* [PATCH] net: filter: remove unused cpu_off
From: Eric Dumazet @ 2012-04-18 2:51 UTC (permalink / raw)
To: David Miller; +Cc: netdev
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
---
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 4ce0296..1a69244 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -240,8 +240,6 @@ do { *prog++ = LD32I | RS1(FP) | S13(-(OFF)) | RD(DEST); \
do { *prog++ = LD32I | RS1(FP) | S13(-(OFF)) | RD(SRC); \
} while (0)
-#define cpu_off offsetof(struct thread_info, cpu)
-
#ifdef CONFIG_SMP
#ifdef CONFIG_SPARC64
#define emit_load_cpu(REG) \
^ permalink raw reply related
* Re: [PATCH 03/11] batman-adv: randomize initial seqno to avoid collision
From: David Miller @ 2012-04-18 2:45 UTC (permalink / raw)
To: ordex; +Cc: netdev, b.a.t.m.a.n, lindner_marek
In-Reply-To: <1334663907-22725-4-git-send-email-ordex@autistici.org>
From: Antonio Quartulli <ordex@autistici.org>
Date: Tue, 17 Apr 2012 13:58:19 +0200
> @@ -33,6 +33,11 @@
> static void bat_iv_ogm_iface_enable(struct hard_iface *hard_iface)
> {
> struct batman_ogm_packet *batman_ogm_packet;
> + unsigned long random_seqno;
> +
> + /* randomize initial seqno to avoid collision */
> + get_random_bytes(&random_seqno, sizeof(unsigned long));
> + atomic_set(&hard_iface->seqno, (uint32_t)random_seqno);
This is silly.
Just use "uint32_t" for the type of random_seqno and the sizeof passed
to get_random_bytes.
And here comes the magic part.
Amazing, no ugly and pointless casts needed!
^ permalink raw reply
* Re: [PATCH 10/11] batman-adv: print OGM seq numbers as unsigned long
From: David Miller @ 2012-04-18 2:47 UTC (permalink / raw)
To: ordex-GaUfNO9RBHfsrOwW+9ziJQ
Cc: netdev-u79uwXL29TY76Z2rM5mHXA,
b.a.t.m.a.n-ZwoEplunGu2X36UT3dwllkB+6BGkLq7r
In-Reply-To: <1334663907-22725-11-git-send-email-ordex-GaUfNO9RBHfsrOwW+9ziJQ@public.gmane.org>
From: Antonio Quartulli <ordex-GaUfNO9RBHfsrOwW+9ziJQ@public.gmane.org>
Date: Tue, 17 Apr 2012 13:58:26 +0200
> OGM sequence numbers are declared as uint32_t and so they have to printed
> using %u instead of %d in order to avoid wrong representations.
>
> Signed-off-by: Antonio Quartulli <ordex-GaUfNO9RBHfsrOwW+9ziJQ@public.gmane.org>
Fix this commit message subject, "%u" is "unsigned int" not
"unsigned long"
"unsigned long" would be "%lu"
^ permalink raw reply
* Re: [PATCH 05/11] batman-adv: handle routing code initialization properly
From: David Miller @ 2012-04-18 2:46 UTC (permalink / raw)
To: ordex-GaUfNO9RBHfsrOwW+9ziJQ
Cc: netdev-u79uwXL29TY76Z2rM5mHXA,
b.a.t.m.a.n-ZwoEplunGu2X36UT3dwllkB+6BGkLq7r,
lindner_marek-LWAfsSFWpa4
In-Reply-To: <1334663907-22725-6-git-send-email-ordex-GaUfNO9RBHfsrOwW+9ziJQ@public.gmane.org>
From: Antonio Quartulli <ordex-GaUfNO9RBHfsrOwW+9ziJQ@public.gmane.org>
Date: Tue, 17 Apr 2012 13:58:21 +0200
> @@ -30,10 +30,11 @@
> #include "send.h"
> #include "bat_algo.h"
>
> -static void bat_iv_ogm_iface_enable(struct hard_iface *hard_iface)
> +static int bat_iv_ogm_iface_enable(struct hard_iface *hard_iface)
> {
> struct batman_ogm_packet *batman_ogm_packet;
> unsigned long random_seqno;
> + int res = -1;
>
> /* randomize initial seqno to avoid collision */
> get_random_bytes(&random_seqno, sizeof(unsigned long));
Use real error codes, even as a default, instead of meaningless
values like -1.
^ permalink raw reply
* Re: [patch] Fix handling of overlength pathname in AF_UNIX sun_path
From: David Miller @ 2012-04-18 2:36 UTC (permalink / raw)
To: mtk.manpages
Cc: netdev, penguin-kernel, linux-api, yoshfuji, jengelh, w, alan
In-Reply-To: <4F8D497F.8060601@gmail.com>
From: Michael Kerrisk <mtk.manpages@gmail.com>
Date: Tue, 17 Apr 2012 22:44:15 +1200
> 1. Changing the kernel behavior prevents userspace having
> to go through the sort of contortions described above
> in order to handle the 108-non-NUL-bytes-in-sun_path case.
The problem with this logic is that it ignores every single Linux
system that exists right now.
You need to code this logic into your application unless you don't
want it to run properly on every Linux system that actually exists.
Sorry, we're not making this change.
^ permalink raw reply
* Re: [PATCH] net/sock.h: fix sk_peek_off kernel-doc warning
From: David Miller @ 2012-04-18 2:39 UTC (permalink / raw)
To: rdunlap; +Cc: netdev
In-Reply-To: <4F8E04E9.7030607@xenotime.net>
From: Randy Dunlap <rdunlap@xenotime.net>
Date: Tue, 17 Apr 2012 17:03:53 -0700
> From: Randy Dunlap <rdunlap@xenotime.net>
>
> Fix kernel-doc warning in net/sock.h:
>
> Warning(include/net/sock.h:377): No description found for parameter 'sk_peek_off'
>
> Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Applied, thanks Randy.
^ permalink raw reply
* Re: 3.3.0, 3.4-rc1 reproducible tun Oops
From: David Miller @ 2012-04-18 2:38 UTC (permalink / raw)
To: skinsbursky; +Cc: sim, eric.dumazet, netdev
In-Reply-To: <4F8DBB22.7060302@parallels.com>
From: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date: Tue, 17 Apr 2012 22:49:06 +0400
> Sorry for whitespaces.
> And thanks, Simon.
Please submit this fix formally, with Simon's Tested-by:
^ permalink raw reply
* Re: [PATCH] ipv6: clean up rt6_clean_expires
From: David Miller @ 2012-04-18 2:32 UTC (permalink / raw)
To: jbohac; +Cc: gaofeng, netdev
In-Reply-To: <20120416133541.GC18159@midget.suse.cz>
From: Jiri Bohac <jbohac@suse.cz>
Date: Mon, 16 Apr 2012 15:35:41 +0200
> Functionally, this change is a NOP.
>
> Semantically, rt6_clean_expires() wants to do rt->dst.from = NULL instead of
> rt->dst.expires = 0. It is clearing the RTF_EXPIRES flag, so the union is going
> to be treated as a pointer (dst.from) not a long (dst.expires).
>
> Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Applied.
^ permalink raw reply
* Re: [PATCH] tcp: fix tcp_grow_window() for large incoming frames
From: David Miller @ 2012-04-18 2:33 UTC (permalink / raw)
To: eric.dumazet; +Cc: ncardwell, therbert, netdev
In-Reply-To: <1334654887.2472.28.camel@edumazet-glaptop>
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 17 Apr 2012 11:28:07 +0200
> From: Eric Dumazet <edumazet@google.com>
>
> tcp_grow_window() has to grow rcv_ssthresh up to window_clamp, allowing
> sender to increase its window.
>
> tcp_grow_window() still assumes a tcp frame is under MSS, but its no
> longer true with LRO/GRO.
>
> This patch fixes one of the performance issue we noticed with GRO on.
>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Applied.
^ permalink raw reply
* Re: [PATCH] ipv6: fix rt6_update_expires
From: David Miller @ 2012-04-18 2:32 UTC (permalink / raw)
To: gaofeng; +Cc: jbohac, netdev
In-Reply-To: <4F8E25F0.3040703@cn.fujitsu.com>
From: Gao feng <gaofeng@cn.fujitsu.com>
Date: Wed, 18 Apr 2012 10:24:48 +0800
> 于 2012年04月16日 21:34, Jiri Bohac 写道:
>>
>> Commit 1716a961 (ipv6: fix problem with expired dst cache) broke PMTU
>> discovery. rt6_update_expires() calls dst_set_expires(), which only updates
>> dst->expires if it has not been set previously (expires == 0) or if the new
>> expires is earlier than the current dst->expires.
>>
>> rt6_update_expires() needs to zero rt->dst.expires, otherwise it will contain
>> ivalid data left over from rt->dst.from and will confuse dst_set_expires().
>>
>> Signed-off-by: Jiri Bohac <jbohac@suse.cz>
...
> looks good to me, thanks.
Applied.
^ permalink raw reply
* Re: [PATCH] davinci_mdio: Fix MDIO timeout check
From: David Miller @ 2012-04-18 2:32 UTC (permalink / raw)
To: christian.riesch
Cc: netdev, davinci-linux-open-source, ravonereal, manfred.rudigier,
stable, cyril
In-Reply-To: <1334586925-11348-1-git-send-email-christian.riesch@omicron.at>
From: Christian Riesch <christian.riesch@omicron.at>
Date: Mon, 16 Apr 2012 16:35:25 +0200
> Under heavy load (flood ping) it is possible for the MDIO timeout to
> expire before the loop checks the GO bit again. This patch adds an
> additional check whether the operation was done before actually
> returning -ETIMEDOUT.
>
> To reproduce this bug, flood ping the device, e.g., ping -f -l 1000
> After some time, a "timed out waiting for user access" warning
> may appear. And even worse, link may go down since the PHY reported a
> timeout.
>
> Signed-off-by: Christian Riesch <christian.riesch@omicron.at>
> Cc: <stable@vger.kernel.org>
> Cc: Cyril Chemparathy <cyril@ti.com>
Applied.
^ permalink raw reply
* Re: [PATCH] drivers/net/wan/farsync.c: add missing iounmap
From: David Miller @ 2012-04-18 2:33 UTC (permalink / raw)
To: Julia.Lawall; +Cc: kevin.curtis, kernel-janitors, netdev, linux-kernel
In-Reply-To: <1334589732-25876-1-git-send-email-Julia.Lawall@lip6.fr>
From: Julia Lawall <Julia.Lawall@lip6.fr>
Date: Mon, 16 Apr 2012 17:22:12 +0200
> From: Julia Lawall <Julia.Lawall@lip6.fr>
>
> Free card->mem in the error-handling code since it was successfully
> allocated just above.
>
> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Applied, thanks Julia.
^ permalink raw reply
* Re: [PATCH] netns: do not leak net_generic data on failed init
From: David Miller @ 2012-04-18 2:32 UTC (permalink / raw)
To: ja; +Cc: netdev, ebiederm
In-Reply-To: <1334587395-6033-1-git-send-email-ja@ssi.bg>
From: Julian Anastasov <ja@ssi.bg>
Date: Mon, 16 Apr 2012 17:43:15 +0300
> ops_init should free the net_generic data on
> init failure and __register_pernet_operations should not
> call ops_free when NET_NS is not enabled.
>
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
Eric please review this patch.
^ permalink raw reply
* Re: [PATCH 3/3] ehea: do not dereference possible NULL port
From: David Miller @ 2012-04-18 2:29 UTC (permalink / raw)
To: cascardo; +Cc: netdev, joe
In-Reply-To: <1334673715-16338-4-git-send-email-cascardo@linux.vnet.ibm.com>
From: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Date: Tue, 17 Apr 2012 11:41:55 -0300
> port may be NULL when we receive an interrupt too early in the probe.
>
> commit 8c4877a4128e7931077b024a891a4b284d8756a3, in particular, has
> introduced this problem in the case of port state change interrupt.
>
> This causes crashes in some situations:
Never fix this kind of bug like this. Do not make a tasklet or
an irq handler pay the price of the probe not doing things in the
right order.
Do not register asynchronous threads of control until all the
state is setup properly.
That's the right way to fix this problem.
^ permalink raw reply
* Re: [PATCH v18 15/15] Documentation: prctl/seccomp_filter
From: Paul Gortmaker @ 2012-04-18 2:28 UTC (permalink / raw)
To: Will Drewry
Cc: linux-kernel, linux-man, linux-security-module, linux-arch,
linux-doc, kernel-hardening, netdev, x86, arnd, davem, hpa, mingo,
oleg, peterz, rdunlap, mcgrathr, tglx, luto, eparis, serge.hallyn,
djm, scarybeasts, indan, pmoore, akpm, corbet, eric.dumazet,
markus, coreyb, keescook, jmorris
In-Reply-To: <1334267284-19166-15-git-send-email-wad@chromium.org>
On Thu, Apr 12, 2012 at 5:48 PM, Will Drewry <wad@chromium.org> wrote:
> Documents how system call filtering using Berkeley Packet
> Filter programs works and how it may be used.
> Includes an example for x86 and a semi-generic
> example using a macro-based code generator.
Hi guys, that is quite the To/CC list. I didn't have the heart to add
yet another address (linux-next) to it...
Can you have a look at this link? It appears to be breaking
the i386 allmodconfig builds in linux-next.
http://kisskb.ellerman.id.au/kisskb/buildresult/6123842/
"samples/seccomp/bpf-direct.c:47:2: error: #error Unsupported platform"
Thanks,
Paul.
--
>
> Acked-by: Eric Paris <eparis@redhat.com>
> Signed-off-by: Will Drewry <wad@chromium.org>
>
> v18: - added acked by
> - update no new privs numbers
> v17: - remove @compat note and add Pitfalls section for arch checking
> (keescook@chromium.org)
> v16: -
> v15: -
> v14: - rebase/nochanges
> v13: - rebase on to 88ebdda6159ffc15699f204c33feb3e431bf9bdc
> v12: - comment on the ptrace_event use
> - update arch support comment
> - note the behavior of SECCOMP_RET_DATA when there are multiple filters
> (keescook@chromium.org)
> - lots of samples/ clean up incl 64-bit bpf-direct support
> (markus@chromium.org)
> - rebase to linux-next
> v11: - overhaul return value language, updates (keescook@chromium.org)
> - comment on do_exit(SIGSYS)
> v10: - update for SIGSYS
> - update for new seccomp_data layout
> - update for ptrace option use
> v9: - updated bpf-direct.c for SIGILL
> v8: - add PR_SET_NO_NEW_PRIVS to the samples.
> v7: - updated for all the new stuff in v7: TRAP, TRACE
> - only talk about PR_SET_SECCOMP now
> - fixed bad JLE32 check (coreyb@linux.vnet.ibm.com)
> - adds dropper.c: a simple system call disabler
> v6: - tweak the language to note the requirement of
> PR_SET_NO_NEW_PRIVS being called prior to use. (luto@mit.edu)
> v5: - update sample to use system call arguments
> - adds a "fancy" example using a macro-based generator
> - cleaned up bpf in the sample
> - update docs to mention arguments
> - fix prctl value (eparis@redhat.com)
> - language cleanup (rdunlap@xenotime.net)
> v4: - update for no_new_privs use
> - minor tweaks
> v3: - call out BPF <-> Berkeley Packet Filter (rdunlap@xenotime.net)
> - document use of tentative always-unprivileged
> - guard sample compilation for i386 and x86_64
> v2: - move code to samples (corbet@lwn.net)
> ---
> Documentation/prctl/seccomp_filter.txt | 163 ++++++++++++++++++++++
> samples/Makefile | 2 +-
> samples/seccomp/Makefile | 38 +++++
> samples/seccomp/bpf-direct.c | 176 +++++++++++++++++++++++
> samples/seccomp/bpf-fancy.c | 102 ++++++++++++++
> samples/seccomp/bpf-helper.c | 89 ++++++++++++
> samples/seccomp/bpf-helper.h | 238 ++++++++++++++++++++++++++++++++
> samples/seccomp/dropper.c | 68 +++++++++
> 8 files changed, 875 insertions(+), 1 deletions(-)
> create mode 100644 Documentation/prctl/seccomp_filter.txt
> create mode 100644 samples/seccomp/Makefile
> create mode 100644 samples/seccomp/bpf-direct.c
> create mode 100644 samples/seccomp/bpf-fancy.c
> create mode 100644 samples/seccomp/bpf-helper.c
> create mode 100644 samples/seccomp/bpf-helper.h
> create mode 100644 samples/seccomp/dropper.c
>
> diff --git a/Documentation/prctl/seccomp_filter.txt b/Documentation/prctl/seccomp_filter.txt
> new file mode 100644
> index 0000000..597c3c5
> --- /dev/null
> +++ b/Documentation/prctl/seccomp_filter.txt
> @@ -0,0 +1,163 @@
> + SECure COMPuting with filters
> + =============================
> +
> +Introduction
> +------------
> +
> +A large number of system calls are exposed to every userland process
> +with many of them going unused for the entire lifetime of the process.
> +As system calls change and mature, bugs are found and eradicated. A
> +certain subset of userland applications benefit by having a reduced set
> +of available system calls. The resulting set reduces the total kernel
> +surface exposed to the application. System call filtering is meant for
> +use with those applications.
> +
> +Seccomp filtering provides a means for a process to specify a filter for
> +incoming system calls. The filter is expressed as a Berkeley Packet
> +Filter (BPF) program, as with socket filters, except that the data
> +operated on is related to the system call being made: system call
> +number and the system call arguments. This allows for expressive
> +filtering of system calls using a filter program language with a long
> +history of being exposed to userland and a straightforward data set.
> +
> +Additionally, BPF makes it impossible for users of seccomp to fall prey
> +to time-of-check-time-of-use (TOCTOU) attacks that are common in system
> +call interposition frameworks. BPF programs may not dereference
> +pointers which constrains all filters to solely evaluating the system
> +call arguments directly.
> +
> +What it isn't
> +-------------
> +
> +System call filtering isn't a sandbox. It provides a clearly defined
> +mechanism for minimizing the exposed kernel surface. It is meant to be
> +a tool for sandbox developers to use. Beyond that, policy for logical
> +behavior and information flow should be managed with a combination of
> +other system hardening techniques and, potentially, an LSM of your
> +choosing. Expressive, dynamic filters provide further options down this
> +path (avoiding pathological sizes or selecting which of the multiplexed
> +system calls in socketcall() is allowed, for instance) which could be
> +construed, incorrectly, as a more complete sandboxing solution.
> +
> +Usage
> +-----
> +
> +An additional seccomp mode is added and is enabled using the same
> +prctl(2) call as the strict seccomp. If the architecture has
> +CONFIG_HAVE_ARCH_SECCOMP_FILTER, then filters may be added as below:
> +
> +PR_SET_SECCOMP:
> + Now takes an additional argument which specifies a new filter
> + using a BPF program.
> + The BPF program will be executed over struct seccomp_data
> + reflecting the system call number, arguments, and other
> + metadata. The BPF program must then return one of the
> + acceptable values to inform the kernel which action should be
> + taken.
> +
> + Usage:
> + prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, prog);
> +
> + The 'prog' argument is a pointer to a struct sock_fprog which
> + will contain the filter program. If the program is invalid, the
> + call will return -1 and set errno to EINVAL.
> +
> + If fork/clone and execve are allowed by @prog, any child
> + processes will be constrained to the same filters and system
> + call ABI as the parent.
> +
> + Prior to use, the task must call prctl(PR_SET_NO_NEW_PRIVS, 1) or
> + run with CAP_SYS_ADMIN privileges in its namespace. If these are not
> + true, -EACCES will be returned. This requirement ensures that filter
> + programs cannot be applied to child processes with greater privileges
> + than the task that installed them.
> +
> + Additionally, if prctl(2) is allowed by the attached filter,
> + additional filters may be layered on which will increase evaluation
> + time, but allow for further decreasing the attack surface during
> + execution of a process.
> +
> +The above call returns 0 on success and non-zero on error.
> +
> +Return values
> +-------------
> +A seccomp filter may return any of the following values. If multiple
> +filters exist, the return value for the evaluation of a given system
> +call will always use the highest precedent value. (For example,
> +SECCOMP_RET_KILL will always take precedence.)
> +
> +In precedence order, they are:
> +
> +SECCOMP_RET_KILL:
> + Results in the task exiting immediately without executing the
> + system call. The exit status of the task (status & 0x7f) will
> + be SIGSYS, not SIGKILL.
> +
> +SECCOMP_RET_TRAP:
> + Results in the kernel sending a SIGSYS signal to the triggering
> + task without executing the system call. The kernel will
> + rollback the register state to just before the system call
> + entry such that a signal handler in the task will be able to
> + inspect the ucontext_t->uc_mcontext registers and emulate
> + system call success or failure upon return from the signal
> + handler.
> +
> + The SECCOMP_RET_DATA portion of the return value will be passed
> + as si_errno.
> +
> + SIGSYS triggered by seccomp will have a si_code of SYS_SECCOMP.
> +
> +SECCOMP_RET_ERRNO:
> + Results in the lower 16-bits of the return value being passed
> + to userland as the errno without executing the system call.
> +
> +SECCOMP_RET_TRACE:
> + When returned, this value will cause the kernel to attempt to
> + notify a ptrace()-based tracer prior to executing the system
> + call. If there is no tracer present, -ENOSYS is returned to
> + userland and the system call is not executed.
> +
> + A tracer will be notified if it requests PTRACE_O_TRACESECCOMP
> + using ptrace(PTRACE_SETOPTIONS). The tracer will be notified
> + of a PTRACE_EVENT_SECCOMP and the SECCOMP_RET_DATA portion of
> + the BPF program return value will be available to the tracer
> + via PTRACE_GETEVENTMSG.
> +
> +SECCOMP_RET_ALLOW:
> + Results in the system call being executed.
> +
> +If multiple filters exist, the return value for the evaluation of a
> +given system call will always use the highest precedent value.
> +
> +Precedence is only determined using the SECCOMP_RET_ACTION mask. When
> +multiple filters return values of the same precedence, only the
> +SECCOMP_RET_DATA from the most recently installed filter will be
> +returned.
> +
> +Pitfalls
> +--------
> +
> +The biggest pitfall to avoid during use is filtering on system call
> +number without checking the architecture value. Why? On any
> +architecture that supports multiple system call invocation conventions,
> +the system call numbers may vary based on the specific invocation. If
> +the numbers in the different calling conventions overlap, then checks in
> +the filters may be abused. Always check the arch value!
> +
> +Example
> +-------
> +
> +The samples/seccomp/ directory contains both an x86-specific example
> +and a more generic example of a higher level macro interface for BPF
> +program generation.
> +
> +
> +
> +Adding architecture support
> +-----------------------
> +
> +See arch/Kconfig for the authoritative requirements. In general, if an
> +architecture supports both ptrace_event and seccomp, it will be able to
> +support seccomp filter with minor fixup: SIGSYS support and seccomp return
> +value checking. Then it must just add CONFIG_HAVE_ARCH_SECCOMP_FILTER
> +to its arch-specific Kconfig.
> diff --git a/samples/Makefile b/samples/Makefile
> index 2f75851..5ef08bb 100644
> --- a/samples/Makefile
> +++ b/samples/Makefile
> @@ -1,4 +1,4 @@
> # Makefile for Linux samples code
>
> obj-$(CONFIG_SAMPLES) += kobject/ kprobes/ tracepoints/ trace_events/ \
> - hw_breakpoint/ kfifo/ kdb/ hidraw/ rpmsg/
> + hw_breakpoint/ kfifo/ kdb/ hidraw/ rpmsg/ seccomp/
> diff --git a/samples/seccomp/Makefile b/samples/seccomp/Makefile
> new file mode 100644
> index 0000000..e8fe0f5
> --- /dev/null
> +++ b/samples/seccomp/Makefile
> @@ -0,0 +1,38 @@
> +# kbuild trick to avoid linker error. Can be omitted if a module is built.
> +obj- := dummy.o
> +
> +hostprogs-$(CONFIG_SECCOMP) := bpf-fancy dropper
> +bpf-fancy-objs := bpf-fancy.o bpf-helper.o
> +
> +HOSTCFLAGS_bpf-fancy.o += -I$(objtree)/usr/include
> +HOSTCFLAGS_bpf-fancy.o += -idirafter $(objtree)/include
> +HOSTCFLAGS_bpf-helper.o += -I$(objtree)/usr/include
> +HOSTCFLAGS_bpf-helper.o += -idirafter $(objtree)/include
> +
> +HOSTCFLAGS_dropper.o += -I$(objtree)/usr/include
> +HOSTCFLAGS_dropper.o += -idirafter $(objtree)/include
> +dropper-objs := dropper.o
> +
> +# bpf-direct.c is x86-only.
> +ifeq ($(SRCARCH),x86)
> +# List of programs to build
> +hostprogs-$(CONFIG_SECCOMP) += bpf-direct
> +bpf-direct-objs := bpf-direct.o
> +endif
> +
> +HOSTCFLAGS_bpf-direct.o += -I$(objtree)/usr/include
> +HOSTCFLAGS_bpf-direct.o += -idirafter $(objtree)/include
> +
> +# Try to match the kernel target.
> +ifeq ($(CONFIG_64BIT),)
> +HOSTCFLAGS_bpf-direct.o += -m32
> +HOSTCFLAGS_dropper.o += -m32
> +HOSTCFLAGS_bpf-helper.o += -m32
> +HOSTCFLAGS_bpf-fancy.o += -m32
> +HOSTLOADLIBES_bpf-direct += -m32
> +HOSTLOADLIBES_bpf-fancy += -m32
> +HOSTLOADLIBES_dropper += -m32
> +endif
> +
> +# Tell kbuild to always build the programs
> +always := $(hostprogs-y)
> diff --git a/samples/seccomp/bpf-direct.c b/samples/seccomp/bpf-direct.c
> new file mode 100644
> index 0000000..26f523e
> --- /dev/null
> +++ b/samples/seccomp/bpf-direct.c
> @@ -0,0 +1,176 @@
> +/*
> + * Seccomp filter example for x86 (32-bit and 64-bit) with BPF macros
> + *
> + * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
> + * Author: Will Drewry <wad@chromium.org>
> + *
> + * The code may be used by anyone for any purpose,
> + * and can serve as a starting point for developing
> + * applications using prctl(PR_SET_SECCOMP, 2, ...).
> + */
> +#define __USE_GNU 1
> +#define _GNU_SOURCE 1
> +
> +#include <linux/types.h>
> +#include <linux/filter.h>
> +#include <linux/seccomp.h>
> +#include <linux/unistd.h>
> +#include <signal.h>
> +#include <stdio.h>
> +#include <stddef.h>
> +#include <string.h>
> +#include <sys/prctl.h>
> +#include <unistd.h>
> +
> +#define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
> +#define syscall_nr (offsetof(struct seccomp_data, nr))
> +
> +#if defined(__i386__)
> +#define REG_RESULT REG_EAX
> +#define REG_SYSCALL REG_EAX
> +#define REG_ARG0 REG_EBX
> +#define REG_ARG1 REG_ECX
> +#define REG_ARG2 REG_EDX
> +#define REG_ARG3 REG_ESI
> +#define REG_ARG4 REG_EDI
> +#define REG_ARG5 REG_EBP
> +#elif defined(__x86_64__)
> +#define REG_RESULT REG_RAX
> +#define REG_SYSCALL REG_RAX
> +#define REG_ARG0 REG_RDI
> +#define REG_ARG1 REG_RSI
> +#define REG_ARG2 REG_RDX
> +#define REG_ARG3 REG_R10
> +#define REG_ARG4 REG_R8
> +#define REG_ARG5 REG_R9
> +#else
> +#error Unsupported platform
> +#endif
> +
> +#ifndef PR_SET_NO_NEW_PRIVS
> +#define PR_SET_NO_NEW_PRIVS 38
> +#endif
> +
> +#ifndef SYS_SECCOMP
> +#define SYS_SECCOMP 1
> +#endif
> +
> +static void emulator(int nr, siginfo_t *info, void *void_context)
> +{
> + ucontext_t *ctx = (ucontext_t *)(void_context);
> + int syscall;
> + char *buf;
> + ssize_t bytes;
> + size_t len;
> + if (info->si_code != SYS_SECCOMP)
> + return;
> + if (!ctx)
> + return;
> + syscall = ctx->uc_mcontext.gregs[REG_SYSCALL];
> + buf = (char *) ctx->uc_mcontext.gregs[REG_ARG1];
> + len = (size_t) ctx->uc_mcontext.gregs[REG_ARG2];
> +
> + if (syscall != __NR_write)
> + return;
> + if (ctx->uc_mcontext.gregs[REG_ARG0] != STDERR_FILENO)
> + return;
> + /* Redirect stderr messages to stdout. Doesn't handle EINTR, etc */
> + ctx->uc_mcontext.gregs[REG_RESULT] = -1;
> + if (write(STDOUT_FILENO, "[ERR] ", 6) > 0) {
> + bytes = write(STDOUT_FILENO, buf, len);
> + ctx->uc_mcontext.gregs[REG_RESULT] = bytes;
> + }
> + return;
> +}
> +
> +static int install_emulator(void)
> +{
> + struct sigaction act;
> + sigset_t mask;
> + memset(&act, 0, sizeof(act));
> + sigemptyset(&mask);
> + sigaddset(&mask, SIGSYS);
> +
> + act.sa_sigaction = &emulator;
> + act.sa_flags = SA_SIGINFO;
> + if (sigaction(SIGSYS, &act, NULL) < 0) {
> + perror("sigaction");
> + return -1;
> + }
> + if (sigprocmask(SIG_UNBLOCK, &mask, NULL)) {
> + perror("sigprocmask");
> + return -1;
> + }
> + return 0;
> +}
> +
> +static int install_filter(void)
> +{
> + struct sock_filter filter[] = {
> + /* Grab the system call number */
> + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_nr),
> + /* Jump table for the allowed syscalls */
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_rt_sigreturn, 0, 1),
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
> +#ifdef __NR_sigreturn
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_sigreturn, 0, 1),
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
> +#endif
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_exit_group, 0, 1),
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_exit, 0, 1),
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_read, 1, 0),
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_write, 3, 2),
> +
> + /* Check that read is only using stdin. */
> + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_arg(0)),
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, STDIN_FILENO, 4, 0),
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
> +
> + /* Check that write is only using stdout */
> + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_arg(0)),
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, STDOUT_FILENO, 1, 0),
> + /* Trap attempts to write to stderr */
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, STDERR_FILENO, 1, 2),
> +
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_TRAP),
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
> + };
> + struct sock_fprog prog = {
> + .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
> + .filter = filter,
> + };
> +
> + if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
> + perror("prctl(NO_NEW_PRIVS)");
> + return 1;
> + }
> +
> +
> + if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
> + perror("prctl");
> + return 1;
> + }
> + return 0;
> +}
> +
> +#define payload(_c) (_c), sizeof((_c))
> +int main(int argc, char **argv)
> +{
> + char buf[4096];
> + ssize_t bytes = 0;
> + if (install_emulator())
> + return 1;
> + if (install_filter())
> + return 1;
> + syscall(__NR_write, STDOUT_FILENO,
> + payload("OHAI! WHAT IS YOUR NAME? "));
> + bytes = syscall(__NR_read, STDIN_FILENO, buf, sizeof(buf));
> + syscall(__NR_write, STDOUT_FILENO, payload("HELLO, "));
> + syscall(__NR_write, STDOUT_FILENO, buf, bytes);
> + syscall(__NR_write, STDERR_FILENO,
> + payload("Error message going to STDERR\n"));
> + return 0;
> +}
> diff --git a/samples/seccomp/bpf-fancy.c b/samples/seccomp/bpf-fancy.c
> new file mode 100644
> index 0000000..8eb483a
> --- /dev/null
> +++ b/samples/seccomp/bpf-fancy.c
> @@ -0,0 +1,102 @@
> +/*
> + * Seccomp BPF example using a macro-based generator.
> + *
> + * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
> + * Author: Will Drewry <wad@chromium.org>
> + *
> + * The code may be used by anyone for any purpose,
> + * and can serve as a starting point for developing
> + * applications using prctl(PR_ATTACH_SECCOMP_FILTER).
> + */
> +
> +#include <linux/filter.h>
> +#include <linux/seccomp.h>
> +#include <linux/unistd.h>
> +#include <stdio.h>
> +#include <string.h>
> +#include <sys/prctl.h>
> +#include <unistd.h>
> +
> +#include "bpf-helper.h"
> +
> +#ifndef PR_SET_NO_NEW_PRIVS
> +#define PR_SET_NO_NEW_PRIVS 38
> +#endif
> +
> +int main(int argc, char **argv)
> +{
> + struct bpf_labels l;
> + static const char msg1[] = "Please type something: ";
> + static const char msg2[] = "You typed: ";
> + char buf[256];
> + struct sock_filter filter[] = {
> + /* TODO: LOAD_SYSCALL_NR(arch) and enforce an arch */
> + LOAD_SYSCALL_NR,
> + SYSCALL(__NR_exit, ALLOW),
> + SYSCALL(__NR_exit_group, ALLOW),
> + SYSCALL(__NR_write, JUMP(&l, write_fd)),
> + SYSCALL(__NR_read, JUMP(&l, read)),
> + DENY, /* Don't passthrough into a label */
> +
> + LABEL(&l, read),
> + ARG(0),
> + JNE(STDIN_FILENO, DENY),
> + ARG(1),
> + JNE((unsigned long)buf, DENY),
> + ARG(2),
> + JGE(sizeof(buf), DENY),
> + ALLOW,
> +
> + LABEL(&l, write_fd),
> + ARG(0),
> + JEQ(STDOUT_FILENO, JUMP(&l, write_buf)),
> + JEQ(STDERR_FILENO, JUMP(&l, write_buf)),
> + DENY,
> +
> + LABEL(&l, write_buf),
> + ARG(1),
> + JEQ((unsigned long)msg1, JUMP(&l, msg1_len)),
> + JEQ((unsigned long)msg2, JUMP(&l, msg2_len)),
> + JEQ((unsigned long)buf, JUMP(&l, buf_len)),
> + DENY,
> +
> + LABEL(&l, msg1_len),
> + ARG(2),
> + JLT(sizeof(msg1), ALLOW),
> + DENY,
> +
> + LABEL(&l, msg2_len),
> + ARG(2),
> + JLT(sizeof(msg2), ALLOW),
> + DENY,
> +
> + LABEL(&l, buf_len),
> + ARG(2),
> + JLT(sizeof(buf), ALLOW),
> + DENY,
> + };
> + struct sock_fprog prog = {
> + .filter = filter,
> + .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
> + };
> + ssize_t bytes;
> + bpf_resolve_jumps(&l, filter, sizeof(filter)/sizeof(*filter));
> +
> + if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
> + perror("prctl(NO_NEW_PRIVS)");
> + return 1;
> + }
> +
> + if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
> + perror("prctl(SECCOMP)");
> + return 1;
> + }
> + syscall(__NR_write, STDOUT_FILENO, msg1, strlen(msg1));
> + bytes = syscall(__NR_read, STDIN_FILENO, buf, sizeof(buf)-1);
> + bytes = (bytes > 0 ? bytes : 0);
> + syscall(__NR_write, STDERR_FILENO, msg2, strlen(msg2));
> + syscall(__NR_write, STDERR_FILENO, buf, bytes);
> + /* Now get killed */
> + syscall(__NR_write, STDERR_FILENO, msg2, strlen(msg2)+2);
> + return 0;
> +}
> diff --git a/samples/seccomp/bpf-helper.c b/samples/seccomp/bpf-helper.c
> new file mode 100644
> index 0000000..579cfe3
> --- /dev/null
> +++ b/samples/seccomp/bpf-helper.c
> @@ -0,0 +1,89 @@
> +/*
> + * Seccomp BPF helper functions
> + *
> + * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
> + * Author: Will Drewry <wad@chromium.org>
> + *
> + * The code may be used by anyone for any purpose,
> + * and can serve as a starting point for developing
> + * applications using prctl(PR_ATTACH_SECCOMP_FILTER).
> + */
> +
> +#include <stdio.h>
> +#include <string.h>
> +
> +#include "bpf-helper.h"
> +
> +int bpf_resolve_jumps(struct bpf_labels *labels,
> + struct sock_filter *filter, size_t count)
> +{
> + struct sock_filter *begin = filter;
> + __u8 insn = count - 1;
> +
> + if (count < 1)
> + return -1;
> + /*
> + * Walk it once, backwards, to build the label table and do fixups.
> + * Since backward jumps are disallowed by BPF, this is easy.
> + */
> + filter += insn;
> + for (; filter >= begin; --insn, --filter) {
> + if (filter->code != (BPF_JMP+BPF_JA))
> + continue;
> + switch ((filter->jt<<8)|filter->jf) {
> + case (JUMP_JT<<8)|JUMP_JF:
> + if (labels->labels[filter->k].location == 0xffffffff) {
> + fprintf(stderr, "Unresolved label: '%s'\n",
> + labels->labels[filter->k].label);
> + return 1;
> + }
> + filter->k = labels->labels[filter->k].location -
> + (insn + 1);
> + filter->jt = 0;
> + filter->jf = 0;
> + continue;
> + case (LABEL_JT<<8)|LABEL_JF:
> + if (labels->labels[filter->k].location != 0xffffffff) {
> + fprintf(stderr, "Duplicate label use: '%s'\n",
> + labels->labels[filter->k].label);
> + return 1;
> + }
> + labels->labels[filter->k].location = insn;
> + filter->k = 0; /* fall through */
> + filter->jt = 0;
> + filter->jf = 0;
> + continue;
> + }
> + }
> + return 0;
> +}
> +
> +/* Simple lookup table for labels. */
> +__u32 seccomp_bpf_label(struct bpf_labels *labels, const char *label)
> +{
> + struct __bpf_label *begin = labels->labels, *end;
> + int id;
> + if (labels->count == 0) {
> + begin->label = label;
> + begin->location = 0xffffffff;
> + labels->count++;
> + return 0;
> + }
> + end = begin + labels->count;
> + for (id = 0; begin < end; ++begin, ++id) {
> + if (!strcmp(label, begin->label))
> + return id;
> + }
> + begin->label = label;
> + begin->location = 0xffffffff;
> + labels->count++;
> + return id;
> +}
> +
> +void seccomp_bpf_print(struct sock_filter *filter, size_t count)
> +{
> + struct sock_filter *end = filter + count;
> + for ( ; filter < end; ++filter)
> + printf("{ code=%u,jt=%u,jf=%u,k=%u },\n",
> + filter->code, filter->jt, filter->jf, filter->k);
> +}
> diff --git a/samples/seccomp/bpf-helper.h b/samples/seccomp/bpf-helper.h
> new file mode 100644
> index 0000000..643279d
> --- /dev/null
> +++ b/samples/seccomp/bpf-helper.h
> @@ -0,0 +1,238 @@
> +/*
> + * Example wrapper around BPF macros.
> + *
> + * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
> + * Author: Will Drewry <wad@chromium.org>
> + *
> + * The code may be used by anyone for any purpose,
> + * and can serve as a starting point for developing
> + * applications using prctl(PR_SET_SECCOMP, 2, ...).
> + *
> + * No guarantees are provided with respect to the correctness
> + * or functionality of this code.
> + */
> +#ifndef __BPF_HELPER_H__
> +#define __BPF_HELPER_H__
> +
> +#include <asm/bitsperlong.h> /* for __BITS_PER_LONG */
> +#include <endian.h>
> +#include <linux/filter.h>
> +#include <linux/seccomp.h> /* for seccomp_data */
> +#include <linux/types.h>
> +#include <linux/unistd.h>
> +#include <stddef.h>
> +
> +#define BPF_LABELS_MAX 256
> +struct bpf_labels {
> + int count;
> + struct __bpf_label {
> + const char *label;
> + __u32 location;
> + } labels[BPF_LABELS_MAX];
> +};
> +
> +int bpf_resolve_jumps(struct bpf_labels *labels,
> + struct sock_filter *filter, size_t count);
> +__u32 seccomp_bpf_label(struct bpf_labels *labels, const char *label);
> +void seccomp_bpf_print(struct sock_filter *filter, size_t count);
> +
> +#define JUMP_JT 0xff
> +#define JUMP_JF 0xff
> +#define LABEL_JT 0xfe
> +#define LABEL_JF 0xfe
> +
> +#define ALLOW \
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
> +#define DENY \
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
> +#define JUMP(labels, label) \
> + BPF_JUMP(BPF_JMP+BPF_JA, FIND_LABEL((labels), (label)), \
> + JUMP_JT, JUMP_JF)
> +#define LABEL(labels, label) \
> + BPF_JUMP(BPF_JMP+BPF_JA, FIND_LABEL((labels), (label)), \
> + LABEL_JT, LABEL_JF)
> +#define SYSCALL(nr, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (nr), 0, 1), \
> + jt
> +
> +/* Lame, but just an example */
> +#define FIND_LABEL(labels, label) seccomp_bpf_label((labels), #label)
> +
> +#define EXPAND(...) __VA_ARGS__
> +/* Map all width-sensitive operations */
> +#if __BITS_PER_LONG == 32
> +
> +#define JEQ(x, jt) JEQ32(x, EXPAND(jt))
> +#define JNE(x, jt) JNE32(x, EXPAND(jt))
> +#define JGT(x, jt) JGT32(x, EXPAND(jt))
> +#define JLT(x, jt) JLT32(x, EXPAND(jt))
> +#define JGE(x, jt) JGE32(x, EXPAND(jt))
> +#define JLE(x, jt) JLE32(x, EXPAND(jt))
> +#define JA(x, jt) JA32(x, EXPAND(jt))
> +#define ARG(i) ARG_32(i)
> +#define LO_ARG(idx) offsetof(struct seccomp_data, args[(idx)])
> +
> +#elif __BITS_PER_LONG == 64
> +
> +/* Ensure that we load the logically correct offset. */
> +#if __BYTE_ORDER == __LITTLE_ENDIAN
> +#define ENDIAN(_lo, _hi) _lo, _hi
> +#define LO_ARG(idx) offsetof(struct seccomp_data, args[(idx)])
> +#define HI_ARG(idx) offsetof(struct seccomp_data, args[(idx)]) + sizeof(__u32)
> +#elif __BYTE_ORDER == __BIG_ENDIAN
> +#define ENDIAN(_lo, _hi) _hi, _lo
> +#define LO_ARG(idx) offsetof(struct seccomp_data, args[(idx)]) + sizeof(__u32)
> +#define HI_ARG(idx) offsetof(struct seccomp_data, args[(idx)])
> +#else
> +#error "Unknown endianness"
> +#endif
> +
> +union arg64 {
> + struct {
> + __u32 ENDIAN(lo32, hi32);
> + };
> + __u64 u64;
> +};
> +
> +#define JEQ(x, jt) \
> + JEQ64(((union arg64){.u64 = (x)}).lo32, \
> + ((union arg64){.u64 = (x)}).hi32, \
> + EXPAND(jt))
> +#define JGT(x, jt) \
> + JGT64(((union arg64){.u64 = (x)}).lo32, \
> + ((union arg64){.u64 = (x)}).hi32, \
> + EXPAND(jt))
> +#define JGE(x, jt) \
> + JGE64(((union arg64){.u64 = (x)}).lo32, \
> + ((union arg64){.u64 = (x)}).hi32, \
> + EXPAND(jt))
> +#define JNE(x, jt) \
> + JNE64(((union arg64){.u64 = (x)}).lo32, \
> + ((union arg64){.u64 = (x)}).hi32, \
> + EXPAND(jt))
> +#define JLT(x, jt) \
> + JLT64(((union arg64){.u64 = (x)}).lo32, \
> + ((union arg64){.u64 = (x)}).hi32, \
> + EXPAND(jt))
> +#define JLE(x, jt) \
> + JLE64(((union arg64){.u64 = (x)}).lo32, \
> + ((union arg64){.u64 = (x)}).hi32, \
> + EXPAND(jt))
> +
> +#define JA(x, jt) \
> + JA64(((union arg64){.u64 = (x)}).lo32, \
> + ((union arg64){.u64 = (x)}).hi32, \
> + EXPAND(jt))
> +#define ARG(i) ARG_64(i)
> +
> +#else
> +#error __BITS_PER_LONG value unusable.
> +#endif
> +
> +/* Loads the arg into A */
> +#define ARG_32(idx) \
> + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx))
> +
> +/* Loads hi into A and lo in X */
> +#define ARG_64(idx) \
> + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx)), \
> + BPF_STMT(BPF_ST, 0), /* lo -> M[0] */ \
> + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, HI_ARG(idx)), \
> + BPF_STMT(BPF_ST, 1) /* hi -> M[1] */
> +
> +#define JEQ32(value, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (value), 0, 1), \
> + jt
> +
> +#define JNE32(value, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (value), 1, 0), \
> + jt
> +
> +/* Checks the lo, then swaps to check the hi. A=lo,X=hi */
> +#define JEQ64(lo, hi, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
> + BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 0, 2), \
> + BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
> + jt, \
> + BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
> +
> +#define JNE64(lo, hi, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 5, 0), \
> + BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 2, 0), \
> + BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
> + jt, \
> + BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
> +
> +#define JA32(value, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (value), 0, 1), \
> + jt
> +
> +#define JA64(lo, hi, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (hi), 3, 0), \
> + BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
> + BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (lo), 0, 2), \
> + BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
> + jt, \
> + BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
> +
> +#define JGE32(value, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 0, 1), \
> + jt
> +
> +#define JLT32(value, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 1, 0), \
> + jt
> +
> +/* Shortcut checking if hi > arg.hi. */
> +#define JGE64(lo, hi, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
> + BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
> + BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (lo), 0, 2), \
> + BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
> + jt, \
> + BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
> +
> +#define JLT64(lo, hi, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
> + BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
> + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \
> + BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
> + jt, \
> + BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
> +
> +#define JGT32(value, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 0, 1), \
> + jt
> +
> +#define JLE32(value, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 1, 0), \
> + jt
> +
> +/* Check hi > args.hi first, then do the GE checking */
> +#define JGT64(lo, hi, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
> + BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
> + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 0, 2), \
> + BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
> + jt, \
> + BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
> +
> +#define JLE64(lo, hi, jt) \
> + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 6, 0), \
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 3), \
> + BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
> + BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \
> + BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
> + jt, \
> + BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
> +
> +#define LOAD_SYSCALL_NR \
> + BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
> + offsetof(struct seccomp_data, nr))
> +
> +#endif /* __BPF_HELPER_H__ */
> diff --git a/samples/seccomp/dropper.c b/samples/seccomp/dropper.c
> new file mode 100644
> index 0000000..c69c347
> --- /dev/null
> +++ b/samples/seccomp/dropper.c
> @@ -0,0 +1,68 @@
> +/*
> + * Naive system call dropper built on seccomp_filter.
> + *
> + * Copyright (c) 2012 The Chromium OS Authors <chromium-os-dev@chromium.org>
> + * Author: Will Drewry <wad@chromium.org>
> + *
> + * The code may be used by anyone for any purpose,
> + * and can serve as a starting point for developing
> + * applications using prctl(PR_SET_SECCOMP, 2, ...).
> + *
> + * When run, returns the specified errno for the specified
> + * system call number against the given architecture.
> + *
> + * Run this one as root as PR_SET_NO_NEW_PRIVS is not called.
> + */
> +
> +#include <errno.h>
> +#include <linux/audit.h>
> +#include <linux/filter.h>
> +#include <linux/seccomp.h>
> +#include <linux/unistd.h>
> +#include <stdio.h>
> +#include <stddef.h>
> +#include <stdlib.h>
> +#include <sys/prctl.h>
> +#include <unistd.h>
> +
> +static int install_filter(int nr, int arch, int error)
> +{
> + struct sock_filter filter[] = {
> + BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
> + (offsetof(struct seccomp_data, arch))),
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, arch, 0, 3),
> + BPF_STMT(BPF_LD+BPF_W+BPF_ABS,
> + (offsetof(struct seccomp_data, nr))),
> + BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, nr, 0, 1),
> + BPF_STMT(BPF_RET+BPF_K,
> + SECCOMP_RET_ERRNO|(error & SECCOMP_RET_DATA)),
> + BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
> + };
> + struct sock_fprog prog = {
> + .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
> + .filter = filter,
> + };
> + if (prctl(PR_SET_SECCOMP, 2, &prog)) {
> + perror("prctl");
> + return 1;
> + }
> + return 0;
> +}
> +
> +int main(int argc, char **argv)
> +{
> + if (argc < 5) {
> + fprintf(stderr, "Usage:\n"
> + "dropper <syscall_nr> <arch> <errno> <prog> [<args>]\n"
> + "Hint: AUDIT_ARCH_I386: 0x%X\n"
> + " AUDIT_ARCH_X86_64: 0x%X\n"
> + "\n", AUDIT_ARCH_I386, AUDIT_ARCH_X86_64);
> + return 1;
> + }
> + if (install_filter(strtol(argv[1], NULL, 0), strtol(argv[2], NULL, 0),
> + strtol(argv[3], NULL, 0)))
> + return 1;
> + execv(argv[4], &argv[4]);
> + printf("Failed to execv\n");
> + return 255;
> +}
> --
> 1.7.5.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH] ipv6: fix rt6_update_expires
From: Gao feng @ 2012-04-18 2:24 UTC (permalink / raw)
To: Jiri Bohac; +Cc: David Miller, netdev
In-Reply-To: <20120416133439.GB18159@midget.suse.cz>
于 2012年04月16日 21:34, Jiri Bohac 写道:
>
> Commit 1716a961 (ipv6: fix problem with expired dst cache) broke PMTU
> discovery. rt6_update_expires() calls dst_set_expires(), which only updates
> dst->expires if it has not been set previously (expires == 0) or if the new
> expires is earlier than the current dst->expires.
>
> rt6_update_expires() needs to zero rt->dst.expires, otherwise it will contain
> ivalid data left over from rt->dst.from and will confuse dst_set_expires().
>
> Signed-off-by: Jiri Bohac <jbohac@suse.cz>
>
> diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
> index ad4126f..68c1f94 100644
> --- a/include/net/ip6_fib.h
> +++ b/include/net/ip6_fib.h
> @@ -143,8 +143,13 @@ static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
>
> static inline void rt6_update_expires(struct rt6_info *rt, int timeout)
> {
> - if (!(rt->rt6i_flags & RTF_EXPIRES) && rt->dst.from)
> - dst_release(rt->dst.from);
> + if (!(rt->rt6i_flags & RTF_EXPIRES)) {
> + if (rt->dst.from)
> + dst_release(rt->dst.from);
> + /* dst_set_expires relies on expires == 0
> + if it has not been set previously */
> + rt->dst.expires = 0;
> + }
>
> dst_set_expires(&rt->dst, timeout);
> rt->rt6i_flags |= RTF_EXPIRES;
>
looks good to me, thanks.
^ permalink raw reply
* Re: [PATCH] arcnet: rimi: Fix device name in debug output
From: David Miller @ 2012-04-18 2:24 UTC (permalink / raw)
To: jkosina; +Cc: sdyoung, linux-kernel, netdev
In-Reply-To: <alpine.LNX.2.00.1204161335420.16373@pobox.suse.cz>
From: Jiri Kosina <jkosina@suse.cz>
Date: Mon, 16 Apr 2012 14:02:48 +0200 (CEST)
> From: Jiri Kosina <jkosina@suse.cz>
> Subject: [PATCH] arcnet: rimi: Fix device name in debug output
>
> arcrimi_probe() calls BUGMSG() before register_netdev() happens. BUGMSG()
> itself prints dev->name, but as the format string hasn't been expanded by
> register_netdev() yet, the output contains bogus device name such as
>
> arc%d: Given: node 00h, shmem 0h, irq 0
>
> As we don't know the device name yet, just drop the prefix completely from
> the debugging messages.
>
> Reported-by: Steven Young <sdyoung@vt220.org>
> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Applied, thanks.
^ permalink raw reply
* Re: tg3: Occassional death on 3.3
From: Matt Carlson @ 2012-04-18 0:55 UTC (permalink / raw)
To: Ilia Mirkin; +Cc: Matt Carlson, Michael Chan, netdev
In-Reply-To: <CAKb7UvjWACB5wF9B1GvznVd64Vby_9ri4SMo57RpAhrhf+awFg@mail.gmail.com>
On Tue, Apr 17, 2012 at 08:22:31PM -0400, Ilia Mirkin wrote:
> Hello,
>
> I'm observing an issue where it appears that tg3 gets wedged into a
> bad state every so often, and never recovers. Doing a sequence of
>
> ifconfig eth0 down
> rmmod broadcom
> rmmod tg3
>
> modprobe broadcom
> modprobe tg3
>
> Makes everything work again. The card I have:
>
> 03:00.0 Ethernet controller [0200]: Broadcom Corporation NetLink
> BCM57788 Gigabit Ethernet PCIe [14e4:1691] (rev 01)
> Subsystem: Dell XPS 8300 [1028:04aa]
> Flags: bus master, fast devsel, latency 0, IRQ 45
> Memory at fb100000 (64-bit, non-prefetchable) [size=64K]
> Capabilities: [48] Power Management version 3
> Capabilities: [60] Vendor Specific Information: Len=6c <?>
> Capabilities: [50] MSI: Enable+ Count=1/1 Maskable- 64bit+
> Capabilities: [cc] Express Endpoint, MSI 00
> Capabilities: [100] Advanced Error Reporting
> Capabilities: [13c] Virtual Channel
> Capabilities: [160] Device Serial Number [the mac address]
> Capabilities: [16c] Power Budgeting <?>
> Kernel driver in use: tg3
> Kernel modules: tg3
>
> I'm attaching the log for the full data dump, since my mailer will
> wrap it horribly otherwise, but the interesting lines are:
>
> [2234380.228971] tg3 0000:03:00.0: eth0: transmit timed out, resetting
> ... some kind of data dump ...
> [2234382.216682] tg3 0000:03:00.0: eth0: 0: Host status block
> [00000001:00000080:(0000:01ef:0000):(01ef:00b2)]
> [2234382.216685] tg3 0000:03:00.0: eth0: 0: NAPI info
> [00000080:00000080:(00cb:00b2:01ff):01ef:(00b7:0000:0000:0000)]
> [2234382.319550] tg3 0000:03:00.0: tg3_stop_block timed out, ofs=1400
> enable_bit=2
> [2234382.421931] tg3 0000:03:00.0: tg3_stop_block timed out, ofs=c00
> enable_bit=2
> [2234382.427199] tg3 0000:03:00.0: eth0: Link is down
> [2234382.438168] tg3 0000:03:00.0: eth0: Link is down
>
> Any further attempts to use the NIC, like ifconfig down/up result in a
> similar error log sequence happening. Also, while it's happening, the
> computer feels extremely laggy for a short period of time (~1s),
> leading me to believe it's doing an uninterruptible sleep of some kind
> going on.
>
> This has happened twice, and at least the second time, there was no
> unusual traffic on the network. It's linked at 100M, and was probably
> doing 10K/s at most when the error happened. If this is insufficient
> information, please let me know what I should collect next time this
> might happen.
>
> Thanks,
Thanks for the report Ilia. I'm guessing the lag is coming from the
driver as it logs the register dump to the syslog.
The register dump shows that interrupts are enabled, but the tag value in
the interrupt mailbox register doesn't match the value in the status block
or the driver's private tag value. I'll see where that leads me.
Stay tuned.
^ permalink raw reply
* [PATCH V2 1/2] bonding support for IPv6 transmit hashing
From: John @ 2012-04-18 0:27 UTC (permalink / raw)
To: netdev
--- a/drivers/net/bonding/bond_main.c 2012-03-18 16:15:34.000000000 -0700
+++ b/drivers/net/bonding/bond_main.c 2012-04-14 20:23:26.000000000 -0700
@@ -3352,56 +3352,87 @@
/*---------------------------- Hashing Policies -----------------------------*/
/*
+ * Hash for the output device based upon layer 2 data
+ */
+static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
+{
+ struct ethhdr *data = (struct ethhdr *)skb->data;
+
+ if (skb_headlen(skb) >= 6)
+ return (data->h_dest[5] ^ data->h_source[5]) % count;
+
+ return 0;
+}
+
+/*
* Hash for the output device based upon layer 2 and layer 3 data. If
- * the packet is not IP mimic bond_xmit_hash_policy_l2()
+ * the packet is not IP, fall back on bond_xmit_hash_policy_l2()
*/
static int bond_xmit_hash_policy_l23(struct sk_buff *skb, int count)
{
struct ethhdr *data = (struct ethhdr *)skb->data;
- struct iphdr *iph = ip_hdr(skb);
- if (skb->protocol == htons(ETH_P_IP)) {
+ if (skb->protocol == htons(ETH_P_IP) &&
+ skb_network_header_len(skb) >= sizeof(struct iphdr)) {
+ struct iphdr *iph = ip_hdr(skb);
return ((ntohl(iph->saddr ^ iph->daddr) & 0xffff) ^
(data->h_dest[5] ^ data->h_source[5])) % count;
+ } else if (skb->protocol == htons(ETH_P_IPV6) &&
+ skb_network_header_len(skb) >= sizeof(struct ipv6hdr)) {
+ struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+ u32 v6hash =
+ (ipv6h->saddr.s6_addr32[1] ^ ipv6h->daddr.s6_addr32[1]) ^
+ (ipv6h->saddr.s6_addr32[2] ^ ipv6h->daddr.s6_addr32[2]) ^
+ (ipv6h->saddr.s6_addr32[3] ^ ipv6h->daddr.s6_addr32[3]);
+ v6hash = (v6hash >> 16) ^ (v6hash >> 8) ^ v6hash;
+ return (v6hash ^ data->h_dest[5] ^ data->h_source[5]) % count;
}
- return (data->h_dest[5] ^ data->h_source[5]) % count;
+ return bond_xmit_hash_policy_l2(skb, count);
}
/*
* Hash for the output device based upon layer 3 and layer 4 data. If
* the packet is a frag or not TCP or UDP, just use layer 3 data. If it is
- * altogether not IP, mimic bond_xmit_hash_policy_l2()
+ * altogether not IP, fall back on bond_xmit_hash_policy_l2()
*/
static int bond_xmit_hash_policy_l34(struct sk_buff *skb, int count)
{
- struct ethhdr *data = (struct ethhdr *)skb->data;
- struct iphdr *iph = ip_hdr(skb);
- __be16 *layer4hdr = (__be16 *)((u32 *)iph + iph->ihl);
- int layer4_xor = 0;
+ u32 layer4_xor = 0;
if (skb->protocol == htons(ETH_P_IP)) {
+ struct iphdr *iph = ip_hdr(skb);
if (!ip_is_fragment(iph) &&
- (iph->protocol == IPPROTO_TCP ||
- iph->protocol == IPPROTO_UDP)) {
+ (iph->protocol == IPPROTO_TCP ||
+ iph->protocol == IPPROTO_UDP)) {
+ __be16 *layer4hdr = (__be16 *)((u32 *)iph + iph->ihl);
+ if (iph->ihl * sizeof(u32) + sizeof(__be16) * 2 >
+ skb_headlen(skb) - skb_network_offset(skb)) goto SHORT_HEADER;
layer4_xor = ntohs((*layer4hdr ^ *(layer4hdr + 1)));
+ } else if (skb_network_header_len(skb) < sizeof(struct iphdr)) {
+ goto SHORT_HEADER;
}
return (layer4_xor ^
((ntohl(iph->saddr ^ iph->daddr)) & 0xffff)) % count;
-
+ } else if (skb->protocol == htons(ETH_P_IPV6)) {
+ struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+ if (ipv6h->nexthdr == IPPROTO_TCP || ipv6h->nexthdr == IPPROTO_UDP) {
+ __be16 *layer4hdrv6 = (__be16 *)((u8 *)ipv6h + sizeof(struct ipv6hdr));
+ if (sizeof(struct ipv6hdr) + sizeof(__be16) * 2 >
+ skb_headlen(skb) - skb_network_offset(skb)) goto SHORT_HEADER;
+ layer4_xor = (*layer4hdrv6 ^ *(layer4hdrv6 + 1));
+ } else if (skb_network_header_len(skb) < sizeof(struct ipv6hdr)) {
+ goto SHORT_HEADER;
+ }
+ layer4_xor ^=
+ (ipv6h->saddr.s6_addr32[1] ^ ipv6h->daddr.s6_addr32[1]) ^
+ (ipv6h->saddr.s6_addr32[2] ^ ipv6h->daddr.s6_addr32[2]) ^
+ (ipv6h->saddr.s6_addr32[3] ^ ipv6h->daddr.s6_addr32[3]);
+ return ((layer4_xor >> 16) ^ (layer4_xor >> 8) ^ layer4_xor) % count;
}
- return (data->h_dest[5] ^ data->h_source[5]) % count;
-}
-
-/*
- * Hash for the output device based upon layer 2 data
- */
-static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
-{
- struct ethhdr *data = (struct ethhdr *)skb->data;
-
- return (data->h_dest[5] ^ data->h_source[5]) % count;
+ SHORT_HEADER:
+ return bond_xmit_hash_policy_l2(skb, count);
}
/*-------------------------- Device entry points ----------------------------*/
^ permalink raw reply
* [PATCH V2 2/2] bonding support for IPv6 transmit hashing
From: John @ 2012-04-18 0:28 UTC (permalink / raw)
To: netdev
--- a/Documentation/networking/bonding.txt 2012-02-08 19:21:53.000000000 -0800
+++ b/Documentation/networking/bonding.txt 2012-02-13 01:11:35.000000000 -0800
@@ -753,12 +753,22 @@
protocol information to generate the hash.
Uses XOR of hardware MAC addresses and IP addresses to
- generate the hash. The formula is
+ generate the hash. The IPv4 formula is
(((source IP XOR dest IP) AND 0xffff) XOR
( source MAC XOR destination MAC ))
modulo slave count
+ The IPv6 forumla is
+
+ iphash =
+ (source ip quad 2 XOR dest IP quad 2) XOR
+ (source ip quad 3 XOR dest IP quad 3) XOR
+ (source ip quad 4 XOR dest IP quad 4)
+
+ ((iphash >> 16) XOR (iphash >> 8) XOR iphash)
+ modulo slave count
+
This algorithm will place all traffic to a particular
network peer on the same slave. For non-IP traffic,
the formula is the same as for the layer2 transmit
@@ -779,19 +789,30 @@
slaves, although a single connection will not span
multiple slaves.
- The formula for unfragmented TCP and UDP packets is
+ The formula for unfragmented IPv4 TCP and UDP packets is
((source port XOR dest port) XOR
((source IP XOR dest IP) AND 0xffff)
modulo slave count
- For fragmented TCP or UDP packets and all other IP
- protocol traffic, the source and destination port
+ The formula for unfragmented IPv6 TCP and UDP packets is
+
+ iphash =
+ (source ip quad 2 XOR dest IP quad 2) XOR
+ (source ip quad 3 XOR dest IP quad 3) XOR
+ (source ip quad 4 XOR dest IP quad 4)
+
+ ((source port XOR dest port) XOR
+ (iphash >> 16) XOR (iphash >> 8) XOR iphash)
+ modulo slave count
+
+ For fragmented TCP or UDP packets and all other IPv4 and
+ IPv6 protocol traffic, the source and destination port
information is omitted. For non-IP traffic, the
formula is the same as for the layer2 transmit hash
policy.
- This policy is intended to mimic the behavior of
+ The IPv4 policy is intended to mimic the behavior of
certain switches, notably Cisco switches with PFC2 as
well as some Foundry and IBM products.
^ permalink raw reply
* [PATCH V2 0/2] bonding support for IPv6 transmit hashing
From: John @ 2012-04-18 0:27 UTC (permalink / raw)
To: netdev
Currently the "bonding" driver does not support load balancing outgoing
traffic in LACP mode for IPv6 traffic. IPv4 (and TCP or UDP over IPv4)
are currently supported; this patch adds transmit hashing for IPv6
(and TCP or UDP over IPv6), bringing IPv6 up to par with IPv4 support
in the bonding driver.
The algorithm chosen (xor'ing the bottom three quads and then xor'ing
the bottom three bytes of that) was chosen after testing almost 400,000
unique IPv6 addresses harvested from server logs. This algorithm
had the most even distribution for both big- and little-endian
architectures while still using few instructions.
Fragmented IPv6 packets are handled the same way as fragmented
IPv4 packets, ie, they are not balanced based on layer 4
information. Additionally, IPv6 packets with intermediate headers
are not balanced based on layer 4 information. In practice these
intermediate headers are not common and this should not cause any
problems, and the alternative (a packet-parsing loop and look-up table)
seemed slow and complicated for little gain.
This is an update to a prior patch I submitted. This version includes
a clarified description, more thorough bounds checking, updates
functions to call bond_xmit_hash_policy_l2 rather than re-implement
the same logic, and patches against Linux 3.3. Patch has been tested
and performs as expected.
John
^ permalink raw reply
* tg3: Occassional death on 3.3
From: Ilia Mirkin @ 2012-04-18 0:22 UTC (permalink / raw)
To: Matt Carlson, Michael Chan, netdev
[-- Attachment #1: Type: text/plain, Size: 2395 bytes --]
Hello,
I'm observing an issue where it appears that tg3 gets wedged into a
bad state every so often, and never recovers. Doing a sequence of
ifconfig eth0 down
rmmod broadcom
rmmod tg3
modprobe broadcom
modprobe tg3
Makes everything work again. The card I have:
03:00.0 Ethernet controller [0200]: Broadcom Corporation NetLink
BCM57788 Gigabit Ethernet PCIe [14e4:1691] (rev 01)
Subsystem: Dell XPS 8300 [1028:04aa]
Flags: bus master, fast devsel, latency 0, IRQ 45
Memory at fb100000 (64-bit, non-prefetchable) [size=64K]
Capabilities: [48] Power Management version 3
Capabilities: [60] Vendor Specific Information: Len=6c <?>
Capabilities: [50] MSI: Enable+ Count=1/1 Maskable- 64bit+
Capabilities: [cc] Express Endpoint, MSI 00
Capabilities: [100] Advanced Error Reporting
Capabilities: [13c] Virtual Channel
Capabilities: [160] Device Serial Number [the mac address]
Capabilities: [16c] Power Budgeting <?>
Kernel driver in use: tg3
Kernel modules: tg3
I'm attaching the log for the full data dump, since my mailer will
wrap it horribly otherwise, but the interesting lines are:
[2234380.228971] tg3 0000:03:00.0: eth0: transmit timed out, resetting
... some kind of data dump ...
[2234382.216682] tg3 0000:03:00.0: eth0: 0: Host status block
[00000001:00000080:(0000:01ef:0000):(01ef:00b2)]
[2234382.216685] tg3 0000:03:00.0: eth0: 0: NAPI info
[00000080:00000080:(00cb:00b2:01ff):01ef:(00b7:0000:0000:0000)]
[2234382.319550] tg3 0000:03:00.0: tg3_stop_block timed out, ofs=1400
enable_bit=2
[2234382.421931] tg3 0000:03:00.0: tg3_stop_block timed out, ofs=c00
enable_bit=2
[2234382.427199] tg3 0000:03:00.0: eth0: Link is down
[2234382.438168] tg3 0000:03:00.0: eth0: Link is down
Any further attempts to use the NIC, like ifconfig down/up result in a
similar error log sequence happening. Also, while it's happening, the
computer feels extremely laggy for a short period of time (~1s),
leading me to believe it's doing an uninterruptible sleep of some kind
going on.
This has happened twice, and at least the second time, there was no
unusual traffic on the network. It's linked at 100M, and was probably
doing 10K/s at most when the error happened. If this is insufficient
information, please let me know what I should collect next time this
might happen.
Thanks,
-ilia
[-- Attachment #2: tg3-dump.log --]
[-- Type: application/octet-stream, Size: 23773 bytes --]
[2234380.228971] tg3 0000:03:00.0: eth0: transmit timed out, resetting
[2234382.216235] tg3 0000:03:00.0: eth0: 0x00000000: 0x169114e4, 0x00100406, 0x02000001, 0x00000010
[2234382.216238] tg3 0000:03:00.0: eth0: 0x00000010: 0xfb100004, 0x00000000, 0x00000000, 0x00000000
[2234382.216241] tg3 0000:03:00.0: eth0: 0x00000020: 0x00000000, 0x00000000, 0x00000000, 0x04aa1028
[2234382.216243] tg3 0000:03:00.0: eth0: 0x00000030: 0x00000000, 0x00000048, 0x00000000, 0x00000103
[2234382.216246] tg3 0000:03:00.0: eth0: 0x00000040: 0x00000000, 0x00000000, 0xc0036001, 0x08002008
[2234382.216248] tg3 0000:03:00.0: eth0: 0x00000050: 0x0081cc05, 0xfeeff00c, 0x00000000, 0x000041a1
[2234382.216251] tg3 0000:03:00.0: eth0: 0x00000060: 0x006c5009, 0x91921271, 0xf0010298, 0x76180000
[2234382.216260] tg3 0000:03:00.0: eth0: 0x00000070: 0x000010f2, 0x00000000, 0x00000000, 0x00000000
[2234382.216263] tg3 0000:03:00.0: eth0: 0x00000080: 0x169114e4, 0x800000f8, 0x00000000, 0x00000000
[2234382.216265] tg3 0000:03:00.0: eth0: 0x000000b0: 0x00000000, 0x00000000, 0x00000000, 0x57780001
[2234382.216268] tg3 0000:03:00.0: eth0: 0x000000c0: 0x00000000, 0x00000000, 0x0000000e, 0x00020010
[2234382.216270] tg3 0000:03:00.0: eth0: 0x000000d0: 0x05908fa0, 0x00102000, 0x0006cc11, 0x10110040
[2234382.216273] tg3 0000:03:00.0: eth0: 0x000000f0: 0x0000001f, 0x00000000, 0x00000000, 0x00000000
[2234382.216275] tg3 0000:03:00.0: eth0: 0x00000100: 0x13c10001, 0x00100000, 0x00000000, 0x00062031
[2234382.216278] tg3 0000:03:00.0: eth0: 0x00000110: 0x00000000, 0x00002000, 0x000000b4, 0x40000001
[2234382.216280] tg3 0000:03:00.0: eth0: 0x00000120: 0x0000000f, 0xfb100400, 0x00000080, 0x00000000
[2234382.216283] tg3 0000:03:00.0: eth0: 0x00000130: 0x00000000, 0x00000000, 0x00000000, 0x16010002
[2234382.216285] tg3 0000:03:00.0: eth0: 0x00000150: 0x80000001, 0x00000000, 0x00000000, 0x00000000
[2234382.216288] tg3 0000:03:00.0: eth0: 0x00000160: 0x16c10003, 0xfe9a0512, 0xd4bed9ff, 0x00010004
[2234382.216290] tg3 0000:03:00.0: eth0: 0x00000170: 0x00000000, 0x00078116, 0x00000001, 0x00000000
[2234382.216293] tg3 0000:03:00.0: eth0: 0x00000180: 0x00000000, 0x00000000, 0x00000000, 0xffffffff
[2234382.216295] tg3 0000:03:00.0: eth0: 0x00000200: 0x00000000, 0x76000000, 0x00000000, 0x00000000
[2234382.216298] tg3 0000:03:00.0: eth0: 0x00000260: 0x00000000, 0x00000000, 0x00000000, 0x000000ad
[2234382.216300] tg3 0000:03:00.0: eth0: 0x00000280: 0x00000000, 0x000001e5, 0x00000000, 0x00000000
[2234382.216303] tg3 0000:03:00.0: eth0: 0x00000300: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216305] tg3 0000:03:00.0: eth0: 0x00000310: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216307] tg3 0000:03:00.0: eth0: 0x00000320: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216310] tg3 0000:03:00.0: eth0: 0x00000330: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216312] tg3 0000:03:00.0: eth0: 0x00000340: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216314] tg3 0000:03:00.0: eth0: 0x00000350: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216317] tg3 0000:03:00.0: eth0: 0x00000360: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216319] tg3 0000:03:00.0: eth0: 0x00000370: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216321] tg3 0000:03:00.0: eth0: 0x00000380: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216323] tg3 0000:03:00.0: eth0: 0x00000390: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216326] tg3 0000:03:00.0: eth0: 0x000003a0: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216328] tg3 0000:03:00.0: eth0: 0x000003b0: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216330] tg3 0000:03:00.0: eth0: 0x000003c0: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216333] tg3 0000:03:00.0: eth0: 0x000003d0: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216335] tg3 0000:03:00.0: eth0: 0x000003e0: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216338] tg3 0000:03:00.0: eth0: 0x000003f0: 0x00000000, 0x000000cb, 0x00000000, 0x000000cb
[2234382.216340] tg3 0000:03:00.0: eth0: 0x00000400: 0x00e04804, 0x00400000, 0x00000000, 0x00000900
[2234382.216342] tg3 0000:03:00.0: eth0: 0x00000410: 0x0000d4be, 0xd99a0512, 0x0000d4be, 0xd99a0512
[2234382.216344] tg3 0000:03:00.0: eth0: 0x00000420: 0x0000d4be, 0xd99a0512, 0x0000d4be, 0xd99a0512
[2234382.216346] tg3 0000:03:00.0: eth0: 0x00000430: 0x00000000, 0x00000000, 0x00000269, 0x000005f2
[2234382.216348] tg3 0000:03:00.0: eth0: 0x00000440: 0x00000000, 0x00000000, 0x00000000, 0x08240de1
[2234382.216349] tg3 0000:03:00.0: eth0: 0x00000450: 0x00000001, 0x00008000, 0x00000000, 0x00000112
[2234382.216351] tg3 0000:03:00.0: eth0: 0x00000460: 0x00000008, 0x00002620, 0x01000006, 0x00000000
[2234382.216353] tg3 0000:03:00.0: eth0: 0x00000470: 0x80000000, 0x00000000, 0x00080000, 0x40000000
[2234382.216355] tg3 0000:03:00.0: eth0: 0x00000480: 0x42000000, 0x7fffffff, 0x06000004, 0x7fffffff
[2234382.216357] tg3 0000:03:00.0: eth0: 0x00000500: 0x00000008, 0x00000002, 0x00000000, 0x00000000
[2234382.216359] tg3 0000:03:00.0: eth0: 0x00000590: 0x00901000, 0x00000000, 0x00000000, 0x00000000
[2234382.216360] tg3 0000:03:00.0: eth0: 0x00000600: 0xffffffff, 0x00f80091, 0x00000000, 0x00001f04
[2234382.216362] tg3 0000:03:00.0: eth0: 0x00000610: 0xffffffff, 0x00000000, 0x07c00004, 0x070c0000
[2234382.216364] tg3 0000:03:00.0: eth0: 0x00000620: 0x00000040, 0x00000000, 0x00000000, 0x00000000
[2234382.216366] tg3 0000:03:00.0: eth0: 0x00000800: 0x00000000, 0xffffffff, 0x00000000, 0x00000000
[2234382.216367] tg3 0000:03:00.0: eth0: 0x00000810: 0x00000000, 0xffffffff, 0x00000000, 0x00000000
[2234382.216369] tg3 0000:03:00.0: eth0: 0x00000820: 0x00000000, 0x00000000, 0xffffffff, 0x00000000
[2234382.216371] tg3 0000:03:00.0: eth0: 0x00000830: 0x00000000, 0xffffffff, 0xffffffff, 0xffffffff
[2234382.216373] tg3 0000:03:00.0: eth0: 0x00000840: 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff
[2234382.216375] tg3 0000:03:00.0: eth0: 0x00000850: 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff
[2234382.216376] tg3 0000:03:00.0: eth0: 0x00000860: 0xffffffff, 0xffffffff, 0xffffffff, 0x00000000
[2234382.216378] tg3 0000:03:00.0: eth0: 0x00000880: 0x0000050d, 0x394a6407, 0x00000000, 0x00000003
[2234382.216380] tg3 0000:03:00.0: eth0: 0x00000890: 0x00000000, 0x00000004, 0x00000000, 0x00000000
[2234382.216382] tg3 0000:03:00.0: eth0: 0x000008f0: 0x00000001, 0x00000000, 0x00000000, 0x00000000
[2234382.216383] tg3 0000:03:00.0: eth0: 0x00000c00: 0x0000000a, 0x00000000, 0x00000003, 0x00000001
[2234382.216385] tg3 0000:03:00.0: eth0: 0x00000c10: 0x00000000, 0x00000007, 0x10000000, 0x06460000
[2234382.216387] tg3 0000:03:00.0: eth0: 0x00000c80: 0x00922543, 0x00000000, 0x00000000, 0x00000000
[2234382.216389] tg3 0000:03:00.0: eth0: 0x00000ce0: 0x0915707a, 0x00000001, 0x00000646, 0x00040008
[2234382.216391] tg3 0000:03:00.0: eth0: 0x00000cf0: 0x00000000, 0x00000033, 0x95380000, 0x00000000
[2234382.216392] tg3 0000:03:00.0: eth0: 0x00001000: 0x00000002, 0x00000000, 0xa0000d34, 0x00000000
[2234382.216394] tg3 0000:03:00.0: eth0: 0x00001010: 0x00b20b20, 0x00001d34, 0x00000000, 0x00000000
[2234382.216396] tg3 0000:03:00.0: eth0: 0x00001400: 0x00000006, 0x00000000, 0x00000000, 0x00000000
[2234382.216398] tg3 0000:03:00.0: eth0: 0x00001440: 0x000000b4, 0x000000b4, 0x000000b4, 0x000000b4
[2234382.216400] tg3 0000:03:00.0: eth0: 0x00001450: 0x000000b4, 0x000000b4, 0x000000b4, 0x000000b4
[2234382.216401] tg3 0000:03:00.0: eth0: 0x00001460: 0x000000b4, 0x000000b4, 0x000000b4, 0x000000b4
[2234382.216403] tg3 0000:03:00.0: eth0: 0x00001470: 0x000000b4, 0x000000b4, 0x000000b4, 0x000000b4
[2234382.216405] tg3 0000:03:00.0: eth0: 0x00001480: 0x00000004, 0x00000000, 0x00000000, 0x00000000
[2234382.216407] tg3 0000:03:00.0: eth0: 0x00001800: 0x00000016, 0x00000000, 0x000000cb, 0x00000000
[2234382.216408] tg3 0000:03:00.0: eth0: 0x00001840: 0x00000000, 0x00000000, 0x00000200, 0x00000010
[2234382.216410] tg3 0000:03:00.0: eth0: 0x00001850: 0x091b4c30, 0x00000001, 0x00004030, 0x00cb00cb
[2234382.216412] tg3 0000:03:00.0: eth0: 0x00001860: 0x08000000, 0x00000000, 0x00000000, 0x00000000
[2234382.216414] tg3 0000:03:00.0: eth0: 0x00001c00: 0x00000002, 0x00000000, 0x00000000, 0x00000000
[2234382.216416] tg3 0000:03:00.0: eth0: 0x00002000: 0x00000002, 0x00000000, 0x00000000, 0x00000000
[2234382.216417] tg3 0000:03:00.0: eth0: 0x00002010: 0x00000181, 0x00000001, 0x007bfffd, 0x00000000
[2234382.216419] tg3 0000:03:00.0: eth0: 0x00002100: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216421] tg3 0000:03:00.0: eth0: 0x00002110: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216423] tg3 0000:03:00.0: eth0: 0x00002120: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216425] tg3 0000:03:00.0: eth0: 0x00002130: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216426] tg3 0000:03:00.0: eth0: 0x00002140: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216428] tg3 0000:03:00.0: eth0: 0x00002150: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216430] tg3 0000:03:00.0: eth0: 0x00002160: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216431] tg3 0000:03:00.0: eth0: 0x00002170: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216433] tg3 0000:03:00.0: eth0: 0x00002180: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216435] tg3 0000:03:00.0: eth0: 0x00002190: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216437] tg3 0000:03:00.0: eth0: 0x000021a0: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216438] tg3 0000:03:00.0: eth0: 0x000021b0: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216440] tg3 0000:03:00.0: eth0: 0x000021c0: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216442] tg3 0000:03:00.0: eth0: 0x000021d0: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216443] tg3 0000:03:00.0: eth0: 0x000021e0: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216445] tg3 0000:03:00.0: eth0: 0x000021f0: 0x000c723a, 0x000c723a, 0x00000000, 0x00000000
[2234382.216447] tg3 0000:03:00.0: eth0: 0x00002200: 0x014d7110, 0x00000000, 0x00000000, 0x00000000
[2234382.216449] tg3 0000:03:00.0: eth0: 0x00002400: 0x00000012, 0x00000000, 0x00000000, 0x00000000
[2234382.216451] tg3 0000:03:00.0: eth0: 0x00002450: 0x00000004, 0x88534000, 0x02000000, 0x00006000
[2234382.216452] tg3 0000:03:00.0: eth0: 0x00002470: 0x00000000, 0x000001e5, 0x00000000, 0x00000000
[2234382.216454] tg3 0000:03:00.0: eth0: 0x000024c0: 0x08000001, 0x00000000, 0x00000000, 0x00000000
[2234382.216456] tg3 0000:03:00.0: eth0: 0x00002800: 0x00000006, 0x00000000, 0x00000000, 0x00000000
[2234382.216458] tg3 0000:03:00.0: eth0: 0x00002c00: 0x00000006, 0x00000000, 0x00000000, 0x00000020
[2234382.216459] tg3 0000:03:00.0: eth0: 0x00002c10: 0x00000000, 0x00000000, 0x00000010, 0x00000000
[2234382.216461] tg3 0000:03:00.0: eth0: 0x00002c20: 0x00000001, 0x00000000, 0x00000000, 0x00000000
[2234382.216463] tg3 0000:03:00.0: eth0: 0x00003000: 0x00000006, 0x00000000, 0x00000000, 0x00000020
[2234382.216465] tg3 0000:03:00.0: eth0: 0x00003600: 0xe0236600, 0x00170000, 0x00110000, 0x00000000
[2234382.216467] tg3 0000:03:00.0: eth0: 0x00003610: 0x00170000, 0x00130000, 0x00150000, 0x00000000
[2234382.216469] tg3 0000:03:00.0: eth0: 0x00003620: 0x00000000, 0x00000000, 0x00000000, 0x00082080
[2234382.216470] tg3 0000:03:00.0: eth0: 0x00003630: 0x00110000, 0x30000000, 0x00001000, 0x00000000
[2234382.216472] tg3 0000:03:00.0: eth0: 0x00003640: 0x00000000, 0x00000000, 0x00000020, 0x0000004b
[2234382.216474] tg3 0000:03:00.0: eth0: 0x00003650: 0x00000171, 0x00000bff, 0x57780001, 0x00000000
[2234382.216476] tg3 0000:03:00.0: eth0: 0x00003660: 0x00000000, 0x00000000, 0x000000af, 0x00000000
[2234382.216477] tg3 0000:03:00.0: eth0: 0x00003670: 0x0000002a, 0xfefffff7, 0x00000000, 0x00000000
[2234382.216479] tg3 0000:03:00.0: eth0: 0x000036a0: 0x00000000, 0x42000000, 0x00000000, 0x00000041
[2234382.216481] tg3 0000:03:00.0: eth0: 0x00003c00: 0x00000302, 0x00000000, 0x00000014, 0x00000048
[2234382.216483] tg3 0000:03:00.0: eth0: 0x00003c10: 0x00000005, 0x00000035, 0x00000000, 0x00000000
[2234382.216484] tg3 0000:03:00.0: eth0: 0x00003c20: 0x00000005, 0x00000005, 0x00000000, 0x00000000
[2234382.216486] tg3 0000:03:00.0: eth0: 0x00003c30: 0x00000000, 0x00000000, 0x00000001, 0x854fb000
[2234382.216488] tg3 0000:03:00.0: eth0: 0x00003c40: 0x00000000, 0x00000b00, 0x00000000, 0x00000000
[2234382.216490] tg3 0000:03:00.0: eth0: 0x00003c50: 0x00000000, 0x000001e9, 0x00000000, 0x00000000
[2234382.216491] tg3 0000:03:00.0: eth0: 0x00003c80: 0x000001e9, 0x00000000, 0x00000000, 0x00000000
[2234382.216493] tg3 0000:03:00.0: eth0: 0x00003cc0: 0x000000b2, 0x00000000, 0x00000000, 0x00000000
[2234382.216495] tg3 0000:03:00.0: eth0: 0x00004000: 0x00000002, 0x00000000, 0x0003c702, 0x00017d9c
[2234382.216497] tg3 0000:03:00.0: eth0: 0x00004010: 0x00434620, 0x00247012, 0x00800440, 0x00848042
[2234382.216499] tg3 0000:03:00.0: eth0: 0x00004020: 0x00000000, 0x00000000, 0x00000010, 0x00000000
[2234382.216500] tg3 0000:03:00.0: eth0: 0x00004030: 0x00000010, 0x00000030, 0x00000000, 0x00000000
[2234382.216502] tg3 0000:03:00.0: eth0: 0x00004040: 0x00000000, 0x00000000, 0x01086420, 0x00000000
[2234382.216504] tg3 0000:03:00.0: eth0: 0x00004050: 0x00000000, 0x00000000, 0x00244010, 0x00428002
[2234382.216506] tg3 0000:03:00.0: eth0: 0x00004060: 0x00435000, 0x00000000, 0x00000000, 0x00000000
[2234382.216508] tg3 0000:03:00.0: eth0: 0x00004400: 0x00000006, 0x00000000, 0x00010000, 0x00004000
[2234382.216510] tg3 0000:03:00.0: eth0: 0x00004410: 0x00000000, 0x00000010, 0x00000060, 0x00000000
[2234382.216511] tg3 0000:03:00.0: eth0: 0x00004420: 0x0000003d, 0x00000000, 0x00000000, 0x00000000
[2234382.216513] tg3 0000:03:00.0: eth0: 0x00004440: 0x00000000, 0x00000000, 0x00000000, 0x0340d036
[2234382.216515] tg3 0000:03:00.0: eth0: 0x00004450: 0x0001027f, 0x00480049, 0x00000000, 0x00000000
[2234382.216517] tg3 0000:03:00.0: eth0: 0x00004800: 0x18033bfe, 0x00000000, 0x00000000, 0x00000020
[2234382.216518] tg3 0000:03:00.0: eth0: 0x00004810: 0x00000000, 0x00000004, 0x020003cc, 0x00000000
[2234382.216520] tg3 0000:03:00.0: eth0: 0x00004820: 0x00000035, 0x00000000, 0xf02c0000, 0x88534400
[2234382.216522] tg3 0000:03:00.0: eth0: 0x00004830: 0x00000000, 0x000000ba, 0x000000ba, 0x00000000
[2234382.216524] tg3 0000:03:00.0: eth0: 0x00004840: 0x00000074, 0x009b9474, 0x000e2200, 0x350ee6ac
[2234382.216526] tg3 0000:03:00.0: eth0: 0x00004850: 0x02c3b235, 0xb729000e, 0x28342834, 0x00000000
[2234382.216527] tg3 0000:03:00.0: eth0: 0x00004860: 0x01000035, 0x00000000, 0x00000000, 0x00000000
[2234382.216529] tg3 0000:03:00.0: eth0: 0x00004900: 0x00028207, 0x50200e08, 0x00000000, 0x00000000
[2234382.216531] tg3 0000:03:00.0: eth0: 0x00004910: 0x00000018, 0x00000000, 0x00000000, 0x00000000
[2234382.216533] tg3 0000:03:00.0: eth0: 0x00004c00: 0x200003fe, 0x00000000, 0x00000000, 0x00000000
[2234382.216534] tg3 0000:03:00.0: eth0: 0x00004c10: 0x00000000, 0x00000000, 0x00000006, 0x00000000
[2234382.216536] tg3 0000:03:00.0: eth0: 0x00004c20: 0x00000000, 0x00000000, 0x00000000, 0x00000006
[2234382.216538] tg3 0000:03:00.0: eth0: 0x00004c30: 0x00000000, 0x00000000, 0x00000065, 0x00000065
[2234382.216540] tg3 0000:03:00.0: eth0: 0x00004c40: 0x00000000, 0x854fb000, 0x00010020, 0x00000020
[2234382.216541] tg3 0000:03:00.0: eth0: 0x00004c50: 0x07ffffe8, 0x07a7d1ff, 0x00000000, 0xf4a97a7a
[2234382.216543] tg3 0000:03:00.0: eth0: 0x00005000: 0x00009800, 0x80000000, 0x00000000, 0x00000000
[2234382.216545] tg3 0000:03:00.0: eth0: 0x00005010: 0x00000000, 0x00000000, 0x00000000, 0x40002cb0
[2234382.216547] tg3 0000:03:00.0: eth0: 0x00005020: 0x16220003, 0x00000000, 0x00000000, 0x40000020
[2234382.216549] tg3 0000:03:00.0: eth0: 0x00005030: 0x00000000, 0x00000051, 0x00000000, 0x00000000
[2234382.216550] tg3 0000:03:00.0: eth0: 0x00005040: 0x00000000, 0x00000000, 0x40002ca8, 0x00000000
[2234382.216552] tg3 0000:03:00.0: eth0: 0x00005080: 0x00009800, 0x80008000, 0x00000000, 0x00000000
[2234382.216554] tg3 0000:03:00.0: eth0: 0x00005090: 0x00000000, 0x00000000, 0x00000000, 0x40002cb0
[2234382.216556] tg3 0000:03:00.0: eth0: 0x000050a0: 0x24020001, 0x00000000, 0x00000000, 0x40000020
[2234382.216557] tg3 0000:03:00.0: eth0: 0x000050b0: 0x00000000, 0x00000051, 0x00000000, 0x00000000
[2234382.216559] tg3 0000:03:00.0: eth0: 0x000050c0: 0x00000000, 0x00000000, 0x40002ca8, 0x00000000
[2234382.216561] tg3 0000:03:00.0: eth0: 0x00005100: 0x00009800, 0x80008000, 0x00000000, 0x00000000
[2234382.216563] tg3 0000:03:00.0: eth0: 0x00005110: 0x00000000, 0x00000000, 0x00000000, 0x40003688
[2234382.216564] tg3 0000:03:00.0: eth0: 0x00005120: 0x03e00008, 0x00000000, 0x00000000, 0x40000020
[2234382.216566] tg3 0000:03:00.0: eth0: 0x00005130: 0x00000000, 0x00000051, 0x00000000, 0x00000000
[2234382.216568] tg3 0000:03:00.0: eth0: 0x00005140: 0x00000000, 0x00000000, 0x40002ca8, 0x00000000
[2234382.216570] tg3 0000:03:00.0: eth0: 0x00005180: 0x00009800, 0x80000000, 0x00000000, 0x00000000
[2234382.216571] tg3 0000:03:00.0: eth0: 0x00005190: 0x00000000, 0x00000000, 0x00000000, 0x400036a0
[2234382.216573] tg3 0000:03:00.0: eth0: 0x000051a0: 0x00000000, 0x00000000, 0x00000000, 0x40000020
[2234382.216575] tg3 0000:03:00.0: eth0: 0x000051b0: 0x00000000, 0x00000051, 0x00000000, 0x00000000
[2234382.216577] tg3 0000:03:00.0: eth0: 0x000051c0: 0x00000000, 0x00000000, 0x40002e28, 0x00000000
[2234382.216578] tg3 0000:03:00.0: eth0: 0x00005200: 0x00000000, 0x00000000, 0x00000000, 0xa1020000
[2234382.216580] tg3 0000:03:00.0: eth0: 0x00005220: 0x00000000, 0xa1020000, 0x00000000, 0x00000000
[2234382.216582] tg3 0000:03:00.0: eth0: 0x00005240: 0x00000000, 0x00000000, 0x00000000, 0xc0000000
[2234382.216583] tg3 0000:03:00.0: eth0: 0x00005260: 0x00000000, 0x00000000, 0x00000000, 0xa1020000
[2234382.216585] tg3 0000:03:00.0: eth0: 0x00005270: 0x00000000, 0x00000000, 0x00000000, 0x08005fe8
[2234382.216587] tg3 0000:03:00.0: eth0: 0x00005280: 0x00009800, 0x80008000, 0x00000000, 0x00000000
[2234382.216589] tg3 0000:03:00.0: eth0: 0x00005290: 0x00000000, 0x00000000, 0x00000000, 0x40001d38
[2234382.216590] tg3 0000:03:00.0: eth0: 0x000052a0: 0x00008021, 0x00000000, 0x00000000, 0x40000020
[2234382.216592] tg3 0000:03:00.0: eth0: 0x000052b0: 0x00000000, 0x00000051, 0x00000000, 0x00000000
[2234382.216594] tg3 0000:03:00.0: eth0: 0x000052c0: 0x00000000, 0x00000000, 0x40002cc4, 0x00000000
[2234382.216596] tg3 0000:03:00.0: eth0: 0x00005300: 0x00009800, 0x80008000, 0x00000000, 0x00000000
[2234382.216597] tg3 0000:03:00.0: eth0: 0x00005310: 0x00000000, 0x00000000, 0x00000000, 0x40002cd4
[2234382.216599] tg3 0000:03:00.0: eth0: 0x00005320: 0x24100001, 0x00000000, 0x00000000, 0x40000020
[2234382.216601] tg3 0000:03:00.0: eth0: 0x00005330: 0x00000000, 0x00000051, 0x00000000, 0x00000000
[2234382.216603] tg3 0000:03:00.0: eth0: 0x00005340: 0x00000000, 0x00000000, 0x40003696, 0x00000000
[2234382.216604] tg3 0000:03:00.0: eth0: 0x00005380: 0x00009800, 0x80008000, 0x00000000, 0x00000000
[2234382.216606] tg3 0000:03:00.0: eth0: 0x00005390: 0x00000000, 0x00000000, 0x00000000, 0x4000354c
[2234382.216608] tg3 0000:03:00.0: eth0: 0x000053a0: 0x16000003, 0x00000000, 0x00000000, 0x40000020
[2234382.216610] tg3 0000:03:00.0: eth0: 0x000053b0: 0x00000000, 0x00000051, 0x00000000, 0x00000000
[2234382.216611] tg3 0000:03:00.0: eth0: 0x000053c0: 0x00000000, 0x00000000, 0x40003696, 0x00000000
[2234382.216613] tg3 0000:03:00.0: eth0: 0x00005600: 0x169114e4, 0x00100406, 0x02000001, 0x00000010
[2234382.216615] tg3 0000:03:00.0: eth0: 0x00005610: 0xfb100004, 0x00000000, 0x00000000, 0x00000000
[2234382.216617] tg3 0000:03:00.0: eth0: 0x00005620: 0x00000000, 0x00000000, 0x00000000, 0x04aa1028
[2234382.216618] tg3 0000:03:00.0: eth0: 0x00005630: 0x00000000, 0x00000048, 0x00000000, 0x00000103
[2234382.216620] tg3 0000:03:00.0: eth0: 0x00005640: 0x00000000, 0x00000000, 0xc0036001, 0x08002008
[2234382.216622] tg3 0000:03:00.0: eth0: 0x00005650: 0x0081cc05, 0xfeeff00c, 0x00000000, 0x000041a1
[2234382.216624] tg3 0000:03:00.0: eth0: 0x00005660: 0x006c5009, 0x91921271, 0xf0010298, 0x76180000
[2234382.216626] tg3 0000:03:00.0: eth0: 0x00005670: 0x000010f2, 0x00000000, 0x00000000, 0x00000000
[2234382.216627] tg3 0000:03:00.0: eth0: 0x00005680: 0x40000008, 0x40000008, 0x00000000, 0x00000000
[2234382.216629] tg3 0000:03:00.0: eth0: 0x000056b0: 0x00000000, 0x00000000, 0x00000000, 0x57780001
[2234382.216631] tg3 0000:03:00.0: eth0: 0x000056c0: 0x00000000, 0x00000000, 0x0000000e, 0x00020010
[2234382.216633] tg3 0000:03:00.0: eth0: 0x000056d0: 0x05908fa0, 0x00102000, 0x0006cc11, 0x10110040
[2234382.216634] tg3 0000:03:00.0: eth0: 0x000056f0: 0x0000001f, 0x00000000, 0x00000000, 0x00000000
[2234382.216636] tg3 0000:03:00.0: eth0: 0x00005700: 0x13c10001, 0x00100000, 0x00000000, 0x00062031
[2234382.216638] tg3 0000:03:00.0: eth0: 0x00005710: 0x00000000, 0x00002000, 0x000000b4, 0x40000001
[2234382.216640] tg3 0000:03:00.0: eth0: 0x00005720: 0x0000000f, 0xfb100400, 0x00000080, 0x00000000
[2234382.216641] tg3 0000:03:00.0: eth0: 0x00005730: 0x00000000, 0x00000000, 0x00000000, 0x16010002
[2234382.216643] tg3 0000:03:00.0: eth0: 0x00005750: 0x80000001, 0x00000000, 0x00000000, 0x00000000
[2234382.216645] tg3 0000:03:00.0: eth0: 0x00005760: 0x16c10003, 0xfe9a0512, 0xd4bed9ff, 0x00010004
[2234382.216647] tg3 0000:03:00.0: eth0: 0x00005770: 0x00000000, 0x00078116, 0x00000001, 0x00000000
[2234382.216648] tg3 0000:03:00.0: eth0: 0x00005780: 0x00000000, 0x00000000, 0x00000000, 0xffffffff
[2234382.216650] tg3 0000:03:00.0: eth0: 0x00005800: 0x00000000, 0x7b000000, 0x00000000, 0x00000000
[2234382.216652] tg3 0000:03:00.0: eth0: 0x00005860: 0x00000000, 0x00000000, 0x00000000, 0x000000b2
[2234382.216654] tg3 0000:03:00.0: eth0: 0x00005880: 0x00000000, 0x000001ea, 0x00000000, 0x00000000
[2234382.216655] tg3 0000:03:00.0: eth0: 0x00005900: 0x00000000, 0x000000cb, 0x00000000, 0x00000000
[2234382.216657] tg3 0000:03:00.0: eth0: 0x00005980: 0x00000000, 0x000000cb, 0x00000000, 0x00000000
[2234382.216659] tg3 0000:03:00.0: eth0: 0x00005a00: 0x00012001, 0x00000000, 0x00010000, 0x00000000
[2234382.216661] tg3 0000:03:00.0: eth0: 0x00006000: 0x00000002, 0x00000000, 0x00000000, 0x00000000
[2234382.216663] tg3 0000:03:00.0: eth0: 0x00006800: 0x04130034, 0x20085082, 0x01009219, 0x6a8b4f40
[2234382.216665] tg3 0000:03:00.0: eth0: 0x00006810: 0xa1020000, 0xffffffff, 0x00000000, 0x00000000
[2234382.216667] tg3 0000:03:00.0: eth0: 0x000068a0: 0x00000000, 0x20010001, 0x00000000, 0x00000000
[2234382.216668] tg3 0000:03:00.0: eth0: 0x000068b0: 0x00040000, 0x00000000, 0x00000000, 0x00000000
[2234382.216670] tg3 0000:03:00.0: eth0: 0x00006c20: 0x00000000, 0x00200000, 0x00000000, 0x00000000
[2234382.216672] tg3 0000:03:00.0: eth0: 0x00007000: 0x08000188, 0x00000000, 0x00000000, 0x00000000
[2234382.216674] tg3 0000:03:00.0: eth0: 0x00007010: 0xffffffff, 0x00008200, 0x000500db, 0x03000a00
[2234382.216676] tg3 0000:03:00.0: eth0: 0x00007020: 0x00000000, 0x00000000, 0x00000406, 0x10004000
[2234382.216677] tg3 0000:03:00.0: eth0: 0x00007030: 0x00020000, 0x00000004, 0x001f0010, 0x00000000
[2234382.216679] tg3 0000:03:00.0: eth0: 0x00007500: 0x00000000, 0x00000000, 0x0000008b, 0x00000240
[2234382.216682] tg3 0000:03:00.0: eth0: 0: Host status block [00000001:00000080:(0000:01ef:0000):(01ef:00b2)]
[2234382.216685] tg3 0000:03:00.0: eth0: 0: NAPI info [00000080:00000080:(00cb:00b2:01ff):01ef:(00b7:0000:0000:0000)]
[2234382.319550] tg3 0000:03:00.0: tg3_stop_block timed out, ofs=1400 enable_bit=2
[2234382.421931] tg3 0000:03:00.0: tg3_stop_block timed out, ofs=c00 enable_bit=2
[2234382.427199] tg3 0000:03:00.0: eth0: Link is down
[2234382.438168] tg3 0000:03:00.0: eth0: Link is down
^ permalink raw reply
* Re: [PATCH 03/12] netfilter: generic proto sysctl support for net namespace
From: Gao feng @ 2012-04-18 0:20 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: netfilter-devel, netdev, ebiederm, serge.hallyn, dlezcano
In-Reply-To: <20120417113541.GB2956@1984>
于 2012年04月17日 19:35, Pablo Neira Ayuso 写道:
> On Tue, Apr 17, 2012 at 06:22:42PM +0800, Gao feng wrote:
>> 于 2012年04月17日 16:58, Pablo Neira Ayuso 写道:
>>> On Tue, Apr 17, 2012 at 10:56:14AM +0800, Gao feng wrote:
>>>> register the generic proto's sysctl in pernet_operations.init.
>>>> and use net->ct.proto.sysctl_generic_timeout replaces nf_ct_generic_timeout.
>>>>
>>>> in the after patch,the timeout_nlattr_to_obj will be modified too.
>>>>
>>>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
>>>> ---
>>>> net/netfilter/nf_conntrack_core.c | 6 ++
>>>> net/netfilter/nf_conntrack_proto_generic.c | 93 +++++++++++++++++++++++++---
>>>> 2 files changed, 91 insertions(+), 8 deletions(-)
>>>>
>>>> diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
>>>> index 729f157..bf11dd6 100644
>>>> --- a/net/netfilter/nf_conntrack_core.c
>>>> +++ b/net/netfilter/nf_conntrack_core.c
>>>> @@ -1358,6 +1358,7 @@ static void nf_conntrack_cleanup_net(struct net *net)
>>>> nf_conntrack_tstamp_fini(net);
>>>> nf_conntrack_acct_fini(net);
>>>> nf_conntrack_expect_fini(net);
>>>> + nf_conntrack_proto_generic_net_fini(net);
>>>> kmem_cache_destroy(net->ct.nf_conntrack_cachep);
>>>> kfree(net->ct.slabname);
>>>> free_percpu(net->ct.stat);
>>>> @@ -1573,6 +1574,9 @@ static int nf_conntrack_init_net(struct net *net)
>>>> printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
>>>> goto err_hash;
>>>> }
>>>> + ret = nf_conntrack_proto_generic_net_init(net);
>>>> + if (ret < 0)
>>>> + goto err_generic;
>>>> ret = nf_conntrack_expect_init(net);
>>>> if (ret < 0)
>>>> goto err_expect;
>>>> @@ -1600,6 +1604,8 @@ err_tstamp:
>>>> err_acct:
>>>> nf_conntrack_expect_fini(net);
>>>> err_expect:
>>>> + nf_conntrack_proto_generic_net_fini(net);
>>>> +err_generic:
>>>> nf_ct_free_hashtable(net->ct.hash, net->ct.htable_size);
>>>> err_hash:
>>>> kmem_cache_destroy(net->ct.nf_conntrack_cachep);
>>>> diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
>>>> index 835e24c..0d4545b 100644
>>>> --- a/net/netfilter/nf_conntrack_proto_generic.c
>>>> +++ b/net/netfilter/nf_conntrack_proto_generic.c
>>>> @@ -42,7 +42,7 @@ static int generic_print_tuple(struct seq_file *s,
>>>>
>>>> static unsigned int *generic_get_timeouts(struct net *net)
>>>> {
>>>> - return &nf_ct_generic_timeout;
>>>> + return &(net->ct.proto.sysctl_generic_timeout);
>>>> }
>>>>
>>>> /* Returns verdict for packet, or -1 for invalid. */
>>>> @@ -105,11 +105,10 @@ generic_timeout_nla_policy[CTA_TIMEOUT_GENERIC_MAX+1] = {
>>>> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
>>>>
>>>> #ifdef CONFIG_SYSCTL
>>>> -static struct ctl_table_header *generic_sysctl_header;
>>>> static struct ctl_table generic_sysctl_table[] = {
>>>> {
>>>> .procname = "nf_conntrack_generic_timeout",
>>>> - .data = &nf_ct_generic_timeout,
>>>> + .data = &init_net.ct.proto.sysctl_generic_timeout,
>>>> .maxlen = sizeof(unsigned int),
>>>> .mode = 0644,
>>>> .proc_handler = proc_dointvec_jiffies,
>>>> @@ -120,7 +119,7 @@ static struct ctl_table generic_sysctl_table[] = {
>>>> static struct ctl_table generic_compat_sysctl_table[] = {
>>>> {
>>>> .procname = "ip_conntrack_generic_timeout",
>>>> - .data = &nf_ct_generic_timeout,
>>>> + .data = &init_net.ct.proto.sysctl_generic_timeout,
>>>> .maxlen = sizeof(unsigned int),
>>>> .mode = 0644,
>>>> .proc_handler = proc_dointvec_jiffies,
>>>> @@ -150,11 +149,89 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_generic __read_mostly =
>>>> .nla_policy = generic_timeout_nla_policy,
>>>> },
>>>> #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
>>>> +};
>>>> +
>>>> +int nf_conntrack_proto_generic_net_init(struct net *net)
>>>
>>> Please, check int nf_conntrack_ecache_init(struct net *net) for
>>> instance on how we're doing the per-net registration of netfilter
>>> modules.
>>
>> nf_conntrack_l4proto_generic is registered when loading nf_conntrack module.
>> so we should register sysctl in nf_conntrack_init_net.
>>
>> I don't know what's wrong here...
>
> Nothing wrong, just a comestic change.
>
> I'd like that the protocol and sysctl registration happen in the same
> function, like in other part of the code, for consistency.
I got it,maybe we can add a field pernet_operations for nf_conntrack_l[3,4]proto,
and change nf_ct_l[3,4]proto_register_sysctl to register the pernet_operations.
I think it will work well. ;)
>
> Probably, you can use http://patchwork.ozlabs.org/patch/152096/ as
> reference.
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* [PATCH] sunrpc: fix rpc_pipe.c kernel-doc notation
From: Randy Dunlap @ 2012-04-18 0:03 UTC (permalink / raw)
To: netdev, davem
From: Randy Dunlap <rdunlap@xenotime.net>
Fix kernel-doc warnings in sunrpc/rpc_pipe.c:
Warning(net/sunrpc/rpc_pipe.c:133): No description found for parameter 'pipe'
Warning(net/sunrpc/rpc_pipe.c:133): Excess function parameter 'inode' description in 'rpc_queue_upcall'
Warning(net/sunrpc/rpc_pipe.c:839): No description found for parameter 'pipe'
Warning(net/sunrpc/rpc_pipe.c:839): Excess function parameter 'ops' description in 'rpc_mkpipe_dentry'
Warning(net/sunrpc/rpc_pipe.c:839): Excess function parameter 'flags' description in 'rpc_mkpipe_dentry'
Warning(net/sunrpc/rpc_pipe.c:949): No description found for parameter 'dentry'
Warning(net/sunrpc/rpc_pipe.c:949): Excess function parameter 'clnt' description in 'rpc_remove_client_dir'
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
---
net/sunrpc/rpc_pipe.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- lnx-34-rc3.orig/net/sunrpc/rpc_pipe.c
+++ lnx-34-rc3/net/sunrpc/rpc_pipe.c
@@ -120,7 +120,7 @@ EXPORT_SYMBOL_GPL(rpc_pipe_generic_upcal
/**
* rpc_queue_upcall - queue an upcall message to userspace
- * @inode: inode of upcall pipe on which to queue given message
+ * @pipe: upcall pipe on which to queue given message
* @msg: message to queue
*
* Call with an @inode created by rpc_mkpipe() to queue an upcall.
@@ -819,9 +819,7 @@ static int rpc_rmdir_depopulate(struct d
* @parent: dentry of directory to create new "pipe" in
* @name: name of pipe
* @private: private data to associate with the pipe, for the caller's use
- * @ops: operations defining the behavior of the pipe: upcall, downcall,
- * release_pipe, open_pipe, and destroy_msg.
- * @flags: rpc_pipe flags
+ * @pipe: &rpc_pipe containing input parameters
*
* Data is made available for userspace to read by calls to
* rpc_queue_upcall(). The actual reads will result in calls to
@@ -943,7 +941,7 @@ struct dentry *rpc_create_client_dir(str
/**
* rpc_remove_client_dir - Remove a directory created with rpc_create_client_dir()
- * @clnt: rpc client
+ * @dentry: dentry for the pipe
*/
int rpc_remove_client_dir(struct dentry *dentry)
{
^ permalink raw reply
* [PATCH] sunrpc: fix rpcb_clnt.c kernel-doc notation
From: Randy Dunlap @ 2012-04-18 0:03 UTC (permalink / raw)
To: netdev, davem
From: Randy Dunlap <rdunlap@xenotime.net>
Fix kernel-doc warnings in sunrpc/rpcb_clnt.c:
Warning(net/sunrpc/rpcb_clnt.c:428): No description found for parameter 'net'
Warning(net/sunrpc/rpcb_clnt.c:567): No description found for parameter 'net'
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
---
net/sunrpc/rpcb_clnt.c | 2 ++
1 file changed, 2 insertions(+)
--- lnx-34-rc3.orig/net/sunrpc/rpcb_clnt.c
+++ lnx-34-rc3/net/sunrpc/rpcb_clnt.c
@@ -394,6 +394,7 @@ static int rpcb_register_call(struct rpc
/**
* rpcb_register - set or unset a port registration with the local rpcbind svc
+ * @net: target network namespace
* @prog: RPC program number to bind
* @vers: RPC version number to bind
* @prot: transport protocol to register
@@ -521,6 +522,7 @@ static int rpcb_unregister_all_protofami
/**
* rpcb_v4_register - set or unset a port registration with the local rpcbind
+ * @net: target network namespace
* @program: RPC program number of service to (un)register
* @version: RPC version number of service to (un)register
* @address: address family, IP address, and port to (un)register
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox