netdev - Re: [PATCH bpf-next v4 2/2] samples/bpf: Add xdp_sample

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 6 Jun 2018 13:33:49 +0200
From:   Jesper Dangaard Brouer <brouer@...hat.com>
To:     Toke Høiland-Jørgensen <toke@...e.dk>
Cc:     brouer@...hat.com, Jakub Kicinski <jakub.kicinski@...ronome.com>,
        netdev@...r.kernel.org, Martin KaFai Lau <kafai@...com>
Subject: Re: [PATCH bpf-next v4 2/2] samples/bpf: Add xdp_sample_pkts
 example

On Wed, 06 Jun 2018 13:01:52 +0200
Toke Høiland-Jørgensen <toke@...e.dk> wrote:

> Jakub Kicinski <jakub.kicinski@...ronome.com> writes:
> 
> > On Tue, 05 Jun 2018 16:50:00 +0200, Toke Høiland-Jørgensen wrote:  
> >> Add an example program showing how to sample packets from XDP using the
> >> perf event buffer. The example userspace program just prints the ethernet
> >> header for every packet sampled.
> >> 
> >> Signed-off-by: Toke Høiland-Jørgensen <toke@...e.dk>  
> >  
> >> diff --git a/samples/bpf/xdp_sample_pkts_kern.c b/samples/bpf/xdp_sample_pkts_kern.c
> >> new file mode 100644
> >> index 000000000000..4560522ca015
> >> --- /dev/null
> >> +++ b/samples/bpf/xdp_sample_pkts_kern.c
> >> @@ -0,0 +1,62 @@
> >> +#include <linux/ptrace.h>
> >> +#include <linux/version.h>
> >> +#include <uapi/linux/bpf.h>
> >> +#include "bpf_helpers.h"
> >> +
> >> +#define SAMPLE_SIZE 64ul
> >> +#define MAX_CPUS 24  
> >
> > That may be a lil' too few for modern HW with hyper-threading on ;)  
> > My development machine says:
> >
> > $ ncpus
> > 28
> >
> > 128, maybe?  
> 
> What? 24 CPUs should be enough for everyone, surely? ;)
> 
> (I just took twice the number of CPUs in my largest machine; but fair
> point, other people have access to more expensive toys I guess... will fix)
> 
> >> +#define bpf_printk(fmt, ...)					\
> >> +({								\
> >> +	       char ____fmt[] = fmt;				\
> >> +	       bpf_trace_printk(____fmt, sizeof(____fmt),	\
> >> +				##__VA_ARGS__);			\
> >> +})
> >> +
> >> +struct bpf_map_def SEC("maps") my_map = {
> >> +	.type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
> >> +	.key_size = sizeof(int),
> >> +	.value_size = sizeof(u32),
> >> +	.max_entries = MAX_CPUS,
> >> +};

I agree, we should increase it to something larger than 24, just to
avoid people getting surprised, but this is only sample code.

At some point I want us to add another example, that show how to adjust
this runtime, which is actually possible with bpf_load.c via a map
callback that Martin added.  I've not look at how libbpf can support
this.  I do have sample code[1] that could be adjusted to do this, but
I don't want to create dependencies to bpf_load.c, as we all agree that
everything should be moved to use libbpf (tools/lib/bpf).

[1] https://github.com/netoptimizer/prototype-kernel/blob/master/kernel/samples/bpf/xdp_ddos01_blacklist_user.c#L186-L218

-- 
Best regards,
  Jesper Dangaard Brouer
  MSc.CS, Principal Kernel Engineer at Red Hat
  LinkedIn: http://www.linkedin.com/in/brouer