This non-RFC patch-set is follow-up on the RFC v3 that was sent earlier. (https://www.spinics.net/lists/netdev/msg519380.html)
In this patch-set following changes are made, RFC v3 -> this patch-set: - "RFC v3 patch 3" is removed as it is no longer needed because bpf_msg_pull_data() has all required bug fixed. Thanks Daniel. - Use __GFP_COMP while allocating pages in bpf_msg_pull_data to avoid page_copy_sane while using sg page in copy_page_to_iter() (patch 1) - In sg_filter_run(), after BPF prog returns, mb.sg_data may have changed while linearize multiple scatterlist entries into one. Therefore, make sure to update original sg and mark the sg end correctly before return. (patch 3) - BPF program can write/modify RDS packet, if that is the case then the modified packet data is represented in scatterlist. Therefore use scatterlist (not skb) while copying payload back to userspace. Also carefully release scatterlist and associated pages e.g. get_page()/put_page() (patch 4) Details: -------- eBPF: Patch 1 use __GFP_COMP while allocating pages in bpf_msg_pull_data to avoid page_copy_sane warning. eBPF: Patch 2 adds new eBPF prog type BPF_PROG_TYPE_SOCKET_SG_FILTER which uses the existing socket filter infrastructure for bpf program attach and load. eBPF program of type BPF_PROG_TYPE_SOCKET_SG_FILTER deals with struct scatterlist as bpf context contrast to BPF_PROG_TYPE_SOCKET_FILTER which deals with struct skb. This new eBPF program type allow socket filter to run on packet data that is in form of struct scatterlist. eBPF: Patch 3 adds sg_filter_run() that runs BPF_PROG_TYPE_SOCKET_SG_FILTER. RDS: patch 4 allows rds_recv_incoming to invoke socket filter program which deals with struct scatterlist bpf/samples: Patch 5 adds socket filter eBPF sample program that uses patches 1 to 5. The sample program opens an rds socket, attach ebpf program (socksg i.e. BPF_PROG_TYPE_SOCKET_SG_FILTER) to rds socket and uses bpf_msg_pull_data() helper to inspect RDS packet data. For a test, current sample program only prints first few bytes of packet data. Background: ----------- The motivation for this work is to allow eBPF based firewalling for kernel modules that do not always get their packet as an sk_buff from their downlink drivers. One such instance of this use-case is RDS, which can be run both over IB (driver RDMA's a scatterlist to the RDS module) or over TCP (TCP passes an sk_buff to the RDS module). This patchset uses exiting socket filter infrastructure and extend it with new eBPF program type that deals with struct scatterlist. Existing bpf helper bpf_msg_pull_data() is used to inspect packet data that are in form struct scatterlist. For RDS, the integrated approach treats the scatterlist as the common denominator, and allows the application to write a filter for processing a scatterlist. Testing: --------- To confirm data accuracy and results, RDS packets of various sizes has been tested with socksg program along with various start and end values for bpf_msg_pull_data(). All such tests shows accurate results. Thanks. -Tushar Tushar Dave (5): bpf: use __GFP_COMP while allocating page eBPF: Add new eBPF prog type BPF_PROG_TYPE_SOCKET_SG_FILTER ebpf: Add sg_filter_run() rds: invoke socket sg filter attached to rds socket ebpf: Add sample ebpf program for SOCKET_SG_FILTER include/linux/bpf_types.h | 1 + include/linux/filter.h | 8 + include/uapi/linux/bpf.h | 7 + kernel/bpf/syscall.c | 1 + kernel/bpf/verifier.c | 1 + net/core/filter.c | 93 ++++++++++- net/rds/ib.c | 1 + net/rds/ib.h | 1 + net/rds/ib_recv.c | 12 ++ net/rds/rds.h | 1 + net/rds/recv.c | 12 ++ net/rds/tcp.c | 1 + net/rds/tcp.h | 2 + net/rds/tcp_recv.c | 108 ++++++++++++- samples/bpf/Makefile | 3 + samples/bpf/bpf_load.c | 11 +- samples/bpf/rds_filter_kern.c | 42 +++++ samples/bpf/rds_filter_user.c | 339 +++++++++++++++++++++++++++++++++++++++++ tools/bpf/bpftool/prog.c | 1 + tools/include/uapi/linux/bpf.h | 7 + tools/lib/bpf/libbpf.c | 3 + tools/lib/bpf/libbpf.h | 2 + 22 files changed, 650 insertions(+), 7 deletions(-) create mode 100644 samples/bpf/rds_filter_kern.c create mode 100644 samples/bpf/rds_filter_user.c -- 1.8.3.1
