Re: [RFC PATCH net-next 0/6] seccomp filter JIT

[Daniel Borkmann <dborkman@redhat.com>]

On 04/26/2013 01:25 PM, Heiko Carstens wrote:
> On Fri, Apr 26, 2013 at 03:51:40AM -0400, Xi Wang wrote:
>> This patchset brings JIT support to seccomp filters for x86_64 and ARM.
>> It is against the net-next tree.
>>
>> The current BPF JIT interface only accepts sk_filter, not seccomp_filter.
>> Patch 1/6 refactors the interface to make it more general.
>>
>> With the refactored interface, patches 2/6 and 3/6 implement the seccomp
>> BPF_S_ANC_SECCOMP_LD_W instruction in x86 & ARM JIT.
>>
>> Status:
>>
>> * x86_64 & ARM: JIT tested with seccomp examples.
>>
>> * powerpc [4/6]: no seccomp change - compile checked.
>>
>> * sparc [5/6] & s390 [6/6]: no seccomp change - untested.
>>
>> Sorry I have no sparc or s390 build environment here.  Can someone help
>> check 5/6 and 6/6?  Thanks.
>
> Your patches are against which tree?
> They don't apply on top of linux-next or Linus' linux tree.

In the subject line it says net-next.

> Btw. are there any test cases around for BPF JIT?
> Not only for the new seccomp but also netfilter?

BPF is used in packet(7) sockets, not Netfilter. But yeah, test
cases for different archs would be really good, i.e. if seccomp
wants to use BPF JIT, where seccomp is used for user space program
sand-boxing (e.g. in Chromium), I can already guess that this will
put attention to certain people. :-)

I think BPF JIT for seccomp on ARM recently got applied to -mm tree
if I'm not mistaken. It was from Nicolas Schichan (cc):

http://thread.gmane.org/gmane.linux.ports.arm.kernel/233416/