lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 12 May 2020 19:46:03 -0600 From: David Ahern <dsahern@...nel.org> To: netdev@...r.kernel.org Cc: davem@...emloft.net, kuba@...nel.org, prashantbhole.linux@...il.com, brouer@...hat.com, toke@...hat.com, daniel@...earbox.net, john.fastabend@...il.com, ast@...nel.org, kafai@...com, songliubraving@...com, yhs@...com, andriin@...com, dsahern@...il.com, David Ahern <dahern@...italocean.com> Subject: [PATCH v5 bpf-next 07/11] net: Support xdp in the Tx path for xdp_frames From: David Ahern <dahern@...italocean.com> Add support to run Tx path program on xdp_frames by adding a hook to bq_xmit_all before xdp_frames are passed to ndo_xdp_xmit for the device. If an xdp_frame is dropped by the program, it is removed from the xdp_frames array with subsequent entries moved up. Signed-off-by: David Ahern <dahern@...italocean.com> --- include/linux/netdevice.h | 2 ++ kernel/bpf/devmap.c | 19 +++++++--- net/core/dev.c | 74 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 90 insertions(+), 5 deletions(-) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 651baeb36729..042190df23d5 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -3717,6 +3717,8 @@ static inline void dev_consume_skb_any(struct sk_buff *skb) void generic_xdp_tx(struct sk_buff *skb, struct bpf_prog *xdp_prog); int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff *skb); +unsigned int do_xdp_egress(struct net_device *dev, struct xdp_frame **frames, + unsigned int count); int netif_rx(struct sk_buff *skb); int netif_rx_ni(struct sk_buff *skb); int netif_receive_skb(struct sk_buff *skb); diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c index a51d9fb7a359..513dec5f67b9 100644 --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -321,24 +321,33 @@ static int bq_xmit_all(struct xdp_dev_bulk_queue *bq, u32 flags) { struct net_device *dev = bq->dev; int sent = 0, drops = 0, err = 0; + unsigned int count = bq->count; int i; - if (unlikely(!bq->count)) + if (unlikely(!count)) return 0; - for (i = 0; i < bq->count; i++) { + for (i = 0; i < count; i++) { struct xdp_frame *xdpf = bq->q[i]; prefetch(xdpf); } - sent = dev->netdev_ops->ndo_xdp_xmit(dev, bq->count, bq->q, flags); + if (static_branch_unlikely(&xdp_egress_needed_key)) { + count = do_xdp_egress(dev, bq->q, count); + drops += bq->count - count; + /* all frames consumed by the xdp program? */ + if (!count) + goto out; + } + + sent = dev->netdev_ops->ndo_xdp_xmit(dev, count, bq->q, flags); if (sent < 0) { err = sent; sent = 0; goto error; } - drops = bq->count - sent; + drops += count - sent; out: bq->count = 0; @@ -350,7 +359,7 @@ static int bq_xmit_all(struct xdp_dev_bulk_queue *bq, u32 flags) /* If ndo_xdp_xmit fails with an errno, no frames have been * xmit'ed and it's our responsibility to them free all. */ - for (i = 0; i < bq->count; i++) { + for (i = 0; i < count; i++) { struct xdp_frame *xdpf = bq->q[i]; xdp_return_frame_rx_napi(xdpf); diff --git a/net/core/dev.c b/net/core/dev.c index 97954f835ceb..e6a737b84768 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -4673,6 +4673,80 @@ int do_xdp_generic(struct bpf_prog *xdp_prog, struct sk_buff *skb) } EXPORT_SYMBOL_GPL(do_xdp_generic); +static u32 __xdp_egress_frame(struct net_device *dev, + struct bpf_prog *xdp_prog, + struct xdp_frame *xdp_frame, + struct xdp_txq_info *txq) +{ + struct xdp_buff xdp; + u32 act; + + xdp.data_hard_start = xdp_frame->data - xdp_frame->headroom + - sizeof(*xdp_frame); + xdp.data = xdp_frame->data; + xdp.data_end = xdp.data + xdp_frame->len; + xdp.data_meta = xdp.data - xdp_frame->metasize; + xdp.txq = txq; + + act = bpf_prog_run_xdp(xdp_prog, &xdp); + switch (act) { + case XDP_DROP: + fallthrough; + case XDP_PASS: + break; + case XDP_TX: + fallthrough; + case XDP_REDIRECT: + fallthrough; + default: + bpf_warn_invalid_xdp_action(act); + fallthrough; + case XDP_ABORTED: + trace_xdp_exception(dev, xdp_prog, act); + act = XDP_DROP; + break; + } + + /* if not dropping frame, readjust pointers in case + * program made changes to the buffer + */ + if (act != XDP_DROP) { + if (unlikely(!update_xdp_frame(&xdp, xdp_frame))) + return XDP_DROP; + } + + return act; +} + +unsigned int do_xdp_egress(struct net_device *dev, struct xdp_frame **frames, + unsigned int count) +{ + struct bpf_prog *xdp_prog; + + xdp_prog = rcu_dereference(dev->xdp_egress_prog); + if (xdp_prog) { + struct xdp_txq_info txq = { .dev = dev }; + unsigned int i, j; + u32 act; + + for (i = 0, j = 0; i < count; i++) { + struct xdp_frame *frame = frames[i]; + + act = __xdp_egress_frame(dev, xdp_prog, frame, &txq); + if (act == XDP_DROP) { + xdp_return_frame_rx_napi(frame); + continue; + } + + frames[j] = frame; + j++; + } + count = j; + } + + return count; +} + static int netif_rx_internal(struct sk_buff *skb) { int ret; -- 2.21.1 (Apple Git-122.3)
Powered by blists - more mailing lists