]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
net: filter: cleanup invocation of internal BPF
authorAlexei Starovoitov <ast@plumgrid.com>
Mon, 19 May 2014 21:56:14 +0000 (14:56 -0700)
committerDavid S. Miller <davem@davemloft.net>
Wed, 21 May 2014 21:07:17 +0000 (17:07 -0400)
commit5fe821a9dee241fa450703ab7015d970ee0cfb8d
tree4ada90ac07b074b55ffc40220d8a14fcee3f305a
parent21ea04fa2d26906a2c8bca40891a238414111f5f
net: filter: cleanup invocation of internal BPF

Kernel API for classic BPF socket filters is:

sk_unattached_filter_create() - validate classic BPF, convert, JIT
SK_RUN_FILTER() - run it
sk_unattached_filter_destroy() - destroy socket filter

Cleanup internal BPF kernel API as following:

sk_filter_select_runtime() - final step of internal BPF creation.
  Try to JIT internal BPF program, if JIT is not available select interpreter
SK_RUN_FILTER() - run it
sk_filter_free() - free internal BPF program

Disallow direct calls to BPF interpreter. Execution of the BPF program should
be done with SK_RUN_FILTER() macro.

Example of internal BPF create, run, destroy:

  struct sk_filter *fp;

  fp = kzalloc(sk_filter_size(prog_len), GFP_KERNEL);
  memcpy(fp->insni, prog, prog_len * sizeof(fp->insni[0]));
  fp->len = prog_len;

  sk_filter_select_runtime(fp);

  SK_RUN_FILTER(fp, ctx);

  sk_filter_free(fp);

Sockets, seccomp, testsuite, tracing are using different ways to populate
sk_filter, so first steps of program creation are not common.

Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/filter.h
kernel/seccomp.c
lib/test_bpf.c
net/core/filter.c