/*
 * netsniff-ng - the packet sniffing beast
 * Copyright 2009, 2010 Daniel Borkmann.
 * Subject to the GPL, version 2.
 */

#ifndef RING_H
#define RING_H

/*
 * "I love the smell of 10GbE in the morning. Smells like ... victory."
 *     - W. Richard Stevens, "Secret Teachings of the UNIX Environment"
 */

#include <stdio.h>
#include <stdint.h>
#include <linux/if_packet.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <sys/ioctl.h>
#include <string.h>
#include <poll.h>
#include <sys/poll.h>

#include "built_in.h"
#include "die.h"
#include "dev.h"

union tpacket_uhdr {
	struct tpacket_hdr  *h1;
	struct tpacket2_hdr *h2;
	struct tpacket3_hdr *h3;
	void *raw;
};

struct frame_map {
	struct tpacket2_hdr tp_h __aligned_tpacket;
	struct sockaddr_ll s_ll __align_tpacket(sizeof(struct tpacket2_hdr));
};

struct block_desc {
	uint32_t version;
	uint32_t offset_to_priv;
	struct tpacket_hdr_v1 h1;
};

struct ring {
	struct iovec *frames;
	uint8_t *mm_space;
	size_t mm_len;
	struct sockaddr_ll s_ll;
	union {
		struct tpacket_req layout;
		struct tpacket_req3 layout3;
		uint8_t raw;
	};
};

static inline void next_rnd_slot(unsigned int *it, struct ring *ring)
{
	*it = rand() % ring->layout.tp_frame_nr;
}

static inline unsigned int ring_size(char *ifname, unsigned int size)
{
	if (size > 0)
		return size;

	/*
	 * Device bitrate in bytes times two as ring size.
	 *    Fallback => ~    64,00 MB
	 *     10 MBit => ~     2,38 MB
	 *     54 MBit => ~    12,88 MB
	 *    100 MBit => ~    23,84 MB
	 *    300 MBit => ~    71,52 MB
	 *  1.000 MBit => ~   238,42 MB
	 * 10.000 MBit => ~ 2.384.18 MB
	 */
	size = device_bitrate(ifname);
	size = (size * 1000000) / 8;
	size = size * 2;
	if (size == 0)
		size = 1 << 26;

	return round_up_cacheline(size);
}

static inline unsigned int ring_frame_size(struct ring *ring)
{
	return ring->layout.tp_frame_size;
}

static inline void ring_verify_layout(struct ring *ring)
{
	bug_on(ring->layout.tp_block_size  < ring->layout.tp_frame_size);
	bug_on((ring->layout.tp_block_size % ring->layout.tp_frame_size) != 0);
	bug_on((ring->layout.tp_block_size % getpagesize()) != 0);
}

static inline void tpacket_hdr_clone(struct tpacket2_hdr *thdrd,
				     struct tpacket2_hdr *thdrs)
{
        thdrd->tp_sec = thdrs->tp_sec;
        thdrd->tp_nsec = thdrs->tp_nsec;
        thdrd->tp_snaplen = thdrs->tp_snaplen;
        thdrd->tp_len = thdrs->tp_len;
}

static inline void prepare_polling(int sock, struct pollfd *pfd)
{
	memset(pfd, 0, sizeof(*pfd));
	pfd->fd = sock;
	pfd->revents = 0;
	pfd->events = POLLIN | POLLRDNORM | POLLERR;
}

static inline void __set_sockopt_tpacket(int sock, int val)
{
	int ret = setsockopt(sock, SOL_PACKET, PACKET_VERSION, &val, sizeof(val));
	if (ret)
		panic("Cannot set tpacketv2!\n");
}

static inline int __get_sockopt_tpacket(int sock)
{
	int val, ret;
	socklen_t len = sizeof(val);

	ret = getsockopt(sock, SOL_PACKET, PACKET_VERSION, &val, &len);
	if (ret)
		panic("Cannot get tpacket version!\n");

	return val;
}

static inline void set_sockopt_tpacket_v2(int sock)
{
	__set_sockopt_tpacket(sock, TPACKET_V2);
}

static inline void set_sockopt_tpacket_v3(int sock)
{
	__set_sockopt_tpacket(sock, TPACKET_V3);
}

static inline int get_sockopt_tpacket(int sock)
{
	return __get_sockopt_tpacket(sock);
}

extern void mmap_ring_generic(int sock, struct ring *ring);
extern void alloc_ring_frames_generic(struct ring *ring, int num, size_t size);
extern void bind_ring_generic(int sock, struct ring *ring, int ifindex);

#endif /* RING_H */
r/acpi?h=nds-private-remove&amp;id=69973b830859bc6529a7a0468ba0d80ee5117826&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th><th class='left'>Files</th><th class='left'>Lines</th></tr>
n value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Linus Torvalds &lt;torvalds@linux-foundation.org&gt;</td><td class='right'>2017-01-29 13:50:06 -0800</td></tr>
<tr><th>committer</th><td>Linus Torvalds &lt;torvalds@linux-foundation.org&gt;</td><td class='right'>2017-01-29 13:50:06 -0800</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/include/drm/bridge?id=39cb2c9a316e77f6dfba96c543e55b6672d5a37e'>39cb2c9a316e77f6dfba96c543e55b6672d5a37e</a> (<a href='/cgit.cgi/linux/net-next.git/patch/include/drm/bridge?id=39cb2c9a316e77f6dfba96c543e55b6672d5a37e'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?id=39cb2c9a316e77f6dfba96c543e55b6672d5a37e'>98fe974ee4e20121253de7f61fc8d01bdb3821c1</a> /<a href='/cgit.cgi/linux/net-next.git/tree/include/drm/bridge?id=39cb2c9a316e77f6dfba96c543e55b6672d5a37e'>include/drm/bridge</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/include/drm/bridge?id=2c5d9555d6d937966d79d4c6529a5f7b9206e405'>2c5d9555d6d937966d79d4c6529a5f7b9206e405</a> (<a href='/cgit.cgi/linux/net-next.git/diff/include/drm/bridge?id=39cb2c9a316e77f6dfba96c543e55b6672d5a37e&amp;id2=2c5d9555d6d937966d79d4c6529a5f7b9206e405'>diff</a>)</td></tr></table>
<div class='commit-subject'>drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()</div><div class='commit-msg'>I've seen this trigger twice now, where the i915_gem_object_to_ggtt()
call in intel_unpin_fb_obj() returns NULL, resulting in an oops
immediately afterwards as the (inlined) call to i915_vma_unpin_fence()
tries to dereference it.

It seems to be some race condition where the object is going away at
shutdown time, since both times happened when shutting down the X
server.  The call chains were different:

 - VT ioctl(KDSETMODE, KD_TEXT):

    intel_cleanup_plane_fb+0x5b/0xa0 [i915]
    drm_atomic_helper_cleanup_planes+0x6f/0x90 [drm_kms_helper]
    intel_atomic_commit_tail+0x749/0xfe0 [i915]
    intel_atomic_commit+0x3cb/0x4f0 [i915]
    drm_atomic_commit+0x4b/0x50 [drm]
    restore_fbdev_mode+0x14c/0x2a0 [drm_kms_helper]
    drm_fb_helper_restore_fbdev_mode_unlocked+0x34/0x80 [drm_kms_helper]
    drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper]
    intel_fbdev_set_par+0x18/0x70 [i915]
    fb_set_var+0x236/0x460
    fbcon_blank+0x30f/0x350
    do_unblank_screen+0xd2/0x1a0
    vt_ioctl+0x507/0x12a0
    tty_ioctl+0x355/0xc30
    do_vfs_ioctl+0xa3/0x5e0
    SyS_ioctl+0x79/0x90
    entry_SYSCALL_64_fastpath+0x13/0x94

 - i915 unpin_work workqueue:

    intel_unpin_work_fn+0x58/0x140 [i915]
    process_one_work+0x1f1/0x480
    worker_thread+0x48/0x4d0
    kthread+0x101/0x140

and this patch purely papers over the issue by adding a NULL pointer
check and a WARN_ON_ONCE() to avoid the oops that would then generally
make the machine unresponsive.

Other callers of i915_gem_object_to_ggtt() seem to also check for the
returned pointer being NULL and warn about it, so this clearly has
happened before in other places.

[ Reported it originally to the i915 developers on Jan 8, applying the
  ugly workaround on my own now after triggering the problem for the
  second time with no feedback.

  This is likely to be the same bug reported as

     https://bugs.freedesktop.org/show_bug.cgi?id=98829
     https://bugs.freedesktop.org/show_bug.cgi?id=99134

  which has a patch for the underlying problem, but it hasn't gotten to
  me, so I'm applying the workaround. ]

Cc: Daniel Vetter &lt;daniel.vetter@intel.com&gt;
Cc: Jani Nikula &lt;jani.nikula@linux.intel.com&gt;
Cc: Ville Syrjälä &lt;ville.syrjala@linux.intel.com&gt;
Cc: Chris Wilson &lt;chris@chris-wilson.co.uk&gt;
Cc: Maarten Lankhorst &lt;maarten.lankhorst@linux.intel.com&gt;
Cc: Tvrtko Ursulin &lt;tvrtko.ursulin@intel.com&gt;
Cc: Imre Deak &lt;imre.deak@intel.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?id=39cb2c9a316e77f6dfba96c543e55b6672d5a37e'>Diffstat</a> (limited to 'include/drm/bridge')</div><table summary='diffstat' class='diffstat'>