netdev - [PATCH bpf-next v3 0/6] AF_XDP Packet Drop Tracing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  2 Feb 2021 13:36:36 +0000
From:   Ciara Loftus <ciara.loftus@...el.com>
To:     netdev@...r.kernel.org, bpf@...r.kernel.org,
        magnus.karlsson@...el.com, bjorn@...nel.org,
        weqaar.a.janjua@...el.com
Cc:     daniel@...earbox.net, Ciara Loftus <ciara.loftus@...el.com>
Subject: [PATCH bpf-next v3 0/6] AF_XDP Packet Drop Tracing

This series introduces tracing infrastructure for AF_XDP sockets (xsk).
A trace event 'xsk_packet_drop' is created which can be enabled by toggling

/sys/kernel/debug/tracing/events/xsk/xsk_packet_drop/enable

When enabled and packets or empty packet buffers are dropped in the kernel,
traces are generated which describe the reason for the packet drop, the netdev
and qid information of the xsk which encountered the drop, and some more
information depending on what type of drop was encountered that will tell
the user why the packet was dropped.  This information should help a user
troubleshoot packet drops by providing an extra level of detail which is not
available through use of simple counters

Example traces:
xsk_packet_drop: netdev: ve3213 qid 0 reason: packet too big: len 3000 max 2048 not_used 0
xsk_packet_drop: netdev: ve3213 qid 0 reason: invalid fill addr: addr 520192 not_used 0 not_used 0
xsk_packet_drop: netdev: ve9266 qid 0 reason: invalid tx desc: addr 0 len 4097 options 0

It was decided to use a single event 'xsk_packet_drop' to capture these three
drop types. This means that for some of them, there is some redundant information
in the trace marked as 'not_used'. An alternative to this would be to introduce 3
separate event types under xsk, each with their own appropriate trace format.
Suggestions are welcome on which approach would be better to take.

The event can be monitored using perf:
perf stat -a -e xsk:xsk_packet_drop

A selftest is added for each drop type. These tests provide the conditions to
trigger the traces and ensure that the appropriate traces are generated.

v2->v3:
* Removed some traces which traced events which were not technically drops eg.
when the rxq is full.
* Introduced traces for descriptor validation on RX and TX and selftests for both

v1->v2:
* Rebase on top of Björn's cleanup series.
* Fixed packet count for trace tests which don't need EOT frame.

This series applies on commit 61ca36c8c4eb3bae35a285b1ae18c514cde65439

Ciara Loftus (6):
  xsk: add tracepoints for packet drops
  selftests/bpf: restructure setting the packet count
  selftests/bpf: add framework for xsk selftests
  selftests/bpf: XSK_TRACE_DROP_PKT_TOO_BIG test
  selftests/bpf: XSK_TRACE_INVALID_FILLADDR test
  selftests/bpf: XSK_TRACE_INVALID_DESC_TX test

 MAINTAINERS                                |   1 +
 include/linux/bpf_trace.h                  |   1 +
 include/trace/events/xsk.h                 |  73 ++++++++
 include/uapi/linux/if_xdp.h                |   6 +
 kernel/bpf/core.c                          |   1 +
 net/xdp/xsk.c                              |   7 +-
 net/xdp/xsk_buff_pool.c                    |   3 +
 net/xdp/xsk_queue.h                        |   4 +
 tools/include/uapi/linux/if_xdp.h          |   6 +
 tools/testing/selftests/bpf/test_xsk.sh    |  90 ++++++++-
 tools/testing/selftests/bpf/xdpxceiver.c   | 206 +++++++++++++++++++--
 tools/testing/selftests/bpf/xdpxceiver.h   |   9 +
 tools/testing/selftests/bpf/xsk_prereqs.sh |   3 +-
 13 files changed, 381 insertions(+), 29 deletions(-)
 create mode 100644 include/trace/events/xsk.h

-- 
2.17.1