From patchwork Sat Feb 23 01:06:56 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lawrence Brakmo X-Patchwork-Id: 1047232 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=fb.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=fb.com header.i=@fb.com header.b="nure6pyp"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 445qnM0bl3z9sBF for ; Sat, 23 Feb 2019 12:07:35 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727633AbfBWBH1 (ORCPT ); Fri, 22 Feb 2019 20:07:27 -0500 Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:50234 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725814AbfBWBH0 (ORCPT ); Fri, 22 Feb 2019 20:07:26 -0500 Received: from pps.filterd (m0089730.ppops.net [127.0.0.1]) by m0089730.ppops.net (8.16.0.27/8.16.0.27) with SMTP id x1N0wx6J010594 for ; Fri, 22 Feb 2019 17:07:23 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-type; s=facebook; bh=sGG5jdokIhPNaOt3oe3IZ7B/JOfU8p02aKns0/lSHEk=; b=nure6pypuuFTIeovaxVCv9PodP0pzVVyn008mQNI3mq+orly+T8DlG/XQF9SVkNM7xp3 QFUaWVxc2kWEO/uAjV4SrI0ujCOZnIIomncqR2HeP7mk7LGlfth8cqykgbx3mUC9z3Zl iT9jslnoY9ZY4ic0JW6negFEMZpfx77sUFM= Received: from maileast.thefacebook.com ([199.201.65.23]) by m0089730.ppops.net with ESMTP id 2qttb18abn-3 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Fri, 22 Feb 2019 17:07:23 -0800 Received: from mx-out.facebook.com (2620:10d:c0a1:3::13) by mail.thefacebook.com (2620:10d:c021:18::175) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) id 15.1.1531.3; Fri, 22 Feb 2019 17:07:22 -0800 Received: by devbig009.ftw2.facebook.com (Postfix, from userid 10340) id 3A9075AE1524; Fri, 22 Feb 2019 17:07:21 -0800 (PST) Smtp-Origin-Hostprefix: devbig From: brakmo Smtp-Origin-Hostname: devbig009.ftw2.facebook.com To: netdev CC: Martin Lau , Alexei Starovoitov , Daniel Borkmann , Eric Dumazet , Kernel Team Smtp-Origin-Cluster: ftw2c04 Subject: [PATCH v2 bpf-next 2/9] bpf: Add bpf helper bpf_tcp_enter_cwr Date: Fri, 22 Feb 2019 17:06:56 -0800 Message-ID: <20190223010703.678070-3-brakmo@fb.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190223010703.678070-1-brakmo@fb.com> References: <20190223010703.678070-1-brakmo@fb.com> X-FB-Internal: Safe MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-02-23_01:, , signatures=0 X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Martin KaFai Lau This patch adds a new bpf helper BPF_FUNC_tcp_enter_cwr "int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp)". It is added to BPF_PROG_TYPE_CGROUP_SKB which can be attached to the egress path where the bpf prog is called by ip_finish_output() or ip6_finish_output(). The verifier ensures that the parameter must be a tcp_sock. This helper makes a tcp_sock enter CWR state. It can be used by a bpf_prog to manage egress network bandwidth limit per cgroupv2. A later patch will have a sample program to show how it can be used to limit bandwidth usage per cgroupv2. To ensure it is only called from BPF_CGROUP_INET_EGRESS, the attr->expected_attach_type must be specified as BPF_CGROUP_INET_EGRESS during load time if the prog uses this new helper. The newly added prog->enforce_expected_attach_type bit will also be set if this new helper is used. This bit is for backward compatibility reason because currently prog->expected_attach_type has been ignored in BPF_PROG_TYPE_CGROUP_SKB. During attach time, prog->expected_attach_type is only enforced if the prog->enforce_expected_attach_type bit is set. i.e. prog->expected_attach_type is only enforced if this new helper is used by the prog. Signed-off-by: Lawrence Brakmo Signed-off-by: Martin KaFai Lau --- include/linux/bpf.h | 1 + include/linux/filter.h | 3 ++- include/uapi/linux/bpf.h | 9 ++++++++- kernel/bpf/syscall.c | 12 ++++++++++++ kernel/bpf/verifier.c | 4 ++++ net/core/filter.c | 25 +++++++++++++++++++++++++ 6 files changed, 52 insertions(+), 2 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index d5ba2fc01af3..2d54ba7cf9dd 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -195,6 +195,7 @@ enum bpf_arg_type { ARG_PTR_TO_SOCKET, /* pointer to bpf_sock */ ARG_PTR_TO_SPIN_LOCK, /* pointer to bpf_spin_lock */ ARG_PTR_TO_SOCK_COMMON, /* pointer to sock_common */ + ARG_PTR_TO_TCP_SOCK, /* pointer to tcp_sock */ }; /* type of values returned from helper functions */ diff --git a/include/linux/filter.h b/include/linux/filter.h index f32b3eca5a04..c6e878bdc5a6 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -510,7 +510,8 @@ struct bpf_prog { blinded:1, /* Was blinded */ is_func:1, /* program is a bpf function */ kprobe_override:1, /* Do we override a kprobe? */ - has_callchain_buf:1; /* callchain buffer allocated? */ + has_callchain_buf:1, /* callchain buffer allocated? */ + enforce_expected_attach_type:1; /* Enforce expected_attach_type checking at attach time */ enum bpf_prog_type type; /* Type of BPF program */ enum bpf_attach_type expected_attach_type; /* For some prog types */ u32 len; /* Number of filter blocks */ diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index bcdd2474eee7..95b5058fa945 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -2359,6 +2359,12 @@ union bpf_attr { * Return * A **struct bpf_tcp_sock** pointer on success, or NULL in * case of failure. + * + * int bpf_tcp_enter_cwr(struct bpf_tcp_sock *tp) + * Description + * Make a tcp_sock enter CWR state. + * Return + * 0 on success, or a negative error in case of failure. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -2457,7 +2463,8 @@ union bpf_attr { FN(spin_lock), \ FN(spin_unlock), \ FN(sk_fullsock), \ - FN(tcp_sock), + FN(tcp_sock), \ + FN(tcp_enter_cwr), /* integer value in 'imm' field of BPF_CALL instruction selects which helper * function eBPF program intends to call diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index ec7c552af76b..9a478f2875cd 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1482,6 +1482,14 @@ bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type, default: return -EINVAL; } + case BPF_PROG_TYPE_CGROUP_SKB: + switch (expected_attach_type) { + case BPF_CGROUP_INET_INGRESS: + case BPF_CGROUP_INET_EGRESS: + return 0; + default: + return -EINVAL; + } default: return 0; } @@ -1725,6 +1733,10 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog, case BPF_PROG_TYPE_CGROUP_SOCK: case BPF_PROG_TYPE_CGROUP_SOCK_ADDR: return attach_type == prog->expected_attach_type ? 0 : -EINVAL; + case BPF_PROG_TYPE_CGROUP_SKB: + return prog->enforce_expected_attach_type && + prog->expected_attach_type != attach_type ? + -EINVAL : 0; default: return 0; } diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1b9496c41383..95fb385c6f3c 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2424,6 +2424,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, return -EFAULT; } meta->ptr_id = reg->id; + } else if (arg_type == ARG_PTR_TO_TCP_SOCK) { + expected_type = PTR_TO_TCP_SOCK; + if (type != expected_type) + goto err_type; } else if (arg_type == ARG_PTR_TO_SPIN_LOCK) { if (meta->func_id == BPF_FUNC_spin_lock) { if (process_spin_lock(env, regno, true)) diff --git a/net/core/filter.c b/net/core/filter.c index 97916eedfe69..ca57ef25279c 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -5426,6 +5426,24 @@ static const struct bpf_func_proto bpf_tcp_sock_proto = { .arg1_type = ARG_PTR_TO_SOCK_COMMON, }; +BPF_CALL_1(bpf_tcp_enter_cwr, struct tcp_sock *, tp) +{ + struct sock *sk = (struct sock *)tp; + + if (sk->sk_state == TCP_ESTABLISHED) { + tcp_enter_cwr(sk); + return 0; + } + + return -EINVAL; +} + +static const struct bpf_func_proto bpf_tcp_enter_cwr_proto = { + .func = bpf_tcp_enter_cwr, + .gpl_only = false, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_TCP_SOCK, +}; #endif /* CONFIG_INET */ bool bpf_helper_changes_pkt_data(void *func) @@ -5585,6 +5603,13 @@ cg_skb_func_proto(enum bpf_func_id func_id, struct bpf_prog *prog) #ifdef CONFIG_INET case BPF_FUNC_tcp_sock: return &bpf_tcp_sock_proto; + case BPF_FUNC_tcp_enter_cwr: + if (prog->expected_attach_type == BPF_CGROUP_INET_EGRESS) { + prog->enforce_expected_attach_type = 1; + return &bpf_tcp_enter_cwr_proto; + } else { + return NULL; + } #endif default: return sk_filter_func_proto(func_id, prog);