| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20200123014210.38412-2-dsahern@kernel.org>
Date: Wed, 22 Jan 2020 18:41:59 -0700
From: David Ahern <dsahern@...nel.org>
To: netdev@...r.kernel.org
Cc: prashantbhole.linux@...il.com, jasowang@...hat.com,
davem@...emloft.net, jakub.kicinski@...ronome.com,
jbrouer@...hat.com, toke@...hat.com, mst@...hat.com,
toshiaki.makita1@...il.com, daniel@...earbox.net,
john.fastabend@...il.com, ast@...nel.org, kafai@...com,
songliubraving@...com, yhs@...com, andriin@...com,
dsahern@...il.com, David Ahern <dahern@...italocean.com>
Subject: [PATCH bpf-next 01/12] net: Add new XDP setup and query commands
From: David Ahern <dahern@...italocean.com>
Add new netdev commands, XDP_SETUP_PROG_EGRESS and
XDP_QUERY_PROG_EGRESS.
Update dev_change_xdp_fd and dev_xdp_install to take an egress argument.
If egress bool is set, then use XDP_SETUP_PROG_EGRESS in dev_xdp_install
and XDP_QUERY_PROG_EGRESS in dev_change_xdp_fd.
Update dev_xdp_uninstall to query for XDP_QUERY_PROG_EGRESS and if a
program is installed call dev_xdp_install with the egress argument set
to true.
This enables existing infrastructure to be used for XDP programs in
the egress path.
Signed-off-by: David Ahern <dahern@...italocean.com>
Co-developed-by: Prashant Bhole <prashantbhole.linux@...il.com>
Signed-off-by: Prashant Bhole <prashantbhole.linux@...il.com>
---
include/linux/netdevice.h | 4 +++-
net/core/dev.c | 30 +++++++++++++++++++++---------
net/core/rtnetlink.c | 2 +-
3 files changed, 25 insertions(+), 11 deletions(-)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5ec3537fbdb1..e9cc326086f4 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -865,8 +865,10 @@ enum bpf_netdev_command {
*/
XDP_SETUP_PROG,
XDP_SETUP_PROG_HW,
+ XDP_SETUP_PROG_EGRESS,
XDP_QUERY_PROG,
XDP_QUERY_PROG_HW,
+ XDP_QUERY_PROG_EGRESS,
/* BPF program for offload callbacks, invoked at program load time. */
BPF_OFFLOAD_MAP_ALLOC,
BPF_OFFLOAD_MAP_FREE,
@@ -3729,7 +3731,7 @@ struct sk_buff *dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
typedef int (*bpf_op_t)(struct net_device *dev, struct netdev_bpf *bpf);
int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
- int fd, u32 flags);
+ int fd, u32 flags, bool egress);
u32 __dev_xdp_query(struct net_device *dev, bpf_op_t xdp_op,
enum bpf_netdev_command cmd);
int xdp_umem_query(struct net_device *dev, u16 queue_id);
diff --git a/net/core/dev.c b/net/core/dev.c
index e7802a41ae7f..04cbcc930bc2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8538,7 +8538,7 @@ u32 __dev_xdp_query(struct net_device *dev, bpf_op_t bpf_op,
static int dev_xdp_install(struct net_device *dev, bpf_op_t bpf_op,
struct netlink_ext_ack *extack, u32 flags,
- struct bpf_prog *prog)
+ struct bpf_prog *prog, bool egress)
{
bool non_hw = !(flags & XDP_FLAGS_HW_MODE);
struct bpf_prog *prev_prog = NULL;
@@ -8556,7 +8556,7 @@ static int dev_xdp_install(struct net_device *dev, bpf_op_t bpf_op,
if (flags & XDP_FLAGS_HW_MODE)
xdp.command = XDP_SETUP_PROG_HW;
else
- xdp.command = XDP_SETUP_PROG;
+ xdp.command = egress ? XDP_SETUP_PROG_EGRESS : XDP_SETUP_PROG;
xdp.extack = extack;
xdp.flags = flags;
xdp.prog = prog;
@@ -8577,7 +8577,8 @@ static void dev_xdp_uninstall(struct net_device *dev)
bpf_op_t ndo_bpf;
/* Remove generic XDP */
- WARN_ON(dev_xdp_install(dev, generic_xdp_install, NULL, 0, NULL));
+ WARN_ON(dev_xdp_install(dev, generic_xdp_install, NULL, 0, NULL,
+ false));
/* Remove from the driver */
ndo_bpf = dev->netdev_ops->ndo_bpf;
@@ -8589,14 +8590,20 @@ static void dev_xdp_uninstall(struct net_device *dev)
WARN_ON(ndo_bpf(dev, &xdp));
if (xdp.prog_id)
WARN_ON(dev_xdp_install(dev, ndo_bpf, NULL, xdp.prog_flags,
- NULL));
+ NULL, false));
/* Remove HW offload */
memset(&xdp, 0, sizeof(xdp));
xdp.command = XDP_QUERY_PROG_HW;
if (!ndo_bpf(dev, &xdp) && xdp.prog_id)
WARN_ON(dev_xdp_install(dev, ndo_bpf, NULL, xdp.prog_flags,
- NULL));
+ NULL, false));
+ /* Remove egress program */
+ memset(&xdp, 0, sizeof(xdp));
+ xdp.command = XDP_QUERY_PROG_EGRESS;
+ if (!ndo_bpf(dev, &xdp) && xdp.prog_id)
+ WARN_ON(dev_xdp_install(dev, ndo_bpf, NULL, xdp.prog_flags,
+ NULL, true));
}
/**
@@ -8609,7 +8616,7 @@ static void dev_xdp_uninstall(struct net_device *dev)
* Set or clear a bpf program for a device
*/
int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
- int fd, u32 flags)
+ int fd, u32 flags, bool egress)
{
const struct net_device_ops *ops = dev->netdev_ops;
enum bpf_netdev_command query;
@@ -8621,7 +8628,11 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
ASSERT_RTNL();
offload = flags & XDP_FLAGS_HW_MODE;
- query = offload ? XDP_QUERY_PROG_HW : XDP_QUERY_PROG;
+ if (egress)
+ query = XDP_QUERY_PROG_EGRESS;
+ else
+ query = offload ? XDP_QUERY_PROG_HW : XDP_QUERY_PROG;
+
bpf_op = bpf_chk = ops->ndo_bpf;
if (!bpf_op && (flags & (XDP_FLAGS_DRV_MODE | XDP_FLAGS_HW_MODE))) {
@@ -8636,7 +8647,8 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
if (fd >= 0) {
u32 prog_id;
- if (!offload && __dev_xdp_query(dev, bpf_chk, XDP_QUERY_PROG)) {
+ if (!offload && !egress &&
+ __dev_xdp_query(dev, bpf_chk, XDP_QUERY_PROG)) {
NL_SET_ERR_MSG(extack, "native and generic XDP can't be active at the same time");
return -EEXIST;
}
@@ -8668,7 +8680,7 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
return 0;
}
- err = dev_xdp_install(dev, bpf_op, extack, flags, prog);
+ err = dev_xdp_install(dev, bpf_op, extack, flags, prog, egress);
if (err < 0 && prog)
bpf_prog_put(prog);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 20bc406f3871..ed0c069ef187 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2801,7 +2801,7 @@ static int do_setlink(const struct sk_buff *skb,
if (xdp[IFLA_XDP_FD]) {
err = dev_change_xdp_fd(dev, extack,
nla_get_s32(xdp[IFLA_XDP_FD]),
- xdp_flags);
+ xdp_flags, false);
if (err)
goto errout;
status |= DO_SETLINK_NOTIFY;
--
2.21.1 (Apple Git-122.3)
Powered by blists - more mailing lists