This allows to redirect bridged packets to local machine:

ether type ip ether daddr set aa:53:08:12:34:56 meta pkttype set unicast
Without 'set unicast', ip stack discards PACKET_OTHERHOST skbs.

It is also useful to add support for a '-m cluster like' nft rule
(where switch floods packets to several nodes, and each cluster node
 node processes a subset of packets for load distribution).

Mangling is restricted to HOST/OTHER/BROAD/MULTICAST, i.e. you cannot set
skb->pkt_type to PACKET_KERNEL or change PACKET_LOOPBACK to PACKET_HOST.
Signed-off-by: NFlorian Westphal <fw@strlen.de>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>

to avoid overly long line in followup patch.
Signed-off-by: NFlorian Westphal <fw@strlen.de>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>

This patch implements xt_cgroup path match which matches cgroup2
membership of the associated socket.  The match is recursive and
invertible.

For rationales on introducing another cgroup based match, please refer
to a preceding commit "sock, cgroup: add sock->sk_cgroup".

v3: Folded into xt_cgroup as a new revision interface as suggested by
    Pablo.

v2: Included linux/limits.h from xt_cgroup2.h for PATH_MAX.  Added
    explicit alignment to the priv field.  Both suggested by Jan.
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Daniel Wagner <daniel.wagner@bmw-carit.de>
CC: Neil Horman <nhorman@tuxdriver.com>
Cc: Jan Engelhardt <jengelh@inai.de>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>

xt_cgroup will grow cgroup2 path based match.  Postfix existing
symbols with _v0 and prepare for multi revision registration.
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Daniel Wagner <daniel.wagner@bmw-carit.de>
CC: Neil Horman <nhorman@tuxdriver.com>
Cc: Jan Engelhardt <jengelh@inai.de>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>

Resolve conflict between commit 264640fc ("ipv6: distinguish frag
queues by device for multicast and link-local packets") from the net
tree and commit 029f7f3b ("netfilter: ipv6: nf_defrag: avoid/free
clone operations") from the nf-next tree.
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>

Conflicts:
	net/ipv6/netfilter/nf_conntrack_reasm.c

Add a per-netns list of timeout objects and adjust code to use it.
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>

Some eisa_driver structures used __init probe functions which generates
a warning and could crash if function is called after being deleted.
Signed-off-by: NFabian Frederick <fabf@skynet.be>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In commit 2a04ae8a ("hv_netvsc: remove locking in netvsc_send()"), the
locking for MSD (Multi-Send Data) field was removed. This could cause a
race condition between RNDIS control messages and data packets processing,
because these two types of traffic are not synchronized.
This patch fixes this issue by sending control messages out directly
without reading MSD field.
Signed-off-by: NHaiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: NK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Add support to enable and disable UDP checksums via netlink. This is
similar to how VXLAN and GUE allow this. This includes support for
enabling the UDP zero checksum (for both TX and RX).
Signed-off-by: NTom Herbert <tom@herbertland.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fixe a couple of cast errors found by sparse.
Signed-off-by: NTom Herbert <tom@herbertland.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Jeff Kirsher says:

====================
100GbE Intel Wired LAN Driver Updates 2015-12-13

This series contains updates to fm10k only.

Jacob updates the driver to use ether_addr_copy() instead of copying
byte-by-byte in a for loop.  Fixed up CamelCase variable names and coding
style issues.  Cleaned up namespace pollution of fm10k_iov_msg_data_pf().
Cleaned up, by making it consistent, the use of VLAN and VLAN ID instead of
vlan or vid.  Lastly, update the driver to initialize XPS so that we can
take advantage of the kernel feature.

Alex Duyck fixed up the driver to free the resources associated with the
MSI-X vector table if the q_vector allocation failed.  Then fixed the driver
to check for msix_entries to be NULL and freed the IRQ if the mailbox API
returned an error on trying to connect.

Bruce cleans up whitespace and namespace pollution issues in the driver.
Also updates the driver to use the BIT() macro instead of bit-shifting coding.
====================
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Similar to ixgbe and i40e, initialize XPS on driver load so that we can
take advantage of this kernel feature.
Signed-off-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Make functions that should be static.  While we're at it, fix the function
header comment for fm10k_tlv_attr_nest_stop(), and update the copyright
header for fm10k_pf.h, fm10k_tlv.c and fm10k_tlv.h.
Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

The function declaration does not need to be 'inline'd here.
Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

This patch addresses two issues.

First is the fact that the fm10k_mbx_free_irq was assuming msix_entries was
valid and that will not always be the case.  As such we need to add a check
for if it is NULL.

Second is the fact that we weren't freeing the IRQ if the mailbox API
returned an error on trying to connect.
Signed-off-by: NAlexander Duyck <aduyck@mirantis.com>
Reviewed-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

If the q_vector allocation fails we should free the resources associated
with the MSI-X vector table.
Signed-off-by: NAlexander Duyck <aduyck@mirantis.com>
Reviewed-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Rather than wrapping fm10k_dcbnl.c and fm10k_debugfs.c support with
 #ifdef blocks, just conditionally include the .o files in the Makefile.
Also, since we're modifying it, update the copyright year on the
Makefile.
Signed-off-by: NJacob Keller <jacob.e.keller@intel.com>
Signed-off-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

We haven't bumped the driver version in a while despite many fixes being
pulled in from the out-of-tree Sourceforge driver. Update the version to
match.
Signed-off-by: NJacob Keller <jacob.e.keller@intel.com>
Tested-by: NKrishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Instead of using lowercase vlan, vid, or VID, always use VLAN or VLAN ID
in comments when referring to VLANs. The original driver code was
consistent, but recent patches have not been as consistent with this
naming scheme.
Signed-off-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <Krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: NBruce Allan <bruce.w.allan@intel.com>
Tested-by: NKrishneil Singh <krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Improve code style by removing the unnecessary else block of an if
statement which immediately returns.
Signed-off-by: NJacob Keller <jacob.e.keller@intel.com>
Tested-by: NKrishneil Singh <krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Avoid the use of CamelCase for some variable names that previously
slipped through review.
Reported-by: NBruce Allan <bruce.w.allan@intel.com>
Signed-off-by: NJacob Keller <jacob.e.keller@intel.com>
Tested-by: NKrishneil Singh <krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Use the ether_addr_copy function instead of copying byte-by-byte in a
for-loop by hand.
Reported-by: NBruce Allan <bruce.w.allan@intel.com>
Signed-off-by: NJacob Keller <jacob.e.keller@intel.com>
Tested-by: NKrishneil Singh <krishneil.k.singh@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Jeff Kirsher says:

====================
1GbE Intel Wired LAN Driver Updates 2015-12-12

This series contains updates to e1000, e1000e and igb.

Joern Engel fixes up the e1000 driver to reduce scheduler latencies by
making the eeprom read/write functions scheduler friendly by using a mutex
lock instead of a spin lock.

Todd adds code for igb to initialize the 88E1543 PHY properly.  Then fixed
igb to use the correct i210 register for EEMNGCTL, since the i210 has two
EEPROM access registers (EEARBC and EEMNGCTL).

Dmitry Vyukov provides a fix for e1000 to resolve a data race found with
KernelThreadSanitizer (KTSAN), where no memory barriers were being used
when buffers get recycled, so the recycled buffers can be corrupted.  So
use smp_store_release() to update tx_ring->next_to_clean and
smp_load_acquire() to read tx_ring->next_to_clean to properly hand off
buffers from e1000_clean_tx_irq() to e1000_xmit_frame().

Jarod Wilson fixes igb so that we do not try to unmap a NULL hw_addr.  Then
cleaned up array_rd32() so that it uses igb_rd32() the same as rd32() and
use io_addr() in more places so that we do not have to call E1000_REMOVED().

Janusz Wolak cleans up the e1000 driver by correcting warnings produced
by checkpatch.pl for the driver.

Jean Sacren provides several patches with general cleanups for e1000 and
e1000e, which include code comment fix-ups and cleanup of local variables
not needed.

Dmitry Fleytman fixes a possible division by zero in the receive interrupt
handler for e1000e when working without adaptive interrupt moderation,
which is typically disabled on jumbo MTUs.

Raanan increases the timeout of the polling bit due to timing changes to
the ME firmware on a platform, so increase the timeout to 300ms.  Added
initial support for i219-LM, which is a LOM that will be available on
systems with the Lewisburg Platform Controller HUB (PCH) chipset.

Jan Beulich fixes a NULL dereference in igb, due to the adapter->vf _data
being NULL while adapter->vfs_allocated_count is non-zero.
====================
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

i219-LM (3) is a LOM that will be available on systems with the
Lewisburg Platform Controller Hub (PCH) chipset from Intel.
This patch provides the initial support for the device.
Signed-off-by: NRaanan Avargil <raanan.avargil@intel.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Clean up array_rd32 so that it uses igb_rd32 the same as rd32, per the
suggestion of Alexander Duyck, and use io_addr in more places, so that
we don't have the need to call E1000_REMOVED (which simply looks for a
null hw_addr) nearly as much.
Signed-off-by: NJarod Wilson <jarod@redhat.com>
Acked-by: NAlexander Duyck <aduyck@mirantis.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Jeff Kirsher says:

====================
40GbE Intel Wired LAN Driver Updates 2015-12-12

This series contains updates to i40e and i40evf only.

Jesse fixes some trivial static analyzer warnings where BIT() can be used
instead of BIT_ULL().

Mitch fixes the virtual channel interface which was using incorrect semantics
to remove MAC addresses and would leave incorrect filters active when using
VLANs.  Also fixes an issue that when VF's are created, the MAC address
defaults to all zeros, indicating to the VF driver that it should use a
random MAC address.  However, the PF driver was incorrectly adding this
zero MAC to the filter table, so check for a good address before adding
the default filter.  Adds a check to make sure that the Tx and Rx rings
actually exist before dereferencing them to free resources.  Re-classifies
several messages which are really for debugging purposes, especially since
the driver can fully recover from any of these.  Fixed up the VF version
strings to match the PF driver.

Anjali adds a virtchnl offload to support the expanded version of TCP/UDP
PCTYPES for RSS.

Shannon fixes i40e to clean the whole MAC filter list when resetting after
an intermediate add or delete push to the firmware.

v2: added blank line after variable declaration in patch 9 based on
    feedback from Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
====================
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The combined effect of commits 6423fc34 ("igb: do not re-init SR-IOV
during probe") and ceee3450 ("igb: make sure SR-IOV init uses the
right number of queues") causes VFs no longer getting set up, leading
to NULL pointer dereferences due to the adapter's ->vf_data being NULL
while ->vfs_allocated_count is non-zero. The first commit not only
neglected the side effect of igb_sriov_reinit() that the second commit
tried to account for, but also that of setting IGB_FLAG_HAS_MSIX,
without which igb_enable_sriov() is effectively a no-op. Calling
igb_{,re}set_interrupt_capability() as done here seems to address this,
but I'm not sure whether this is better than sinply reverting the other
two commits.
Signed-off-by: NJan Beulich <jbeulich@suse.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Due to timing changes to the ME firmware in Skylake, this timer
needs to be increased to 300ms.
Signed-off-by: NRaanan Avargil <raanan.avargil@intel.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

This patch fixes possible division by zero in receive
interrupt handler when working without adaptive interrupt
moderation.

The adaptive interrupt moderation mechanism is typically
disabled on jumbo MTUs.
Signed-off-by: NDmitry Fleytman <dmitry@daynix.com>
Signed-off-by: NLeonid Bloch <leonid@daynix.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NJanusz Wolak <januszvdm@gmail.com>
Acked-by: NJesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

By using goto statement, we can achieve sharing the same exit path so
that code duplication could be minimized.
Signed-off-by: NJean Sacren <sakiwit@gmail.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Due to historical reason, 'phy_data' has never been included in the
kernel doc. Fix it so that the requirement could be fulfilled.
Signed-off-by: NJean Sacren <sakiwit@gmail.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

The local variable 'ret' doesn't serve much purpose so we might as well
clean it up.
Signed-off-by: NJean Sacren <sakiwit@gmail.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Use 'That' to replace 'The' so that the comment would make sense.
Signed-off-by: NJean Sacren <sakiwit@gmail.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

The checking logic needed some clean-up work, so we rewrite it by
checking for break first. With that change in place, we can even move
the second check for goto statement outside of the loop.

As this is merely a cleanup, no functional change is involved. The
questionable 'tmp != 0xFF' is intentionally left alone.

Mark Rustad and Alexander Duyck contributed to this patch.

CC: Mark Rustad <mark.d.rustad@intel.com>
CC: Alex Duyck <aduyck@mirantis.com>
Signed-off-by: NJean Sacren <sakiwit@gmail.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

The i210 has two EEPROM access registers that are located in
non-standard offsets: EEARBC and EEMNGCTL. EEARBC was fixed previously
and EEMNGCTL should also be corrected.
Reported-by: NRoman Hodek <roman.aud@siemens.com>
Signed-off-by: NTodd Fujinaka <todd.fujinaka@intel.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>