tables_core.h
index a05134507e7b,0096f65096b5..000000000000
--- a/include/net/netfilter/nf_tables_core.h
+++ b/include/net/netfilter/nf_tables_core.h
@@@ -65,10 -65,11 +65,17 @@@ extern const struct nft_expr_ops nft_pa
  extern struct static_key_false nft_counters_enabled;
  extern struct static_key_false nft_trace_enabled;
  
 +extern struct nft_set_type nft_set_rhash_type;
 +extern struct nft_set_type nft_set_hash_type;
 +extern struct nft_set_type nft_set_hash_fast_type;
 +extern struct nft_set_type nft_set_rbtree_type;
 +extern struct nft_set_type nft_set_bitmap_type;
 +
+ struct nft_expr;
+ struct nft_regs;
+ struct nft_pktinfo;
+ void nft_meta_get_eval(const struct nft_expr *expr,
+ 		       struct nft_regs *regs, const struct nft_pktinfo *pkt);
+ void nft_lookup_eval(const struct nft_expr *expr,
+ 		     struct nft_regs *regs, const struct nft_pktinfo *pkt);
  #endif /* _NET_NF_TABLES_CORE_H */

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the netfilter-next tree with the net tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 819 bytes --]

Hi all,

Today's linux-next merge of the netfilter-next tree got a conflict in:

  net/netfilter/nft_set_pipapo.c

between commit:

  f0b3d338064e ("netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version")

from the net tree and commit:

  b1bc08f6474f ("netfilter: nf_tables: prefer direct calls for set lookups")

from the netfilter-next tree.

I fixed it up (I just used the latter) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the netfilter-next tree with the net tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1900 bytes --]

Hi all,

On Wed, 19 May 2021 09:56:27 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> Today's linux-next merge of the netfilter-next tree got a conflict in:
> 
>   net/netfilter/nft_set_pipapo.c
> 
> between commit:
> 
>   f0b3d338064e ("netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version")
> 
> from the net tree and commit:
> 
>   b1bc08f6474f ("netfilter: nf_tables: prefer direct calls for set lookups")
> 
> from the netfilter-next tree.
> 
> I fixed it up (I just used the latter) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.

This merge also needs the following merge resolution patch:

From: Stephen Rothwell <sfr@canb.auug.org.au>
Date: Wed, 19 May 2021 13:48:22 +1000
Subject: [PATCH] fix up for merge involving nft_pipapo_lookup()

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
---
 net/netfilter/nft_set_pipapo.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h
index d84afb8fa79a..25a75591583e 100644
--- a/net/netfilter/nft_set_pipapo.h
+++ b/net/netfilter/nft_set_pipapo.h
@@ -178,8 +178,6 @@ struct nft_pipapo_elem {
 
 int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,
 		  union nft_pipapo_map_bucket *mt, bool match_only);
-bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
-		       const u32 *key, const struct nft_set_ext **ext);
 
 /**
  * pipapo_and_field_buckets_4bit() - Intersect 4-bit buckets
-- 
2.30.2

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the netfilter-next tree with the net tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 3891 bytes --]

Hi all,

On Wed, 19 May 2021 14:05:32 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> On Wed, 19 May 2021 09:56:27 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> >
> > Today's linux-next merge of the netfilter-next tree got a conflict in:
> > 
> >   net/netfilter/nft_set_pipapo.c
> > 
> > between commit:
> > 
> >   f0b3d338064e ("netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version")
> > 
> > from the net tree and commit:
> > 
> >   b1bc08f6474f ("netfilter: nf_tables: prefer direct calls for set lookups")
> > 
> > from the netfilter-next tree.
> > 
> > I fixed it up (I just used the latter) and can carry the fix as necessary. This
> > is now fixed as far as linux-next is concerned, but any non trivial
> > conflicts should be mentioned to your upstream maintainer when your tree
> > is submitted for merging.  You may also want to consider cooperating
> > with the maintainer of the conflicting tree to minimise any particularly
> > complex conflicts.  
> 
> This merge also needs the following merge resolution patch:
> 
> From: Stephen Rothwell <sfr@canb.auug.org.au>
> Date: Wed, 19 May 2021 13:48:22 +1000
> Subject: [PATCH] fix up for merge involving nft_pipapo_lookup()
> 
> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
> ---
>  net/netfilter/nft_set_pipapo.h | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h
> index d84afb8fa79a..25a75591583e 100644
> --- a/net/netfilter/nft_set_pipapo.h
> +++ b/net/netfilter/nft_set_pipapo.h
> @@ -178,8 +178,6 @@ struct nft_pipapo_elem {
>  
>  int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,
>  		  union nft_pipapo_map_bucket *mt, bool match_only);
> -bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
> -		       const u32 *key, const struct nft_set_ext **ext);
>  
>  /**
>   * pipapo_and_field_buckets_4bit() - Intersect 4-bit buckets
> -- 
> 2.30.2

Actually it appears to also need this:

diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h
index 789e9eadd76d..8652b2514e57 100644
--- a/include/net/netfilter/nf_tables_core.h
+++ b/include/net/netfilter/nf_tables_core.h
@@ -89,6 +89,8 @@ extern const struct nft_set_type nft_set_bitmap_type;
 extern const struct nft_set_type nft_set_pipapo_type;
 extern const struct nft_set_type nft_set_pipapo_avx2_type;
 
+bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
+			    const u32 *key, const struct nft_set_ext **ext);
 #ifdef CONFIG_RETPOLINE
 bool nft_rhash_lookup(const struct net *net, const struct nft_set *set,
 		      const u32 *key, const struct nft_set_ext **ext);
@@ -101,8 +103,6 @@ bool nft_hash_lookup_fast(const struct net *net,
 			  const u32 *key, const struct nft_set_ext **ext);
 bool nft_hash_lookup(const struct net *net, const struct nft_set *set,
 		     const u32 *key, const struct nft_set_ext **ext);
-bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
-			    const u32 *key, const struct nft_set_ext **ext);
 bool nft_set_do_lookup(const struct net *net, const struct nft_set *set,
 		       const u32 *key, const struct nft_set_ext **ext);
 #else
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 9addc0b447f7..dce866d93fee 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -408,7 +408,6 @@ int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,
  *
  * Return: true on match, false otherwise.
  */
-INDIRECT_CALLABLE_SCOPE
 bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
 		       const u32 *key, const struct nft_set_ext **ext)
 {


-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the netfilter-next tree with the net tree

[Stefano Brivio]

Hi,

On Fri, 21 May 2021 09:12:22 +1000
Stephen Rothwell <sfr@canb.auug.org.au> wrote:

> Hi all,
> 
> On Wed, 19 May 2021 14:05:32 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> >
> > On Wed, 19 May 2021 09:56:27 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:  
> > >
> > > Today's linux-next merge of the netfilter-next tree got a conflict in:
> > > 
> > >   net/netfilter/nft_set_pipapo.c
> > > 
> > > between commit:
> > > 
> > >   f0b3d338064e ("netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version")
> > > 
> > > from the net tree and commit:
> > > 
> > >   b1bc08f6474f ("netfilter: nf_tables: prefer direct calls for set lookups")
> > > 
> > > from the netfilter-next tree.
> > > 
> > > I fixed it up (I just used the latter) and can carry the fix as necessary. This
> > > is now fixed as far as linux-next is concerned, but any non trivial
> > > conflicts should be mentioned to your upstream maintainer when your tree
> > > is submitted for merging.  You may also want to consider cooperating
> > > with the maintainer of the conflicting tree to minimise any particularly
> > > complex conflicts.    
> > 
> > This merge also needs the following merge resolution patch:
> > 
> > From: Stephen Rothwell <sfr@canb.auug.org.au>
> > Date: Wed, 19 May 2021 13:48:22 +1000
> > Subject: [PATCH] fix up for merge involving nft_pipapo_lookup()
> > 
> > Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
> > ---
> >  net/netfilter/nft_set_pipapo.h | 2 --
> >  1 file changed, 2 deletions(-)
> > 
> > diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h
> > index d84afb8fa79a..25a75591583e 100644
> > --- a/net/netfilter/nft_set_pipapo.h
> > +++ b/net/netfilter/nft_set_pipapo.h
> > @@ -178,8 +178,6 @@ struct nft_pipapo_elem {
> >  
> >  int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,
> >  		  union nft_pipapo_map_bucket *mt, bool match_only);
> > -bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
> > -		       const u32 *key, const struct nft_set_ext **ext);
> >  
> >  /**
> >   * pipapo_and_field_buckets_4bit() - Intersect 4-bit buckets
> > -- 
> > 2.30.2  
> 
> Actually it appears to also need this:

Thanks for the fix, and sorry for the mess. To retain the effect of
b1bc08f6474f ("netfilter: nf_tables: prefer direct calls for set lookups")
from nf-next, though,

> diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h
> index 789e9eadd76d..8652b2514e57 100644
> --- a/include/net/netfilter/nf_tables_core.h
> +++ b/include/net/netfilter/nf_tables_core.h
> @@ -89,6 +89,8 @@ extern const struct nft_set_type nft_set_bitmap_type;
>  extern const struct nft_set_type nft_set_pipapo_type;
>  extern const struct nft_set_type nft_set_pipapo_avx2_type;
>  
> +bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
> +			    const u32 *key, const struct nft_set_ext **ext);

while this looks correct to me (b1bc08f6474f adds the prototype
conditionally for CONFIG_RETPOLINE, f0b3d338064e adds it
unconditionally),

>  #ifdef CONFIG_RETPOLINE
>  bool nft_rhash_lookup(const struct net *net, const struct nft_set *set,
>  		      const u32 *key, const struct nft_set_ext **ext);
> @@ -101,8 +103,6 @@ bool nft_hash_lookup_fast(const struct net *net,
>  			  const u32 *key, const struct nft_set_ext **ext);
>  bool nft_hash_lookup(const struct net *net, const struct nft_set *set,
>  		     const u32 *key, const struct nft_set_ext **ext);
> -bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
> -			    const u32 *key, const struct nft_set_ext **ext);
>  bool nft_set_do_lookup(const struct net *net, const struct nft_set *set,
>  		       const u32 *key, const struct nft_set_ext **ext);
>  #else
> diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
> index 9addc0b447f7..dce866d93fee 100644
> --- a/net/netfilter/nft_set_pipapo.c
> +++ b/net/netfilter/nft_set_pipapo.c
> @@ -408,7 +408,6 @@ int pipapo_refill(unsigned long *map, int len, int rules, unsigned long *dst,
>   *
>   * Return: true on match, false otherwise.
>   */
> -INDIRECT_CALLABLE_SCOPE

this shouldn't be removed.

>  bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set,
>  		       const u32 *key, const struct nft_set_ext **ext)
>  {
> 
> 

Let me know if I should rather send a patch for linux-next (but it
might take me a bit).

-- 
Stefano

linux-next: manual merge of the netfilter-next tree with the net tree

[Stephen Rothwell]

Hi all,

Today's linux-next merge of the netfilter-next tree got a conflict in:

  net/netfilter/nf_tables_netdev.c

between commit:

  c73c24849011 ("netfilter: nf_tables_netdev: remove redundant ip_hdr assignment")

from the net tree and commit:

  ddc8b6027ad0 ("netfilter: introduce nft_set_pktinfo_{ipv4, ipv6}_validate()")

from the netfilter-next tree.

I fixed it up (I used the latter version of this file and applied the
patch below) and can carry the fix as necessary. This is now fixed as
far as linux-next is concerned, but any non trivial conflicts should be
mentioned to your upstream maintainer when your tree is submitted for
merging.  You may also want to consider cooperating with the maintainer
of the conflicting tree to minimise any particularly complex conflicts.

From: Stephen Rothwell <sfr@canb.auug.org.au>
Date: Tue, 13 Sep 2016 10:08:58 +1000
Subject: [PATCH] netfilter: merge fixup for "nf_tables_netdev: remove
 redundant ip_hdr assignment"

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
---
 include/net/netfilter/nf_tables_ipv4.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h
index 968f00b82fb5..25e33aee91e7 100644
--- a/include/net/netfilter/nf_tables_ipv4.h
+++ b/include/net/netfilter/nf_tables_ipv4.h
@@ -33,7 +33,6 @@ __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
 	if (!iph)
 		return -1;
 
-	iph = ip_hdr(skb);
 	if (iph->ihl < 5 || iph->version != 4)
 		return -1;
 
-- 
2.8.1

-- 
Cheers,
Stephen Rothwell

Re: linux-next: manual merge of the netfilter-next tree with the net tree

[Stephen Rothwell]

Hi all,

On Tue, 13 Sep 2016 10:12:50 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> Today's linux-next merge of the netfilter-next tree got a conflict in:
> 
>   net/netfilter/nf_tables_netdev.c
> 
> between commit:
> 
>   c73c24849011 ("netfilter: nf_tables_netdev: remove redundant ip_hdr assignment")
> 
> from the net tree and commit:
> 
>   ddc8b6027ad0 ("netfilter: introduce nft_set_pktinfo_{ipv4, ipv6}_validate()")
> 
> from the netfilter-next tree.
> 
> I fixed it up (I used the latter version of this file and applied the
> patch below) and can carry the fix as necessary. This is now fixed as
> far as linux-next is concerned, but any non trivial conflicts should be
> mentioned to your upstream maintainer when your tree is submitted for
> merging.  You may also want to consider cooperating with the maintainer
> of the conflicting tree to minimise any particularly complex conflicts.
> 
> From: Stephen Rothwell <sfr@canb.auug.org.au>
> Date: Tue, 13 Sep 2016 10:08:58 +1000
> Subject: [PATCH] netfilter: merge fixup for "nf_tables_netdev: remove
>  redundant ip_hdr assignment"
> 
> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
> ---
>  include/net/netfilter/nf_tables_ipv4.h | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h
> index 968f00b82fb5..25e33aee91e7 100644
> --- a/include/net/netfilter/nf_tables_ipv4.h
> +++ b/include/net/netfilter/nf_tables_ipv4.h
> @@ -33,7 +33,6 @@ __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
>  	if (!iph)
>  		return -1;
>  
> -	iph = ip_hdr(skb);
>  	if (iph->ihl < 5 || iph->version != 4)
>  		return -1;
>  
> -- 
> 2.8.1

The above merge fix patch is now needed when the net-next tree is
merged with Linus' tree.

-- 
Cheers,
Stephen Rothwell

Re: linux-next: manual merge of the netfilter-next tree with the net tree

[Liping Zhang]

[ remove other unrelated dev groups ]

Hi pablo,

2016-09-29 9:20 GMT+08:00 Stephen Rothwell <sfr@canb.auug.org.au>:
> Hi all,
>
> On Tue, 13 Sep 2016 10:12:50 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>>
>> Today's linux-next merge of the netfilter-next tree got a conflict in:
>>
>>   net/netfilter/nf_tables_netdev.c
>>
>> between commit:
>>
>>   c73c24849011 ("netfilter: nf_tables_netdev: remove redundant ip_hdr assignment")
>>
>> from the net tree and commit:
>>
>>   ddc8b6027ad0 ("netfilter: introduce nft_set_pktinfo_{ipv4, ipv6}_validate()")
>>
>>  include/net/netfilter/nf_tables_ipv4.h | 1 -
>>  1 file changed, 1 deletion(-)
>>
>> diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h
>> index 968f00b82fb5..25e33aee91e7 100644
>> --- a/include/net/netfilter/nf_tables_ipv4.h
>> +++ b/include/net/netfilter/nf_tables_ipv4.h
>> @@ -33,7 +33,6 @@ __nft_set_pktinfo_ipv4_validate(struct nft_pktinfo *pkt,
>>       if (!iph)
>>               return -1;
>>
>> -     iph = ip_hdr(skb);
>>       if (iph->ihl < 5 || iph->version != 4)
>>               return -1;
>>
>> --
>> 2.8.1
>
> The above merge fix patch is now needed when the net-next tree is
> merged with Linus' tree.
>

I think this merge conflict was fixed in your nf-next tree by
commit f20fbc0717f9.

But this redundant statement "iph = ip_hdr(skb);" should be
removed, we already use skb_header_pointer to get ip header
pointer before.

See function __nft_set_pktinfo_ipv4_validate():
{
    struct iphdr *iph, _iph;
    u32 len, thoff;

    iph = skb_header_pointer(skb, ....);
    ^^^^^^^^^^^^^^^^^^^^^^^^^
    if (!iph)
         return -1;

     iph = ip_hdr(skb);
     ^^^^^^^^^^^^^^^^^
     if (iph->ihl < 5 || iph->version != 4)
     ....

> --
> Cheers,
> Stephen Rothwell