From: Daniel Borkmann <daniel@iogearbox•net>
To: Jakub Kicinski <jakub.kicinski@netronome•com>, netdev@vger•kernel.org
Cc: oss-drivers@netronome•com, alexei.starovoitov@gmail•com
Subject: Re: [PATCH net-next 01/12] bpf: verifier: set reg_type on context accesses in second pass
Date: Thu, 12 Oct 2017 22:43:10 +0200 [thread overview]
Message-ID: <59DFD3DE.9050907@iogearbox.net> (raw)
In-Reply-To: <20171012173418.4029-2-jakub.kicinski@netronome.com>
On 10/12/2017 07:34 PM, Jakub Kicinski wrote:
> Use a simplified is_valid_access() callback when verifier
> is used for program analysis by non-host JITs. This allows
> us to teach the verifier about packet start and packet end
> offsets for direct packet access.
>
> We can extend the callback as needed but for most packet
> processing needs there isn't much more the offloads may
> require.
>
> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome•com>
> Reviewed-by: Simon Horman <simon.horman@netronome•com>
> ---
> CC: alexei.starovoitov@gmail•com
> CC: daniel@iogearbox•net
>
> kernel/bpf/verifier.c | 43 +++++++++++++++++++++++++++++++++++++------
> 1 file changed, 37 insertions(+), 6 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 2cdbcc4f8f6b..9755279d94cb 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -813,6 +813,36 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off,
> return err;
> }
>
> +static bool analyzer_is_valid_access(struct bpf_verifier_env *env, int off,
> + struct bpf_insn_access_aux *info)
> +{
> + switch (env->prog->type) {
> + case BPF_PROG_TYPE_XDP:
> + switch (off) {
> + case offsetof(struct xdp_buff, data):
> + info->reg_type = PTR_TO_PACKET;
> + return true;
> + case offsetof(struct xdp_buff, data_end):
> + info->reg_type = PTR_TO_PACKET_END;
> + return true;
> + }
> + return false;
> + case BPF_PROG_TYPE_SCHED_CLS:
> + switch (off) {
> + case offsetof(struct sk_buff, data):
> + info->reg_type = PTR_TO_PACKET;
> + return true;
> + case offsetof(struct sk_buff, cb) +
> + offsetof(struct bpf_skb_data_end, data_end):
> + info->reg_type = PTR_TO_PACKET_END;
> + return true;
> + }
> + return false;
> + default:
> + return false;
> + }
> +}
> +
> /* check access to 'struct bpf_context' fields. Supports fixed offsets only */
> static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size,
> enum bpf_access_type t, enum bpf_reg_type *reg_type)
> @@ -821,12 +851,13 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off,
> .reg_type = *reg_type,
> };
>
> - /* for analyzer ctx accesses are already validated and converted */
> - if (env->analyzer_ops)
> - return 0;
> -
> - if (env->prog->aux->ops->is_valid_access &&
> - env->prog->aux->ops->is_valid_access(off, size, t, &info)) {
> + if (env->analyzer_ops) {
> + if (analyzer_is_valid_access(env, off, &info)) {
> + *reg_type = info.reg_type;
Is there some specific issue with the is_valid_access() callbacks that you
need to do this (I couldn't parse that out of the commit message)? It would
be nice to keep the reg_type setting in one place, meaning the callbacks
themselves, so we wouldn't need to maintain this in multiple places.
> + return 0;
> + }
> + } else if (env->prog->aux->ops->is_valid_access &&
> + env->prog->aux->ops->is_valid_access(off, size, t, &info)) {
> /* A non zero info.ctx_field_size indicates that this field is a
> * candidate for later verifier transformation to load the whole
> * field and then apply a mask when accessed with a narrower
>
next prev parent reply other threads:[~2017-10-12 20:43 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-12 17:34 [PATCH net-next 00/12] nfp: bpf: support direct packet access Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 01/12] bpf: verifier: set reg_type on context accesses in second pass Jakub Kicinski
2017-10-12 20:43 ` Daniel Borkmann [this message]
2017-10-12 20:56 ` Jakub Kicinski
2017-10-12 21:33 ` Daniel Borkmann
2017-10-12 21:39 ` Jakub Kicinski
2017-10-12 21:46 ` Daniel Borkmann
2017-10-12 17:34 ` [PATCH net-next 02/12] nfp: bpf: reorder arguments to emit_ld_field_any() Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 03/12] nfp: bpf: add missing return in jne_imm optimization Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 04/12] nfp: bpf: fix compare instructions Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 05/12] nfp: bpf: add mov helper Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 06/12] nfp: bpf: implement byte swap instruction Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 07/12] nfp: bpf: support BPF offload only on little endian Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 08/12] nfp: bpf: fix context accesses Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 09/12] nfp: bpf: separate I/O from checks for legacy data load Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 10/12] nfp: bpf: add support for direct packet access - read Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 11/12] nfp: bpf: direct packet access - write Jakub Kicinski
2017-10-12 17:34 ` [PATCH net-next 12/12] nfp: bpf: support direct packet access in TC Jakub Kicinski
2017-10-14 18:13 ` [PATCH net-next 00/12] nfp: bpf: support direct packet access David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=59DFD3DE.9050907@iogearbox.net \
--to=daniel@iogearbox$(echo .)net \
--cc=alexei.starovoitov@gmail$(echo .)com \
--cc=jakub.kicinski@netronome$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=oss-drivers@netronome$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox