bpf: Add support for BTF pointers to interpreter

Pointer to BTF object is a pointer to kernel object or NULL. The memory access in the interpreter has to be done via probe_kernel_read to avoid page faults.

Alexei Starovoitov committed 7 years ago

Commit 2a027591 parent ac4414b3 files · +30 −0Browse files

Unified · Split

3 files

include/linux/filter.h +3 −0
kernel/bpf/core.c +19 −0
kernel/bpf/verifier.c +8 −0

include/linux/filter.h+3−0

@@ -65,6 +65,9 @@ struct ctl_table_header; · 64 unmodified lines
65	/* unused opcode to mark special call to bpf_tail_call() helper */	65	/* unused opcode to mark special call to bpf_tail_call() helper */
66	#define BPF_TAIL_CALL 0xf0	66	#define BPF_TAIL_CALL 0xf0
67		67
		68	/* unused opcode to mark special load instruction. Same as BPF_ABS */
		69	#define BPF_PROBE_MEM 0x20
		70
68	/* unused opcode to mark call to interpreter with arguments */	71	/* unused opcode to mark call to interpreter with arguments */
69	#define BPF_CALL_ARGS 0xe0	72	#define BPF_CALL_ARGS 0xe0
70		73

kernel/bpf/core.c+19−0

@@ -1291,6 +1291,11 @@ bool bpf_opcode_in_insntable(u8 code) · 1290 unmodified lines
1291	}	1291	}
1292		1292
1293	#ifndef CONFIG_BPF_JIT_ALWAYS_ON	1293	#ifndef CONFIG_BPF_JIT_ALWAYS_ON
		1294	u64 __weak bpf_probe_read(void * dst, u32 size, const void * unsafe_ptr)
		1295	{
		1296	memset(dst, 0, size);
		1297	return -EFAULT;
		1298	}
1294	/**	1299	/**
1295	* __bpf_prog_run - run eBPF program on a given context	1300	* __bpf_prog_run - run eBPF program on a given context
1296	* @regs: is the array of MAX_BPF_EXT_REG eBPF pseudo-registers	1301	* @regs: is the array of MAX_BPF_EXT_REG eBPF pseudo-registers
@@ -1310,6 +1315,10 @@ static u64 __no_fgcse ___bpf_prog_run(u64 regs, const struct bpf_insn insn, u6 · 13 unmodified lines
1310	/* Non-UAPI available opcodes. */	1315	/* Non-UAPI available opcodes. */
1311	[BPF_JMP \| BPF_CALL_ARGS] = &&JMP_CALL_ARGS,	1316	[BPF_JMP \| BPF_CALL_ARGS] = &&JMP_CALL_ARGS,
1312	[BPF_JMP \| BPF_TAIL_CALL] = &&JMP_TAIL_CALL,	1317	[BPF_JMP \| BPF_TAIL_CALL] = &&JMP_TAIL_CALL,
		1318	[BPF_LDX \| BPF_PROBE_MEM \| BPF_B] = &&LDX_PROBE_MEM_B,
		1319	[BPF_LDX \| BPF_PROBE_MEM \| BPF_H] = &&LDX_PROBE_MEM_H,
		1320	[BPF_LDX \| BPF_PROBE_MEM \| BPF_W] = &&LDX_PROBE_MEM_W,
		1321	[BPF_LDX \| BPF_PROBE_MEM \| BPF_DW] = &&LDX_PROBE_MEM_DW,
1313	};	1322	};
1314	#undef BPF_INSN_3_LBL	1323	#undef BPF_INSN_3_LBL
1315	#undef BPF_INSN_2_LBL	1324	#undef BPF_INSN_2_LBL
@@ -1542,6 +1551,16 @@ out: · 226 unmodified lines
1542	LDST(W, u32)	1551	LDST(W, u32)
1543	LDST(DW, u64)	1552	LDST(DW, u64)
1544	#undef LDST	1553	#undef LDST
		1554	#define LDX_PROBE(SIZEOP, SIZE) \
		1555	LDX_PROBE_MEM_##SIZEOP: \
		1556	bpf_probe_read(&DST, SIZE, (const void *)(long) SRC); \
		1557	CONT;
		1558	LDX_PROBE(B, 1)
		1559	LDX_PROBE(H, 2)
		1560	LDX_PROBE(W, 4)
		1561	LDX_PROBE(DW, 8)
		1562	#undef LDX_PROBE
		1563
1545	STX_XADD_W: /* lock xadd (u32 )(dst_reg + off16) += src_reg */	1564	STX_XADD_W: /* lock xadd (u32 )(dst_reg + off16) += src_reg */
1546	atomic_add((u32) SRC, (atomic_t *)(unsigned long)	1565	atomic_add((u32) SRC, (atomic_t *)(unsigned long)
1547	(DST + insn->off));	1566	(DST + insn->off));

kernel/bpf/verifier.c+8−0

 	case PTR_TO_TCP_SOCK:
 	case PTR_TO_TCP_SOCK_OR_NULL:
 	case PTR_TO_XDP_SOCK:
+	case PTR_TO_BTF_ID:
 		return false;
 	default:
 		return true;
 		case PTR_TO_XDP_SOCK:
 			convert_ctx_access = bpf_xdp_sock_convert_ctx_access;
 			break;
+		case PTR_TO_BTF_ID:
+			if (type == BPF_WRITE) {
+				verbose(env, "Writes through BTF pointers are not allowed\n");
+				return -EINVAL;
+			}
+			insn->code = BPF_LDX | BPF_PROBE_MEM | BPF_SIZE((insn)->code);
+			continue;
 		default:
 			continue;
 		}

bpf: Add support for BTF pointers to interpreter

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code