| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20191018040748.30593-6-toshiaki.makita1@gmail.com>
Date: Fri, 18 Oct 2019 13:07:38 +0900
From: Toshiaki Makita <toshiaki.makita1@...il.com>
To: Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Martin KaFai Lau <kafai@...com>,
Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
"David S. Miller" <davem@...emloft.net>,
Jakub Kicinski <jakub.kicinski@...ronome.com>,
Jesper Dangaard Brouer <hawk@...nel.org>,
John Fastabend <john.fastabend@...il.com>,
Jamal Hadi Salim <jhs@...atatu.com>,
Cong Wang <xiyou.wangcong@...il.com>,
Jiri Pirko <jiri@...nulli.us>,
Pablo Neira Ayuso <pablo@...filter.org>,
Jozsef Kadlecsik <kadlec@...filter.org>,
Florian Westphal <fw@...len.de>,
Pravin B Shelar <pshelar@....org>
Cc: Toshiaki Makita <toshiaki.makita1@...il.com>,
netdev@...r.kernel.org, bpf@...r.kernel.org,
William Tu <u9012063@...il.com>,
Stanislav Fomichev <sdf@...ichev.me>
Subject: [RFC PATCH v2 bpf-next 05/15] xdp_flow: Attach bpf prog to XDP in kernel after UMH loaded program
As UMH runs under RTNL, it cannot attach XDP from userspace. Thus the
kernel, xdp_flow module, installs the XDP program.
Signed-off-by: Toshiaki Makita <toshiaki.makita1@...il.com>
---
net/xdp_flow/xdp_flow_kern_mod.c | 109 ++++++++++++++++++++++++++++++++++++---
1 file changed, 103 insertions(+), 6 deletions(-)
diff --git a/net/xdp_flow/xdp_flow_kern_mod.c b/net/xdp_flow/xdp_flow_kern_mod.c
index 14e06ee..2c80590 100644
--- a/net/xdp_flow/xdp_flow_kern_mod.c
+++ b/net/xdp_flow/xdp_flow_kern_mod.c
@@ -3,10 +3,27 @@
#include <linux/module.h>
#include <linux/umh.h>
#include <linux/sched/signal.h>
+#include <linux/rhashtable.h>
#include <linux/rtnetlink.h>
+#include <linux/filter.h>
#include "xdp_flow.h"
#include "msgfmt.h"
+struct xdp_flow_prog {
+ struct rhash_head ht_node;
+ struct net_device *dev;
+ struct bpf_prog *prog;
+};
+
+static const struct rhashtable_params progs_params = {
+ .key_len = sizeof(struct net_devce *),
+ .key_offset = offsetof(struct xdp_flow_prog, dev),
+ .head_offset = offsetof(struct xdp_flow_prog, ht_node),
+ .automatic_shrinking = true,
+};
+
+static struct rhashtable progs;
+
extern char xdp_flow_umh_start;
extern char xdp_flow_umh_end;
@@ -116,10 +133,17 @@ static int xdp_flow_setup_block_cb(enum tc_setup_type type, void *type_data,
static int xdp_flow_setup_bind(struct net_device *dev,
struct netlink_ext_ack *extack)
{
+ u32 flags = XDP_FLAGS_DRV_MODE | XDP_FLAGS_UPDATE_IF_NOEXIST;
+ struct xdp_flow_prog *prog_node;
struct mbox_request *req;
+ struct bpf_prog *prog;
u32 id = 0;
int err;
+ err = dev_check_xdp(dev, extack, true, NULL, flags);
+ if (err)
+ return err;
+
req = kzalloc(sizeof(*req), GFP_KERNEL);
if (!req)
return -ENOMEM;
@@ -129,21 +153,83 @@ static int xdp_flow_setup_bind(struct net_device *dev,
/* Load bpf in UMH and get prog id */
err = transact_umh(req, &id);
+ if (err)
+ goto out;
+
+ prog = bpf_prog_get_type_dev_by_id(id, BPF_PROG_TYPE_XDP, true);
+ if (IS_ERR(prog)) {
+ err = PTR_ERR(prog);
+ goto err_umh;
+ }
- /* TODO: id will be used to attach bpf prog to XDP
- * As we have rtnl_lock, UMH cannot attach prog to XDP
- */
+ err = dev_change_xdp(dev, extack, prog, flags);
+ if (err)
+ goto err_prog;
+ prog_node = kzalloc(sizeof(*prog_node), GFP_KERNEL);
+ if (!prog_node) {
+ err = -ENOMEM;
+ goto err_xdp;
+ }
+
+ prog_node->dev = dev;
+ prog_node->prog = prog;
+ err = rhashtable_insert_fast(&progs, &prog_node->ht_node, progs_params);
+ if (err)
+ goto err_pnode;
+
+ prog = bpf_prog_inc(prog);
+ if (IS_ERR(prog)) {
+ err = PTR_ERR(prog);
+ goto err_rht;
+ }
+out:
kfree(req);
return err;
+err_rht:
+ rhashtable_remove_fast(&progs, &prog_node->ht_node, progs_params);
+err_pnode:
+ kfree(prog_node);
+err_xdp:
+ dev_change_xdp(dev, extack, NULL, flags);
+err_prog:
+ bpf_prog_put(prog);
+err_umh:
+ req->cmd = XDP_FLOW_CMD_UNLOAD;
+ transact_umh(req, NULL);
+
+ goto out;
}
static int xdp_flow_setup_unbind(struct net_device *dev,
struct netlink_ext_ack *extack)
{
+ struct xdp_flow_prog *prog_node;
+ u32 flags = XDP_FLAGS_DRV_MODE;
struct mbox_request *req;
- int err;
+ int err, ret = 0;
+ u32 prog_id = 0;
+
+ prog_node = rhashtable_lookup_fast(&progs, &dev, progs_params);
+ if (!prog_node) {
+ pr_warn_once("%s: xdp_flow unbind was requested before bind\n",
+ dev->name);
+ return -ENOENT;
+ }
+
+ err = dev_check_xdp(dev, extack, false, &prog_id, flags);
+ if (!err && prog_id == prog_node->prog->aux->id) {
+ err = dev_change_xdp(dev, extack, NULL, flags);
+ if (err) {
+ pr_warn("Failed to uninstall XDP prog: %d\n", err);
+ ret = err;
+ }
+ }
+
+ bpf_prog_put(prog_node->prog);
+ rhashtable_remove_fast(&progs, &prog_node->ht_node, progs_params);
+ kfree(prog_node);
req = kzalloc(sizeof(*req), GFP_KERNEL);
if (!req)
@@ -153,10 +239,12 @@ static int xdp_flow_setup_unbind(struct net_device *dev,
req->ifindex = dev->ifindex;
err = transact_umh(req, NULL);
+ if (err)
+ ret = err;
kfree(req);
- return err;
+ return ret;
}
static int xdp_flow_setup(struct net_device *dev, bool do_bind,
@@ -214,7 +302,11 @@ static int start_umh(void)
static int __init load_umh(void)
{
- int err = 0;
+ int err;
+
+ err = rhashtable_init(&progs, &progs_params);
+ if (err)
+ return err;
mutex_lock(&xdp_flow_ops.lock);
if (!xdp_flow_ops.stop) {
@@ -230,8 +322,12 @@ static int __init load_umh(void)
xdp_flow_ops.setup = &xdp_flow_setup;
xdp_flow_ops.start = &start_umh;
xdp_flow_ops.module = THIS_MODULE;
+
+ mutex_unlock(&xdp_flow_ops.lock);
+ return 0;
err:
mutex_unlock(&xdp_flow_ops.lock);
+ rhashtable_destroy(&progs);
return err;
}
@@ -244,6 +340,7 @@ static void __exit fini_umh(void)
xdp_flow_ops.setup = NULL;
xdp_flow_ops.setup_cb = NULL;
mutex_unlock(&xdp_flow_ops.lock);
+ rhashtable_destroy(&progs);
}
module_init(load_umh);
module_exit(fini_umh);
--
1.8.3.1
Powered by blists - more mailing lists