netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH net-next v2 0/9] BPF updates
@ 2014-03-25 12:10 Daniel Borkmann
  2014-03-25 12:10 ` [PATCH net-next v2 1/9] net: filter: add jited flag to indicate jit compiled filters Daniel Borkmann
                   ` (9 more replies)
  0 siblings, 10 replies; 19+ messages in thread
From: Daniel Borkmann @ 2014-03-25 12:10 UTC (permalink / raw)
  To: davem; +Cc: ast, netdev

We sat down and have heavily reworked the whole previous patchset
from v10 [1] to address all comments/concerns. This patchset therefore
*replaces* the internal BPF interpreter with the new layout as
discussed in [1], and migrates some exotic callers to properly use the
BPF API for a transparent upgrade. All other callers that already use
the BPF API in a way it should be used, need no further changes to run
the new internals. We also removed the sysctl knob entirely, and do not
expose any structure to userland, so that implementation details only
reside in kernel space. Since we are replacing the interpreter we had
to migrate seccomp in one patch along with the interpreter to not break
anything. When attaching a new filter, the flow can be described as
following: i) test if jit compiler is enabled and can compile the user
BPF, ii) if so, then go for it, iii) if not, then transparently migrate
the filter into the new representation, and run it in the interpreter.
Also, we have scratched the jit flag from the len attribute and made it
as initial patch in this series as Pablo has suggested in the last
feedback, thanks. For details, please refer to the patches themselves.

We did extensive testing of BPF and seccomp on the new interpreter
itself and also on the user ABIs and could not find any issues; new
performance numbers as posted in patch 8 are also still the same.

Please find more details in the patches themselves.

For all the previous history from v1 to v10, see [1]. We have decided
to drop the v11 as we have pedantically reworked the set, but of course,
included all previous feedback.

v1 -> v2:
 - Rebased to latest net-next
 - Added static to ptp_filter as suggested by Dave
 - Fixed a typo in patch 8's commit message
 - Rest unchanged

Thanks !

  [1] http://thread.gmane.org/gmane.linux.kernel/1665858

Alexei Starovoitov (2):
  net: filter: rework/optimize internal BPF interpreter's instruction set
  doc: filter: extend BPF documentation to document new internals

Daniel Borkmann (7):
  net: filter: add jited flag to indicate jit compiled filters
  net: filter: keep original BPF program around
  net: filter: move filter accounting to filter core
  net: ptp: use sk_unattached_filter_create() for BPF
  net: ptp: do not reimplement PTP/BPF classifier
  net: ppp: use sk_unattached_filter api
  net: isdn: use sk_unattached_filter api

 Documentation/networking/filter.txt                |  147 ++
 arch/arm/net/bpf_jit_32.c                          |    3 +-
 arch/powerpc/net/bpf_jit_comp.c                    |    3 +-
 arch/s390/net/bpf_jit_comp.c                       |    5 +-
 arch/sparc/net/bpf_jit_comp.c                      |    3 +-
 arch/x86/net/bpf_jit_comp.c                        |    3 +-
 drivers/isdn/i4l/isdn_ppp.c                        |   61 +-
 .../net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c   |   11 +-
 drivers/net/ethernet/ti/cpts.c                     |   10 +-
 drivers/net/ethernet/xscale/ixp4xx_eth.c           |   11 +-
 drivers/net/ppp/ppp_generic.c                      |   60 +-
 include/linux/filter.h                             |  110 +-
 include/linux/isdn_ppp.h                           |    5 +-
 include/linux/ptp_classify.h                       |   14 +-
 include/linux/seccomp.h                            |    1 -
 include/net/sock.h                                 |   27 -
 kernel/seccomp.c                                   |  119 +-
 net/core/filter.c                                  | 1523 ++++++++++++++++----
 net/core/sock_diag.c                               |   23 +-
 net/core/timestamping.c                            |   27 +-
 20 files changed, 1630 insertions(+), 536 deletions(-)

-- 
1.7.11.7

^ permalink raw reply	[flat|nested] 19+ messages in thread
* [PATCH net-next v2 7/9] net: isdn: use sk_unattached_filter api
@ 2014-03-25 15:05 Daniel Borkmann
  0 siblings, 0 replies; 19+ messages in thread
From: Daniel Borkmann @ 2014-03-25 15:05 UTC (permalink / raw)
  To: davem; +Cc: ast, netdev, Karsten Keil, isdn4linux

Similarly as in ppp, we need to migrate the ISDN/PPP code to make use
of the sk_unattached_filter api in order to decouple having direct
filter structure access. By using sk_unattached_filter_{create,destroy},
we can allow for the possibility to jit compile filters for faster
filter verdicts as well.

Joint work with Alexei Starovoitov.

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: isdn4linux@listserv.isdn4linux.de
---
 drivers/isdn/i4l/isdn_ppp.c | 61 ++++++++++++++++++++++++++++++---------------
 include/linux/isdn_ppp.h    |  5 ++--
 2 files changed, 43 insertions(+), 23 deletions(-)

diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 38ceac5..a5da511 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -378,10 +378,15 @@ isdn_ppp_release(int min, struct file *file)
 	is->slcomp = NULL;
 #endif
 #ifdef CONFIG_IPPP_FILTER
-	kfree(is->pass_filter);
-	is->pass_filter = NULL;
-	kfree(is->active_filter);
-	is->active_filter = NULL;
+	if (is->pass_filter) {
+		sk_unattached_filter_destroy(is->pass_filter);
+		is->pass_filter = NULL;
+	}
+
+	if (is->active_filter) {
+		sk_unattached_filter_destroy(is->active_filter);
+		is->active_filter = NULL;
+	}
 #endif
 
 /* TODO: if this was the previous master: link the stuff to the new master */
@@ -629,25 +634,41 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
 #ifdef CONFIG_IPPP_FILTER
 	case PPPIOCSPASS:
 	{
+		struct sock_fprog fprog;
 		struct sock_filter *code;
-		int len = get_filter(argp, &code);
+		int err, len = get_filter(argp, &code);
+
 		if (len < 0)
 			return len;
-		kfree(is->pass_filter);
-		is->pass_filter = code;
-		is->pass_len = len;
-		break;
+
+		fprog.len = len;
+		fprog.filter = code;
+
+		if (is->pass_filter)
+			sk_unattached_filter_destroy(is->pass_filter);
+		err = sk_unattached_filter_create(&is->pass_filter, &fprog);
+		kfree(code);
+
+		return err;
 	}
 	case PPPIOCSACTIVE:
 	{
+		struct sock_fprog fprog;
 		struct sock_filter *code;
-		int len = get_filter(argp, &code);
+		int err, len = get_filter(argp, &code);
+
 		if (len < 0)
 			return len;
-		kfree(is->active_filter);
-		is->active_filter = code;
-		is->active_len = len;
-		break;
+
+		fprog.len = len;
+		fprog.filter = code;
+
+		if (is->active_filter)
+			sk_unattached_filter_destroy(is->active_filter);
+		err = sk_unattached_filter_create(&is->active_filter, &fprog);
+		kfree(code);
+
+		return err;
 	}
 #endif /* CONFIG_IPPP_FILTER */
 	default:
@@ -1147,14 +1168,14 @@ isdn_ppp_push_higher(isdn_net_dev *net_dev, isdn_net_local *lp, struct sk_buff *
 	}
 
 	if (is->pass_filter
-	    && sk_run_filter(skb, is->pass_filter) == 0) {
+	    && SK_RUN_FILTER(is->pass_filter, skb) == 0) {
 		if (is->debug & 0x2)
 			printk(KERN_DEBUG "IPPP: inbound frame filtered.\n");
 		kfree_skb(skb);
 		return;
 	}
 	if (!(is->active_filter
-	      && sk_run_filter(skb, is->active_filter) == 0)) {
+	      && SK_RUN_FILTER(is->active_filter, skb) == 0)) {
 		if (is->debug & 0x2)
 			printk(KERN_DEBUG "IPPP: link-active filter: resetting huptimer.\n");
 		lp->huptimer = 0;
@@ -1293,14 +1314,14 @@ isdn_ppp_xmit(struct sk_buff *skb, struct net_device *netdev)
 	}
 
 	if (ipt->pass_filter
-	    && sk_run_filter(skb, ipt->pass_filter) == 0) {
+	    && SK_RUN_FILTER(ipt->pass_filter, skb) == 0) {
 		if (ipt->debug & 0x4)
 			printk(KERN_DEBUG "IPPP: outbound frame filtered.\n");
 		kfree_skb(skb);
 		goto unlock;
 	}
 	if (!(ipt->active_filter
-	      && sk_run_filter(skb, ipt->active_filter) == 0)) {
+	      && SK_RUN_FILTER(ipt->active_filter, skb) == 0)) {
 		if (ipt->debug & 0x4)
 			printk(KERN_DEBUG "IPPP: link-active filter: resetting huptimer.\n");
 		lp->huptimer = 0;
@@ -1490,9 +1511,9 @@ int isdn_ppp_autodial_filter(struct sk_buff *skb, isdn_net_local *lp)
 	}
 
 	drop |= is->pass_filter
-		&& sk_run_filter(skb, is->pass_filter) == 0;
+		&& SK_RUN_FILTER(is->pass_filter, skb) == 0;
 	drop |= is->active_filter
-		&& sk_run_filter(skb, is->active_filter) == 0;
+		&& SK_RUN_FILTER(is->active_filter, skb) == 0;
 
 	skb_push(skb, IPPP_MAX_HEADER - 4);
 	return drop;
diff --git a/include/linux/isdn_ppp.h b/include/linux/isdn_ppp.h
index d5f62bc..8e10f57 100644
--- a/include/linux/isdn_ppp.h
+++ b/include/linux/isdn_ppp.h
@@ -180,9 +180,8 @@ struct ippp_struct {
   struct slcompress *slcomp;
 #endif
 #ifdef CONFIG_IPPP_FILTER
-  struct sock_filter *pass_filter;	/* filter for packets to pass */
-  struct sock_filter *active_filter;	/* filter for pkts to reset idle */
-  unsigned pass_len, active_len;
+  struct sk_filter *pass_filter;   /* filter for packets to pass */
+  struct sk_filter *active_filter; /* filter for pkts to reset idle */
 #endif
   unsigned long debug;
   struct isdn_ppp_compressor *compressor,*decompressor;
-- 
1.7.11.7

^ permalink raw reply related	[flat|nested] 19+ messages in thread
end of thread, other threads:[~2014-03-26 16:22 UTC | newest]

Thread overview: 19+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-03-25 12:10 [PATCH net-next v2 0/9] BPF updates Daniel Borkmann
2014-03-25 12:10 ` [PATCH net-next v2 1/9] net: filter: add jited flag to indicate jit compiled filters Daniel Borkmann
2014-03-25 12:10 ` [PATCH net-next v2 2/9] net: filter: keep original BPF program around Daniel Borkmann
2014-03-25 12:10 ` [PATCH net-next v2 3/9] net: filter: move filter accounting to filter core Daniel Borkmann
2014-03-25 12:10 ` [PATCH net-next v2 4/9] net: ptp: use sk_unattached_filter_create() for BPF Daniel Borkmann
2014-03-25 12:10 ` [PATCH net-next v2 5/9] net: ptp: do not reimplement PTP/BPF classifier Daniel Borkmann
2014-03-25 12:10 ` [PATCH net-next v2 6/9] net: ppp: use sk_unattached_filter api Daniel Borkmann
2014-03-25 12:10 ` [PATCH net-next v2 7/9] net: isdn: " Daniel Borkmann
2014-03-25 23:08   ` David Miller
2014-03-25 12:10 ` [PATCH net-next v2 8/9] net: filter: rework/optimize internal BPF interpreter's instruction set Daniel Borkmann
2014-03-26  0:17   ` David Miller
2014-03-26  0:24     ` H. Peter Anvin
2014-03-26  0:46       ` David Miller
2014-03-26  1:58         ` Alexei Starovoitov
2014-03-26 16:22           ` David Miller
2014-03-25 12:10 ` [PATCH net-next v2 9/9] doc: filter: extend BPF documentation to document new internals Daniel Borkmann
2014-03-25 15:02 ` [PATCH net-next v2 0/9] BPF updates David Miller
2014-03-25 15:06   ` Daniel Borkmann
  -- strict thread matches above, loose matches on Subject: below --
2014-03-25 15:05 [PATCH net-next v2 7/9] net: isdn: use sk_unattached_filter api Daniel Borkmann

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).