8 files changed, 385 insertions, 31 deletions

diff --git a/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c b/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c
index 7e298148ca26..cb87fccb9f6a 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2017 Netronome Systems, Inc.
+ * Copyright (C) 2017-2018 Netronome Systems, Inc.
  *
  * This software is dual licensed under the GNU General License Version 2,
  * June 1991 as shown in the file COPYING in the top-level directory of this
@@ -102,6 +102,15 @@ nfp_bpf_cmsg_map_req_alloc(struct nfp_app_bpf *bpf, unsigned int n)
         return nfp_bpf_cmsg_alloc(bpf, size);
 }
 
+static u8 nfp_bpf_cmsg_get_type(struct sk_buff *skb)
+{
+        struct cmsg_hdr *hdr;
+
+        hdr = (struct cmsg_hdr *)skb->data;
+
+        return hdr->type;
+}
+
 static unsigned int nfp_bpf_cmsg_get_tag(struct sk_buff *skb)
 {
         struct cmsg_hdr *hdr;
@@ -431,6 +440,11 @@ void nfp_bpf_ctrl_msg_rx(struct nfp_app *app, struct sk_buff *skb)
                 goto err_free;
         }
 
+        if (nfp_bpf_cmsg_get_type(skb) == CMSG_TYPE_BPF_EVENT) {
+                nfp_bpf_event_output(bpf, skb);
+                return;
+        }
+
         nfp_ctrl_lock(bpf->app->ctrl);
 
         tag = nfp_bpf_cmsg_get_tag(skb);
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/fw.h b/drivers/net/ethernet/netronome/nfp/bpf/fw.h
index 39639ac28b01..3dbc21653ce5 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/fw.h
+++ b/drivers/net/ethernet/netronome/nfp/bpf/fw.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2017 Netronome Systems, Inc.
+ * Copyright (C) 2017-2018 Netronome Systems, Inc.
  *
  * This software is dual licensed under the GNU General License Version 2,
  * June 1991 as shown in the file COPYING in the top-level directory of this
@@ -37,6 +37,14 @@
 #include <linux/bitops.h>
 #include <linux/types.h>
 
+/* Kernel's enum bpf_reg_type is not uABI so people may change it breaking
+ * our FW ABI.  In that case we will do translation in the driver.
+ */
+#define NFP_BPF_SCALAR_VALUE            1
+#define NFP_BPF_MAP_VALUE               4
+#define NFP_BPF_STACK                   6
+#define NFP_BPF_PACKET_DATA             8
+
 enum bpf_cap_tlv_type {
         NFP_BPF_CAP_TYPE_FUNC           = 1,
         NFP_BPF_CAP_TYPE_ADJUST_HEAD    = 2,
@@ -81,6 +89,7 @@ enum nfp_bpf_cmsg_type {
         CMSG_TYPE_MAP_DELETE    = 5,
         CMSG_TYPE_MAP_GETNEXT   = 6,
         CMSG_TYPE_MAP_GETFIRST  = 7,
+        CMSG_TYPE_BPF_EVENT     = 8,
         __CMSG_TYPE_MAP_MAX,
 };
 
@@ -155,4 +164,13 @@ struct cmsg_reply_map_op {
         __be32 resv;
         struct cmsg_key_value_pair elem[0];
 };
+
+struct cmsg_bpf_event {
+        struct cmsg_hdr hdr;
+        __be32 cpu_id;
+        __be64 map_ptr;
+        __be32 data_size;
+        __be32 pkt_size;
+        u8 data[0];
+};
 #endif
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/jit.c b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
index 65f0791cae0c..326a2085d650 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016-2017 Netronome Systems, Inc.
+ * Copyright (C) 2016-2018 Netronome Systems, Inc.
  *
  * This software is dual licensed under the GNU General License Version 2,
  * June 1991 as shown in the file COPYING in the top-level directory of this
@@ -1395,15 +1395,9 @@ static int adjust_head(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
 static int
 map_call_stack_common(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
 {
-        struct bpf_offloaded_map *offmap;
-        struct nfp_bpf_map *nfp_map;
         bool load_lm_ptr;
         u32 ret_tgt;
         s64 lm_off;
-        swreg tid;
-
-        offmap = (struct bpf_offloaded_map *)meta->arg1.map_ptr;
-        nfp_map = offmap->dev_priv;
 
         /* We only have to reload LM0 if the key is not at start of stack */
         lm_off = nfp_prog->stack_depth;
@@ -1416,17 +1410,12 @@ map_call_stack_common(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
         if (meta->func_id == BPF_FUNC_map_update_elem)
                 emit_csr_wr(nfp_prog, reg_b(3 * 2), NFP_CSR_ACT_LM_ADDR2);
 
-        /* Load map ID into a register, it should actually fit as an immediate
-         * but in case it doesn't deal with it here, not in the delay slots.
-         */
-        tid = ur_load_imm_any(nfp_prog, nfp_map->tid, imm_a(nfp_prog));
-
         emit_br_relo(nfp_prog, BR_UNC, BR_OFF_RELO + meta->func_id,
                      2, RELO_BR_HELPER);
         ret_tgt = nfp_prog_current_offset(nfp_prog) + 2;
 
         /* Load map ID into A0 */
-        wrp_mov(nfp_prog, reg_a(0), tid);
+        wrp_mov(nfp_prog, reg_a(0), reg_a(2));
 
         /* Load the return address into B0 */
         wrp_immed_relo(nfp_prog, reg_b(0), ret_tgt, RELO_IMMED_REL);
@@ -1456,6 +1445,31 @@ nfp_get_prandom_u32(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
         return 0;
 }
 
+static int
+nfp_perf_event_output(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+{
+        swreg ptr_type;
+        u32 ret_tgt;
+
+        ptr_type = ur_load_imm_any(nfp_prog, meta->arg1.type, imm_a(nfp_prog));
+
+        ret_tgt = nfp_prog_current_offset(nfp_prog) + 3;
+
+        emit_br_relo(nfp_prog, BR_UNC, BR_OFF_RELO + meta->func_id,
+                     2, RELO_BR_HELPER);
+
+        /* Load ptr type into A1 */
+        wrp_mov(nfp_prog, reg_a(1), ptr_type);
+
+        /* Load the return address into B0 */
+        wrp_immed_relo(nfp_prog, reg_b(0), ret_tgt, RELO_IMMED_REL);
+
+        if (!nfp_prog_confirm_current_offset(nfp_prog, ret_tgt))
+                return -EINVAL;
+
+        return 0;
+}
+
 /* --- Callbacks --- */
 static int mov_reg64(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
 {
@@ -2411,6 +2425,8 @@ static int call(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
                 return map_call_stack_common(nfp_prog, meta);
         case BPF_FUNC_get_prandom_u32:
                 return nfp_get_prandom_u32(nfp_prog, meta);
+        case BPF_FUNC_perf_event_output:
+                return nfp_perf_event_output(nfp_prog, meta);
         default:
                 WARN_ONCE(1, "verifier allowed unsupported function\n");
                 return -EOPNOTSUPP;
@@ -3227,6 +3243,33 @@ static int nfp_bpf_optimize(struct nfp_prog *nfp_prog)
         return 0;
 }
 
+static int nfp_bpf_replace_map_ptrs(struct nfp_prog *nfp_prog)
+{
+        struct nfp_insn_meta *meta1, *meta2;
+        struct nfp_bpf_map *nfp_map;
+        struct bpf_map *map;
+
+        nfp_for_each_insn_walk2(nfp_prog, meta1, meta2) {
+                if (meta1->skip || meta2->skip)
+                        continue;
+
+                if (meta1->insn.code != (BPF_LD | BPF_IMM | BPF_DW) ||
+                    meta1->insn.src_reg != BPF_PSEUDO_MAP_FD)
+                        continue;
+
+                map = (void *)(unsigned long)((u32)meta1->insn.imm |
+                                              (u64)meta2->insn.imm << 32);
+                if (bpf_map_offload_neutral(map))
+                        continue;
+                nfp_map = map_to_offmap(map)->dev_priv;
+
+                meta1->insn.imm = nfp_map->tid;
+                meta2->insn.imm = 0;
+        }
+
+        return 0;
+}
+
 static int nfp_bpf_ustore_calc(u64 *prog, unsigned int len)
 {
         __le64 *ustore = (__force __le64 *)prog;
@@ -3263,6 +3306,10 @@ int nfp_bpf_jit(struct nfp_prog *nfp_prog)
 {
         int ret;
 
+        ret = nfp_bpf_replace_map_ptrs(nfp_prog);
+        if (ret)
+                return ret;
+
         ret = nfp_bpf_optimize(nfp_prog);
         if (ret)
                 return ret;
@@ -3353,6 +3400,9 @@ void *nfp_bpf_relo_for_vnic(struct nfp_prog *nfp_prog, struct nfp_bpf_vnic *bv)
                         case BPF_FUNC_map_delete_elem:
                                 val = nfp_prog->bpf->helpers.map_delete;
                                 break;
+                        case BPF_FUNC_perf_event_output:
+                                val = nfp_prog->bpf->helpers.perf_event_output;
+                                break;
                         default:
                                 pr_err("relocation of unknown helper %d\n",
                                        val);
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
index 1dc424685f4e..d72f9e7f42da 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2017 Netronome Systems, Inc.
+ * Copyright (C) 2017-2018 Netronome Systems, Inc.
  *
  * This software is dual licensed under the GNU General License Version 2,
  * June 1991 as shown in the file COPYING in the top-level directory of this
@@ -43,6 +43,14 @@
 #include "fw.h"
 #include "main.h"
 
+const struct rhashtable_params nfp_bpf_maps_neutral_params = {
+        .nelem_hint             = 4,
+        .key_len                = FIELD_SIZEOF(struct nfp_bpf_neutral_map, ptr),
+        .key_offset             = offsetof(struct nfp_bpf_neutral_map, ptr),
+        .head_offset            = offsetof(struct nfp_bpf_neutral_map, l),
+        .automatic_shrinking    = true,
+};
+
 static bool nfp_net_ebpf_capable(struct nfp_net *nn)
 {
 #ifdef __LITTLE_ENDIAN
@@ -290,6 +298,9 @@ nfp_bpf_parse_cap_func(struct nfp_app_bpf *bpf, void __iomem *value, u32 length)
         case BPF_FUNC_map_delete_elem:
                 bpf->helpers.map_delete = readl(&cap->func_addr);
                 break;
+        case BPF_FUNC_perf_event_output:
+                bpf->helpers.perf_event_output = readl(&cap->func_addr);
+                break;
         }
 
         return 0;
@@ -401,17 +412,28 @@ static int nfp_bpf_init(struct nfp_app *app)
         init_waitqueue_head(&bpf->cmsg_wq);
         INIT_LIST_HEAD(&bpf->map_list);
 
-        err = nfp_bpf_parse_capabilities(app);
+        err = rhashtable_init(&bpf->maps_neutral, &nfp_bpf_maps_neutral_params);
         if (err)
                 goto err_free_bpf;
 
+        err = nfp_bpf_parse_capabilities(app);
+        if (err)
+                goto err_free_neutral_maps;
+
         return 0;
 
+err_free_neutral_maps:
+        rhashtable_destroy(&bpf->maps_neutral);
 err_free_bpf:
         kfree(bpf);
         return err;
 }
 
+static void nfp_check_rhashtable_empty(void *ptr, void *arg)
+{
+        WARN_ON_ONCE(1);
+}
+
 static void nfp_bpf_clean(struct nfp_app *app)
 {
         struct nfp_app_bpf *bpf = app->priv;
@@ -419,6 +441,8 @@ static void nfp_bpf_clean(struct nfp_app *app)
         WARN_ON(!skb_queue_empty(&bpf->cmsg_replies));
         WARN_ON(!list_empty(&bpf->map_list));
         WARN_ON(bpf->maps_in_use || bpf->map_elems_in_use);
+        rhashtable_free_and_destroy(&bpf->maps_neutral,
+                                    nfp_check_rhashtable_empty, NULL);
         kfree(bpf);
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h
index 68b5d326483d..82682378d57f 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.h
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016-2017 Netronome Systems, Inc.
+ * Copyright (C) 2016-2018 Netronome Systems, Inc.
  *
  * This software is dual licensed under the GNU General License Version 2,
  * June 1991 as shown in the file COPYING in the top-level directory of this
@@ -39,6 +39,7 @@
 #include <linux/bpf_verifier.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
+#include <linux/rhashtable.h>
 #include <linux/skbuff.h>
 #include <linux/types.h>
 #include <linux/wait.h>
@@ -114,6 +115,8 @@ enum pkt_vec {
  * @maps_in_use:        number of currently offloaded maps
  * @map_elems_in_use:   number of elements allocated to offloaded maps
  *
+ * @maps_neutral:       hash table of offload-neutral maps (on pointer)
+ *
  * @adjust_head:        adjust head capability
  * @adjust_head.flags:          extra flags for adjust head
  * @adjust_head.off_min:        minimal packet offset within buffer required
@@ -133,6 +136,7 @@ enum pkt_vec {
  * @helpers.map_lookup:         map lookup helper address
  * @helpers.map_update:         map update helper address
  * @helpers.map_delete:         map delete helper address
+ * @helpers.perf_event_output:  output perf event to a ring buffer
  *
  * @pseudo_random:      FW initialized the pseudo-random machinery (CSRs)
  */
@@ -150,6 +154,8 @@ struct nfp_app_bpf {
         unsigned int maps_in_use;
         unsigned int map_elems_in_use;
 
+        struct rhashtable maps_neutral;
+
         struct nfp_bpf_cap_adjust_head {
                 u32 flags;
                 int off_min;
@@ -171,6 +177,7 @@ struct nfp_app_bpf {
                 u32 map_lookup;
                 u32 map_update;
                 u32 map_delete;
+                u32 perf_event_output;
         } helpers;
 
         bool pseudo_random;
@@ -199,6 +206,14 @@ struct nfp_bpf_map {
         enum nfp_bpf_map_use use_map[];
 };
 
+struct nfp_bpf_neutral_map {
+        struct rhash_head l;
+        struct bpf_map *ptr;
+        u32 count;
+};
+
+extern const struct rhashtable_params nfp_bpf_maps_neutral_params;
+
 struct nfp_prog;
 struct nfp_insn_meta;
 typedef int (*instr_cb_t)(struct nfp_prog *, struct nfp_insn_meta *);
@@ -367,6 +382,8 @@ static inline bool is_mbpf_xadd(const struct nfp_insn_meta *meta)
  * @error: error code if something went wrong
  * @stack_depth: max stack depth from the verifier
  * @adjust_head_location: if program has single adjust head call - the insn no.
+ * @map_records_cnt: the number of map pointers recorded for this prog
+ * @map_records: the map record pointers from bpf->maps_neutral
  * @insns: list of BPF instruction wrappers (struct nfp_insn_meta)
  */
 struct nfp_prog {
@@ -390,6 +407,9 @@ struct nfp_prog {
         unsigned int stack_depth;
         unsigned int adjust_head_location;
 
+        unsigned int map_records_cnt;
+        struct nfp_bpf_neutral_map **map_records;
+
         struct list_head insns;
 };
 
@@ -440,5 +460,7 @@ int nfp_bpf_ctrl_lookup_entry(struct bpf_offloaded_map *offmap,
 int nfp_bpf_ctrl_getnext_entry(struct bpf_offloaded_map *offmap,
                                void *key, void *next_key);
 
+int nfp_bpf_event_output(struct nfp_app_bpf *bpf, struct sk_buff *skb);
+
 void nfp_bpf_ctrl_msg_rx(struct nfp_app *app, struct sk_buff *skb);
 #endif
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
index 42d98792bd25..4db0ac1e42a8 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016-2017 Netronome Systems, Inc.
+ * Copyright (C) 2016-2018 Netronome Systems, Inc.
  *
  * This software is dual licensed under the GNU General License Version 2,
  * June 1991 as shown in the file COPYING in the top-level directory of this
@@ -57,6 +57,126 @@
 #include "../nfp_net.h"
 
 static int
+nfp_map_ptr_record(struct nfp_app_bpf *bpf, struct nfp_prog *nfp_prog,
+                   struct bpf_map *map)
+{
+        struct nfp_bpf_neutral_map *record;
+        int err;
+
+        /* Map record paths are entered via ndo, update side is protected. */
+        ASSERT_RTNL();
+
+        /* Reuse path - other offloaded program is already tracking this map. */
+        record = rhashtable_lookup_fast(&bpf->maps_neutral, &map,
+                                        nfp_bpf_maps_neutral_params);
+        if (record) {
+                nfp_prog->map_records[nfp_prog->map_records_cnt++] = record;
+                record->count++;
+                return 0;
+        }
+
+        /* Grab a single ref to the map for our record.  The prog destroy ndo
+         * happens after free_used_maps().
+         */
+        map = bpf_map_inc(map, false);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
+
+        record = kmalloc(sizeof(*record), GFP_KERNEL);
+        if (!record) {
+                err = -ENOMEM;
+                goto err_map_put;
+        }
+
+        record->ptr = map;
+        record->count = 1;
+
+        err = rhashtable_insert_fast(&bpf->maps_neutral, &record->l,
+                                     nfp_bpf_maps_neutral_params);
+        if (err)
+                goto err_free_rec;
+
+        nfp_prog->map_records[nfp_prog->map_records_cnt++] = record;
+
+        return 0;
+
+err_free_rec:
+        kfree(record);
+err_map_put:
+        bpf_map_put(map);
+        return err;
+}
+
+static void
+nfp_map_ptrs_forget(struct nfp_app_bpf *bpf, struct nfp_prog *nfp_prog)
+{
+        bool freed = false;
+        int i;
+
+        ASSERT_RTNL();
+
+        for (i = 0; i < nfp_prog->map_records_cnt; i++) {
+                if (--nfp_prog->map_records[i]->count) {
+                        nfp_prog->map_records[i] = NULL;
+                        continue;
+                }
+
+                WARN_ON(rhashtable_remove_fast(&bpf->maps_neutral,
+                                               &nfp_prog->map_records[i]->l,
+                                               nfp_bpf_maps_neutral_params));
+                freed = true;
+        }
+
+        if (freed) {
+                synchronize_rcu();
+
+                for (i = 0; i < nfp_prog->map_records_cnt; i++)
+                        if (nfp_prog->map_records[i]) {
+                                bpf_map_put(nfp_prog->map_records[i]->ptr);
+                                kfree(nfp_prog->map_records[i]);
+                        }
+        }
+
+        kfree(nfp_prog->map_records);
+        nfp_prog->map_records = NULL;
+        nfp_prog->map_records_cnt = 0;
+}
+
+static int
+nfp_map_ptrs_record(struct nfp_app_bpf *bpf, struct nfp_prog *nfp_prog,
+                    struct bpf_prog *prog)
+{
+        int i, cnt, err;
+
+        /* Quickly count the maps we will have to remember */
+        cnt = 0;
+        for (i = 0; i < prog->aux->used_map_cnt; i++)
+                if (bpf_map_offload_neutral(prog->aux->used_maps[i]))
+                        cnt++;
+        if (!cnt)
+                return 0;
+
+        nfp_prog->map_records = kmalloc_array(cnt,
+                                              sizeof(nfp_prog->map_records[0]),
+                                              GFP_KERNEL);
+        if (!nfp_prog->map_records)
+                return -ENOMEM;
+
+        for (i = 0; i < prog->aux->used_map_cnt; i++)
+                if (bpf_map_offload_neutral(prog->aux->used_maps[i])) {
+                        err = nfp_map_ptr_record(bpf, nfp_prog,
+                                                 prog->aux->used_maps[i]);
+                        if (err) {
+                                nfp_map_ptrs_forget(bpf, nfp_prog);
+                                return err;
+                        }
+                }
+        WARN_ON(cnt != nfp_prog->map_records_cnt);
+
+        return 0;
+}
+
+static int
 nfp_prog_prepare(struct nfp_prog *nfp_prog, const struct bpf_insn *prog,
                  unsigned int cnt)
 {
@@ -151,7 +271,7 @@ static int nfp_bpf_translate(struct nfp_net *nn, struct bpf_prog *prog)
         prog->aux->offload->jited_len = nfp_prog->prog_len * sizeof(u64);
         prog->aux->offload->jited_image = nfp_prog->prog;
 
-        return 0;
+        return nfp_map_ptrs_record(nfp_prog->bpf, nfp_prog, prog);
 }
 
 static int nfp_bpf_destroy(struct nfp_net *nn, struct bpf_prog *prog)
@@ -159,6 +279,7 @@ static int nfp_bpf_destroy(struct nfp_net *nn, struct bpf_prog *prog)
         struct nfp_prog *nfp_prog = prog->aux->offload->dev_priv;
 
         kvfree(nfp_prog->prog);
+        nfp_map_ptrs_forget(nfp_prog->bpf, nfp_prog);
         nfp_prog_free(nfp_prog);
 
         return 0;
@@ -320,6 +441,53 @@ int nfp_ndo_bpf(struct nfp_app *app, struct nfp_net *nn, struct netdev_bpf *bpf)
         }
 }
 
+static unsigned long
+nfp_bpf_perf_event_copy(void *dst, const void *src,
+                        unsigned long off, unsigned long len)
+{
+        memcpy(dst, src + off, len);
+        return 0;
+}
+
+int nfp_bpf_event_output(struct nfp_app_bpf *bpf, struct sk_buff *skb)
+{
+        struct cmsg_bpf_event *cbe = (void *)skb->data;
+        u32 pkt_size, data_size;
+        struct bpf_map *map;
+
+        if (skb->len < sizeof(struct cmsg_bpf_event))
+                goto err_drop;
+
+        pkt_size = be32_to_cpu(cbe->pkt_size);
+        data_size = be32_to_cpu(cbe->data_size);
+        map = (void *)(unsigned long)be64_to_cpu(cbe->map_ptr);
+
+        if (skb->len < sizeof(struct cmsg_bpf_event) + pkt_size + data_size)
+                goto err_drop;
+        if (cbe->hdr.ver != CMSG_MAP_ABI_VERSION)
+                goto err_drop;
+
+        rcu_read_lock();
+        if (!rhashtable_lookup_fast(&bpf->maps_neutral, &map,
+                                    nfp_bpf_maps_neutral_params)) {
+                rcu_read_unlock();
+                pr_warn("perf event: dest map pointer %px not recognized, dropping event\n",
+                        map);
+                goto err_drop;
+        }
+
+        bpf_event_output(map, be32_to_cpu(cbe->cpu_id),
+                         &cbe->data[round_up(pkt_size, 4)], data_size,
+                         cbe->data, pkt_size, nfp_bpf_perf_event_copy);
+        rcu_read_unlock();
+
+        dev_consume_skb_any(skb);
+        return 0;
+err_drop:
+        dev_kfree_skb_any(skb);
+        return -EINVAL;
+}
+
 static int
 nfp_net_bpf_load(struct nfp_net *nn, struct bpf_prog *prog,
                  struct netlink_ext_ack *extack)
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/verifier.c b/drivers/net/ethernet/netronome/nfp/bpf/verifier.c
index 06ad53ce4ad9..e163f3cfa47d 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/verifier.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/verifier.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016-2017 Netronome Systems, Inc.
+ * Copyright (C) 2016-2018 Netronome Systems, Inc.
  *
  * This software is dual licensed under the GNU General License Version 2,
  * June 1991 as shown in the file COPYING in the top-level directory of this
@@ -36,6 +36,8 @@
 #include <linux/kernel.h>
 #include <linux/pkt_cls.h>
 
+#include "../nfp_app.h"
+#include "../nfp_main.h"
 #include "fw.h"
 #include "main.h"
 
@@ -149,15 +151,6 @@ nfp_bpf_map_call_ok(const char *fname, struct bpf_verifier_env *env,
                 return false;
         }
 
-        /* Rest of the checks is only if we re-parse the same insn */
-        if (!meta->func_id)
-                return true;
-
-        if (meta->arg1.map_ptr != reg1->map_ptr) {
-                pr_vlog(env, "%s: called for different map\n", fname);
-                return false;
-        }
-
         return true;
 }
 
@@ -216,6 +209,71 @@ nfp_bpf_check_call(struct nfp_prog *nfp_prog, struct bpf_verifier_env *env,
                 pr_vlog(env, "bpf_get_prandom_u32(): FW doesn't support random number generation\n");
                 return -EOPNOTSUPP;
 
+        case BPF_FUNC_perf_event_output:
+                BUILD_BUG_ON(NFP_BPF_SCALAR_VALUE != SCALAR_VALUE ||
+                             NFP_BPF_MAP_VALUE != PTR_TO_MAP_VALUE ||
+                             NFP_BPF_STACK != PTR_TO_STACK ||
+                             NFP_BPF_PACKET_DATA != PTR_TO_PACKET);
+
+                if (!bpf->helpers.perf_event_output) {
+                        pr_vlog(env, "event_output: not supported by FW\n");
+                        return -EOPNOTSUPP;
+                }
+
+                /* Force current CPU to make sure we can report the event
+                 * wherever we get the control message from FW.
+                 */
+                if (reg3->var_off.mask & BPF_F_INDEX_MASK ||
+                    (reg3->var_off.value & BPF_F_INDEX_MASK) !=
+                    BPF_F_CURRENT_CPU) {
+                        char tn_buf[48];
+
+                        tnum_strn(tn_buf, sizeof(tn_buf), reg3->var_off);
+                        pr_vlog(env, "event_output: must use BPF_F_CURRENT_CPU, var_off: %s\n",
+                                tn_buf);
+                        return -EOPNOTSUPP;
+                }
+
+                /* Save space in meta, we don't care about arguments other
+                 * than 4th meta, shove it into arg1.
+                 */
+                reg1 = cur_regs(env) + BPF_REG_4;
+
+                if (reg1->type != SCALAR_VALUE /* NULL ptr */ &&
+                    reg1->type != PTR_TO_STACK &&
+                    reg1->type != PTR_TO_MAP_VALUE &&
+                    reg1->type != PTR_TO_PACKET) {
+                        pr_vlog(env, "event_output: unsupported ptr type: %d\n",
+                                reg1->type);
+                        return -EOPNOTSUPP;
+                }
+
+                if (reg1->type == PTR_TO_STACK &&
+                    !nfp_bpf_stack_arg_ok("event_output", env, reg1, NULL))
+                        return -EOPNOTSUPP;
+
+                /* Warn user that on offload NFP may return success even if map
+                 * is not going to accept the event, since the event output is
+                 * fully async and device won't know the state of the map.
+                 * There is also FW limitation on the event length.
+                 *
+                 * Lost events will not show up on the perf ring, driver
+                 * won't see them at all.  Events may also get reordered.
+                 */
+                dev_warn_once(&nfp_prog->bpf->app->pf->pdev->dev,
+                              "bpf: note: return codes and behavior of bpf_event_output() helper differs for offloaded programs!\n");
+                pr_vlog(env, "warning: return codes and behavior of event_output helper differ for offload!\n");
+
+                if (!meta->func_id)
+                        break;
+
+                if (reg1->type != meta->arg1.type) {
+                        pr_vlog(env, "event_output: ptr type changed: %d %d\n",
+                                meta->arg1.type, reg1->type);
+                        return -EINVAL;
+                }
+                break;
+
         default:
                 pr_vlog(env, "unsupported function id: %d\n", func_id);
                 return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_app.c b/drivers/net/ethernet/netronome/nfp/nfp_app.c
index 6aedef0ad433..0e0253c7e17b 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_app.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_app.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2017 Netronome Systems, Inc.
+ * Copyright (C) 2017-2018 Netronome Systems, Inc.
  *
  * This software is dual licensed under the GNU General License Version 2,
  * June 1991 as shown in the file COPYING in the top-level directory of this