1. 09 Dec, 2014 37 commits
  2. 06 Dec, 2014 3 commits
    • David S. Miller's avatar
      Merge branch 'ebpf-next' · 8d0c4697
      David S. Miller authored
      Alexei Starovoitov says:
      
      ====================
      allow eBPF programs to be attached to sockets
      
      V1->V2:
      
      fixed comments in sample code to state clearly that packet data is accessed
      with LD_ABS instructions and not internal skb fields.
      Also replaced constants in:
      BPF_LD_ABS(BPF_B, 14 + 9 /* R0 = ip->proto */),
      with:
      BPF_LD_ABS(BPF_B, ETH_HLEN + offsetof(struct iphdr, protocol) /* R0 = ip->proto */),
      
      V1 cover:
      
      Introduce BPF_PROG_TYPE_SOCKET_FILTER type of eBPF programs that can be
      attached to sockets with setsockopt().
      Allow such programs to access maps via lookup/update/delete helpers.
      
      This feature was previewed by bpf manpage in commit b4fc1a46("Merge branch 'bpf-next'")
      Now it can actually run.
      
      1st patch adds LD_ABS/LD_IND instruction verification and
      2nd patch adds new setsockopt() flag.
      Patches 3-6 are examples in assembler and in C.
      
      Though native eBPF programs are way more powerful than classic filters
      (attachable through similar setsockopt() call), they don't have skb field
      accessors yet. Like skb->pkt_type, skb->dev->ifindex are not accessible.
      There are sevaral ways to achieve that. That will be in the next set of patches.
      So in this set native eBPF programs can only read data from packet and
      access maps.
      
      The most powerful example is sockex2_kern.c from patch 6 where ~200 lines of C
      are compiled into ~300 of eBPF instructions.
      It shows how quite complex packet parsing can be done.
      
      LLVM used to build examples is at https://github.com/iovisor/llvm
      which is fork of llvm trunk that I'm cleaning up for upstreaming.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8d0c4697
    • Alexei Starovoitov's avatar
      samples: bpf: large eBPF program in C · fbe33108
      Alexei Starovoitov authored
      sockex2_kern.c is purposefully large eBPF program in C.
      llvm compiles ~200 lines of C code into ~300 eBPF instructions.
      
      It's similar to __skb_flow_dissect() to demonstrate that complex packet parsing
      can be done by eBPF.
      Then it uses (struct flow_keys)->dst IP address (or hash of ipv6 dst) to keep
      stats of number of packets per IP.
      User space loads eBPF program, attaches it to loopback interface and prints
      dest_ip->#packets stats every second.
      
      Usage:
      $sudo samples/bpf/sockex2
      ip 127.0.0.1 count 19
      ip 127.0.0.1 count 178115
      ip 127.0.0.1 count 369437
      ip 127.0.0.1 count 559841
      ip 127.0.0.1 count 750539
      Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      fbe33108
    • Alexei Starovoitov's avatar
      samples: bpf: trivial eBPF program in C · a8085782
      Alexei Starovoitov authored
      this example does the same task as previous socket example
      in assembler, but this one does it in C.
      
      eBPF program in kernel does:
          /* assume that packet is IPv4, load one byte of IP->proto */
          int index = load_byte(skb, ETH_HLEN + offsetof(struct iphdr, protocol));
          long *value;
      
          value = bpf_map_lookup_elem(&my_map, &index);
          if (value)
              __sync_fetch_and_add(value, 1);
      
      Corresponding user space reads map[tcp], map[udp], map[icmp]
      and prints protocol stats every second
      Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a8085782