netdev - Re: [PATCH bpf-next v4 05/11] bpf: Enable TCP congestion control kfunc from modules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzZKXWPV-nE+AiNsujnEuGXOjG+cHzmSaSpthBPA4aEcPg@mail.gmail.com>
Date:   Tue, 21 Sep 2021 16:02:42 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Kumar Kartikeya Dwivedi <memxor@...il.com>
Cc:     bpf <bpf@...r.kernel.org>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Jesper Dangaard Brouer <brouer@...hat.com>,
        Toke Høiland-Jørgensen <toke@...hat.com>,
        Networking <netdev@...r.kernel.org>, Jiri Olsa <jolsa@...nel.org>
Subject: Re: [PATCH bpf-next v4 05/11] bpf: Enable TCP congestion control
 kfunc from modules

On Tue, Sep 21, 2021 at 3:23 PM Kumar Kartikeya Dwivedi
<memxor@...il.com> wrote:
>
> On Wed, Sep 22, 2021 at 03:48:55AM IST, Andrii Nakryiko wrote:
> > On Mon, Sep 20, 2021 at 7:15 AM Kumar Kartikeya Dwivedi
> > <memxor@...il.com> wrote:
> > >
> > > This commit moves BTF ID lookup into the newly added registration
> > > helper, in a way that the bbr, cubic, and dctcp implementation set up
> > > their sets in the bpf_tcp_ca kfunc_btf_set list, while the ones not
> > > dependent on modules are looked up from the wrapper function.
> > >
> > > This lifts the restriction for them to be compiled as built in objects,
> > > and can be loaded as modules if required. Also modify Makefile.modfinal
> > > to resolve_btfids in TCP congestion control modules if the config option
> > > is set, using the base BTF support added in the previous commit.
> > >
> > > See following commits for background on use of:
> > >
> > >  CONFIG_X86 ifdef:
> > >  569c484f9995 (bpf: Limit static tcp-cc functions in the .BTF_ids list to x86)
> > >
> > >  CONFIG_DYNAMIC_FTRACE ifdef:
> > >  7aae231ac93b (bpf: tcp: Limit calling some tcp cc functions to CONFIG_DYNAMIC_FTRACE)
> > >
> > > [ resolve_btfids uses --no-fail because some crypto kernel modules
> > >   under arch/x86/crypto generated from ASM do not have the .BTF sections ]
> > >
> > > Signed-off-by: Kumar Kartikeya Dwivedi <memxor@...il.com>
> > > ---
> > >  include/linux/btf.h       |  4 ++++
> > >  kernel/bpf/btf.c          |  3 +++
> > >  net/ipv4/bpf_tcp_ca.c     | 34 +++-------------------------------
> > >  net/ipv4/tcp_bbr.c        | 28 +++++++++++++++++++++++++++-
> > >  net/ipv4/tcp_cubic.c      | 26 +++++++++++++++++++++++++-
> > >  net/ipv4/tcp_dctcp.c      | 26 +++++++++++++++++++++++++-
> > >  scripts/Makefile.modfinal |  1 +
> > >  7 files changed, 88 insertions(+), 34 deletions(-)
> > >
> >
> > [...]
> >
> > > diff --git a/scripts/Makefile.modfinal b/scripts/Makefile.modfinal
> > > index ff805777431c..b4f83533eda6 100644
> > > --- a/scripts/Makefile.modfinal
> > > +++ b/scripts/Makefile.modfinal
> > > @@ -41,6 +41,7 @@ quiet_cmd_btf_ko = BTF [M] $@
> > >        cmd_btf_ko =                                                     \
> > >         if [ -f vmlinux ]; then                                         \
> > >                 LLVM_OBJCOPY="$(OBJCOPY)" $(PAHOLE) -J --btf_base vmlinux $@; \
> > > +               $(RESOLVE_BTFIDS) --no-fail -s vmlinux $@;              \
> >
> > I think I've asked that before, but I don't remember this being
> > answered. Why is this --no-fail?
> >
>
> Sorry, the first time, I missed that mail, and then it was too late so I decided
> to put the reason in the commit message above.
>
> > > [ resolve_btfids uses --no-fail because some crypto kernel modules
> > >   under arch/x86/crypto generated from ASM do not have the .BTF sections ]
>
> I could add a mode that fails only when processing a .BTF section present in
> object fails, would that be better?

Oh, missed [ ] part in the commit message. But yeah, it feels like it
shouldn't be an error if the module legitimately doesn't have a .BTF
section. Is it an error right now? cc Jiri, maybe that was intentional

>
> --
> Kartikeya