netdev - Re: [PATCH net-next] net: add network device notifier trace points

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3bb9fe50-87f9-a8b5-f886-9727d4e059e9@gmail.com>
Date:   Tue, 18 Dec 2018 20:38:48 -0700
From:   David Ahern <dsahern@...il.com>
To:     Stephen Hemminger <stephen@...workplumber.org>,
        netdev@...r.kernel.org
Cc:     Stephen Hemminger <sthemmin@...rosoft.com>
Subject: Re: [PATCH net-next] net: add network device notifier trace points

On 12/18/18 7:27 PM, Stephen Hemminger wrote:
> There already are network trace points for transmit and receive but
> nothing for state changes.  Add network tracepoints for before and
> after netlink callback is done. This is simple (without extack or
> other info) but that could be added if useful. Network namespace id
> would also be helpful but hard to get a string for it.

That has been a sore spot for a long time. One option is to allocate a
namespace id relative to init_net as every namespace is created and then
use the nsid in tracepoints.

> 
> This is the result of a conversation about monitoring of link
> state changes with BPF. Parsing netlink is hard and unnecessary
> because the data exists (unserialized) already in the
> callbacks.
> 
>   #  cd /sys/kernel/debug/tracing
>   #  echo 1 > events/net/net_dev_notifier_entry/enable
>   #  echo 1 > events/net/net_dev_notifier/enable
>   #  ip li set dev eno1 down
>   #  ip li set dev eno1 up
>   #  cat trace
> 	# tracer: nop
> 	#
> 	#                              _-----=> irqs-off
> 	#                             / _----=> need-resched
> 	#                            | / _---=> hardirq/softirq
> 	#                            || / _--=> preempt-depth
> 	#                            ||| /     delay
> 	#           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
> 	#              | |       |   ||||       |         |
> 		      ip-3194  [011] ....    74.926831: net_dev_notifier_entry: dev=eno1 event=GOING_DOWN
> 		      ip-3194  [011] ....    74.926838: net_dev_notifier: dev=eno1 event=GOING_DOWN ret=1

naming the second one 'net_dev_notifier__exit' would align the columns,
make this a lot easier to read and better discriminate the entry/exit
difference.