1 // SPDX-License-Identifier: GPL-2.0 2 /* -*- linux-c -*- 3 * sysctl_net_core.c: sysctl interface to net core subsystem. 4 * 5 * Begun April 1, 1996, Mike Shaver. 6 * Added /proc/sys/net/core directory entry (empty =) ). [MS] 7 */ 8 9 #include <linux/filter.h> 10 #include <linux/mm.h> 11 #include <linux/sysctl.h> 12 #include <linux/module.h> 13 #include <linux/socket.h> 14 #include <linux/netdevice.h> 15 #include <linux/ratelimit.h> 16 #include <linux/vmalloc.h> 17 #include <linux/init.h> 18 #include <linux/slab.h> 19 #include <linux/sched/isolation.h> 20 #include <linux/hex.h> 21 22 #include <net/ip.h> 23 #include <net/sock.h> 24 #include <net/neighbour.h> 25 #include <net/net_ratelimit.h> 26 #include <net/busy_poll.h> 27 #include <net/pkt_sched.h> 28 #include <net/hotdata.h> 29 #include <net/proto_memory.h> 30 #include <net/rps.h> 31 32 #include "dev.h" 33 #include "net-sysfs.h" 34 35 static int int_3600 = 3600; 36 static int min_sndbuf = SOCK_MIN_SNDBUF; 37 static int min_rcvbuf = SOCK_MIN_RCVBUF; 38 static int max_skb_frags = MAX_SKB_FRAGS; 39 static int min_mem_pcpu_rsv = SK_MEMORY_PCPU_RESERVE; 40 static int netdev_budget_usecs_min = 2 * USEC_PER_SEC / HZ; 41 42 static int net_msg_warn; /* Unused, but still a sysctl */ 43 44 int sysctl_fb_tunnels_only_for_init_net __read_mostly = 0; 45 EXPORT_SYMBOL(sysctl_fb_tunnels_only_for_init_net); 46 47 /* 0 - Keep current behavior: 48 * IPv4: inherit all current settings from init_net 49 * IPv6: reset all settings to default 50 * 1 - Both inherit all current settings from init_net 51 * 2 - Both reset all settings to default 52 * 3 - Both inherit all settings from current netns 53 */ 54 int sysctl_devconf_inherit_init_net __read_mostly; 55 EXPORT_SYMBOL(sysctl_devconf_inherit_init_net); 56 57 #if IS_ENABLED(CONFIG_NET_FLOW_LIMIT) || IS_ENABLED(CONFIG_RPS) 58 static int dump_cpumask(void *buffer, size_t *lenp, loff_t *ppos, 59 struct cpumask *mask) 60 { 61 char *kbuf; 62 int len; 63 64 if (*ppos || !*lenp) { 65 *lenp = 0; 66 return 0; 67 } 68 69 /* CPUs are displayed as a hex bitmap + a comma between each groups of 8 70 * nibbles (except the last one which has a newline instead). 71 * Guesstimate the buffer size at the group granularity level. 72 */ 73 len = min(DIV_ROUND_UP(nr_cpumask_bits, 32) * (8 + 1), *lenp); 74 kbuf = kmalloc(len, GFP_KERNEL); 75 if (!kbuf) { 76 *lenp = 0; 77 return -ENOMEM; 78 } 79 80 len = scnprintf(kbuf, len, "%*pb", cpumask_pr_args(mask)); 81 if (!len) { 82 *lenp = 0; 83 goto free_buf; 84 } 85 86 /* scnprintf writes a trailing null char not counted in the returned 87 * length, override it with a newline. 88 */ 89 kbuf[len++] = '\n'; 90 memcpy(buffer, kbuf, len); 91 *lenp = len; 92 *ppos += len; 93 94 free_buf: 95 kfree(kbuf); 96 return 0; 97 } 98 #endif 99 100 #ifdef CONFIG_RPS 101 102 DEFINE_MUTEX(rps_default_mask_mutex); 103 104 static int rps_default_mask_sysctl(const struct ctl_table *table, int write, 105 void *buffer, size_t *lenp, loff_t *ppos) 106 { 107 struct net *net = (struct net *)table->data; 108 struct cpumask *mask; 109 int err = 0; 110 111 mutex_lock(&rps_default_mask_mutex); 112 mask = net->core.rps_default_mask; 113 if (write) { 114 if (!mask) { 115 mask = kzalloc(cpumask_size(), GFP_KERNEL); 116 net->core.rps_default_mask = mask; 117 } 118 err = -ENOMEM; 119 if (!mask) 120 goto done; 121 122 err = cpumask_parse(buffer, mask); 123 if (err) 124 goto done; 125 126 err = rps_cpumask_housekeeping(mask); 127 if (err) 128 goto done; 129 } else { 130 err = dump_cpumask(buffer, lenp, ppos, 131 mask ?: cpu_none_mask); 132 } 133 134 done: 135 mutex_unlock(&rps_default_mask_mutex); 136 return err; 137 } 138 139 static int rps_sock_flow_sysctl(const struct ctl_table *table, int write, 140 void *buffer, size_t *lenp, loff_t *ppos) 141 { 142 struct rps_sock_flow_table *o_sock_table, *sock_table; 143 static DEFINE_MUTEX(sock_flow_mutex); 144 rps_tag_ptr o_tag_ptr, tag_ptr; 145 unsigned int orig_size, size; 146 struct ctl_table tmp = { 147 .data = &size, 148 .maxlen = sizeof(size), 149 .mode = table->mode 150 }; 151 void *tofree = NULL; 152 int ret, i; 153 u8 log; 154 155 mutex_lock(&sock_flow_mutex); 156 157 o_tag_ptr = tag_ptr = net_hotdata.rps_sock_flow_table; 158 159 size = o_tag_ptr ? rps_tag_to_mask(o_tag_ptr) + 1 : 0; 160 o_sock_table = rps_tag_to_table(o_tag_ptr); 161 orig_size = size; 162 163 ret = proc_dointvec(&tmp, write, buffer, lenp, ppos); 164 165 if (!write) 166 goto unlock; 167 168 if (size) { 169 if (size > 1<<29) { 170 /* Enforce limit to prevent overflow */ 171 mutex_unlock(&sock_flow_mutex); 172 return -EINVAL; 173 } 174 sock_table = o_sock_table; 175 size = roundup_pow_of_two(size); 176 if (size != orig_size) { 177 sock_table = vmalloc_huge(size * sizeof(*sock_table), 178 GFP_KERNEL); 179 if (!sock_table) { 180 mutex_unlock(&sock_flow_mutex); 181 return -ENOMEM; 182 } 183 net_hotdata.rps_cpu_mask = 184 roundup_pow_of_two(nr_cpu_ids) - 1; 185 log = ilog2(size); 186 tag_ptr = (rps_tag_ptr)sock_table | log; 187 } 188 189 for (i = 0; i < size; i++) 190 sock_table[i].ent = RPS_NO_CPU; 191 } else { 192 sock_table = NULL; 193 tag_ptr = 0UL; 194 } 195 if (tag_ptr != o_tag_ptr) { 196 smp_store_release(&net_hotdata.rps_sock_flow_table, tag_ptr); 197 if (sock_table) { 198 static_branch_inc(&rps_needed); 199 static_branch_inc(&rfs_needed); 200 } 201 if (o_sock_table) { 202 static_branch_dec(&rps_needed); 203 static_branch_dec(&rfs_needed); 204 tofree = o_sock_table; 205 } 206 } 207 208 unlock: 209 mutex_unlock(&sock_flow_mutex); 210 211 kvfree_rcu_mightsleep(tofree); 212 return ret; 213 } 214 #endif /* CONFIG_RPS */ 215 216 #ifdef CONFIG_NET_FLOW_LIMIT 217 static DEFINE_MUTEX(flow_limit_update_mutex); 218 219 static int flow_limit_cpu_sysctl(const struct ctl_table *table, int write, 220 void *buffer, size_t *lenp, loff_t *ppos) 221 { 222 struct sd_flow_limit *cur; 223 struct softnet_data *sd; 224 cpumask_var_t mask; 225 int i, len, ret = 0; 226 227 if (!alloc_cpumask_var(&mask, GFP_KERNEL)) 228 return -ENOMEM; 229 230 if (write) { 231 ret = cpumask_parse(buffer, mask); 232 if (ret) 233 goto done; 234 235 mutex_lock(&flow_limit_update_mutex); 236 len = sizeof(*cur) + netdev_flow_limit_table_len; 237 for_each_possible_cpu(i) { 238 sd = &per_cpu(softnet_data, i); 239 cur = rcu_dereference_protected(sd->flow_limit, 240 lockdep_is_held(&flow_limit_update_mutex)); 241 if (cur && !cpumask_test_cpu(i, mask)) { 242 RCU_INIT_POINTER(sd->flow_limit, NULL); 243 kfree_rcu(cur, rcu); 244 } else if (!cur && cpumask_test_cpu(i, mask)) { 245 cur = kzalloc_node(len, GFP_KERNEL, 246 cpu_to_node(i)); 247 if (!cur) { 248 /* not unwinding previous changes */ 249 ret = -ENOMEM; 250 goto write_unlock; 251 } 252 cur->log_buckets = ilog2(netdev_flow_limit_table_len); 253 rcu_assign_pointer(sd->flow_limit, cur); 254 } 255 } 256 write_unlock: 257 mutex_unlock(&flow_limit_update_mutex); 258 } else { 259 cpumask_clear(mask); 260 rcu_read_lock(); 261 for_each_possible_cpu(i) { 262 sd = &per_cpu(softnet_data, i); 263 if (rcu_dereference(sd->flow_limit)) 264 cpumask_set_cpu(i, mask); 265 } 266 rcu_read_unlock(); 267 268 ret = dump_cpumask(buffer, lenp, ppos, mask); 269 } 270 271 done: 272 free_cpumask_var(mask); 273 return ret; 274 } 275 276 static int flow_limit_table_len_sysctl(const struct ctl_table *table, int write, 277 void *buffer, size_t *lenp, loff_t *ppos) 278 { 279 unsigned int old, *ptr; 280 int ret; 281 282 mutex_lock(&flow_limit_update_mutex); 283 284 ptr = table->data; 285 old = *ptr; 286 ret = proc_dointvec(table, write, buffer, lenp, ppos); 287 if (!ret && write && !is_power_of_2(*ptr)) { 288 *ptr = old; 289 ret = -EINVAL; 290 } 291 292 mutex_unlock(&flow_limit_update_mutex); 293 return ret; 294 } 295 #endif /* CONFIG_NET_FLOW_LIMIT */ 296 297 #ifdef CONFIG_NET_SCHED 298 static int set_default_qdisc(const struct ctl_table *table, int write, 299 void *buffer, size_t *lenp, loff_t *ppos) 300 { 301 char id[IFNAMSIZ]; 302 struct ctl_table tbl = { 303 .data = id, 304 .maxlen = IFNAMSIZ, 305 }; 306 int ret; 307 308 qdisc_get_default(id, IFNAMSIZ); 309 310 ret = proc_dostring(&tbl, write, buffer, lenp, ppos); 311 if (write && ret == 0) 312 ret = qdisc_set_default(id); 313 return ret; 314 } 315 #endif 316 317 static int proc_do_dev_weight(const struct ctl_table *table, int write, 318 void *buffer, size_t *lenp, loff_t *ppos) 319 { 320 static DEFINE_MUTEX(dev_weight_mutex); 321 int ret, weight; 322 323 mutex_lock(&dev_weight_mutex); 324 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 325 if (!ret && write) { 326 weight = READ_ONCE(weight_p); 327 WRITE_ONCE(net_hotdata.dev_rx_weight, weight * dev_weight_rx_bias); 328 WRITE_ONCE(net_hotdata.dev_tx_weight, weight * dev_weight_tx_bias); 329 } 330 mutex_unlock(&dev_weight_mutex); 331 332 return ret; 333 } 334 335 static int proc_do_rss_key(const struct ctl_table *table, int write, 336 void *buffer, size_t *lenp, loff_t *ppos) 337 { 338 char buf[NETDEV_RSS_KEY_LEN * 3]; 339 struct ctl_table fake_table; 340 bool initialized; 341 char *pos = buf; 342 343 initialized = READ_ONCE(netdev_rss_key_initialized); 344 /* Pair with smp_wmb() in netdev_rss_key_fill(). */ 345 smp_rmb(); 346 347 for (int i = 0; i < NETDEV_RSS_KEY_LEN; i++) { 348 pos = hex_byte_pack(pos, initialized ? netdev_rss_key[i] : 0); 349 *pos++ = ':'; 350 } 351 *(--pos) = 0; 352 353 fake_table.data = buf; 354 fake_table.maxlen = sizeof(buf); 355 return proc_dostring(&fake_table, write, buffer, lenp, ppos); 356 } 357 358 static int proc_do_skb_defer_max(const struct ctl_table *table, int write, 359 void *buffer, size_t *lenp, loff_t *ppos) 360 { 361 static DEFINE_MUTEX(skb_defer_max_mutex); 362 int ret, oval, nval; 363 364 mutex_lock(&skb_defer_max_mutex); 365 366 oval = !net_hotdata.sysctl_skb_defer_max; 367 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 368 nval = !net_hotdata.sysctl_skb_defer_max; 369 370 if (nval != oval) { 371 if (nval) 372 static_branch_enable(&skb_defer_disable_key); 373 else 374 static_branch_disable(&skb_defer_disable_key); 375 } 376 377 mutex_unlock(&skb_defer_max_mutex); 378 return ret; 379 } 380 381 #ifdef CONFIG_BPF_JIT 382 static int proc_dointvec_minmax_bpf_enable(const struct ctl_table *table, int write, 383 void *buffer, size_t *lenp, 384 loff_t *ppos) 385 { 386 int ret, jit_enable = *(int *)table->data; 387 int min = *(int *)table->extra1; 388 int max = *(int *)table->extra2; 389 struct ctl_table tmp = *table; 390 391 if (write && !capable(CAP_SYS_ADMIN)) 392 return -EPERM; 393 394 tmp.data = &jit_enable; 395 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); 396 if (write && !ret) { 397 if (jit_enable < 2 || 398 (jit_enable == 2 && bpf_dump_raw_ok(current_cred()))) { 399 *(int *)table->data = jit_enable; 400 if (jit_enable == 2) 401 pr_warn("bpf_jit_enable = 2 was set! NEVER use this in production, only for JIT debugging!\n"); 402 } else { 403 ret = -EPERM; 404 } 405 } 406 407 if (write && ret && min == max) 408 pr_info_once("CONFIG_BPF_JIT_ALWAYS_ON is enabled, bpf_jit_enable is permanently set to 1.\n"); 409 410 return ret; 411 } 412 413 # ifdef CONFIG_HAVE_EBPF_JIT 414 static int 415 proc_dointvec_minmax_bpf_restricted(const struct ctl_table *table, int write, 416 void *buffer, size_t *lenp, loff_t *ppos) 417 { 418 if (!capable(CAP_SYS_ADMIN)) 419 return -EPERM; 420 421 return proc_dointvec_minmax(table, write, buffer, lenp, ppos); 422 } 423 # endif /* CONFIG_HAVE_EBPF_JIT */ 424 425 static int 426 proc_dolongvec_minmax_bpf_restricted(const struct ctl_table *table, int write, 427 void *buffer, size_t *lenp, loff_t *ppos) 428 { 429 if (!capable(CAP_SYS_ADMIN)) 430 return -EPERM; 431 432 return proc_doulongvec_minmax(table, write, buffer, lenp, ppos); 433 } 434 #endif 435 436 static struct ctl_table net_core_table[] = { 437 { 438 .procname = "mem_pcpu_rsv", 439 .data = &net_hotdata.sysctl_mem_pcpu_rsv, 440 .maxlen = sizeof(int), 441 .mode = 0644, 442 .proc_handler = proc_dointvec_minmax, 443 .extra1 = &min_mem_pcpu_rsv, 444 }, 445 { 446 .procname = "dev_weight", 447 .data = &weight_p, 448 .maxlen = sizeof(int), 449 .mode = 0644, 450 .proc_handler = proc_do_dev_weight, 451 .extra1 = SYSCTL_ONE, 452 }, 453 { 454 .procname = "dev_weight_rx_bias", 455 .data = &dev_weight_rx_bias, 456 .maxlen = sizeof(int), 457 .mode = 0644, 458 .proc_handler = proc_do_dev_weight, 459 .extra1 = SYSCTL_ONE, 460 }, 461 { 462 .procname = "dev_weight_tx_bias", 463 .data = &dev_weight_tx_bias, 464 .maxlen = sizeof(int), 465 .mode = 0644, 466 .proc_handler = proc_do_dev_weight, 467 .extra1 = SYSCTL_ONE, 468 }, 469 { 470 .procname = "netdev_max_backlog", 471 .data = &net_hotdata.max_backlog, 472 .maxlen = sizeof(int), 473 .mode = 0644, 474 .proc_handler = proc_dointvec 475 }, 476 { 477 .procname = "qdisc_max_burst", 478 .data = &net_hotdata.qdisc_max_burst, 479 .maxlen = sizeof(int), 480 .mode = 0644, 481 .proc_handler = proc_dointvec 482 }, 483 { 484 .procname = "netdev_rss_key", 485 .data = &netdev_rss_key, 486 .maxlen = sizeof(int), 487 .mode = 0444, 488 .proc_handler = proc_do_rss_key, 489 }, 490 #ifdef CONFIG_BPF_JIT 491 { 492 .procname = "bpf_jit_enable", 493 .data = &bpf_jit_enable, 494 .maxlen = sizeof(int), 495 .mode = 0644, 496 .proc_handler = proc_dointvec_minmax_bpf_enable, 497 # ifdef CONFIG_BPF_JIT_ALWAYS_ON 498 .extra1 = SYSCTL_ONE, 499 .extra2 = SYSCTL_ONE, 500 # else 501 .extra1 = SYSCTL_ZERO, 502 .extra2 = SYSCTL_TWO, 503 # endif 504 }, 505 # ifdef CONFIG_HAVE_EBPF_JIT 506 { 507 .procname = "bpf_jit_harden", 508 .data = &bpf_jit_harden, 509 .maxlen = sizeof(int), 510 .mode = 0600, 511 .proc_handler = proc_dointvec_minmax_bpf_restricted, 512 .extra1 = SYSCTL_ZERO, 513 .extra2 = SYSCTL_TWO, 514 }, 515 { 516 .procname = "bpf_jit_kallsyms", 517 .data = &bpf_jit_kallsyms, 518 .maxlen = sizeof(int), 519 .mode = 0600, 520 .proc_handler = proc_dointvec_minmax_bpf_restricted, 521 .extra1 = SYSCTL_ZERO, 522 .extra2 = SYSCTL_ONE, 523 }, 524 # endif 525 { 526 .procname = "bpf_jit_limit", 527 .data = &bpf_jit_limit, 528 .maxlen = sizeof(long), 529 .mode = 0600, 530 .proc_handler = proc_dolongvec_minmax_bpf_restricted, 531 .extra1 = SYSCTL_LONG_ONE, 532 .extra2 = &bpf_jit_limit_max, 533 }, 534 #endif 535 { 536 .procname = "netdev_tstamp_prequeue", 537 .data = &net_hotdata.tstamp_prequeue, 538 .maxlen = sizeof(int), 539 .mode = 0644, 540 .proc_handler = proc_dointvec 541 }, 542 { 543 .procname = "message_cost", 544 .data = &net_ratelimit_state.interval, 545 .maxlen = sizeof(int), 546 .mode = 0644, 547 .proc_handler = proc_dointvec_jiffies, 548 }, 549 { 550 .procname = "message_burst", 551 .data = &net_ratelimit_state.burst, 552 .maxlen = sizeof(int), 553 .mode = 0644, 554 .proc_handler = proc_dointvec, 555 }, 556 #ifdef CONFIG_RPS 557 { 558 .procname = "rps_sock_flow_entries", 559 .maxlen = sizeof(int), 560 .mode = 0644, 561 .proc_handler = rps_sock_flow_sysctl 562 }, 563 #endif 564 #ifdef CONFIG_NET_FLOW_LIMIT 565 { 566 .procname = "flow_limit_cpu_bitmap", 567 .mode = 0644, 568 .proc_handler = flow_limit_cpu_sysctl 569 }, 570 { 571 .procname = "flow_limit_table_len", 572 .data = &netdev_flow_limit_table_len, 573 .maxlen = sizeof(int), 574 .mode = 0644, 575 .proc_handler = flow_limit_table_len_sysctl 576 }, 577 #endif /* CONFIG_NET_FLOW_LIMIT */ 578 #ifdef CONFIG_NET_RX_BUSY_POLL 579 { 580 .procname = "busy_poll", 581 .data = &sysctl_net_busy_poll, 582 .maxlen = sizeof(unsigned int), 583 .mode = 0644, 584 .proc_handler = proc_dointvec_minmax, 585 .extra1 = SYSCTL_ZERO, 586 }, 587 { 588 .procname = "busy_read", 589 .data = &sysctl_net_busy_read, 590 .maxlen = sizeof(unsigned int), 591 .mode = 0644, 592 .proc_handler = proc_dointvec_minmax, 593 .extra1 = SYSCTL_ZERO, 594 }, 595 #endif 596 #ifdef CONFIG_NET_SCHED 597 { 598 .procname = "default_qdisc", 599 .mode = 0644, 600 .maxlen = IFNAMSIZ, 601 .proc_handler = set_default_qdisc 602 }, 603 #endif 604 { 605 .procname = "netdev_budget", 606 .data = &net_hotdata.netdev_budget, 607 .maxlen = sizeof(int), 608 .mode = 0644, 609 .proc_handler = proc_dointvec 610 }, 611 { 612 .procname = "warnings", 613 .data = &net_msg_warn, 614 .maxlen = sizeof(int), 615 .mode = 0644, 616 .proc_handler = proc_dointvec 617 }, 618 { 619 .procname = "max_skb_frags", 620 .data = &net_hotdata.sysctl_max_skb_frags, 621 .maxlen = sizeof(int), 622 .mode = 0644, 623 .proc_handler = proc_dointvec_minmax, 624 .extra1 = SYSCTL_ONE, 625 .extra2 = &max_skb_frags, 626 }, 627 { 628 .procname = "netdev_budget_usecs", 629 .data = &net_hotdata.netdev_budget_usecs, 630 .maxlen = sizeof(unsigned int), 631 .mode = 0644, 632 .proc_handler = proc_dointvec_minmax, 633 .extra1 = &netdev_budget_usecs_min, 634 }, 635 { 636 .procname = "fb_tunnels_only_for_init_net", 637 .data = &sysctl_fb_tunnels_only_for_init_net, 638 .maxlen = sizeof(int), 639 .mode = 0644, 640 .proc_handler = proc_dointvec_minmax, 641 .extra1 = SYSCTL_ZERO, 642 .extra2 = SYSCTL_TWO, 643 }, 644 { 645 .procname = "devconf_inherit_init_net", 646 .data = &sysctl_devconf_inherit_init_net, 647 .maxlen = sizeof(int), 648 .mode = 0644, 649 .proc_handler = proc_dointvec_minmax, 650 .extra1 = SYSCTL_ZERO, 651 .extra2 = SYSCTL_THREE, 652 }, 653 { 654 .procname = "high_order_alloc_disable", 655 .data = &net_high_order_alloc_disable_key.key, 656 .maxlen = sizeof(net_high_order_alloc_disable_key), 657 .mode = 0644, 658 .proc_handler = proc_do_static_key, 659 }, 660 { 661 .procname = "gro_normal_batch", 662 .data = &net_hotdata.gro_normal_batch, 663 .maxlen = sizeof(unsigned int), 664 .mode = 0644, 665 .proc_handler = proc_dointvec_minmax, 666 .extra1 = SYSCTL_ONE, 667 }, 668 { 669 .procname = "netdev_unregister_timeout_secs", 670 .data = &netdev_unregister_timeout_secs, 671 .maxlen = sizeof(unsigned int), 672 .mode = 0644, 673 .proc_handler = proc_dointvec_minmax, 674 .extra1 = SYSCTL_ONE, 675 .extra2 = &int_3600, 676 }, 677 { 678 .procname = "skb_defer_max", 679 .data = &net_hotdata.sysctl_skb_defer_max, 680 .maxlen = sizeof(unsigned int), 681 .mode = 0644, 682 .proc_handler = proc_do_skb_defer_max, 683 .extra1 = SYSCTL_ZERO, 684 }, 685 { 686 .procname = "neigh_inherit_init_net", 687 .data = &sysctl_neigh_inherit_init_net, 688 .maxlen = sizeof(int), 689 .mode = 0644, 690 .proc_handler = proc_dointvec_minmax, 691 .extra1 = SYSCTL_ZERO, 692 .extra2 = SYSCTL_ONE, 693 }, 694 }; 695 696 static const struct ctl_table netns_core_table[] = { 697 #if IS_ENABLED(CONFIG_RPS) 698 { 699 .procname = "rps_default_mask", 700 .data = &init_net, 701 .mode = 0644, 702 .proc_handler = rps_default_mask_sysctl 703 }, 704 #endif 705 { 706 .procname = "somaxconn", 707 .data = &init_net.core.sysctl_somaxconn, 708 .maxlen = sizeof(int), 709 .mode = 0644, 710 .extra1 = SYSCTL_ZERO, 711 .proc_handler = proc_dointvec_minmax 712 }, 713 { 714 .procname = "optmem_max", 715 .data = &init_net.core.sysctl_optmem_max, 716 .maxlen = sizeof(int), 717 .mode = 0644, 718 .extra1 = SYSCTL_ZERO, 719 .proc_handler = proc_dointvec_minmax 720 }, 721 { 722 .procname = "txrehash", 723 .data = &init_net.core.sysctl_txrehash, 724 .maxlen = sizeof(u8), 725 .mode = 0644, 726 .extra1 = SYSCTL_ZERO, 727 .extra2 = SYSCTL_ONE, 728 .proc_handler = proc_dou8vec_minmax, 729 }, 730 { 731 .procname = "txq_reselection_ms", 732 .data = &init_net.core.sysctl_txq_reselection, 733 .maxlen = sizeof(int), 734 .mode = 0644, 735 .proc_handler = proc_dointvec_ms_jiffies, 736 }, 737 { 738 .procname = "tstamp_allow_data", 739 .data = &init_net.core.sysctl_tstamp_allow_data, 740 .maxlen = sizeof(u8), 741 .mode = 0644, 742 .proc_handler = proc_dou8vec_minmax, 743 .extra1 = SYSCTL_ZERO, 744 .extra2 = SYSCTL_ONE 745 }, 746 { 747 .procname = "bypass_prot_mem", 748 .data = &init_net.core.sysctl_bypass_prot_mem, 749 .maxlen = sizeof(u8), 750 .mode = 0644, 751 .proc_handler = proc_dou8vec_minmax, 752 .extra1 = SYSCTL_ZERO, 753 .extra2 = SYSCTL_ONE 754 }, 755 /* sysctl_core_net_init() will set the values after this 756 * to readonly in network namespaces 757 */ 758 { 759 .procname = "wmem_max", 760 .data = &sysctl_wmem_max, 761 .maxlen = sizeof(int), 762 .mode = 0644, 763 .proc_handler = proc_dointvec_minmax, 764 .extra1 = &min_sndbuf, 765 }, 766 { 767 .procname = "rmem_max", 768 .data = &sysctl_rmem_max, 769 .maxlen = sizeof(int), 770 .mode = 0644, 771 .proc_handler = proc_dointvec_minmax, 772 .extra1 = &min_rcvbuf, 773 }, 774 { 775 .procname = "wmem_default", 776 .data = &sysctl_wmem_default, 777 .maxlen = sizeof(int), 778 .mode = 0644, 779 .proc_handler = proc_dointvec_minmax, 780 .extra1 = &min_sndbuf, 781 }, 782 { 783 .procname = "rmem_default", 784 .data = &sysctl_rmem_default, 785 .maxlen = sizeof(int), 786 .mode = 0644, 787 .proc_handler = proc_dointvec_minmax, 788 .extra1 = &min_rcvbuf, 789 }, 790 }; 791 792 static int __init fb_tunnels_only_for_init_net_sysctl_setup(char *str) 793 { 794 /* fallback tunnels for initns only */ 795 if (!strncmp(str, "initns", 6)) 796 sysctl_fb_tunnels_only_for_init_net = 1; 797 /* no fallback tunnels anywhere */ 798 else if (!strncmp(str, "none", 4)) 799 sysctl_fb_tunnels_only_for_init_net = 2; 800 801 return 1; 802 } 803 __setup("fb_tunnels=", fb_tunnels_only_for_init_net_sysctl_setup); 804 805 static const struct ctl_table *netns_core_table_dup(struct net *net) 806 { 807 size_t table_size = ARRAY_SIZE(netns_core_table); 808 struct ctl_table *tbl; 809 int i; 810 811 tbl = kmemdup(netns_core_table, sizeof(netns_core_table), GFP_KERNEL); 812 if (!tbl) 813 return NULL; 814 815 for (i = 0; i < table_size; ++i) { 816 if (tbl[i].data == &sysctl_wmem_max) 817 break; 818 819 tbl[i].data += (char *)net - (char *)&init_net; 820 } 821 for (; i < table_size; ++i) 822 tbl[i].mode &= ~0222; 823 824 return tbl; 825 } 826 827 static __net_init int sysctl_core_net_init(struct net *net) 828 { 829 size_t table_size = ARRAY_SIZE(netns_core_table); 830 const struct ctl_table *tbl; 831 832 tbl = netns_core_table; 833 if (!net_eq(net, &init_net)) { 834 tbl = netns_core_table_dup(net); 835 if (tbl == NULL) 836 goto err_dup; 837 } 838 839 net->core.sysctl_hdr = register_net_sysctl_sz(net, "net/core", tbl, table_size); 840 if (net->core.sysctl_hdr == NULL) 841 goto err_reg; 842 843 return 0; 844 845 err_reg: 846 if (tbl != netns_core_table) 847 kfree(tbl); 848 err_dup: 849 return -ENOMEM; 850 } 851 852 static __net_exit void sysctl_core_net_exit(struct net *net) 853 { 854 const struct ctl_table *tbl; 855 856 tbl = net->core.sysctl_hdr->ctl_table_arg; 857 unregister_net_sysctl_table(net->core.sysctl_hdr); 858 BUG_ON(tbl == netns_core_table); 859 #if IS_ENABLED(CONFIG_RPS) 860 kfree(net->core.rps_default_mask); 861 #endif 862 kfree(tbl); 863 } 864 865 static __net_initdata struct pernet_operations sysctl_core_ops = { 866 .init = sysctl_core_net_init, 867 .exit = sysctl_core_net_exit, 868 }; 869 870 static __init int sysctl_core_init(void) 871 { 872 register_net_sysctl(&init_net, "net/core", net_core_table); 873 return register_pernet_subsys(&sysctl_core_ops); 874 } 875 876 fs_initcall(sysctl_core_init); 877