diff mbox series

[bpf-next,1/9] bpf: Add bpf helper bpf_tcp_enter_cwr

Message ID 20190219053830.2086578-1-brakmo@fb.com
State Changes Requested
Delegated to: BPF Maintainers
Headers show
Series [bpf-next,1/9] bpf: Add bpf helper bpf_tcp_enter_cwr | expand

Commit Message

Lawrence Brakmo Feb. 19, 2019, 5:38 a.m. UTC 
This patch adds a new bpf helper BPF_FUNC_tcp_enter_cwr
"int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp)".
It is added to BPF_PROG_TYPE_CGROUP_SKB typed bpf_prog
which currently can be attached to the ingress and egress
path.

This helper makes a tcp_sock enter CWR state.  It can be used
by a bpf_prog to manage egress network bandwidth limit per
cgroupv2.  A later patch will have a sample program to
show how it can be used to limit bandwidth usage per cgroupv2.

Signed-off-by: Lawrence Brakmo <brakmo@fb.com>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
---
 include/linux/bpf.h      |  1 +
 include/uapi/linux/bpf.h |  9 ++++++++-
 kernel/bpf/verifier.c    |  4 ++++
 net/core/filter.c        | 14 ++++++++++++++
 4 files changed, 27 insertions(+), 1 deletion(-)

Comments

Daniel Borkmann Feb. 19, 2019, 10:24 a.m. UTC | #1 
On 02/19/2019 06:38 AM, brakmo wrote:
> This patch adds a new bpf helper BPF_FUNC_tcp_enter_cwr
> "int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp)".
> It is added to BPF_PROG_TYPE_CGROUP_SKB typed bpf_prog
> which currently can be attached to the ingress and egress
> path.
> 
> This helper makes a tcp_sock enter CWR state.  It can be used
> by a bpf_prog to manage egress network bandwidth limit per
> cgroupv2.  A later patch will have a sample program to
> show how it can be used to limit bandwidth usage per cgroupv2.
> 
> Signed-off-by: Lawrence Brakmo <brakmo@fb.com>
> Signed-off-by: Martin KaFai Lau <kafai@fb.com>
> ---
>  include/linux/bpf.h      |  1 +
>  include/uapi/linux/bpf.h |  9 ++++++++-
>  kernel/bpf/verifier.c    |  4 ++++
>  net/core/filter.c        | 14 ++++++++++++++
>  4 files changed, 27 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index de18227b3d95..525628c913c9 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -195,6 +195,7 @@ enum bpf_arg_type {
>  	ARG_PTR_TO_SOCKET,	/* pointer to bpf_sock */
>  	ARG_PTR_TO_SPIN_LOCK,	/* pointer to bpf_spin_lock */
>  	ARG_PTR_TO_SOCK_COMMON,	/* pointer to sock_common */
> +	ARG_PTR_TO_TCP_SOCK,    /* pointer to tcp_sock */
>  };
>  
>  /* type of values returned from helper functions */
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index bcdd2474eee7..9e9f4f1a0370 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -2359,6 +2359,12 @@ union bpf_attr {
>   *	Return
>   *		A **struct bpf_tcp_sock** pointer on success, or NULL in
>   *		case of failure.
> + *
> + * int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp)
> + *    Description
> + *        Make a tcp_sock enter CWR state.
> + *    Return
> + *        0
>   */
>  #define __BPF_FUNC_MAPPER(FN)		\
>  	FN(unspec),			\
> @@ -2457,7 +2463,8 @@ union bpf_attr {
>  	FN(spin_lock),			\
>  	FN(spin_unlock),		\
>  	FN(sk_fullsock),		\
> -	FN(tcp_sock),
> +	FN(tcp_sock),			\
> +	FN(tcp_enter_cwr),
>  
>  /* integer value in 'imm' field of BPF_CALL instruction selects which helper
>   * function eBPF program intends to call
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 1b9496c41383..95fb385c6f3c 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2424,6 +2424,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
>  			return -EFAULT;
>  		}
>  		meta->ptr_id = reg->id;
> +	} else if (arg_type == ARG_PTR_TO_TCP_SOCK) {
> +		expected_type = PTR_TO_TCP_SOCK;
> +		if (type != expected_type)
> +			goto err_type;
>  	} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
>  		if (meta->func_id == BPF_FUNC_spin_lock) {
>  			if (process_spin_lock(env, regno, true))
> diff --git a/net/core/filter.c b/net/core/filter.c
> index b584cb42a803..f51c4a781844 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -5426,6 +5426,18 @@ static const struct bpf_func_proto bpf_tcp_sock_proto = {
>  	.arg1_type	= ARG_PTR_TO_SOCK_COMMON,
>  };
>  
> +BPF_CALL_1(bpf_tcp_enter_cwr, struct tcp_sock *, tp)
> +{
> +	tcp_enter_cwr((struct sock *)tp);

Is it safe to call in every case, meaning do we always have a icsk_ca_ops
assigned (e.g. pre-4whs completion)?

> +	return 0;
> +}
> +
> +static const struct bpf_func_proto bpf_tcp_enter_cwr_proto = {
> +	.func        = bpf_tcp_enter_cwr,
> +	.gpl_only    = false,
> +	.ret_type    = RET_INTEGER,
> +	.arg1_type    = ARG_PTR_TO_TCP_SOCK,
> +};
>  #endif /* CONFIG_INET */
>  
>  bool bpf_helper_changes_pkt_data(void *func)
> @@ -5585,6 +5597,8 @@ cg_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>  #ifdef CONFIG_INET
>  	case BPF_FUNC_tcp_sock:
>  		return &bpf_tcp_sock_proto;
> +	case BPF_FUNC_tcp_enter_cwr:
> +		return &bpf_tcp_enter_cwr_proto;
>  #endif
>  	default:
>  		return sk_filter_func_proto(func_id, prog);
>
Eric Dumazet Feb. 19, 2019, 6:30 p.m. UTC | #2 
On 02/18/2019 09:38 PM, brakmo wrote:
> This patch adds a new bpf helper BPF_FUNC_tcp_enter_cwr
> "int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp)".
> It is added to BPF_PROG_TYPE_CGROUP_SKB typed bpf_prog
> which currently can be attached to the ingress and egress
> path.
>

Do we have the guarantee socket is a tcp one, and that the caller
owns the socket lock ?

Please describe the exact context for this helper being used.
Lawrence Brakmo Feb. 19, 2019, 10:59 p.m. UTC | #3 
On 2/19/19, 2:24 AM, "Daniel Borkmann" <daniel@iogearbox.net> wrote:

    On 02/19/2019 06:38 AM, brakmo wrote:
    > This patch adds a new bpf helper BPF_FUNC_tcp_enter_cwr
    > "int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp)".
    > It is added to BPF_PROG_TYPE_CGROUP_SKB typed bpf_prog
    > which currently can be attached to the ingress and egress
    > path.
    > 
    > This helper makes a tcp_sock enter CWR state.  It can be used
    > by a bpf_prog to manage egress network bandwidth limit per
    > cgroupv2.  A later patch will have a sample program to
    > show how it can be used to limit bandwidth usage per cgroupv2.
    > 
    > Signed-off-by: Lawrence Brakmo <brakmo@fb.com>
    > Signed-off-by: Martin KaFai Lau <kafai@fb.com>
    > ---
    >  include/linux/bpf.h      |  1 +
    >  include/uapi/linux/bpf.h |  9 ++++++++-
    >  kernel/bpf/verifier.c    |  4 ++++
    >  net/core/filter.c        | 14 ++++++++++++++
    >  4 files changed, 27 insertions(+), 1 deletion(-)
    > 
    > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
    > index de18227b3d95..525628c913c9 100644
    > --- a/include/linux/bpf.h
    > +++ b/include/linux/bpf.h
    > @@ -195,6 +195,7 @@ enum bpf_arg_type {
    >  	ARG_PTR_TO_SOCKET,	/* pointer to bpf_sock */
    >  	ARG_PTR_TO_SPIN_LOCK,	/* pointer to bpf_spin_lock */
    >  	ARG_PTR_TO_SOCK_COMMON,	/* pointer to sock_common */
    > +	ARG_PTR_TO_TCP_SOCK,    /* pointer to tcp_sock */
    >  };
    >  
    >  /* type of values returned from helper functions */
    > diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
    > index bcdd2474eee7..9e9f4f1a0370 100644
    > --- a/include/uapi/linux/bpf.h
    > +++ b/include/uapi/linux/bpf.h
    > @@ -2359,6 +2359,12 @@ union bpf_attr {
    >   *	Return
    >   *		A **struct bpf_tcp_sock** pointer on success, or NULL in
    >   *		case of failure.
    > + *
    > + * int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp)
    > + *    Description
    > + *        Make a tcp_sock enter CWR state.
    > + *    Return
    > + *        0
    >   */
    >  #define __BPF_FUNC_MAPPER(FN)		\
    >  	FN(unspec),			\
    > @@ -2457,7 +2463,8 @@ union bpf_attr {
    >  	FN(spin_lock),			\
    >  	FN(spin_unlock),		\
    >  	FN(sk_fullsock),		\
    > -	FN(tcp_sock),
    > +	FN(tcp_sock),			\
    > +	FN(tcp_enter_cwr),
    >  
    >  /* integer value in 'imm' field of BPF_CALL instruction selects which helper
    >   * function eBPF program intends to call
    > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    > index 1b9496c41383..95fb385c6f3c 100644
    > --- a/kernel/bpf/verifier.c
    > +++ b/kernel/bpf/verifier.c
    > @@ -2424,6 +2424,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
    >  			return -EFAULT;
    >  		}
    >  		meta->ptr_id = reg->id;
    > +	} else if (arg_type == ARG_PTR_TO_TCP_SOCK) {
    > +		expected_type = PTR_TO_TCP_SOCK;
    > +		if (type != expected_type)
    > +			goto err_type;
    >  	} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
    >  		if (meta->func_id == BPF_FUNC_spin_lock) {
    >  			if (process_spin_lock(env, regno, true))
    > diff --git a/net/core/filter.c b/net/core/filter.c
    > index b584cb42a803..f51c4a781844 100644
    > --- a/net/core/filter.c
    > +++ b/net/core/filter.c
    > @@ -5426,6 +5426,18 @@ static const struct bpf_func_proto bpf_tcp_sock_proto = {
    >  	.arg1_type	= ARG_PTR_TO_SOCK_COMMON,
    >  };
    >  
    > +BPF_CALL_1(bpf_tcp_enter_cwr, struct tcp_sock *, tp)
    > +{
    > +	tcp_enter_cwr((struct sock *)tp);
    
    Is it safe to call in every case, meaning do we always have a icsk_ca_ops
    assigned (e.g. pre-4whs completion)?

The helper, bpf_tcp_enter_cwr, can only be called for an skb belonging to a full tcp socket. The icsk_ca_ops field is initialized by tcp_init_sock, so this should not be an issue. However, it could be called before icsk_ca_ops->init() has been called, so it is probably better to check that the tcp sock is in the established state in the bpf helper.
    
    > +	return 0;
    > +}
    > +
    > +static const struct bpf_func_proto bpf_tcp_enter_cwr_proto = {
    > +	.func        = bpf_tcp_enter_cwr,
    > +	.gpl_only    = false,
    > +	.ret_type    = RET_INTEGER,
    > +	.arg1_type    = ARG_PTR_TO_TCP_SOCK,
    > +};
    >  #endif /* CONFIG_INET */
    >  
    >  bool bpf_helper_changes_pkt_data(void *func)
    > @@ -5585,6 +5597,8 @@ cg_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
    >  #ifdef CONFIG_INET
    >  	case BPF_FUNC_tcp_sock:
    >  		return &bpf_tcp_sock_proto;
    > +	case BPF_FUNC_tcp_enter_cwr:
    > +		return &bpf_tcp_enter_cwr_proto;
    >  #endif
    >  	default:
    >  		return sk_filter_func_proto(func_id, prog);
    >
Lawrence Brakmo Feb. 21, 2019, 3:18 a.m. UTC | #4 
On 2/19/19, 10:30 AM, "Eric Dumazet" <eric.dumazet@gmail.com> wrote:

    
    
    On 02/18/2019 09:38 PM, brakmo wrote:
    > This patch adds a new bpf helper BPF_FUNC_tcp_enter_cwr
    > "int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp)".
    > It is added to BPF_PROG_TYPE_CGROUP_SKB typed bpf_prog
    > which currently can be attached to the ingress and egress
    > path.
    >
    
    Do we have the guarantee socket is a tcp one, and that the caller
    owns the socket lock ?

Yes. The BPF verifier insures that a pointer to bpf_tcp_sock points to a non-NULL full tcp socket.

    
    Please describe the exact context for this helper being used.

From cgroup skb egress bpf program. When the BPF program determines that a flow needs to slow down, it will call bpf_tcp_enter_cwr(tp).
diff mbox series

Patch

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index de18227b3d95..525628c913c9 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -195,6 +195,7 @@  enum bpf_arg_type {
 	ARG_PTR_TO_SOCKET,	/* pointer to bpf_sock */
 	ARG_PTR_TO_SPIN_LOCK,	/* pointer to bpf_spin_lock */
 	ARG_PTR_TO_SOCK_COMMON,	/* pointer to sock_common */
+	ARG_PTR_TO_TCP_SOCK,    /* pointer to tcp_sock */
 };
 
 /* type of values returned from helper functions */
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index bcdd2474eee7..9e9f4f1a0370 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2359,6 +2359,12 @@  union bpf_attr {
  *	Return
  *		A **struct bpf_tcp_sock** pointer on success, or NULL in
  *		case of failure.
+ *
+ * int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp)
+ *    Description
+ *        Make a tcp_sock enter CWR state.
+ *    Return
+ *        0
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -2457,7 +2463,8 @@  union bpf_attr {
 	FN(spin_lock),			\
 	FN(spin_unlock),		\
 	FN(sk_fullsock),		\
-	FN(tcp_sock),
+	FN(tcp_sock),			\
+	FN(tcp_enter_cwr),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1b9496c41383..95fb385c6f3c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2424,6 +2424,10 @@  static int check_func_arg(struct bpf_verifier_env *env, u32 regno,
 			return -EFAULT;
 		}
 		meta->ptr_id = reg->id;
+	} else if (arg_type == ARG_PTR_TO_TCP_SOCK) {
+		expected_type = PTR_TO_TCP_SOCK;
+		if (type != expected_type)
+			goto err_type;
 	} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
 		if (meta->func_id == BPF_FUNC_spin_lock) {
 			if (process_spin_lock(env, regno, true))
diff --git a/net/core/filter.c b/net/core/filter.c
index b584cb42a803..f51c4a781844 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -5426,6 +5426,18 @@  static const struct bpf_func_proto bpf_tcp_sock_proto = {
 	.arg1_type	= ARG_PTR_TO_SOCK_COMMON,
 };
 
+BPF_CALL_1(bpf_tcp_enter_cwr, struct tcp_sock *, tp)
+{
+	tcp_enter_cwr((struct sock *)tp);
+	return 0;
+}
+
+static const struct bpf_func_proto bpf_tcp_enter_cwr_proto = {
+	.func        = bpf_tcp_enter_cwr,
+	.gpl_only    = false,
+	.ret_type    = RET_INTEGER,
+	.arg1_type    = ARG_PTR_TO_TCP_SOCK,
+};
 #endif /* CONFIG_INET */
 
 bool bpf_helper_changes_pkt_data(void *func)
@@ -5585,6 +5597,8 @@  cg_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 #ifdef CONFIG_INET
 	case BPF_FUNC_tcp_sock:
 		return &bpf_tcp_sock_proto;
+	case BPF_FUNC_tcp_enter_cwr:
+		return &bpf_tcp_enter_cwr_proto;
 #endif
 	default:
 		return sk_filter_func_proto(func_id, prog);