bpf: Use sha1() instead of sha1_transform() in bpf_prog_calc_tag()
Subsystems (3)
PATCH 1/1 bpf: Use sha1() instead of sha1_transform() in bpf_prog_calc_tag()
Now that there's a proper SHA-1 library API, just use that instead of the low-level SHA-1 compression function. This eliminates the need for bpf_prog_calc_tag() to implement the SHA-1 padding itself. No functional change; the computed tags remain the same.
--- include/linux/filter.h | 6 ----- kernel/bpf/core.c | 50 ++++++++---------------------------------- 2 files changed, 9 insertions(+), 47 deletions(-)
include/linux/filter.h +0 -6
@@ -995,16 +995,10 @@ void bpf_prog_change_xdp(struct bpf_prog *prev_prog, struct bpf_prog *prog);static inline u32 bpf_prog_insn_size (const struct bpf_prog *prog) {return prog->len *sizeof (struct bpf_insn ); } -static inline u32 bpf_prog_tag_scratch_size (const struct bpf_prog *prog) -{ -return round_up (bpf_prog_insn_size (prog) + -sizeof (__be64) +1 ,SHA1_BLOCK_SIZE ); -} -static inline unsigned int bpf_prog_size (unsigned int proglen) {return max (sizeof (struct bpf_prog ), offsetof(struct bpf_prog, insns[proglen])); }
kernel/bpf/core.c +9 -41
88 lines not on this page · raw message
base-commit: 8f5ae30d69d7543eee0d70083daf4de8fe15d585
Signature · 1 line
2.50.1
Quoted 7 lines · Eric Biggers
Now that there's a proper SHA-1 library API, just use that instead of the low-level SHA-1 compression function. This eliminates the need for
bpf_prog_calc_tag()to implement the SHA-1 padding itself. No functional change; the computed tags remain the same.Signed-off-by Eric Biggers <[email protected]>---
The logic seem to unchanged.
[...]
Song Liu
reviewerQuoted 11 lines · Eric Biggers
Now that there's a proper SHA-1 library API, just use that instead of the low-level SHA-1 compression function. This eliminates the need for
bpf_prog_calc_tag()to implement the SHA-1 padding itself. No functional change; the computed tags remain the same.Signed-off-by Eric Biggers <[email protected]>--- include/linux/filter.h | 6 ----- kernel/bpf/core.c | 50 ++++++++---------------------------------- 2 files changed, 9 insertions(+), 47 deletions(-)
Nice clean up!
It appears this patch changes the sha1 of some programs, but not some other programs. For example, sha1 of program test_task_kfunc_flavor_relo_not_found from task_kfunc_success.bpf.o stays the same before and after the patch, while other programs from task_kfunc_success.bpf.o have different sha1 after the patch.
Is this expected?
Thanks,
Song
Quoted 15 lines · Song Liu
Quoted 11 lines · Eric Biggers
Now that there's a proper SHA-1 library API, just use that instead of the low-level SHA-1 compression function. This eliminates the need for
bpf_prog_calc_tag()to implement the SHA-1 padding itself. No functional change; the computed tags remain the same.Signed-off-by Eric Biggers <[email protected]>--- include/linux/filter.h | 6 ----- kernel/bpf/core.c | 50 ++++++++---------------------------------- 2 files changed, 9 insertions(+), 47 deletions(-)Nice clean up!
Quoted 7 lines
It appears this patch changes the sha1 of some programs, but not some other programs. For example, sha1 of program
test_task_kfunc_flavor_relo_not_foundfrom task_kfunc_success.bpf.o stays the same before and after the patch, while other programs from task_kfunc_success.bpf.o have different sha1 after the patch.Is this expected?
I don't see how the behavior could have changed. The previous code calculated the SHA-1 value correctly, just in a hard-to-read way. Is it possible that those BPF programs changed between your two tests? Did you recompile them?
- Eric
Quoted 16 lines · Song Liu
Quoted 11 lines · Eric Biggers
Now that there's a proper SHA-1 library API, just use that instead of the low-level SHA-1 compression function. This eliminates the need for
bpf_prog_calc_tag()to implement the SHA-1 padding itself. No functional change; the computed tags remain the same.Signed-off-by Eric Biggers <[email protected]>--- include/linux/filter.h | 6 ----- kernel/bpf/core.c | 50 ++++++++---------------------------------- 2 files changed, 9 insertions(+), 47 deletions(-)Nice clean up!
Quoted 8 lines
It appears this patch changes the sha1 of some programs, but not some other programs. For example, sha1 of program
test_task_kfunc_flavor_relo_not_foundfrom task_kfunc_success.bpf.o stays the same before and after the patch, while other programs from task_kfunc_success.bpf.o have different sha1 after the patch.Is this expected?
I modified veristat.c locally to print prog tags, and they were identical before and after. So I'm landing the patch as it's a nice clean up (and it looks like we might change sha1 for sha256 soon anyways with KP's work on signing). Thanks!
$ sudo ./veristat task_kfunc_success.bpf.o Processing 'task_kfunc_success.bpf.o'... TAG for task_kfunc_success.bpf.o/test_task_kfunc_flavor_relo: 3ec44141eafbb946 TAG for task_kfunc_success.bpf.o/test_task_kfunc_flavor_relo_not_found: a2b1538278853bab TAG for task_kfunc_success.bpf.o/test_task_acquire_release_argument: 81814696d4ca6b04 TAG for task_kfunc_success.bpf.o/test_task_acquire_release_current: da78e4661f6fc0f5 TAG for task_kfunc_success.bpf.o/test_task_acquire_leave_in_map: 6987ab3c231b11c8 TAG for task_kfunc_success.bpf.o/test_task_xchg_release: 243afeabd9545c81 TAG for task_kfunc_success.bpf.o/test_task_map_acquire_release: 52c2aa84fd0f4163 TAG for task_kfunc_success.bpf.o/test_task_current_acquire_release: 0a49c6127a61f92e TAG for task_kfunc_success.bpf.o/test_task_from_pid_arg: f2c0d6eb9d6f1c87 TAG for task_kfunc_success.bpf.o/test_task_from_pid_current: 3a7cc6125deb0920 TAG for task_kfunc_success.bpf.o/test_task_from_pid_invalid: a41a7678b91b0f12 TAG for task_kfunc_success.bpf.o/task_kfunc_acquire_trusted_walked: 8c38bae3eeaab179 TAG for task_kfunc_success.bpf.o/test_task_from_vpid_current: 4d5bd93fd0615005 TAG for task_kfunc_success.bpf.o/test_task_from_vpid_invalid: 87a101256cffd707 File Program Verdict Duration (us) Insns States Program size Jited size ------------------------ ------------------------------------- ------- ------------- ----- ------ ------------ ---------- task_kfunc_success.bpf.o task_kfunc_acquire_trusted_walked success 1111 13 1 13 73 task_kfunc_success.bpf.o test_task_acquire_leave_in_map success 376 73 7 57 282 task_kfunc_success.bpf.o test_task_acquire_release_argument success 211 18 2 41 83 task_kfunc_success.bpf.o test_task_acquire_release_current success 229 18 2 41 82 task_kfunc_success.bpf.o test_task_current_acquire_release success 212 20 2 19 96 task_kfunc_success.bpf.o test_task_from_pid_arg success 235 31 3 26 173 task_kfunc_success.bpf.o test_task_from_pid_current success 239 32 3 27 181 task_kfunc_success.bpf.o test_task_from_pid_invalid success 234 42 4 42 213 task_kfunc_success.bpf.o test_task_from_vpid_current success 139 21 2 19 106 task_kfunc_success.bpf.o test_task_from_vpid_invalid success 107 29 3 19 107 task_kfunc_success.bpf.o test_task_kfunc_flavor_relo success 270 17 1 37 88 task_kfunc_success.bpf.o test_task_kfunc_flavor_relo_not_found success 146 8 0 13 38 task_kfunc_success.bpf.o test_task_map_acquire_release success 428 126 12 95 469 task_kfunc_success.bpf.o test_task_xchg_release success 634 202 19 173 854 ------------------------ ------------------------------------- ------- ------------- ----- ------ ------------ ---------- Done. Processed 1 files, 0 programs. Skipped 14 files, 0 programs.
Quoted 2 lines
Thanks,
Song