netdev - Re: [PATCH v2] net: filter: Just In Time compiler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4DA71690.2020202@redhat.com>
Date:	Thu, 14 Apr 2011 18:45:20 +0300
From:	Avi Kivity <avi@...hat.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	David Miller <davem@...emloft.net>,
	netdev <netdev@...r.kernel.org>,
	Arnaldo Carvalho de Melo <acme@...radead.org>,
	Ben Hutchings <bhutchings@...arflare.com>,
	Hagen Paul Pfeifer <hagen@...u.net>
Subject: Re: [PATCH v2] net: filter: Just In Time compiler

On 04/14/2011 06:40 PM, Eric Dumazet wrote:
> Le jeudi 14 avril 2011 à 17:40 +0300, Avi Kivity a écrit :
> >  On 04/03/2011 04:56 PM, Eric Dumazet wrote:
> >  >  In order to speedup packet filtering, here is an implementation of a JIT
> >  >  compiler for x86_64
> >  >
> >
> >  Have you considered putting the compiler in userspace?
> >
>
> Hmm, to be honest no.
>
> >  You could have a trusted compile server waiting on a pipe and compiling
> >  programs sent to it by the kernel, sending the results back down.  Use
> >  the interpreter until the compiler returns; if it doesn't, use the
> >  interpreter forever.
>
> I feel it might be too expensive in some cases, and kind of complex
> architecture.

It is, but the kernel-side complexity is lower.  And since we have a 
fallback, overall reliability is improved rather than reduced.

> >
> >  The upside is that you can use established optimizing compilers like
> >  LLVM or GCC, which already support more target architectures.  It may
> >  not matter much for something simple like bpf, but other VMs may be a
> >  lot more complicated.
> >
>
> Not only bpf is very simple, but it needs to access skb fields and other
> parts of the kernel, we would need to instruct userland compiler of all
> these details.

A simple implementation would be to translate the bpf program into a C 
function which receives the same arguments as your bpf runtime, and 
optimize that with gcc.

> We would need to load kind of a module (with dynamic loader)

Well, we have one.

> Of course, making each bpf filter a module of his own has benefit for
> perf profiling.

And stack unwind info, etc.

-- 
error compiling committee.c: too many arguments to function

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html