FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=release%2F9.3.0 2014-02-17T13:58:50Z 2014-02-17T13:58:50Z Andriy Gapon avg@FreeBSD.org 2014-02-17T13:58:50Z urn:sha1:9e5c74464b4f93205b751421c28a8a1c80283947 SDT_PROBE_DEFINE 2014-02-17T13:53:01Z Andriy Gapon avg@FreeBSD.org 2014-02-17T13:53:01Z urn:sha1:001d12d325535346276661d9f136ee1d3eeb29d9 show up as unknown MFC slacker: markj 2013-12-26T16:58:30Z John Baldwin jhb@FreeBSD.org 2013-12-26T16:58:30Z urn:sha1:cabbcf7d98e6c45d1b4d86577a9f183949196ec8 2013-10-06T05:53:29Z Konstantin Belousov kib@FreeBSD.org 2013-10-06T05:53:29Z urn:sha1:a678e9532c7a37c4739bb4dced0b0792f405c25a Make the mac_policy_rm lock recursable, which allows reentrance into the mac framework. 2013-07-16T11:15:05Z Andriy Gapon avg@FreeBSD.org 2013-07-16T11:15:05Z urn:sha1:63109872745e7d760c0c5595a4ca4ded936902e5 Approved by: re (kib) 2013-04-05T08:22:11Z Alexander Motin mav@FreeBSD.org 2013-04-05T08:22:11Z urn:sha1:1139d398ea93668ee65ae02b8ceab630ca9e5487 Mark MALLOC_DEFINEs static that have no corresponding MALLOC_DECLAREs. This means that their use is restricted to a single C file. 2013-03-09T02:36:32Z Marius Strobl marius@FreeBSD.org 2013-03-09T02:36:32Z urn:sha1:7b1b32ed4582e7bcdd416c4718d0d79ebaea192d Mark all SYSCTL_NODEs static that have no corresponding SYSCTL_DECLs. The SYSCTL_NODE macro defines a list that stores all child-elements of that node. If there's no SYSCTL_DECL macro anywhere else, there's no reason why it shouldn't be static. 2013-03-02T15:11:20Z Alexander V. Chernikov melifaro@FreeBSD.org 2013-03-02T15:11:20Z urn:sha1:c60e58f609d064c139a1c072721534a586147a3e * r233937 - Improve BPF locking model * r233938 - Improve performace for writer-only BPF users * r233946 - Fix build * r235744 - Fix (new) panic on attaching to non-existent interface * r235745 - Fix old panic when BPF consumer attaches to destroying interface * r235746 - Call bpf_jitter() before acquiring BPF global lock * r235747 - Make most BPF ioctls() SMP-safe. * r236231 - Fix BPF_JITTER code broken by r235746. * r236251 - Fix shim for BIOCSETF to drop all packets buffered on the descriptor. * r236261 - Save the previous filter right before we set new one. * r236262 - Fix style(9) nits, reduce unnecessary type castings. * r236559 - Fix panic introduced by r235745 * r236806 - Fix typo introduced in r236559. r233937 - Improve BPF locking model. Interface locks and descriptor locks are converted from mutex(9) to rwlock(9). This greately improves performance: in most common case we need to acquire 1 reader lock instead of 2 mutexes. - Remove filter(descriptor) (reader) lock in bpf_mtap[2] This was suggested by glebius@. We protect filter by requesting interface writer lock on filter change. - Cover struct bpf_if under BPF_INTERNAL define. This permits including bpf.h without including rwlock stuff. However, this is is temporary solution, struct bpf_if should be made opaque for any external caller. r233938 - Improve performace for writer-only BPF users. Linux and Solaris (at least OpenSolaris) has PF_PACKET socket families to send raw ethernet frames. The only FreeBSD interface that can be used to send raw frames is BPF. As a result, many programs like cdpd, lldpd, various dhcp stuff uses BPF only to send data. This leads us to the situation when software like cdpd, being run on high-traffic-volume interface significantly reduces overall performance since we have to acquire additional locks for every packet. Here we add sysctl that changes BPF behavior in the following way: If program came and opens BPF socket without explicitly specifyin read filter we assume it to be write-only and add it to special writer-only per-interface list. This makes bpf_peers_present() return 0, so no additional overhead is introduced. After filter is supplied, descriptor is added to original per-interface list permitting packets to be captured. Unfortunately, pcap_open_live() sets catch-all filter itself for the purpose of setting snap length. Fortunately, most programs explicitly sets (event catch-all) filter after that. tcpdump(1) is a good example. So a bit hackis approach is taken: we upgrade description only after second BIOCSETF is received. Sysctl is named net.bpf.optimize_writers and is turned off by default. - While here, document all sysctl variables in bpf.4 r233946 Fix build broken by r233938. r235744 Fix panic on attaching to non-existent interface (introduced by r233937, pointed by hrs@) Fix panic on tcpdump being attached to interface being removed (introduced by r233937, pointed by hrs@ and adrian@) Protect most of bpf_setf() by BPF global lock Add several forgotten assertions (thanks to adrian@) Document current locking model inside bpf.c Document EVENTHANDLER(9) usage inside BPF. r235745 Fix old panic when BPF consumer attaches to destroying interface. 'flags' field is added to the end of bpf_if structure. Currently the only flag is BPFIF_FLAG_DYING which is set on bpf detach and checked by bpf_attachd() Problem can be easily triggered on SMP stable/[89] by the following command (sort of): 'while true; do ifconfig vlan222 create vlan 222 vlandev em0 up ; \ tcpdump -pi vlan222 & ; ifconfig vlan222 destroy ; done' Fix possible use-after-free when BPF detaches itself from interface, freeing bpf_bif memory, while interface is still UP and there can be routes via this interface. Freeing is now delayed till ifnet_departure_event is received via eventhandler(9) api. Convert bpfd rwlock back to mutex due lack of performance gain (currently checking if packet matches filter is done without holding bpfd lock and we have to acquire write lock if packet matches) r235746 Call bpf_jitter() before acquiring BPF global lock due to malloc() being used inside bpf_jitter. Eliminate bpf_buffer_alloc() and allocate BPF buffers on descriptor creation and BIOCSBLEN ioctl. This permits us not to allocate buffers inside bpf_attachd() which is protected by global lock. r235747 Make most BPF ioctls() SMP-safe. r236559 Fix panic introduced by r235745. Panic occurs after first packet traverse renamed interface. Add several comments on locking r236231 Fix BPF_JITTER code broken by r235746. r236251 Fix 32-bit shim for BIOCSETF to drop all packets buffered on the descriptor and reset statistics as it should. r236261 - Save the previous filter right before we set new one. - Reduce duplicate code and make it little easier to read. r236262 Fix style(9) nits, reduce unnecessary type castings, etc., for bpf_setf(). r236806 Fix typo introduced in r236559. 2012-12-18T10:23:58Z Robert Watson rwatson@FreeBSD.org 2012-12-18T10:23:58Z urn:sha1:9947be2942a969416d78dcce5215d175bd2d7554 Merge OpenBSM 1.2-alpha2 changes from contrib/openbsm to src/sys/{bsm,security/audit}. There are a few tweaks to help with the FreeBSD build environment that will be merged back to OpenBSM. No significant functional changes appear on the kernel side. Obtained from: TrustedBSD Project Sponsored by: The FreeBSD Foundation (auditdistd) 2012-12-16T23:41:34Z Pawel Jakub Dawidek pjd@FreeBSD.org 2012-12-16T23:41:34Z urn:sha1:c5a94118866333734e15d466739ddbac1bc1fee8 r243719: IFp4 @208450: Remove redundant call to AUDIT_ARG_UPATH1(). Path will be remembered by the following NDINIT(AUDITVNODE1) call. Sponsored by: The FreeBSD Foundation (auditdistd) r243720: IFp4 @208381: For VOP_GETATTR() we just need vnode to be shared-locked. Sponsored by: The FreeBSD Foundation (auditdistd) r243722: IFp4 @208382: Currently on each record write we call VFS_STATFS() to get available space on the file system as well as VOP_GETATTR() to get trail file size. We can assume that trail file is only updated by the audit worker, so instead of asking for file size on every write, get file size on trail switch only (it should be zero, but it's not expensive) and use global variable audit_size protected by the audit worker lock to keep track of trail file's size. This eliminates VOP_GETATTR() call for every write. VFS_STATFS() is satisfied from in-memory data (mount->mnt_stat), so shouldn't be expensive. Sponsored by: The FreeBSD Foundation (auditdistd) r243723: IFp4 @208383: Currently when we discover that trail file is greater than configured limit we send AUDIT_TRIGGER_ROTATE_KERNEL trigger to the auditd daemon once. If for some reason auditd didn't rotate trail file it will never be rotated. Change it by sending the trigger when trail file size grows by the configured limit. For example if the limit is 1MB, we will send trigger on 1MB, 2MB, 3MB, etc. This is also needed for the auditd change that will be committed soon where auditd may ignore the trigger - it might be ignored if kernel requests the trail file to be rotated too quickly (often than once a second) which would result in overwriting previous trail file. Sponsored by: The FreeBSD Foundation (auditdistd) r243726: IFp4 @208451: Fix path handling for *at() syscalls. Before the change directory descriptor was totally ignored, so the relative path argument was appended to current working directory path and not to the path provided by descriptor, thus wrong paths were stored in audit logs. Now that we use directory descriptor in vfs_lookup, move AUDIT_ARG_UPATH1() and AUDIT_ARG_UPATH2() calls to the place where we hold file descriptors table lock, so we are sure paths will be resolved according to the same directory in audit record and in actual operation. Sponsored by: The FreeBSD Foundation (auditdistd) Reviewed by: rwatson r243727: IFp4 @208452: Audit handling for missing events: - AUE_READLINKAT - AUE_FACCESSAT - AUE_MKDIRAT - AUE_MKFIFOAT - AUE_MKNODAT - AUE_SYMLINKAT Sponsored by: FreeBSD Foundation (auditdistd) r243746: Fix one more compilation issue. Sponsored by: FreeBSD Foundation (auditdistd)