support offloading of ct_state flags invalid and reply

Bug #1922682 reported by Roi Dayan
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-bluefield (Ubuntu)
Invalid
Undecided
Unassigned
Focal
Fix Released
Medium
Roi Dayan

Bug Description

SRU Justification:

The patches are adding offload support for ct_state invalid and
ct_state reply.

* Explain the bug(s)

tc doesn't support matching on ct_state invalid and reply.

* brief explanation of fixes

Add tc support for ct_state invalid and reply which will allow supported drivers
to offload such to hw.

* How to test

Add tc rule with match on ct_state invalid or reply.

* What it could break.

Offloading of such tc rules. will continue to be handled in ovs dp.

CVE References

Roi Dayan (roidayan)
description: updated
Stefan Bader (smb)
Changed in linux-bluefield (Ubuntu Focal):
assignee: nobody → Roi Dayan (roidayan)
importance: Undecided → Medium
status: New → In Progress
Changed in linux-bluefield (Ubuntu):
status: New → Invalid
Stefan Bader (smb)
Changed in linux-bluefield (Ubuntu Focal):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-focal
Roi Dayan (roidayan)
tags: added: verification-done-focal
removed: verification-needed-focal
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (42.0 KiB)

This bug was fixed in the package linux-bluefield - 5.4.0-1011.14

---------------
linux-bluefield (5.4.0-1011.14) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1011.14 -proposed tracker (LP: #1923761)

  * kernel crash with stress CT offload traffic (LP: #1922672)
    - netfilter: conntrack: Move nf_ct_offload_timeout to header file
    - netfilter: flowtable: Set offload timeout when adding flow

  * support offloading of ct_state flags invalid and reply (LP: #1922682)
    - net/sched: cls_flower add CT_FLAGS_INVALID flag support
    - net/sched: act_api: fix miss set post_ct for ovs after do conntrack in
      act_ct
    - net/sched: act_ct: clear post_ct if doing ct_clear
    - net/sched: cls_flower: Add match on the ct_state reply flag
    - net: flow_offload: Add original direction flag to ct_metadata

  * netfilter offload could bloat up memory (LP: #1922678)
    - netfilter: flowtable: separate replace, destroy and stats to different
      workqueues
    - SAUCE: netfilter: nf_flow_table_offload: Limit work entries on offload add
      wq

  * TLS fixes (LP: #1916508)
    - net/tls: Add asynchronous resync
    - net/tls: fix sign extension issue when left shifting u16 value
    - net/tls: Fix wrong record sn in async mode of device resync

  * ipmb_host.c: Fix slow transactions (LP: #1922393)
    - SAUCE: ipmb_host.c: Fix slow transactions

  * i2c-mlx.c: sync up with upstream (LP: #1921506)
    - SAUCE: Syncup i2c-mlx driver with upstreamed version

  [ Ubuntu: 5.4.0-73.82 ]

  * focal/linux: 5.4.0-73.82 -proposed tracker (LP: #1923781)
  * Packaging resync (LP: #1786013)
    - update dkms package versions
  * CIFS DFS entries not accessible with 5.4.0-71.74-generic (LP: #1923670)
    - Revert "cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting
      cifs_sb->prepath."
  * CVE-2021-29650
    - Revert "netfilter: x_tables: Update remaining dereference to RCU"
    - Revert "netfilter: x_tables: Switch synchronization to RCU"
    - netfilter: x_tables: Use correct memory barriers.
  * LRMv4: switch to signing nvidia modules via the Ubuntu Modules signing key
    (LP: #1918134)
    - [Packaging] dkms-build{,--nvidia-N} sync back from LRMv4
  * 5.4 kernel: when iommu is on crashdump fails (LP: #1922738)
    - iommu/vt-d: Refactor find_domain() helper
    - iommu/vt-d: Add attach_deferred() helper
    - iommu/vt-d: Move deferred device attachment into helper function
    - iommu/vt-d: Do deferred attachment in iommu_need_mapping()
    - iommu/vt-d: Remove deferred_attach_domain()
    - iommu/vt-d: Simplify check in identity_mapping()
  * Backport mlx5e fix for tunnel offload (LP: #1921769)
    - net/mlx5e: Check tunnel offload is required before setting SWP
  * Bcache bypasse writeback on caching device with fragmentation (LP: #1900438)
    - bcache: consider the fragmentation when update the writeback rate
  * Fix implicit declaration warnings for kselftests/memfd test on newer
    releases (LP: #1910323)
    - selftests/memfd: Fix implicit declaration warnings
  * net/mlx5e: Add missing capability check for uplink follow (LP: #1921104)
    - net/mlx5e: Add missing capability check for uplink follow
  * [UBUNUT 21.04] s390/vti...

Changed in linux-bluefield (Ubuntu Focal):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.