From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.us.es ([193.147.175.20]:58566 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932556AbeBULtU (ORCPT ); Wed, 21 Feb 2018 06:49:20 -0500 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 0765110FB32 for ; Wed, 21 Feb 2018 12:49:18 +0100 (CET) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id D3822DA248 for ; Wed, 21 Feb 2018 12:49:17 +0100 (CET) Date: Wed, 21 Feb 2018 12:48:51 +0100 From: Pablo Neira Ayuso To: Alexei Starovoitov Cc: David Miller , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, laforge@netfilter.org, fw@strlen.de, daniel@iogearbox.net Subject: Re: [PATCH RFC 3/3] netfilter: nf_tables: add BPF-based jit infrastructure Message-ID: <20180221114851.b4vgjzehvl6jfwgw@salvia> References: <20180219163706.5388-1-pablo@netfilter.org> <20180219163706.5388-4-pablo@netfilter.org> <20180219.135334.93041549091981531.davem@davemloft.net> <20180220105355.f5dd2y73qjzkhciu@salvia> <20180221020137.o4vs2gy4utcue6nj@ast-mbp.dhcp.thefacebook.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180221020137.o4vs2gy4utcue6nj@ast-mbp.dhcp.thefacebook.com> Sender: netdev-owner@vger.kernel.org List-ID: Hi Alexei, On Tue, Feb 20, 2018 at 06:01:39PM -0800, Alexei Starovoitov wrote: > On Tue, Feb 20, 2018 at 11:53:55AM +0100, Pablo Neira Ayuso wrote: > > > > I'll explore how to generate eBPF code in the next patchset version. > > from the user space please... OK, let's do that, from user space I see two things we can do to integrate with eBPF: 1) Add a bpf chain type, that we can use to allow to attach eBPF programs, it would look similar to tc cls_bpf. We mentioned this idea in the past, it can open up existing netfilter hooks for custom eBPF programs. 2) Use the usermode helper infrastructure that bpfilter PoC is proposing to transparently pass the nft netlink batch to userspace for eBPF jit. This would allow us to convert the datapath to eBPF. Regarding the usermode helper, just an idea, not sure your plans but it's probably interesting to explore some sort of messaging-based communication between kernel and the eBPF userspace infrastructure. But that can be done later on, I understand all this is a PoC. Thanks!