Daniel Borkmann
e2e9b6541d
cls_bpf: add initial eBPF support for programmable classifiers ...
This work extends the "classic" BPF programmable tc classifier by
extending its scope also to native eBPF code!
This allows for user space to implement own custom, 'safe' C like
classifiers (or whatever other frontend language LLVM et al may
provide in future), that can then be compiled with the LLVM eBPF
backend to an eBPF elf file. The result of this can be loaded into
the kernel via iproute2's tc. In the kernel, they can be JITed on
major archs and thus run in native performance.
Simple, minimal toy example to demonstrate the workflow:
#include <linux/ip.h>
#include <linux/if_ether.h>
#include <linux/bpf.h>
#include "tc_bpf_api.h"
__section("classify")
int cls_main(struct sk_buff *skb)
{
return (0x800 << 16) | load_byte(skb, ETH_HLEN + __builtin_offsetof(struct iphdr, tos));
}
char __license[] __section("license") = "GPL";
The classifier can then be compiled into eBPF opcodes and loaded
via tc, for example:
clang -O2 -emit-llvm -c cls.c -o - | llc -march=bpf -filetype=obj -o cls.o
tc filter add dev em1 parent 1: bpf cls.o [...]
As it has been demonstrated, the scope can even reach up to a fully
fledged flow dissector (similarly as in samples/bpf/sockex2_kern.c).
For tc, maps are allowed to be used, but from kernel context only,
in other words, eBPF code can keep state across filter invocations.
In future, we perhaps may reattach from a different application to
those maps e.g., to read out collected statistics/state.
Similarly as in socket filters, we may extend functionality for eBPF
classifiers over time depending on the use cases. For that purpose,
cls_bpf programs are using BPF_PROG_TYPE_SCHED_CLS program type, so
we can allow additional functions/accessors (e.g. an ABI compatible
offset translation to skb fields/metadata). For an initial cls_bpf
support, we allow the same set of helper functions as eBPF socket
filters, but we could diverge at some point in time w/o problem.
I was wondering whether cls_bpf and act_bpf could share C programs,
I can imagine that at some point, we introduce i) further common
handlers for both (or even beyond their scope), and/or if truly needed
ii) some restricted function space for each of them. Both can be
abstracted easily through struct bpf_verifier_ops in future.
The context of cls_bpf versus act_bpf is slightly different though:
a cls_bpf program will return a specific classid whereas act_bpf a
drop/non-drop return code, latter may also in future mangle skbs.
That said, we can surely have a "classify" and "action" section in
a single object file, or considered mentioned constraint add a
possibility of a shared section.
The workflow for getting native eBPF running from tc [1] is as
follows: for f_bpf, I've added a slightly modified ELF parser code
from Alexei's kernel sample, which reads out the LLVM compiled
object, sets up maps (and dynamically fixes up map fds) if any, and
loads the eBPF instructions all centrally through the bpf syscall.
The resulting fd from the loaded program itself is being passed down
to cls_bpf, which looks up struct bpf_prog from the fd store, and
holds reference, so that it stays available also after tc program
lifetime. On tc filter destruction, it will then drop its reference.
Moreover, I've also added the optional possibility to annotate an
eBPF filter with a name (e.g. path to object file, or something
else if preferred) so that when tc dumps currently installed filters,
some more context can be given to an admin for a given instance (as
opposed to just the file descriptor number).
Last but not least, bpf_prog_get() and bpf_prog_put() needed to be
exported, so that eBPF can be used from cls_bpf built as a module.
Thanks to 60a3b2253chttp://git.breakpoint.cc/cgit/dborkman/iproute2.git/log/?h=ebpf
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-03-01 14:05:19 -05:00
android: uapi: binder.h
2014-10-20 10:30:15 +08:00
caif: Remove my bouncing email address.
2013-04-23 13:25:51 -04:00
can: m_can: tag current CAN FD controllers as non-ISO
2015-01-15 16:57:59 +01:00
cifs: Move and expand MAX_SERVER_SIZE definition
2013-09-08 14:34:22 -05:00
[media] demux.h: Remove duplicated enum
2013-04-08 06:53:15 -03:00
GenWQE: Update author information
2014-09-23 23:15:46 -07:00
netfilter: ipset: Alignment problem between 64bit kernel 32bit userspace
2014-12-03 12:43:35 +01:00
uapi: netfilter_arp: use __u8 instead of u_int8_t
2014-08-20 15:13:08 +02:00
netfilter: kill ulog targets
2014-06-25 19:28:43 +02:00
netfilter: kill ulog targets
2014-06-25 19:28:43 +02:00
netfilter: fix struct ip6t_frag field description
2013-04-02 12:25:57 +02:00
nfsd: implement pNFS operations
2015-02-02 18:09:42 +01:00
md: discard PRINT_RAID_DEBUG ioctl
2014-10-14 13:08:29 +11:00
spi: spidev: Add support for Dual/Quad SPI Transfers
2014-02-27 13:51:29 +09:00
net: sched: Introduce connmark action
2015-01-19 16:02:06 -05:00
usb: gadget: ffs: add eventfd notification about ffs events
2015-01-27 09:34:59 -06:00
uapi: Convert some uses of 6 to ETH_ALEN
2013-08-02 12:33:54 -07:00
UAPI: fix endianness conditionals in linux/acct.h
2013-03-13 15:21:48 -07:00
UAPI: fix endianness conditionals in linux/aio_abi.h
2013-03-13 15:21:48 -07:00
[media] media: platform: add VPFE capture driver support for AM437X
2014-12-23 12:09:58 -02:00
apm-emulation: add hibernation APM events to support suspend2disk
2014-01-07 13:50:28 +01:00
powerpc updates for 3.19 batch 2
2014-12-19 12:57:45 -08:00
powerpc: Add HWCAP2 aux entry
2013-04-26 16:08:16 +10:00
bcache: Add bch_btree_keys_u64s_remaining()
2014-01-08 13:05:13 -08:00
MIPS: BCM63XX: recognize Cable Modem firmware format
2013-07-01 15:10:53 +02:00
ebpf: add sched_cls_type and map it to sk_filter's verifier ops
2015-03-01 14:05:19 -05:00
net: filter: move common defines into bpf_common.h
2014-10-14 16:06:45 -04:00
block SG_IO: add SG_FLAG_Q_AT_HEAD flag
2014-07-01 10:48:05 -06:00
Btrfs: return failure if btrfs_dev_replace_finishing() failed
2014-11-20 17:14:28 -08:00
can: unify identifiers to ensure unique include processing
2014-05-19 09:38:24 +02:00
audit: add netlink audit protocol bind to check capabilities on multicast join
2014-04-22 21:42:27 -04:00
isdn: capi: fix "CAPI_VERSION" comment
2014-03-20 14:55:18 +01:00
Omnikey Cardman 4000: pull in ioctl.h in user header
2013-08-28 19:26:38 -07:00
connector: Added coredumping event to the process connector
2013-03-20 13:23:21 -04:00
Drivers: hv: Add a new driver to support host initiated backup
2013-03-15 12:12:36 -07:00
linux/const.h: Add _BITUL() and _BITULL()
2013-06-25 15:50:04 -07:00
dcbnl : Fix misleading dcb_app->priority explanation
2014-07-30 17:21:05 -07:00
dlm: adopt orphan locks
2014-11-19 14:48:02 -06:00
dm: allocate requests in target when stacking on blk-mq devices
2015-02-09 13:06:47 -05:00
dm log userspace: allow mark requests to piggyback on flush requests
2014-01-21 23:46:27 -05:00
include/uapi/linux/dn.h: pull in ioctl.h header
2014-01-23 16:36:55 -08:00
quota: Add a new quotactl command Q_XGETQSTATV
2013-08-20 16:53:58 -05:00
Add ELF machine define for Nios2
2014-12-08 12:55:57 +08:00
arm64: ptrace: add NT_ARM_SYSTEM_CALL regset
2014-11-28 10:19:49 +00:00
net-timestamp: ACK timestamp for bytestreams
2014-08-05 16:35:54 -07:00
ethtool: rename reserved1 memeber in ethtool_drvinfo for expansion ROM version
2015-02-09 14:07:54 -08:00
epoll: drop EPOLLWAKEUP if PM_SLEEP is disabled
2013-12-03 15:35:52 +01:00
fs: Introduce FALLOC_FL_ZERO_RANGE flag for fallocate
2014-03-13 19:07:42 +11:00
shm: add sealing API
2014-08-08 15:57:31 -07:00
floppy: bail out in open() if drive is not responding to block0 read
2014-01-17 11:12:06 +01:00
fib_rules: fix suppressor names and default values
2013-08-03 10:40:23 -07:00
ext4: add support for extent pre-caching
2013-08-16 22:05:14 -04:00
net: filter: move common defines into bpf_common.h
2014-10-14 16:06:45 -04:00
firewire: fix libdc1394/FlyCap2 iso event regression
2013-07-27 20:24:36 +02:00
gue: Use checksum partial with remote checksum offload
2015-02-11 15:12:13 -08:00
vfs: add support for a lazytime mount option
2015-02-05 02:45:00 -05:00
fuse: add FUSE_NO_OPEN_SUPPORT flag to INIT
2014-07-22 16:37:43 +02:00
net_sched: add 64bit rate estimators
2013-06-11 02:51:03 -07:00
genetlink/pmcraid: use proper genetlink multicast API
2013-11-28 18:26:30 -05:00
GFS2: remove transaction glock
2014-05-14 10:04:34 +01:00
crypto: provide single place for hash algo information
2013-10-25 17:14:03 -04:00
net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)
2013-11-03 23:20:14 -05:00
Drivers: hv: util: make struct hv_do_fcopy match Hyper-V host messages
2014-11-07 10:21:44 -08:00
i8k: uapi: Introduce define for new highest fan speed
2014-07-09 16:41:36 -07:00
ICMPv6: treat dest unreachable codes 5 and 6 as EACCES, not EPROTO
2013-09-03 22:11:44 -04:00
net: move net_device priv_flags out from UAPI
2014-02-27 15:59:09 -05:00
multicast: Extend ip address command to enable multicast group join/leave on
2015-02-27 16:25:25 -05:00
crypto: af_alg - add user space interface for AEAD
2014-12-05 23:56:55 +08:00
net: if_arp: add ARPHRD_6LOWPAN type
2013-12-11 12:57:55 -08:00
bonding: modify the old and add new xmit hash policies
2013-10-03 15:36:38 -04:00
bridge: support for multiple vlans and vlan ranges in setlink and dellink requests
2015-01-12 16:47:04 -05:00
if_cablemodem.h: Add parenthesis around ioctl macros
2013-05-08 13:13:30 -07:00
net: dsa: reduce number of protocol hooks
2014-08-27 22:59:39 -07:00
FDDI: Reformat <linux/if_fddi.h> for 8-character tabs
2014-04-27 19:08:06 -04:00
vxlan: Use checksum partial with remote checksum offload
2015-02-11 15:12:13 -08:00
packet: remove deprecated syststamp timestamp
2014-07-29 11:39:50 -07:00
pptp: fix byte order warnings
2013-08-13 15:10:22 -07:00
if_tun: drop broken IFF_VNET_LE
2014-12-16 11:19:42 -05:00
gue: TX support for using remote checksum offload option
2014-11-05 16:30:03 -05:00
ip: Add offset parameter to ip_cmsg_recv
2015-01-05 22:44:46 -05:00
in6: fix conflict with glibc
2014-12-22 16:12:36 -05:00
net: tcp: add DCTCP congestion control algorithm
2014-09-29 00:13:10 -04:00
HID: wacom: add support for Cintiq 27QHD and 27QHD touch
2015-01-29 14:05:05 +01:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2013-08-26 16:37:08 -04:00
ipvs: Add destination address family to netlink interface
2014-09-16 09:03:33 +09:00
ipmi: remove superfluous kernel/userspace explanation
2013-02-27 19:10:21 -08:00
net: ipv6: Add sysctl entry to disable MTU updates from RA
2015-01-25 14:54:41 -08:00
fs/binfmt_som: Drop kernel support for HP-UX SOM binaries
2015-02-17 16:29:36 +01:00
kcmp: Move kcmp.h into uapi
2014-12-02 13:52:53 -07:00
mm:add KPF_ZERO_PAGE flag for /proc/kpageflags
2015-02-11 17:06:00 -08:00
kexec: Fix make headers_check
2015-02-17 14:34:51 -08:00
KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches
2013-09-24 10:35:19 +01:00
drm/amdkfd: reformat IOCTL definitions to drm-style
2015-01-06 19:44:36 +02:00
KVM: s390: fixes and features for kvm/next (3.20)
2015-01-23 14:33:36 +01:00
MIPS: Add functions for hypervisor call
2014-05-30 21:01:11 +02:00
l2tp : multicast notification to the registered listeners
2014-12-31 14:17:20 -05:00
ipv6: fix redefinition of in6_pktinfo and ip6_mtuinfo
2015-01-08 19:29:11 -08:00
take the targets of /proc/*/ns/* symlinks to separate fs
2014-12-10 21:30:20 -05:00
mtd: Move major number definitions to major.h
2013-11-06 23:32:59 -08:00
[media] Move mediabus format definition to a more standard place
2014-11-14 17:47:47 -02:00
[media] media: Add pad flag MEDIA_PAD_FL_MUST_CONNECT
2013-12-04 14:59:20 -02:00
shm: add memfd_create() syscall
2014-08-08 15:57:31 -07:00
mm: convert p[te|md]_numa users to p[te|md]_protnone_numa
2015-02-12 18:54:08 -08:00
misc: mic: Fix endianness issues.
2013-11-27 11:03:38 -08:00
misc: mic: fix possible signed underflow (undefined behavior) in userspace API
2014-02-07 15:30:34 -08:00
UAPI: add MPLS label stack definition
2014-03-04 13:51:06 -05:00
uapi: Use __kernel_long_t in struct mq_attr
2014-01-20 14:45:33 -08:00
msdos_fs.h: fix 'fields' in comment
2015-01-20 13:51:06 +01:00
ipc/msg: increase MSGMNI, remove scaling
2014-12-13 12:42:52 -08:00
nbd: support FLUSH requests
2013-02-27 19:10:22 -08:00
vxlan: advertise link netns in fdb messages
2015-01-27 17:11:07 -08:00
netns: add rtnl cmd to add and get peer netns ids
2015-01-19 14:21:18 -05:00
net-timestamp: no-payload option
2015-02-02 18:46:51 -08:00
netconf: rename PROXY_ARP to NEIGH_PROXY
2013-12-22 18:02:43 -05:00
net: add name_assign_type netdev attribute
2014-07-15 16:12:01 -07:00
netfilter: nf_tables: add "inet" table for IPv4/IPv6
2014-01-07 23:57:25 +01:00
netlink: mmaped netlink: ring setup
2013-04-19 14:57:57 -04:00
diag: warn about missing first netlink attribute
2013-11-28 18:16:43 -05:00
NFC: Forward NFC_EVT_TRANSACTION to user space
2015-02-02 21:50:40 +01:00
uapi: convert u64 to __u64 in exported headers
2014-01-23 16:36:55 -08:00
NFS: stop using NFS_MOUNT_SECFLAVOUR server flag
2013-10-28 15:37:56 -04:00
nl80211: don't document per-wiphy interface dump
2015-01-29 16:54:44 +01:00
NVMe: Updates for 1.1 spec
2014-11-04 13:17:10 -07:00
net: openvswitch: Support masked set actions.
2015-02-07 22:40:17 -08:00
diag: warn about missing first netlink attribute
2013-11-28 18:16:43 -05:00
PCI: Add defines for PCIe Max_Read_Request_Size
2015-01-27 08:14:26 -06:00
perf: Add ability to sample machine state on interrupt
2014-11-16 11:41:57 +01:00
ipsec: add support of limited SA dump
2014-02-17 07:18:19 +01:00
cls_bpf: add initial eBPF support for programmable classifiers
2015-03-01 14:05:19 -05:00
pkt_sched: fq: better control of DDOS traffic
2015-02-04 22:15:45 -08:00
include/uapi/linux/ppp-ioctl.h: pull in ppp_defs.h
2014-01-23 16:36:55 -08:00
x86, mpx: On-demand kernel allocation of bounds tables
2014-11-18 00:58:53 +01:00
ARM/ARM64: KVM: Add common header for PSCI related defines
2014-04-30 04:18:57 -07:00
ptp: introduce programmable pins.
2014-03-21 14:21:13 -04:00
ptrace: add ability to get/set signal-blocked mask
2013-07-03 16:08:01 -07:00
quota: Cleanup flags definitions
2015-01-21 19:21:30 +01:00
random: introduce getrandom(2) system call
2014-08-05 16:41:22 -04:00
xattr: Constify ->name member of "struct xattr".
2013-07-25 19:30:03 +10:00
uapi: Use __kernel_long_t/__kernel_ulong_t in <linux/resource.h>
2014-01-20 14:44:17 -08:00
rfkill: Add NFC to the list of supported radios
2013-04-12 16:54:38 +02:00
netns: add rtnl cmd to add and get peer netns ids
2015-01-19 14:21:18 -05:00
sched: Update comments about CLONE_NEWUTS and CLONE_NEWIPC
2014-11-16 10:58:53 +01:00
net: sctp: implement rfc6458, 8.1.31. SCTP_DEFAULT_SNDINFO support
2014-07-16 14:40:04 -07:00
seccomp: implement SECCOMP_FILTER_FLAG_TSYNC
2014-07-18 12:13:40 -07:00
ipc/sem.c: increase SEMMSL, SEMMNI, SEMOPM
2014-12-13 12:42:52 -08:00
serial: driver for ETRAX FS UART
2015-02-07 18:43:16 +08:00
tty: 8250: Add 64byte UART support for FSL platforms
2015-01-09 14:33:04 -08:00
Input: add support for Wacom protocol 4 serial tablets
2014-07-20 14:33:23 -07:00
ipc,shm: document new limits in the uapi header
2014-06-06 16:08:14 -07:00
[media] smiapp: Add driver-specific test pattern menu item definitions
2014-08-21 15:25:11 -05:00
tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks
2015-02-08 01:03:12 -08:00
net_tstamp: Add SIOCGHWTSTAMP ioctl to match SIOCSHWTSTAMP
2013-11-19 19:07:21 +00:00
kernel: add panic_on_warn
2014-12-10 17:41:10 -08:00
uapi/linux/target_core_user.h: fix headers_install.sh badness
2014-12-18 11:07:27 -08:00
tcp: add pacing_rate information into tcp_info
2014-02-14 16:09:43 -05:00
tcp: switch rtt estimations to usec resolution
2014-02-26 17:08:40 -05:00
thermal: provide an UAPI header file
2014-12-09 14:10:41 +08:00
timekeeping: Add CLOCK_TAI clockid
2013-03-22 16:19:59 -07:00
uapi: Use __kernel_long_t in struct timex
2014-01-20 14:44:05 -08:00
tipc: add ioctl to fetch link names
2014-04-26 12:13:24 -04:00
tipc: convert legacy nl link stat to nl compat
2015-02-09 13:20:47 -08:00
tipc: add name table dump to new netlink api
2014-11-21 15:01:32 -05:00
tty: warn on deprecated serial flags
2014-11-06 15:01:03 -08:00
net: Make enabling of zero UDP6 csums more restrictive
2014-05-23 16:28:53 -04:00
HID: uhid: report to user-space whether reports are numbered
2014-08-25 03:28:08 -05:00
Input: uinput - fix ioctl nr overflow for UI_GET_SYSNAME/VERSION
2015-01-11 16:27:25 -08:00
diag: warn about missing first netlink attribute
2013-11-28 18:16:43 -05:00
USB: usbfs: allow URBs to be reaped after disconnection
2015-01-31 09:05:06 -08:00
usbip: move usbip kernel code out of staging
2014-08-25 10:40:06 -07:00
[media] v4l: Add V4L2_SEL_TGT_NATIVE_SIZE selection target
2014-12-04 12:37:01 -02:00
[media] adv7180: Add fast switch support
2015-02-02 11:51:38 -02:00
Revert "[media] v4l2-dv-timings: fix a sparse warning"
2014-10-24 08:58:09 -02:00
[media] v4l2-mediabus.h: use two __u16 instead of two __u32
2014-12-16 23:21:36 -02:00
[media] Make use of the new media_bus_format definitions
2014-11-14 17:51:18 -02:00
vfio/iommu_type1: add new VFIO_TYPE1_NESTING_IOMMU IOMMU type
2014-09-29 10:06:19 -06:00
tcm_vhost: header split up
2013-05-02 13:40:15 +03:00
[media] v4l: Add packed Bayer raw10 pixel formats
2014-12-23 10:57:09 -02:00
virtio_balloon: free some memory from balloon on OOM
2014-11-11 17:09:58 +10:30
virtio_blk: v1.0 support
2014-12-09 12:05:26 +02:00
virtio: make VIRTIO_F_VERSION_1 a transport bit
2014-12-09 12:06:32 +02:00
virtio_console: virtio 1.0 support
2014-12-09 12:06:32 +02:00
caif_virtio: Introduce caif over virtio
2013-03-20 14:06:06 +10:30
virtio_net: v1.0 endianness
2014-12-09 12:05:26 +02:00
virtio_pci: add VIRTIO_PCI_NO_LEGACY
2014-12-14 15:10:31 +02:00
virtio_ring: document alignment requirements
2014-12-29 10:54:54 +02:00
virtio_scsi: export to userspace
2014-12-09 12:06:31 +02:00
virtio: memory access APIs
2014-12-09 12:05:24 +02:00
VSOCK: Split vm_sockets.h into kernel/uapi
2013-03-08 12:24:48 -05:00
[media] v4l: vsp1: Add LUT support
2013-12-11 09:25:20 -02:00
vt: Remove vt_get_kmsg_redirect() from uapi header
2014-11-05 20:18:30 -08:00
wil6210: atomic I/O for the card memory
2014-10-02 14:23:14 -04:00
xattr: fix check for simultaneous glibc header inclusion
2014-08-29 16:28:16 -07:00
xfrm: configure policy hash table thresholds by netlink
2014-09-02 13:37:56 +02:00
zorro/UAPI: Use proper types (endianness/size) in <linux/zorro.h>
2013-11-26 11:09:09 +01:00
zorro/UAPI: Disintegrate include/linux/zorro*.h
2013-11-26 11:09:08 +01:00
e2e9b6541d