mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-31 16:38:12 +00:00
41c48f3a98
There are multiple use-cases when it's convenient to have access to bpf
map fields, both `struct bpf_map` and map type specific struct-s such as
`struct bpf_array`, `struct bpf_htab`, etc.
For example while working with sock arrays it can be necessary to
calculate the key based on map->max_entries (some_hash % max_entries).
Currently this is solved by communicating max_entries via "out-of-band"
channel, e.g. via additional map with known key to get info about target
map. That works, but is not very convenient and error-prone while
working with many maps.
In other cases necessary data is dynamic (i.e. unknown at loading time)
and it's impossible to get it at all. For example while working with a
hash table it can be convenient to know how much capacity is already
used (bpf_htab.count.counter for BPF_F_NO_PREALLOC case).
At the same time kernel knows this info and can provide it to bpf
program.
Fill this gap by adding support to access bpf map fields from bpf
program for both `struct bpf_map` and map type specific fields.
Support is implemented via btf_struct_access() so that a user can define
their own `struct bpf_map` or map type specific struct in their program
with only necessary fields and preserve_access_index attribute, cast a
map to this struct and use a field.
For example:
struct bpf_map {
__u32 max_entries;
} __attribute__((preserve_access_index));
struct bpf_array {
struct bpf_map map;
__u32 elem_size;
} __attribute__((preserve_access_index));
struct {
__uint(type, BPF_MAP_TYPE_ARRAY);
__uint(max_entries, 4);
__type(key, __u32);
__type(value, __u32);
} m_array SEC(".maps");
SEC("cgroup_skb/egress")
int cg_skb(void *ctx)
{
struct bpf_array *array = (struct bpf_array *)&m_array;
struct bpf_map *map = (struct bpf_map *)&m_array;
/* .. use map->max_entries or array->map.max_entries .. */
}
Similarly to other btf_struct_access() use-cases (e.g. struct tcp_sock
in net/ipv4/bpf_tcp_ca.c) the patch allows access to any fields of
corresponding struct. Only reading from map fields is supported.
For btf_struct_access() to work there should be a way to know btf id of
a struct that corresponds to a map type. To get btf id there should be a
way to get a stringified name of map-specific struct, such as
"bpf_array", "bpf_htab", etc for a map type. Two new fields are added to
`struct bpf_map_ops` to handle it:
* .map_btf_name keeps a btf name of a struct returned by map_alloc();
* .map_btf_id is used to cache btf id of that struct.
To make btf ids calculation cheaper they're calculated once while
preparing btf_vmlinux and cached same way as it's done for btf_id field
of `struct bpf_func_proto`
While calculating btf ids, struct names are NOT checked for collision.
Collisions will be checked as a part of the work to prepare btf ids used
in verifier in compile time that should land soon. The only known
collision for `struct bpf_htab` (kernel/bpf/hashtab.c vs
net/core/sock_map.c) was fixed earlier.
Both new fields .map_btf_name and .map_btf_id must be set for a map type
for the feature to work. If neither is set for a map type, verifier will
return ENOTSUPP on a try to access map_ptr of corresponding type. If
just one of them set, it's verifier misconfiguration.
Only `struct bpf_array` for BPF_MAP_TYPE_ARRAY and `struct bpf_htab` for
BPF_MAP_TYPE_HASH are supported by this patch. Other map types will be
supported separately.
The feature is available only for CONFIG_DEBUG_INFO_BTF=y and gated by
perfmon_capable() so that unpriv programs won't have access to bpf map
fields.
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/6479686a0cd1e9067993df57b4c3eef0e276fec9.1592600985.git.rdna@fb.com
100 lines
2.9 KiB
C
100 lines
2.9 KiB
C
{
|
|
"calls: two calls returning different map pointers for lookup (hash, array)",
|
|
.insns = {
|
|
/* main prog */
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
|
|
BPF_CALL_REL(11),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
|
BPF_CALL_REL(12),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
/* subprog 1 */
|
|
BPF_LD_MAP_FD(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
/* subprog 2 */
|
|
BPF_LD_MAP_FD(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
.fixup_map_hash_48b = { 13 },
|
|
.fixup_map_array_48b = { 16 },
|
|
.result = ACCEPT,
|
|
.retval = 1,
|
|
},
|
|
{
|
|
"calls: two calls returning different map pointers for lookup (hash, map in map)",
|
|
.insns = {
|
|
/* main prog */
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
|
|
BPF_CALL_REL(11),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
|
|
BPF_CALL_REL(12),
|
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
/* subprog 1 */
|
|
BPF_LD_MAP_FD(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
/* subprog 2 */
|
|
BPF_LD_MAP_FD(BPF_REG_0, 0),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
.fixup_map_in_map = { 16 },
|
|
.fixup_map_array_48b = { 13 },
|
|
.result = REJECT,
|
|
.errstr = "only read from bpf_array is supported",
|
|
},
|
|
{
|
|
"cond: two branches returning different map pointers for lookup (tail, tail)",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 3),
|
|
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_3, 7),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_prog1 = { 5 },
|
|
.fixup_prog2 = { 2 },
|
|
.result_unpriv = REJECT,
|
|
.errstr_unpriv = "tail_call abusing map_ptr",
|
|
.result = ACCEPT,
|
|
.retval = 42,
|
|
},
|
|
{
|
|
"cond: two branches returning same map pointers for lookup (tail, tail)",
|
|
.insns = {
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
offsetof(struct __sk_buff, mark)),
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 3),
|
|
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
|
BPF_JMP_IMM(BPF_JA, 0, 0, 2),
|
|
BPF_LD_MAP_FD(BPF_REG_2, 0),
|
|
BPF_MOV64_IMM(BPF_REG_3, 7),
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
|
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
|
BPF_EXIT_INSN(),
|
|
},
|
|
.fixup_prog2 = { 2, 5 },
|
|
.result_unpriv = ACCEPT,
|
|
.result = ACCEPT,
|
|
.retval = 42,
|
|
},
|