From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3F41C282CB for ; Tue, 5 Feb 2019 17:36:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 675C6217D6 for ; Tue, 5 Feb 2019 17:36:45 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="u4oGJXYC" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729285AbfBERgo (ORCPT ); Tue, 5 Feb 2019 12:36:44 -0500 Received: from mail-it1-f202.google.com ([209.85.166.202]:36476 "EHLO mail-it1-f202.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726550AbfBERgn (ORCPT ); Tue, 5 Feb 2019 12:36:43 -0500 Received: by mail-it1-f202.google.com with SMTP id w15so6914403ita.1 for ; Tue, 05 Feb 2019 09:36:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=h4uy8v2JzjOwxNQ9i3pPZ2NNAgb/rS/jd0o4p0gor7Y=; b=u4oGJXYCT0O6GxM/5BiLIpRByYY6lfkU3la2CeYVfKqFgk2d8z5RGTd1XKDA1lEfBI LpCnJ02lvlyFO9E5W5UQpc+T1/8KYkiaa4p7NpgeR+CFe/wG+6tY3gx3X1jFc2k2nddr DZPlyqVrvf11D1yUguWKB0b11gZ0ae0CWlOe/v5Cwnr8VgcSd4dDCyYEUhYfL8JsNQ1M 1U7CoO1x8fXCCM63OlsKWjjlLz7EA2cXgmTB545uze6wSjNTDem85Ufgf2Qg3x4x2zv/ 7++a7AEbFjvPWNGHP3HhmqYY1oOKWvkYaPGWjuaXgFOlFTR2gTvn2lPx0o23SPzNQcLT JtqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=h4uy8v2JzjOwxNQ9i3pPZ2NNAgb/rS/jd0o4p0gor7Y=; b=tFegcYljjIkK3nL+AovaMSgmye0mCHQ4/ViVnJMwOVDNzjPdynqh3IM56KtU0vfRaQ Z4SsZ0itOv1BEccvAxhI0yaSdJBmimym+AZBb8pH2d3nJ4YXgXvzKOPrdbdefmsdH2AL KTd7+mj0l1w2onUGDxpVaVhCjzdrx+WQnpcGoDv9CLigxPBZ5NFCw3J+jGzKgZtGS2lS nlVnZ0ytqxdyzaCbJ+3aoLmMvymqw71RtSyaFrQEDtKzHJP9QepAzobyul52BqJ8itTT cDLoUH4VeLd57xqRPleEekf24vpKJIhxyfWr9lqOXnCIR78FCLYu1GLpkq6qvFx4xVup 5qzw== X-Gm-Message-State: AHQUAubVfuD3i9DDyAbtQ7SxlbY93XpEtMcBnQaZKaOqAl2716+H/X6B Rz+g52c0TxAxhoAEZnzS5tN70/91hO37jUZCNLDmQF9c7H5dDvPZgMF4IrYLOihQOOW63fgtG2V I6HNZSszSMd3G4F6n0NQ9CfsxHAAJY1DQ8XWUuyB/Ioy9E6dPr5Lyjg== X-Google-Smtp-Source: AHgI3IbeGz6b1wqi0Qs+zm89zrIpIfe0FOMRaKzCvi5X2cbpjkUS4SwpbXOGNwM7Lfx/Cm+MD/9yIOo= X-Received: by 2002:a24:5948:: with SMTP id p69mr3634838itb.21.1549388202422; Tue, 05 Feb 2019 09:36:42 -0800 (PST) Date: Tue, 5 Feb 2019 09:36:26 -0800 In-Reply-To: <20190205173629.160717-1-sdf@google.com> Message-Id: <20190205173629.160717-5-sdf@google.com> Mime-Version: 1.0 References: <20190205173629.160717-1-sdf@google.com> X-Mailer: git-send-email 2.20.1.611.gfbb209baf1-goog Subject: [RFC bpf-next 4/7] net: flow_dissector: handle no-skb use case From: Stanislav Fomichev To: netdev@vger.kernel.org Cc: davem@davemloft.net, ast@kernel.org, daniel@iogearbox.net, simon.horman@netronome.com, willemb@google.com, Stanislav Fomichev Content-Type: text/plain; charset="UTF-8" Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When flow_dissector is called without skb (with only data and hlen), construct on-stack skb (which has a linear chunk of data passed to the flow dissector). This should let us handle eth_get_headlen case where only data is provided and we don't want to (yet) allocate an skb. Since this on-stack skb doesn't allocate its own data, we can't add shinfo and need to be careful to avoid any code paths that use it. Flow dissector BPF programs can only call bpf_skb_load_bytes helper, which doesn't touch shinfo in our case (skb->len is the length of the linear header so it exits early). Signed-off-by: Stanislav Fomichev --- include/linux/skbuff.h | 5 +++ net/core/flow_dissector.c | 95 +++++++++++++++++++++++++++++---------- 2 files changed, 76 insertions(+), 24 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index aa9a9983de80..5f1c085cb34c 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1227,6 +1227,11 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog, const struct sk_buff *skb, struct flow_dissector *flow_dissector, struct bpf_flow_keys *flow_keys); +bool __flow_bpf_dissect(struct bpf_prog *prog, + void *data, __be16 proto, + int nhoff, int hlen, + struct flow_dissector *flow_dissector, + struct bpf_flow_keys *flow_keys); bool __skb_flow_dissect(struct net *net, const struct sk_buff *skb, struct flow_dissector *flow_dissector, diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c index dddcc37c0462..87167b74f59a 100644 --- a/net/core/flow_dissector.c +++ b/net/core/flow_dissector.c @@ -683,6 +683,28 @@ static void __skb_flow_bpf_to_target(const struct bpf_flow_keys *flow_keys, } } +static inline void init_flow_keys(struct bpf_flow_keys *flow_keys, + struct sk_buff *skb, int nhoff) +{ + struct bpf_skb_data_end *cb = (struct bpf_skb_data_end *)skb->cb; + + memset(cb, 0, sizeof(*cb)); + memset(flow_keys, 0, sizeof(*flow_keys)); + + flow_keys->nhoff = nhoff; + flow_keys->thoff = nhoff; + + cb->qdisc_cb.flow_keys = flow_keys; +} + +static inline void clamp_flow_keys(struct bpf_flow_keys *flow_keys, + int hlen) +{ + flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff, 0, hlen); + flow_keys->thoff = clamp_t(u16, flow_keys->thoff, + flow_keys->nhoff, hlen); +} + bool __skb_flow_bpf_dissect(struct bpf_prog *prog, const struct sk_buff *skb, struct flow_dissector *flow_dissector, @@ -702,13 +724,9 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog, /* Save Control Block */ memcpy(&cb_saved, cb, sizeof(cb_saved)); - memset(cb, 0, sizeof(*cb)); /* Pass parameters to the BPF program */ - memset(flow_keys, 0, sizeof(*flow_keys)); - cb->qdisc_cb.flow_keys = flow_keys; - flow_keys->nhoff = skb_network_offset(skb); - flow_keys->thoff = flow_keys->nhoff; + init_flow_keys(flow_keys, skb, skb_network_offset(skb)); bpf_compute_data_pointers((struct sk_buff *)skb); result = BPF_PROG_RUN(prog, skb); @@ -716,9 +734,34 @@ bool __skb_flow_bpf_dissect(struct bpf_prog *prog, /* Restore state */ memcpy(cb, &cb_saved, sizeof(cb_saved)); - flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff, 0, skb->len); - flow_keys->thoff = clamp_t(u16, flow_keys->thoff, - flow_keys->nhoff, skb->len); + clamp_flow_keys(flow_keys, skb->len); + + return result == BPF_OK; +} + +bool __flow_bpf_dissect(struct bpf_prog *prog, + void *data, __be16 proto, + int nhoff, int hlen, + struct flow_dissector *flow_dissector, + struct bpf_flow_keys *flow_keys) +{ + struct bpf_skb_data_end *cb; + struct sk_buff skb; + u32 result; + + __init_skb(&skb, data, hlen); + skb_put(&skb, hlen); + skb.protocol = proto; + + init_flow_keys(flow_keys, &skb, nhoff); + + cb = (struct bpf_skb_data_end *)skb.cb; + cb->data_meta = skb.data; + cb->data_end = skb.data + skb_headlen(&skb); + + result = BPF_PROG_RUN(prog, &skb); + + clamp_flow_keys(flow_keys, hlen); return result == BPF_OK; } @@ -754,8 +797,10 @@ bool __skb_flow_dissect(struct net *net, struct flow_dissector_key_icmp *key_icmp; struct flow_dissector_key_tags *key_tags; struct flow_dissector_key_vlan *key_vlan; - enum flow_dissect_ret fdret; enum flow_dissector_key_id dissector_vlan = FLOW_DISSECTOR_KEY_MAX; + struct bpf_prog *attached = NULL; + struct bpf_flow_keys flow_keys; + enum flow_dissect_ret fdret; int num_hdrs = 0; u8 ip_proto = 0; bool ret; @@ -795,30 +840,32 @@ bool __skb_flow_dissect(struct net *net, FLOW_DISSECTOR_KEY_BASIC, target_container); - if (skb) { - struct bpf_flow_keys flow_keys; - struct bpf_prog *attached = NULL; + rcu_read_lock(); - rcu_read_lock(); + if (!net && skb) + net = skb_net(skb); + if (net) + attached = rcu_dereference(net->flow_dissector_prog); - if (!net && skb) - net = skb_net(skb); - if (net) - attached = rcu_dereference(net->flow_dissector_prog); - WARN_ON_ONCE(!net); + WARN_ON_ONCE(!net); - if (attached) { + if (attached) { + if (skb) ret = __skb_flow_bpf_dissect(attached, skb, flow_dissector, &flow_keys); - __skb_flow_bpf_to_target(&flow_keys, flow_dissector, - target_container); - rcu_read_unlock(); - return ret; - } + else + ret = __flow_bpf_dissect(attached, data, proto, nhoff, + hlen, flow_dissector, + &flow_keys); + __skb_flow_bpf_to_target(&flow_keys, flow_dissector, + target_container); rcu_read_unlock(); + return ret; } + rcu_read_unlock(); + if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) { struct ethhdr *eth = eth_hdr(skb); -- 2.20.1.611.gfbb209baf1-goog