netdev - Re: [PATCH iproute2 -next] tc, bpf: finalize eBPF support for cls and act front-end

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 31 Mar 2015 22:16:49 -0700
From:	Alexei Starovoitov <ast@...mgrid.com>
To:	Daniel Borkmann <daniel@...earbox.net>, stephen@...workplumber.org
CC:	jiri@...nulli.us, tgraf@...g.ch, netdev@...r.kernel.org,
	Jamal Hadi Salim <jhs@...atatu.com>
Subject: Re: [PATCH iproute2 -next] tc, bpf: finalize eBPF support for cls
 and act front-end

On 3/30/15 3:35 PM, Daniel Borkmann wrote:
> +static inline void act_update_drop_map(void)
> +{
> +	uint32_t *count, cpu = get_smp_processor_id();
> +
> +	count = bpf_map_lookup_elem(&map_drops, &cpu);
> +	if (count)
> +		__sync_fetch_and_add(count, 1);

since this function demonstrates poor man's per-cpu counters we can use
regular *count++ instead of atomic.
Just picking nits :)

> +__section("action-rand") int act_rand_main(struct __sk_buff *skb)
> +{
> +	/* Sorry, we're near event horizon ... */
> +	if ((get_prandom_u32() & 3) == 0) {
> +		act_update_drop_map();
> +		return TC_ACT_SHOT;
> +	}

didn't get the joke. Is it April 1st yet? :)

> +/* tc ELF map ABI */
> +struct bpf_elf_map {
> +	uint32_t type;
> +	uint32_t id;
> +	uint32_t size_key;
> +	uint32_t size_value;
> +	uint32_t max_elem;
> +};

can you change 'id' being last, so that TC+bpf programs from
samples/bpf/ that don't have 'id' concept can also be loaded?

> +#ifndef min
> +# define min(x, y) ({			\
> +	typeof(x) _min1 = (x);		\
> +	typeof(y) _min2 = (y);		\
> +	(void) (&_min1 == &_min2);	\
> +	_min1 < _min2 ? _min1 : _min2; })
> +#endif
...
> +#ifndef min
> +# define min(x, y) ({			\
> +	typeof(x) _min1 = (x);		\
> +	typeof(y) _min2 = (y);		\
> +	(void) (&_min1 == &_min2);	\
> +	_min1 < _min2 ? _min1 : _min2; })
> +#endif

two 'min' macros in different files?

> -static inline int bpf_open_object(const char *path, enum bpf_prog_type type)
> +static inline int bpf_open_object(const char *path, enum bpf_prog_type type,
> +				  const char *sec)
>   {
>   	errno = ENOSYS;
>   	return -1;
>   }

while playing with it, I hit the ENOSYS first, since my user space
is quite old. Can you add a human readable printf message here and other
places, so we don't have to recompile tc with -g and run gdb on it?
I think it will help distributions to configure dependencies of iproute2
as well.

Acked-by: Alexei Starovoitov <ast@...mgrid.com>

Great work! Thanks a lot!


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html