6.15.6 include:
From 06a34f7db773e01efa8a90c5b4d912207a80dd60 Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Sun, 17 Nov 2024 22:20:30 +0100
Subject: [PATCH] wireguard: device: support big tcp GSO
Advertise GSO_MAX_SIZE as TSO max size in order support BIG TCP for wireguard.
This helps to improve wireguard performance a bit when enabled as it allows
wireguard to aggregate larger skbs in wg_packet_consume_data_done() via
napi_gro_receive(), but also allows the stack to build larger skbs on xmit
where the driver then segments them before encryption inside wg_xmit().
We've seen a 15% improvement in TCP stream performance.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://patch.msgid.link/20241117212030.629159-5-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
drivers/net/wireguard/device.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
index a2ba71fbbed46..6cf173a008e78 100644
--- a/drivers/net/wireguard/device.c
+++ b/drivers/net/wireguard/device.c
@@ -302,6 +302,8 @@ static void wg_setup(struct net_device *dev)
/* We need to keep the dst around in case of icmp replies. */
netif_keep_dst(dev);
+ netif_set_tso_max_size(dev, GSO_MAX_SIZE);
+
wg->dev = dev;
}
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
compile and install perf tool from linux
source for performance monitoring.
change the setting before run perf
echo -1 > /proc/sys/kernel/perf_event_paranoid
echo 0 > /proc/sys/kernel/kptr_restrict
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
how to generate logo format:
apt-get install netpbm
1 convert png format to ppm format
pngtopnm bpfire-logo.png > bpfire-logo.ppm
2 reduce the color count to 224
ppmquant 224 bpfire-logo.ppm > bpfire-logo-224.ppm
3 convert ppm raw format to ascii format
pnmnoraw bpfire-logo-224.ppm > bpfire-logo-ascii.ppm
cp bpfire-logo-ascii.ppm config/kernel/
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
upgrade kernel to recent stable release 6.10.11
1, scripts/kconfig/merge_config.sh does not work for 6.10.11
2, vmlinux BTF binary name changed in 6.10.11
3, remove rtl8812au for now since it has compiling error
4, remove 5.15 nfqueue patch since it does not apply cleanly
also see [0]
[0]: https://github.com/vincentmli/BPFire/issues/41
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
error when run lunatik which loads lunatik kernel modules
root@bpfire-2 lua]# lunatik run examples/filter/sni false
[root@bpfire-2 lua]# dmesg
[ 330.411665] lunatik: loading out-of-tree module taints kernel.
[ 330.411680] lunatik: module verification failed: signature and/or required key missing - tainting kernel
[ 330.433955] Kernel module BTF mismatch detected, BTF debug info may be unavailable for some modules
[ 330.767701] missing module BTF, cannot register kfuncs
BPFire chroot build mount /sys/kernel/btf/vmlinux which is
the host binary vmlinux BTF to build against lunatik kernel module,
which result in above error. adjust BPFire kernel build to save
the binary vmlinux BTF to chroot
/lib/modules/6.6.15-ipfire/build/vmlinux for lunatik kernel module.
create the vmlinux.h from the same binary vmlinux BTF for the ebpf https.o
lunatik kernel module is depending on kernel build, adjust the lunatik
build accordingly when kerne upgrade in future.
See https://github.com/vincentmli/BPFire/issues/40
see https://github.com/luainkernel/lunatik/issues/189
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
lunatik kernel modules requires kernel to be built first
so /lib/modules is available for lunatik
lunatik also requires resolve_btfids under:
/lib/modules/$(VER)-$(VERSUFIX)/build/tools/bpf/resolve_btfids/
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
bpftool comes with Linux kernel source and
it is handy to have bpftool on ipfire kernel
with BPF/BTF enabled to diagnosis BPF related
issue.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
Compiling the kernel has automatically introduced
CONFIG_INIT_STACK_ALL_ZERO=y and removed GCC's structleak plugin (not to
be confused with its stackleak counterpart). However, according to
related documentation, this neither introduces a security nor
performance disadvantage.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
