netdev - RE: [RFC PATCH v2 net-next 0/2] BPF and OVS extensions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 17 Sep 2013 09:40:20 +0100
From:	"David Laight" <David.Laight@...LAB.COM>
To:	"Alexei Starovoitov" <ast@...mgrid.com>,
	"David S. Miller" <davem@...emloft.net>, <netdev@...r.kernel.org>,
	"Eric Dumazet" <edumazet@...gle.com>,
	"Alexey Kuznetsov" <kuznet@....inr.ac.ru>,
	"James Morris" <jmorris@...ei.org>,
	"Hideaki YOSHIFUJI" <yoshfuji@...ux-ipv6.org>,
	"Patrick McHardy" <kaber@...sh.net>,
	"Thomas Gleixner" <tglx@...utronix.de>,
	"Ingo Molnar" <mingo@...hat.com>, "H. Peter Anvin" <hpa@...or.com>,
	"Daniel Borkmann" <dborkman@...hat.com>,
	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
	"Xi Wang" <xi.wang@...il.com>,
	"David Howells" <dhowells@...hat.com>,
	"Cong Wang" <xiyou.wangcong@...il.com>,
	"Jesse Gross" <jesse@...ira.com>,
	"Pravin B Shelar" <pshelar@...ira.com>,
	"Ben Pfaff" <blp@...ira.com>, "Thomas Graf" <tgraf@...g.ch>,
	<dev@...nvswitch.org>
Subject: RE: [RFC PATCH v2 net-next 0/2] BPF and OVS extensions

> Patch 1/2: generic BPF extension
> Original A and X 32-bit BPF registers are replaced with ten 64-bit registers.
> bpf opcode encoding kept the same. load/store were generalized to access stack,
> bpf_tables and bpf_context.
> BPF program interfaces to outside world via tables that it can read and write,
> and via bpf_context which is in/out blob of data.
> Other kernel components can provide callbacks to tailor BPF to specific needs.

As has been recently pointed out on some of the NetBSD lists
one of the points about BPF is that the filters are deterministic
and easily proven to both terminate and have no unwanted side effects.

The functionality you are proposing breaks both of these assumptions.

It is understood that parsing IPv6 headers is currently impossible
(needs loops of some form) but a specific helper instruction is
probably a better solution.

What you seem to be proposing is a completely different beast,
so you should call it something else - it isn't BPF.

Whether the Linux kernel needs a (another?) byte code interpreter
is a separate issue.

	David



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html