* [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type @ 2019-04-24 21:31 Stanislav Fomichev 2019-04-24 21:31 ` [PATCH bpf-next v4 2/2] bpftool: show flow_dissector attachment status Stanislav Fomichev 2019-04-25 21:21 ` [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type Daniel Borkmann 0 siblings, 2 replies; 5+ messages in thread From: Stanislav Fomichev @ 2019-04-24 21:31 UTC (permalink / raw) To: netdev, bpf Cc: davem, ast, daniel, jakub.kicinski, quentin.monnet, Stanislav Fomichev, Jann Horn target_fd is target namespace. If there is a flow dissector BPF program attached to that namespace, its (single) id is returned. v4: * add missing put_net (Jann Horn) v3: * add missing inline to skb_flow_dissector_prog_query static def (kbuild test robot <lkp@intel.com>) v2: * don't sleep in rcu critical section (Jakub Kicinski) * check input prog_cnt (exit early) Cc: Jann Horn <jannh@google.com> Signed-off-by: Stanislav Fomichev <sdf@google.com> --- include/linux/skbuff.h | 8 +++++++ kernel/bpf/syscall.c | 2 ++ net/core/flow_dissector.c | 46 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 56 insertions(+) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 998256c2820b..6d58fa8a65fd 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1258,11 +1258,19 @@ void skb_flow_dissector_init(struct flow_dissector *flow_dissector, unsigned int key_count); #ifdef CONFIG_NET +int skb_flow_dissector_prog_query(const union bpf_attr *attr, + union bpf_attr __user *uattr); int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog); int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr); #else +static inline int skb_flow_dissector_prog_query(const union bpf_attr *attr, + union bpf_attr __user *uattr) +{ + return -EOPNOTSUPP; +} + static inline int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog) { diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 92c9b8a32b50..b0de49598341 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2009,6 +2009,8 @@ static int bpf_prog_query(const union bpf_attr *attr, break; case BPF_LIRC_MODE2: return lirc_prog_query(attr, uattr); + case BPF_FLOW_DISSECTOR: + return skb_flow_dissector_prog_query(attr, uattr); default: return -EINVAL; } diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c index fac712cee9d5..27466e54ad3a 100644 --- a/net/core/flow_dissector.c +++ b/net/core/flow_dissector.c @@ -65,6 +65,52 @@ void skb_flow_dissector_init(struct flow_dissector *flow_dissector, } EXPORT_SYMBOL(skb_flow_dissector_init); +int skb_flow_dissector_prog_query(const union bpf_attr *attr, + union bpf_attr __user *uattr) +{ + __u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids); + u32 prog_id, prog_cnt = 0, flags = 0; + struct bpf_prog *attached; + struct net *net; + int ret = 0; + + if (attr->query.query_flags) + return -EINVAL; + + net = get_net_ns_by_fd(attr->query.target_fd); + if (IS_ERR(net)) + return PTR_ERR(net); + + rcu_read_lock(); + attached = rcu_dereference(net->flow_dissector_prog); + if (attached) { + prog_cnt = 1; + prog_id = attached->aux->id; + } + rcu_read_unlock(); + + if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags))) { + ret = -EFAULT; + goto out; + } + if (copy_to_user(&uattr->query.prog_cnt, &prog_cnt, sizeof(prog_cnt))) { + ret = -EFAULT; + goto out; + } + + if (!attr->query.prog_cnt || !prog_ids || !prog_cnt) + goto out; + + if (copy_to_user(prog_ids, &prog_id, sizeof(u32))) { + ret = -EFAULT; + goto out; + } + +out: + put_net(net); + return ret; +} + int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog) { -- 2.21.0.593.g511ec345e18-goog ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH bpf-next v4 2/2] bpftool: show flow_dissector attachment status 2019-04-24 21:31 [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type Stanislav Fomichev @ 2019-04-24 21:31 ` Stanislav Fomichev 2019-04-24 21:44 ` Jakub Kicinski 2019-04-25 21:21 ` [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type Daniel Borkmann 1 sibling, 1 reply; 5+ messages in thread From: Stanislav Fomichev @ 2019-04-24 21:31 UTC (permalink / raw) To: netdev, bpf Cc: davem, ast, daniel, jakub.kicinski, quentin.monnet, Stanislav Fomichev Right now there is no way to query whether BPF flow_dissector program is attached to a network namespace or not. In previous commit, I added support for querying that info, show it when doing `bpftool net`: $ bpftool prog loadall ./bpf_flow.o \ /sys/fs/bpf/flow type flow_dissector \ pinmaps /sys/fs/bpf/flow $ bpftool prog 3: flow_dissector name _dissect tag 8c9e917b513dd5cc gpl loaded_at 2019-04-23T16:14:48-0700 uid 0 xlated 656B jited 461B memlock 4096B map_ids 1,2 btf_id 1 ... $ bpftool net -j [{"xdp":[],"tc":[],"flow_dissector":[]}] $ bpftool prog attach pinned \ /sys/fs/bpf/flow/flow_dissector flow_dissector $ bpftool net -j [{"xdp":[],"tc":[],"flow_dissector":["id":3]}] Doesn't show up in a different net namespace: $ ip netns add test $ ip netns exec test bpftool net -j [{"xdp":[],"tc":[],"flow_dissector":[]}] Non-json output: $ bpftool net xdp: tc: flow_dissector: id 3 v2: * initialization order (Jakub Kicinski) * clear errno for batch mode (Quentin Monnet) Signed-off-by: Stanislav Fomichev <sdf@google.com> Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com> --- tools/bpf/bpftool/net.c | 54 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c index db0e7de49d49..67e99c56bc88 100644 --- a/tools/bpf/bpftool/net.c +++ b/tools/bpf/bpftool/net.c @@ -3,6 +3,7 @@ #define _GNU_SOURCE #include <errno.h> +#include <fcntl.h> #include <stdlib.h> #include <string.h> #include <unistd.h> @@ -12,6 +13,8 @@ #include <linux/rtnetlink.h> #include <linux/tc_act/tc_bpf.h> #include <sys/socket.h> +#include <sys/stat.h> +#include <sys/types.h> #include <bpf.h> #include <nlattr.h> @@ -48,6 +51,10 @@ struct bpf_filter_t { int ifindex; }; +struct bpf_attach_info { + __u32 flow_dissector_id; +}; + static int dump_link_nlmsg(void *cookie, void *msg, struct nlattr **tb) { struct bpf_netdev_t *netinfo = cookie; @@ -180,8 +187,45 @@ static int show_dev_tc_bpf(int sock, unsigned int nl_pid, return 0; } +static int query_flow_dissector(struct bpf_attach_info *attach_info) +{ + __u32 attach_flags; + __u32 prog_ids[1]; + __u32 prog_cnt; + int err; + int fd; + + fd = open("/proc/self/ns/net", O_RDONLY); + if (fd < 0) { + p_err("can't open /proc/self/ns/net: %d", + strerror(errno)); + return -1; + } + prog_cnt = ARRAY_SIZE(prog_ids); + err = bpf_prog_query(fd, BPF_FLOW_DISSECTOR, 0, + &attach_flags, prog_ids, &prog_cnt); + close(fd); + if (err) { + if (errno == EINVAL) { + /* Older kernel's don't support querying + * flow dissector programs. + */ + errno = 0; + return 0; + } + p_err("can't query prog: %s", strerror(errno)); + return -1; + } + + if (prog_cnt == 1) + attach_info->flow_dissector_id = prog_ids[0]; + + return 0; +} + static int do_show(int argc, char **argv) { + struct bpf_attach_info attach_info = {}; int i, sock, ret, filter_idx = -1; struct bpf_netdev_t dev_array; unsigned int nl_pid; @@ -199,6 +243,10 @@ static int do_show(int argc, char **argv) usage(); } + ret = query_flow_dissector(&attach_info); + if (ret) + return -1; + sock = libbpf_netlink_open(&nl_pid); if (sock < 0) { fprintf(stderr, "failed to open netlink sock\n"); @@ -227,6 +275,12 @@ static int do_show(int argc, char **argv) } NET_END_ARRAY("\n"); } + + NET_START_ARRAY("flow_dissector", "%s:\n"); + if (attach_info.flow_dissector_id > 0) + NET_DUMP_UINT("id", "id %u", attach_info.flow_dissector_id); + NET_END_ARRAY("\n"); + NET_END_OBJECT; if (json_output) jsonw_end_array(json_wtr); -- 2.21.0.593.g511ec345e18-goog ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH bpf-next v4 2/2] bpftool: show flow_dissector attachment status 2019-04-24 21:31 ` [PATCH bpf-next v4 2/2] bpftool: show flow_dissector attachment status Stanislav Fomichev @ 2019-04-24 21:44 ` Jakub Kicinski 0 siblings, 0 replies; 5+ messages in thread From: Jakub Kicinski @ 2019-04-24 21:44 UTC (permalink / raw) To: Stanislav Fomichev; +Cc: netdev, bpf, davem, ast, daniel, quentin.monnet On Wed, 24 Apr 2019 14:31:41 -0700, Stanislav Fomichev wrote: > Right now there is no way to query whether BPF flow_dissector program > is attached to a network namespace or not. In previous commit, I added > support for querying that info, show it when doing `bpftool net`: Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type 2019-04-24 21:31 [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type Stanislav Fomichev 2019-04-24 21:31 ` [PATCH bpf-next v4 2/2] bpftool: show flow_dissector attachment status Stanislav Fomichev @ 2019-04-25 21:21 ` Daniel Borkmann 2019-04-25 21:31 ` Stanislav Fomichev 1 sibling, 1 reply; 5+ messages in thread From: Daniel Borkmann @ 2019-04-25 21:21 UTC (permalink / raw) To: Stanislav Fomichev, netdev, bpf Cc: davem, ast, jakub.kicinski, quentin.monnet, Jann Horn On 04/24/2019 11:31 PM, Stanislav Fomichev wrote: > target_fd is target namespace. If there is a flow dissector BPF program > attached to that namespace, its (single) id is returned. > > v4: > * add missing put_net (Jann Horn) > > v3: > * add missing inline to skb_flow_dissector_prog_query static def > (kbuild test robot <lkp@intel.com>) > > v2: > * don't sleep in rcu critical section (Jakub Kicinski) > * check input prog_cnt (exit early) > > Cc: Jann Horn <jannh@google.com> > Signed-off-by: Stanislav Fomichev <sdf@google.com> > --- > include/linux/skbuff.h | 8 +++++++ > kernel/bpf/syscall.c | 2 ++ > net/core/flow_dissector.c | 46 +++++++++++++++++++++++++++++++++++++++ > 3 files changed, 56 insertions(+) > > diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h > index 998256c2820b..6d58fa8a65fd 100644 > --- a/include/linux/skbuff.h > +++ b/include/linux/skbuff.h > @@ -1258,11 +1258,19 @@ void skb_flow_dissector_init(struct flow_dissector *flow_dissector, > unsigned int key_count); > > #ifdef CONFIG_NET > +int skb_flow_dissector_prog_query(const union bpf_attr *attr, > + union bpf_attr __user *uattr); > int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, > struct bpf_prog *prog); > > int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr); > #else > +static inline int skb_flow_dissector_prog_query(const union bpf_attr *attr, > + union bpf_attr __user *uattr) > +{ > + return -EOPNOTSUPP; > +} > + > static inline int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, > struct bpf_prog *prog) > { > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index 92c9b8a32b50..b0de49598341 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -2009,6 +2009,8 @@ static int bpf_prog_query(const union bpf_attr *attr, > break; > case BPF_LIRC_MODE2: > return lirc_prog_query(attr, uattr); > + case BPF_FLOW_DISSECTOR: > + return skb_flow_dissector_prog_query(attr, uattr); > default: > return -EINVAL; > } > diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c > index fac712cee9d5..27466e54ad3a 100644 > --- a/net/core/flow_dissector.c > +++ b/net/core/flow_dissector.c > @@ -65,6 +65,52 @@ void skb_flow_dissector_init(struct flow_dissector *flow_dissector, > } > EXPORT_SYMBOL(skb_flow_dissector_init); > > +int skb_flow_dissector_prog_query(const union bpf_attr *attr, > + union bpf_attr __user *uattr) > +{ > + __u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids); > + u32 prog_id, prog_cnt = 0, flags = 0; > + struct bpf_prog *attached; > + struct net *net; > + int ret = 0; > + > + if (attr->query.query_flags) > + return -EINVAL; > + > + net = get_net_ns_by_fd(attr->query.target_fd); > + if (IS_ERR(net)) > + return PTR_ERR(net); > + > + rcu_read_lock(); > + attached = rcu_dereference(net->flow_dissector_prog); > + if (attached) { > + prog_cnt = 1; > + prog_id = attached->aux->id; > + } > + rcu_read_unlock(); Patch looks good to me, one small nit: is there any reason you didn't do the put_net(net) right after the rcu_read_unlock() above? Below it's not really needed anymore, so this would also simplify the error paths by being able to directly return in error case, no? > + if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags))) { > + ret = -EFAULT; > + goto out; > + } > + if (copy_to_user(&uattr->query.prog_cnt, &prog_cnt, sizeof(prog_cnt))) { > + ret = -EFAULT; > + goto out; > + } > + > + if (!attr->query.prog_cnt || !prog_ids || !prog_cnt) > + goto out; > + > + if (copy_to_user(prog_ids, &prog_id, sizeof(u32))) { > + ret = -EFAULT; > + goto out; > + } > + > +out: > + put_net(net); > + return ret; > +} > + > int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, > struct bpf_prog *prog) > { > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type 2019-04-25 21:21 ` [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type Daniel Borkmann @ 2019-04-25 21:31 ` Stanislav Fomichev 0 siblings, 0 replies; 5+ messages in thread From: Stanislav Fomichev @ 2019-04-25 21:31 UTC (permalink / raw) To: Daniel Borkmann Cc: Netdev, bpf, David Miller, Alexei Starovoitov, Jakub Kicinski, Quentin Monnet, Jann Horn On Thu, Apr 25, 2019 at 2:21 PM Daniel Borkmann <daniel@iogearbox.net> wrote: > > On 04/24/2019 11:31 PM, Stanislav Fomichev wrote: > > target_fd is target namespace. If there is a flow dissector BPF program > > attached to that namespace, its (single) id is returned. > > > > v4: > > * add missing put_net (Jann Horn) > > > > v3: > > * add missing inline to skb_flow_dissector_prog_query static def > > (kbuild test robot <lkp@intel.com>) > > > > v2: > > * don't sleep in rcu critical section (Jakub Kicinski) > > * check input prog_cnt (exit early) > > > > Cc: Jann Horn <jannh@google.com> > > Signed-off-by: Stanislav Fomichev <sdf@google.com> > > --- > > include/linux/skbuff.h | 8 +++++++ > > kernel/bpf/syscall.c | 2 ++ > > net/core/flow_dissector.c | 46 +++++++++++++++++++++++++++++++++++++++ > > 3 files changed, 56 insertions(+) > > > > diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h > > index 998256c2820b..6d58fa8a65fd 100644 > > --- a/include/linux/skbuff.h > > +++ b/include/linux/skbuff.h > > @@ -1258,11 +1258,19 @@ void skb_flow_dissector_init(struct flow_dissector *flow_dissector, > > unsigned int key_count); > > > > #ifdef CONFIG_NET > > +int skb_flow_dissector_prog_query(const union bpf_attr *attr, > > + union bpf_attr __user *uattr); > > int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, > > struct bpf_prog *prog); > > > > int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr); > > #else > > +static inline int skb_flow_dissector_prog_query(const union bpf_attr *attr, > > + union bpf_attr __user *uattr) > > +{ > > + return -EOPNOTSUPP; > > +} > > + > > static inline int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, > > struct bpf_prog *prog) > > { > > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > > index 92c9b8a32b50..b0de49598341 100644 > > --- a/kernel/bpf/syscall.c > > +++ b/kernel/bpf/syscall.c > > @@ -2009,6 +2009,8 @@ static int bpf_prog_query(const union bpf_attr *attr, > > break; > > case BPF_LIRC_MODE2: > > return lirc_prog_query(attr, uattr); > > + case BPF_FLOW_DISSECTOR: > > + return skb_flow_dissector_prog_query(attr, uattr); > > default: > > return -EINVAL; > > } > > diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c > > index fac712cee9d5..27466e54ad3a 100644 > > --- a/net/core/flow_dissector.c > > +++ b/net/core/flow_dissector.c > > @@ -65,6 +65,52 @@ void skb_flow_dissector_init(struct flow_dissector *flow_dissector, > > } > > EXPORT_SYMBOL(skb_flow_dissector_init); > > > > +int skb_flow_dissector_prog_query(const union bpf_attr *attr, > > + union bpf_attr __user *uattr) > > +{ > > + __u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids); > > + u32 prog_id, prog_cnt = 0, flags = 0; > > + struct bpf_prog *attached; > > + struct net *net; > > + int ret = 0; > > + > > + if (attr->query.query_flags) > > + return -EINVAL; > > + > > + net = get_net_ns_by_fd(attr->query.target_fd); > > + if (IS_ERR(net)) > > + return PTR_ERR(net); > > + > > + rcu_read_lock(); > > + attached = rcu_dereference(net->flow_dissector_prog); > > + if (attached) { > > + prog_cnt = 1; > > + prog_id = attached->aux->id; > > + } > > + rcu_read_unlock(); > > Patch looks good to me, one small nit: is there any reason you didn't > do the put_net(net) right after the rcu_read_unlock() above? Below it's > not really needed anymore, so this would also simplify the error paths > by being able to directly return in error case, no? Yes, good point. I think I was probably mentally locked down into a pattern where the refs are generally dropped at the end of a routine. Dropping it right after rcu_unlock indeed looks much better. Will follow up with another version, thank you for a suggestion! > > + if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags))) { > > + ret = -EFAULT; > > + goto out; > > + } > > + if (copy_to_user(&uattr->query.prog_cnt, &prog_cnt, sizeof(prog_cnt))) { > > + ret = -EFAULT; > > + goto out; > > + } > > + > > + if (!attr->query.prog_cnt || !prog_ids || !prog_cnt) > > + goto out; > > + > > + if (copy_to_user(prog_ids, &prog_id, sizeof(u32))) { > > + ret = -EFAULT; > > + goto out; > > + } > > + > > +out: > > + put_net(net); > > + return ret; > > +} > > + > > int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, > > struct bpf_prog *prog) > > { > > > ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-04-25 21:31 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2019-04-24 21:31 [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type Stanislav Fomichev 2019-04-24 21:31 ` [PATCH bpf-next v4 2/2] bpftool: show flow_dissector attachment status Stanislav Fomichev 2019-04-24 21:44 ` Jakub Kicinski 2019-04-25 21:21 ` [PATCH bpf-next v4 1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type Daniel Borkmann 2019-04-25 21:31 ` Stanislav Fomichev
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).