mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-30 08:02:30 +00:00
0a14842f5a
In order to speedup packet filtering, here is an implementation of a JIT compiler for x86_64 It is disabled by default, and must be enabled by the admin. echo 1 >/proc/sys/net/core/bpf_jit_enable It uses module_alloc() and module_free() to get memory in the 2GB text kernel range since we call helpers functions from the generated code. EAX : BPF A accumulator EBX : BPF X accumulator RDI : pointer to skb (first argument given to JIT function) RBP : frame pointer (even if CONFIG_FRAME_POINTER=n) r9d : skb->len - skb->data_len (headlen) r8 : skb->data To get a trace of generated code, use : echo 2 >/proc/sys/net/core/bpf_jit_enable Example of generated code : # tcpdump -p -n -s 0 -i eth1 host 192.168.20.0/24 flen=18 proglen=147 pass=3 image=ffffffffa00b5000 JIT code: ffffffffa00b5000: 55 48 89 e5 48 83 ec 60 48 89 5d f8 44 8b 4f 60 JIT code: ffffffffa00b5010: 44 2b 4f 64 4c 8b 87 b8 00 00 00 be 0c 00 00 00 JIT code: ffffffffa00b5020: e8 24 7b f7 e0 3d 00 08 00 00 75 28 be 1a 00 00 JIT code: ffffffffa00b5030: 00 e8 fe 7a f7 e0 24 00 3d 00 14 a8 c0 74 49 be JIT code: ffffffffa00b5040: 1e 00 00 00 e8 eb 7a f7 e0 24 00 3d 00 14 a8 c0 JIT code: ffffffffa00b5050: 74 36 eb 3b 3d 06 08 00 00 74 07 3d 35 80 00 00 JIT code: ffffffffa00b5060: 75 2d be 1c 00 00 00 e8 c8 7a f7 e0 24 00 3d 00 JIT code: ffffffffa00b5070: 14 a8 c0 74 13 be 26 00 00 00 e8 b5 7a f7 e0 24 JIT code: ffffffffa00b5080: 00 3d 00 14 a8 c0 75 07 b8 ff ff 00 00 eb 02 31 JIT code: ffffffffa00b5090: c0 c9 c3 BPF program is 144 bytes long, so native program is almost same size ;) (000) ldh [12] (001) jeq #0x800 jt 2 jf 8 (002) ld [26] (003) and #0xffffff00 (004) jeq #0xc0a81400 jt 16 jf 5 (005) ld [30] (006) and #0xffffff00 (007) jeq #0xc0a81400 jt 16 jf 17 (008) jeq #0x806 jt 10 jf 9 (009) jeq #0x8035 jt 10 jf 17 (010) ld [28] (011) and #0xffffff00 (012) jeq #0xc0a81400 jt 16 jf 13 (013) ld [38] (014) and #0xffffff00 (015) jeq #0xc0a81400 jt 16 jf 17 (016) ret #65535 (017) ret #0 Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Arnaldo Carvalho de Melo <acme@infradead.org> Cc: Ben Hutchings <bhutchings@solarflare.com> Cc: Hagen Paul Pfeifer <hagen@jauu.net> Signed-off-by: David S. Miller <davem@davemloft.net>
196 lines
6.9 KiB
Text
196 lines
6.9 KiB
Text
Documentation for /proc/sys/net/* kernel version 2.4.0-test11-pre4
|
|
(c) 1999 Terrehon Bowden <terrehon@pacbell.net>
|
|
Bodo Bauer <bb@ricochet.net>
|
|
(c) 2000 Jorge Nerin <comandante@zaralinux.com>
|
|
(c) 2009 Shen Feng <shen@cn.fujitsu.com>
|
|
|
|
For general info and legal blurb, please look in README.
|
|
|
|
==============================================================
|
|
|
|
This file contains the documentation for the sysctl files in
|
|
/proc/sys/net and is valid for Linux kernel version 2.4.0-test11-pre4.
|
|
|
|
The interface to the networking parts of the kernel is located in
|
|
/proc/sys/net. The following table shows all possible subdirectories.You may
|
|
see only some of them, depending on your kernel's configuration.
|
|
|
|
|
|
Table : Subdirectories in /proc/sys/net
|
|
..............................................................................
|
|
Directory Content Directory Content
|
|
core General parameter appletalk Appletalk protocol
|
|
unix Unix domain sockets netrom NET/ROM
|
|
802 E802 protocol ax25 AX25
|
|
ethernet Ethernet protocol rose X.25 PLP layer
|
|
ipv4 IP version 4 x25 X.25 protocol
|
|
ipx IPX token-ring IBM token ring
|
|
bridge Bridging decnet DEC net
|
|
ipv6 IP version 6
|
|
..............................................................................
|
|
|
|
1. /proc/sys/net/core - Network core options
|
|
-------------------------------------------------------
|
|
|
|
bpf_jit_enable
|
|
--------------
|
|
|
|
This enables Berkeley Packet Filter Just in Time compiler.
|
|
Currently supported on x86_64 architecture, bpf_jit provides a framework
|
|
to speed packet filtering, the one used by tcpdump/libpcap for example.
|
|
Values :
|
|
0 - disable the JIT (default value)
|
|
1 - enable the JIT
|
|
2 - enable the JIT and ask the compiler to emit traces on kernel log.
|
|
|
|
rmem_default
|
|
------------
|
|
|
|
The default setting of the socket receive buffer in bytes.
|
|
|
|
rmem_max
|
|
--------
|
|
|
|
The maximum receive socket buffer size in bytes.
|
|
|
|
wmem_default
|
|
------------
|
|
|
|
The default setting (in bytes) of the socket send buffer.
|
|
|
|
wmem_max
|
|
--------
|
|
|
|
The maximum send socket buffer size in bytes.
|
|
|
|
message_burst and message_cost
|
|
------------------------------
|
|
|
|
These parameters are used to limit the warning messages written to the kernel
|
|
log from the networking code. They enforce a rate limit to make a
|
|
denial-of-service attack impossible. A higher message_cost factor, results in
|
|
fewer messages that will be written. Message_burst controls when messages will
|
|
be dropped. The default settings limit warning messages to one every five
|
|
seconds.
|
|
|
|
warnings
|
|
--------
|
|
|
|
This controls console messages from the networking stack that can occur because
|
|
of problems on the network like duplicate address or bad checksums. Normally,
|
|
this should be enabled, but if the problem persists the messages can be
|
|
disabled.
|
|
|
|
netdev_budget
|
|
-------------
|
|
|
|
Maximum number of packets taken from all interfaces in one polling cycle (NAPI
|
|
poll). In one polling cycle interfaces which are registered to polling are
|
|
probed in a round-robin manner. The limit of packets in one such probe can be
|
|
set per-device via sysfs class/net/<device>/weight .
|
|
|
|
netdev_max_backlog
|
|
------------------
|
|
|
|
Maximum number of packets, queued on the INPUT side, when the interface
|
|
receives packets faster than kernel can process them.
|
|
|
|
netdev_tstamp_prequeue
|
|
----------------------
|
|
|
|
If set to 0, RX packet timestamps can be sampled after RPS processing, when
|
|
the target CPU processes packets. It might give some delay on timestamps, but
|
|
permit to distribute the load on several cpus.
|
|
|
|
If set to 1 (default), timestamps are sampled as soon as possible, before
|
|
queueing.
|
|
|
|
optmem_max
|
|
----------
|
|
|
|
Maximum ancillary buffer size allowed per socket. Ancillary data is a sequence
|
|
of struct cmsghdr structures with appended data.
|
|
|
|
2. /proc/sys/net/unix - Parameters for Unix domain sockets
|
|
-------------------------------------------------------
|
|
|
|
There is only one file in this directory.
|
|
unix_dgram_qlen limits the max number of datagrams queued in Unix domain
|
|
socket's buffer. It will not take effect unless PF_UNIX flag is specified.
|
|
|
|
|
|
3. /proc/sys/net/ipv4 - IPV4 settings
|
|
-------------------------------------------------------
|
|
Please see: Documentation/networking/ip-sysctl.txt and ipvs-sysctl.txt for
|
|
descriptions of these entries.
|
|
|
|
|
|
4. Appletalk
|
|
-------------------------------------------------------
|
|
|
|
The /proc/sys/net/appletalk directory holds the Appletalk configuration data
|
|
when Appletalk is loaded. The configurable parameters are:
|
|
|
|
aarp-expiry-time
|
|
----------------
|
|
|
|
The amount of time we keep an ARP entry before expiring it. Used to age out
|
|
old hosts.
|
|
|
|
aarp-resolve-time
|
|
-----------------
|
|
|
|
The amount of time we will spend trying to resolve an Appletalk address.
|
|
|
|
aarp-retransmit-limit
|
|
---------------------
|
|
|
|
The number of times we will retransmit a query before giving up.
|
|
|
|
aarp-tick-time
|
|
--------------
|
|
|
|
Controls the rate at which expires are checked.
|
|
|
|
The directory /proc/net/appletalk holds the list of active Appletalk sockets
|
|
on a machine.
|
|
|
|
The fields indicate the DDP type, the local address (in network:node format)
|
|
the remote address, the size of the transmit pending queue, the size of the
|
|
received queue (bytes waiting for applications to read) the state and the uid
|
|
owning the socket.
|
|
|
|
/proc/net/atalk_iface lists all the interfaces configured for appletalk.It
|
|
shows the name of the interface, its Appletalk address, the network range on
|
|
that address (or network number for phase 1 networks), and the status of the
|
|
interface.
|
|
|
|
/proc/net/atalk_route lists each known network route. It lists the target
|
|
(network) that the route leads to, the router (may be directly connected), the
|
|
route flags, and the device the route is using.
|
|
|
|
|
|
5. IPX
|
|
-------------------------------------------------------
|
|
|
|
The IPX protocol has no tunable values in proc/sys/net.
|
|
|
|
The IPX protocol does, however, provide proc/net/ipx. This lists each IPX
|
|
socket giving the local and remote addresses in Novell format (that is
|
|
network:node:port). In accordance with the strange Novell tradition,
|
|
everything but the port is in hex. Not_Connected is displayed for sockets that
|
|
are not tied to a specific remote address. The Tx and Rx queue sizes indicate
|
|
the number of bytes pending for transmission and reception. The state
|
|
indicates the state the socket is in and the uid is the owning uid of the
|
|
socket.
|
|
|
|
The /proc/net/ipx_interface file lists all IPX interfaces. For each interface
|
|
it gives the network number, the node number, and indicates if the network is
|
|
the primary network. It also indicates which device it is bound to (or
|
|
Internal for internal networks) and the Frame Type if appropriate. Linux
|
|
supports 802.3, 802.2, 802.2 SNAP and DIX (Blue Book) ethernet framing for
|
|
IPX.
|
|
|
|
The /proc/net/ipx_route table holds a list of IPX routes. For each route it
|
|
gives the destination network, the router node (or Directly) and the network
|
|
address of the router (or Connected) for internal networks.
|