From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755671Ab3DZLq6 (ORCPT ); Fri, 26 Apr 2013 07:46:58 -0400 Received: from mx1.redhat.com ([209.132.183.28]:16017 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755618Ab3DZLq4 (ORCPT ); Fri, 26 Apr 2013 07:46:56 -0400 Message-ID: <517A6915.2020208@redhat.com> Date: Fri, 26 Apr 2013 13:46:29 +0200 From: Daniel Borkmann User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Heiko Carstens CC: Xi Wang , "David S. Miller" , Russell King , Eric Dumazet , Will Drewry , Andrew Morton , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Nicolas Schichan , Mircea Gherzan Subject: Re: [RFC PATCH net-next 0/6] seccomp filter JIT References: <1366962706-24204-1-git-send-email-xi.wang@gmail.com> <20130426112539.GA3736@osiris> In-Reply-To: <20130426112539.GA3736@osiris> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 04/26/2013 01:25 PM, Heiko Carstens wrote: > On Fri, Apr 26, 2013 at 03:51:40AM -0400, Xi Wang wrote: >> This patchset brings JIT support to seccomp filters for x86_64 and ARM. >> It is against the net-next tree. >> >> The current BPF JIT interface only accepts sk_filter, not seccomp_filter. >> Patch 1/6 refactors the interface to make it more general. >> >> With the refactored interface, patches 2/6 and 3/6 implement the seccomp >> BPF_S_ANC_SECCOMP_LD_W instruction in x86 & ARM JIT. >> >> Status: >> >> * x86_64 & ARM: JIT tested with seccomp examples. >> >> * powerpc [4/6]: no seccomp change - compile checked. >> >> * sparc [5/6] & s390 [6/6]: no seccomp change - untested. >> >> Sorry I have no sparc or s390 build environment here. Can someone help >> check 5/6 and 6/6? Thanks. > > Your patches are against which tree? > They don't apply on top of linux-next or Linus' linux tree. In the subject line it says net-next. > Btw. are there any test cases around for BPF JIT? > Not only for the new seccomp but also netfilter? BPF is used in packet(7) sockets, not Netfilter. But yeah, test cases for different archs would be really good, i.e. if seccomp wants to use BPF JIT, where seccomp is used for user space program sand-boxing (e.g. in Chromium), I can already guess that this will put attention to certain people. :-) I think BPF JIT for seccomp on ARM recently got applied to -mm tree if I'm not mistaken. It was from Nicolas Schichan (cc): http://thread.gmane.org/gmane.linux.ports.arm.kernel/233416/