From: Daniel Borkmann <dborkman@redhat.com> To: Alexei Starovoitov <ast@plumgrid.com> Cc: "David S. Miller" <davem@davemloft.net>, Ingo Molnar <mingo@kernel.org>, Linus Torvalds <torvalds@linux-foundation.org>, Steven Rostedt <rostedt@goodmis.org>, Chema Gonzalez <chema@google.com>, Eric Dumazet <edumazet@google.com>, Peter Zijlstra <a.p.zijlstra@chello.nl>, Arnaldo Carvalho de Melo <acme@infradead.org>, Jiri Olsa <jolsa@redhat.com>, Thomas Gleixner <tglx@linutronix.de>, "H. Peter Anvin" <hpa@zytor.com>, Andrew Morton <akpm@linux-foundation.org>, Kees Cook <keescook@chromium.org>, linux-api@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH RFC net-next 08/14] bpf: add eBPF verifier Date: Tue, 01 Jul 2014 10:05:04 +0200 [thread overview] Message-ID: <53B26BB0.90209@redhat.com> (raw) In-Reply-To: <1403913966-4927-9-git-send-email-ast@plumgrid.com> On 06/28/2014 02:06 AM, Alexei Starovoitov wrote: > Safety of eBPF programs is statically determined by the verifier, which detects: > - loops > - out of range jumps > - unreachable instructions > - invalid instructions > - uninitialized register access > - uninitialized stack access > - misaligned stack access > - out of range stack access > - invalid calling convention ... > More details in Documentation/networking/filter.txt > > Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> > --- ... > kernel/bpf/verifier.c | 1431 +++++++++++++++++++++++++++++++++++ Looking at classic BPF verifier which checks safety of BPF user space programs, it's roughly 200 loc. :-/ > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > new file mode 100644 ... > +#define _(OP) ({ int ret = OP; if (ret < 0) return ret; }) ... > + _(get_map_info(env, map_id, &map)); ... > + _(size = bpf_size_to_bytes(bpf_size)); Nit: such macros should be removed, please.
WARNING: multiple messages have this Message-ID (diff)
From: Daniel Borkmann <dborkman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> To: Alexei Starovoitov <ast-uqk4Ao+rVK5Wk0Htik3J/w@public.gmane.org> Cc: "David S. Miller" <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>, Ingo Molnar <mingo-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>, Linus Torvalds <torvalds-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>, Steven Rostedt <rostedt-nx8X9YLhiw1AfugRpC6u6w@public.gmane.org>, Chema Gonzalez <chema-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>, Eric Dumazet <edumazet-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>, Peter Zijlstra <a.p.zijlstra-/NLkJaSkS4VmR6Xm/wNWPw@public.gmane.org>, Arnaldo Carvalho de Melo <acme-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org>, Jiri Olsa <jolsa-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>, Thomas Gleixner <tglx-hfZtesqFncYOwBW4kG4KsQ@public.gmane.org>, "H. Peter Anvin" <hpa-YMNOUZJC4hwAvxtiuMwx3w@public.gmane.org>, Andrew Morton <akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>, Kees Cook <keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Subject: Re: [PATCH RFC net-next 08/14] bpf: add eBPF verifier Date: Tue, 01 Jul 2014 10:05:04 +0200 [thread overview] Message-ID: <53B26BB0.90209@redhat.com> (raw) In-Reply-To: <1403913966-4927-9-git-send-email-ast-uqk4Ao+rVK5Wk0Htik3J/w@public.gmane.org> On 06/28/2014 02:06 AM, Alexei Starovoitov wrote: > Safety of eBPF programs is statically determined by the verifier, which detects: > - loops > - out of range jumps > - unreachable instructions > - invalid instructions > - uninitialized register access > - uninitialized stack access > - misaligned stack access > - out of range stack access > - invalid calling convention ... > More details in Documentation/networking/filter.txt > > Signed-off-by: Alexei Starovoitov <ast-uqk4Ao+rVK5Wk0Htik3J/w@public.gmane.org> > --- ... > kernel/bpf/verifier.c | 1431 +++++++++++++++++++++++++++++++++++ Looking at classic BPF verifier which checks safety of BPF user space programs, it's roughly 200 loc. :-/ > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > new file mode 100644 ... > +#define _(OP) ({ int ret = OP; if (ret < 0) return ret; }) ... > + _(get_map_info(env, map_id, &map)); ... > + _(size = bpf_size_to_bytes(bpf_size)); Nit: such macros should be removed, please.
next prev parent reply other threads:[~2014-07-01 8:05 UTC|newest] Thread overview: 108+ messages / expand[flat|nested] mbox.gz Atom feed top 2014-06-28 0:05 [PATCH RFC net-next 00/14] BPF syscall, maps, verifier, samples Alexei Starovoitov 2014-06-28 0:05 ` [PATCH RFC net-next 01/14] net: filter: split filter.c into two files Alexei Starovoitov 2014-07-02 4:23 ` Namhyung Kim 2014-07-02 4:23 ` Namhyung Kim 2014-07-02 5:35 ` Alexei Starovoitov 2014-07-02 5:35 ` Alexei Starovoitov 2014-06-28 0:05 ` [PATCH RFC net-next 02/14] net: filter: split filter.h and expose eBPF to user space Alexei Starovoitov 2014-06-28 0:05 ` [PATCH RFC net-next 03/14] bpf: introduce syscall(BPF, ...) and BPF maps Alexei Starovoitov 2014-06-28 0:16 ` Andy Lutomirski 2014-06-28 5:55 ` Alexei Starovoitov 2014-06-28 6:25 ` Andy Lutomirski 2014-06-28 6:25 ` Andy Lutomirski 2014-06-28 6:43 ` Alexei Starovoitov 2014-06-28 6:43 ` Alexei Starovoitov 2014-06-28 15:34 ` Andy Lutomirski 2014-06-28 15:34 ` Andy Lutomirski 2014-06-28 20:49 ` Alexei Starovoitov 2014-06-28 20:49 ` Alexei Starovoitov 2014-06-29 1:52 ` Andy Lutomirski 2014-06-29 1:52 ` Andy Lutomirski 2014-06-29 6:36 ` Alexei Starovoitov 2014-06-29 6:36 ` Alexei Starovoitov 2014-06-30 22:09 ` Andy Lutomirski 2014-06-30 22:09 ` Andy Lutomirski 2014-07-01 5:47 ` Alexei Starovoitov 2014-07-01 15:11 ` Andy Lutomirski 2014-07-01 15:11 ` Andy Lutomirski 2014-07-02 5:33 ` Alexei Starovoitov 2014-07-02 5:33 ` Alexei Starovoitov 2014-07-03 1:43 ` Andy Lutomirski 2014-07-03 1:43 ` Andy Lutomirski 2014-07-03 2:29 ` Alexei Starovoitov 2014-07-04 15:17 ` Andy Lutomirski 2014-07-04 15:17 ` Andy Lutomirski 2014-07-05 21:59 ` Alexei Starovoitov 2014-06-28 0:05 ` [PATCH RFC net-next 04/14] bpf: update MAINTAINERS entry Alexei Starovoitov 2014-06-28 0:18 ` Joe Perches 2014-06-28 5:59 ` Alexei Starovoitov 2014-06-28 5:59 ` Alexei Starovoitov 2014-06-28 0:05 ` [PATCH RFC net-next 05/14] bpf: add lookup/update/delete/iterate methods to BPF maps Alexei Starovoitov 2014-06-28 0:05 ` [PATCH RFC net-next 06/14] bpf: add hashtable type of " Alexei Starovoitov 2014-06-28 0:05 ` [PATCH RFC net-next 07/14] bpf: expand BPF syscall with program load/unload Alexei Starovoitov 2014-06-28 0:19 ` Andy Lutomirski 2014-06-28 0:19 ` Andy Lutomirski 2014-06-28 6:12 ` Alexei Starovoitov 2014-06-28 6:28 ` Andy Lutomirski 2014-06-28 7:26 ` Alexei Starovoitov 2014-06-28 7:26 ` Alexei Starovoitov 2014-06-28 15:21 ` Greg KH 2014-06-28 15:21 ` Greg KH 2014-06-28 15:35 ` Andy Lutomirski 2014-06-30 20:39 ` Alexei Starovoitov 2014-06-30 10:06 ` David Laight 2014-06-30 10:06 ` David Laight 2014-06-28 0:06 ` [PATCH RFC net-next 08/14] bpf: add eBPF verifier Alexei Starovoitov 2014-06-28 16:01 ` Andy Lutomirski 2014-06-28 16:01 ` Andy Lutomirski 2014-06-28 20:25 ` Alexei Starovoitov 2014-06-28 20:25 ` Alexei Starovoitov 2014-06-29 1:58 ` Andy Lutomirski 2014-06-29 6:20 ` Alexei Starovoitov 2014-06-29 6:20 ` Alexei Starovoitov 2014-07-01 8:05 ` Daniel Borkmann [this message] 2014-07-01 8:05 ` Daniel Borkmann 2014-07-01 20:04 ` Alexei Starovoitov 2014-07-01 20:04 ` Alexei Starovoitov 2014-07-02 8:11 ` David Laight 2014-07-02 8:11 ` David Laight 2014-07-02 22:43 ` Alexei Starovoitov 2014-07-02 22:43 ` Alexei Starovoitov 2014-07-02 5:05 ` Namhyung Kim 2014-07-02 5:05 ` Namhyung Kim 2014-07-02 5:57 ` Alexei Starovoitov 2014-07-02 22:22 ` Chema Gonzalez 2014-07-02 23:04 ` Alexei Starovoitov 2014-07-02 23:04 ` Alexei Starovoitov 2014-07-02 23:35 ` Chema Gonzalez 2014-07-03 0:01 ` Alexei Starovoitov 2014-07-03 0:01 ` Alexei Starovoitov 2014-07-03 9:13 ` David Laight 2014-07-03 9:13 ` David Laight 2014-07-03 17:41 ` Alexei Starovoitov 2014-06-28 0:06 ` [PATCH RFC net-next 09/14] bpf: allow eBPF programs to use maps Alexei Starovoitov 2014-06-28 0:06 ` Alexei Starovoitov 2014-06-28 0:06 ` [PATCH RFC net-next 10/14] net: sock: allow eBPF programs to be attached to sockets Alexei Starovoitov 2014-06-28 0:06 ` [PATCH RFC net-next 11/14] tracing: allow eBPF programs to be attached to events Alexei Starovoitov 2014-07-01 8:30 ` Daniel Borkmann 2014-07-01 8:30 ` Daniel Borkmann 2014-07-01 20:06 ` Alexei Starovoitov 2014-07-01 20:06 ` Alexei Starovoitov 2014-07-02 5:32 ` Namhyung Kim 2014-07-02 5:32 ` Namhyung Kim 2014-07-02 6:14 ` Alexei Starovoitov 2014-07-02 6:14 ` Alexei Starovoitov 2014-07-02 6:39 ` Namhyung Kim 2014-07-02 7:29 ` Alexei Starovoitov 2014-06-28 0:06 ` [PATCH RFC net-next 12/14] samples: bpf: add mini eBPF library to manipulate maps and programs Alexei Starovoitov 2014-06-28 0:06 ` [PATCH RFC net-next 13/14] samples: bpf: example of stateful socket filtering Alexei Starovoitov 2014-06-28 0:21 ` Andy Lutomirski 2014-06-28 6:21 ` Alexei Starovoitov 2014-06-28 6:21 ` Alexei Starovoitov 2014-06-28 0:06 ` [PATCH RFC net-next 14/14] samples: bpf: example of tracing filters with eBPF Alexei Starovoitov 2014-06-30 23:09 ` [PATCH RFC net-next 00/14] BPF syscall, maps, verifier, samples Kees Cook 2014-06-30 23:09 ` Kees Cook 2014-07-01 7:18 ` Daniel Borkmann 2014-07-01 7:18 ` Daniel Borkmann 2014-07-02 16:39 ` Kees Cook 2014-07-02 16:39 ` Kees Cook
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=53B26BB0.90209@redhat.com \ --to=dborkman@redhat.com \ --cc=a.p.zijlstra@chello.nl \ --cc=acme@infradead.org \ --cc=akpm@linux-foundation.org \ --cc=ast@plumgrid.com \ --cc=chema@google.com \ --cc=davem@davemloft.net \ --cc=edumazet@google.com \ --cc=hpa@zytor.com \ --cc=jolsa@redhat.com \ --cc=keescook@chromium.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mingo@kernel.org \ --cc=netdev@vger.kernel.org \ --cc=rostedt@goodmis.org \ --cc=tglx@linutronix.de \ --cc=torvalds@linux-foundation.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.