MIME-Version: 1.0
References: <20211123205607.452497-1-zenczykowski@gmail.com> <CANP3RGdZq6x0NB2wKn5YG2Va=j0YHKd5DcM7_dyaKWhdyUrzOw@mail.gmail.com>
In-Reply-To: <CANP3RGdZq6x0NB2wKn5YG2Va=j0YHKd5DcM7_dyaKWhdyUrzOw@mail.gmail.com>
From:   Song Liu <song@kernel.org>
Date:   Fri, 26 Nov 2021 18:13:57 -0800
Message-ID: <CAPhsuW6h4cvFiRwT9h-0z1xTr_HeWcXMTgnd0FERSmTTjbZOUA@mail.gmail.com>
Subject: Re: [PATCH bpf-next] bpf: allow readonly direct path access for skfilter
To:     =?UTF-8?Q?Maciej_=C5=BBenczykowski?= <maze@google.com>
Cc:     Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Linux Network Development Mailing List 
        <netdev@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        BPF Mailing List <bpf@vger.kernel.org>,
        "David S . Miller" <davem@davemloft.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Tue, Nov 23, 2021 at 3:02 PM Maciej =C5=BBenczykowski <maze@google.com> =
wrote:
>
> Note: this is more of an RFC... question in patch format... is this
> even a good idea?
>
> On Tue, Nov 23, 2021 at 12:56 PM Maciej =C5=BBenczykowski
> <zenczykowski@gmail.com> wrote:
> >
> > From: Maciej =C5=BBenczykowski <maze@google.com>
> >
> > skfilter bpf programs can read the packet directly via llvm.bpf.load.by=
te/
> > /half/word which are 8/16/32-bit primitive bpf instructions and thus
> > behave basically as well as DPA reads.  But there is no 64-bit equivale=
nt,
> > due to the support for the equivalent 64-bit bpf opcode never having be=
en
> > added (unclear why, there was a patch posted).
> > DPA uses a slightly different mechanism, so doesn't suffer this limitat=
ion.
> >
> > Using 64-bit reads, 128-bit ipv6 address comparisons can be done in jus=
t
> > 2 steps, instead of the 4 steps needed with llvm.bpf.word.
> >
> > This should hopefully allow simpler (less instructions, and possibly le=
ss
> > logic and maybe even less jumps) programs.  Less jumps may also mean va=
stly
> > faster bpf verifier times (it can be exponential in the number of jumps=
...).
> >
> > This can be particularly important when trying to do something like sca=
n
> > a netlink message for a pattern (2000 iteration loop) to decide whether
> > a message should be dropped, or delivered to userspace (thus waking it =
up).
> >
> > I'm requiring CAP_NET_ADMIN because I'm not sure of the security
> > implications...

I don't know BPF_PROG_TYPE_SOCKET_FILTER very well, but the patch
seems reasonable to me. It will be great if we can show the performance
impact with a benchmark or a selftests.

Thanks,
Song