History

bpf, x86: Attach a cookie to fentry/fexit/fmod_ret/lsm.

Pass a cookie along with BPF_LINK_CREATE requests. Add a bpf_cookie field to struct bpf_tracing_link to attach a cookie. The cookie of a bpf_tracing_link is available by calling bpf_get_attach_cookie when running the BPF program of the attached link. The value of a cookie will be set at bpf_tramp_run_ctx by the trampoline of the link.

Kui-Feng Lee committed 4 years ago

Commit 2fcc8241 parent e384c7b8 files · +69 −8Browse files

Showing the changes to kernel (4 of 8 files). Show all

Unified · Split

4 files
  1. kernel/bpf/bpf_lsm.c +17 −0
  2. kernel/bpf/syscall.c +8 −4
  3. kernel/bpf/trampoline.c +5 −2
  4. kernel/trace/bpf_trace.c +17 −0
kernel/bpf/bpf_lsm.c+17−0
@@ -117,6 +117,21 @@ static const struct bpf_func_proto bpf_ima_file_hash_proto = { · 116 unmodified lines
117117 .allowed = bpf_ima_inode_hash_allowed,
118118 };
119119
120+BPF_CALL_1(bpf_get_attach_cookie, void *, ctx)
121+{
122+ struct bpf_trace_run_ctx *run_ctx;
123+
124+ run_ctx = container_of(current->bpf_ctx, struct bpf_trace_run_ctx, run_ctx);
125+ return run_ctx->bpf_cookie;
126+}
127+
128+static const struct bpf_func_proto bpf_get_attach_cookie_proto = {
129+ .func = bpf_get_attach_cookie,
130+ .gpl_only = false,
131+ .ret_type = RET_INTEGER,
132+ .arg1_type = ARG_PTR_TO_CTX,
133+};
134+
120135 static const struct bpf_func_proto *
121136 bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
122137 {
@@ -141,6 +156,8 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) · 18 unmodified lines
141156 return prog->aux->sleepable ? &bpf_ima_inode_hash_proto : NULL;
142157 case BPF_FUNC_ima_file_hash:
143158 return prog->aux->sleepable ? &bpf_ima_file_hash_proto : NULL;
159+ case BPF_FUNC_get_attach_cookie:
160+ return bpf_prog_has_trampoline(prog) ? &bpf_get_attach_cookie_proto : NULL;
144161 default:
145162 return tracing_prog_func_proto(func_id, prog);
146163 }
kernel/bpf/syscall.c+8−4
@@ -2921,7 +2921,8 @@ static const struct bpf_link_ops bpf_tracing_link_lops = { · 2920 unmodified lines
29212921
29222922 static int bpf_tracing_prog_attach(struct bpf_prog *prog,
29232923 int tgt_prog_fd,
2924− u32 btf_id)
2924+ u32 btf_id,
2925+ u64 bpf_cookie)
29252926 {
29262927 struct bpf_link_primer link_primer;
29272928 struct bpf_prog *tgt_prog = NULL;
@@ -2986,6 +2987,7 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, · 58 unmodified lines
29862987 bpf_link_init(&link->link.link, BPF_LINK_TYPE_TRACING,
29872988 &bpf_tracing_link_lops, prog);
29882989 link->attach_type = prog->expected_attach_type;
2990+ link->link.cookie = bpf_cookie;
29892991
29902992 mutex_lock(&prog->aux->dst_mutex);
29912993
@@ -3271,7 +3273,7 @@ static int bpf_raw_tp_link_attach(struct bpf_prog *prog, · 279 unmodified lines
32713273 tp_name = prog->aux->attach_func_name;
32723274 break;
32733275 }
3274− return bpf_tracing_prog_attach(prog, 0, 0);
3276+ return bpf_tracing_prog_attach(prog, 0, 0, 0);
32753277 case BPF_PROG_TYPE_RAW_TRACEPOINT:
32763278 case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
32773279 if (strncpy_from_user(buf, user_tp_name, sizeof(buf) - 1) < 0)
@@ -4524,7 +4526,8 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr) · 1246 unmodified lines
45244526 case BPF_PROG_TYPE_EXT:
45254527 ret = bpf_tracing_prog_attach(prog,
45264528 attr->link_create.target_fd,
4527− attr->link_create.target_btf_id);
4529+ attr->link_create.target_btf_id,
4530+ attr->link_create.tracing.cookie);
45284531 break;
45294532 case BPF_PROG_TYPE_LSM:
45304533 case BPF_PROG_TYPE_TRACING:
@@ -4539,7 +4542,8 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr) · 8 unmodified lines
45394542 else
45404543 ret = bpf_tracing_prog_attach(prog,
45414544 attr->link_create.target_fd,
4542− attr->link_create.target_btf_id);
4545+ attr->link_create.target_btf_id,
4546+ attr->link_create.tracing.cookie);
45434547 break;
45444548 case BPF_PROG_TYPE_FLOW_DISSECTOR:
45454549 case BPF_PROG_TYPE_SK_LOOKUP:
kernel/bpf/trampoline.c+5−2
@@ -30,9 +30,12 @@ static DEFINE_MUTEX(trampoline_mutex); · 29 unmodified lines
3030 bool bpf_prog_has_trampoline(const struct bpf_prog *prog)
3131 {
3232 enum bpf_attach_type eatype = prog->expected_attach_type;
33+ enum bpf_prog_type ptype = prog->type;
3334
34− return eatype == BPF_TRACE_FENTRY || eatype == BPF_TRACE_FEXIT ||
35− eatype == BPF_MODIFY_RETURN;
35+ return (ptype == BPF_PROG_TYPE_TRACING &&
36+ (eatype == BPF_TRACE_FENTRY || eatype == BPF_TRACE_FEXIT ||
37+ eatype == BPF_MODIFY_RETURN)) ||
38+ (ptype == BPF_PROG_TYPE_LSM && eatype == BPF_LSM_MAC);
3639 }
3740
3841 void *bpf_jit_alloc_exec_page(void)
kernel/trace/bpf_trace.c+17−0
@@ -1091,6 +1091,21 @@ static const struct bpf_func_proto bpf_get_attach_cookie_proto_pe = { · 1090 unmodified lines
10911091 .arg1_type = ARG_PTR_TO_CTX,
10921092 };
10931093
1094+BPF_CALL_1(bpf_get_attach_cookie_tracing, void *, ctx)
1095+{
1096+ struct bpf_trace_run_ctx *run_ctx;
1097+
1098+ run_ctx = container_of(current->bpf_ctx, struct bpf_trace_run_ctx, run_ctx);
1099+ return run_ctx->bpf_cookie;
1100+}
1101+
1102+static const struct bpf_func_proto bpf_get_attach_cookie_proto_tracing = {
1103+ .func = bpf_get_attach_cookie_tracing,
1104+ .gpl_only = false,
1105+ .ret_type = RET_INTEGER,
1106+ .arg1_type = ARG_PTR_TO_CTX,
1107+};
1108+
10941109 BPF_CALL_3(bpf_get_branch_snapshot, void *, buf, u32, size, u64, flags)
10951110 {
10961111 #ifndef CONFIG_X86
@@ -1719,6 +1734,8 @@ tracing_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) · 622 unmodified lines
17191734 return bpf_prog_has_trampoline(prog) ? &bpf_get_func_ret_proto : NULL;
17201735 case BPF_FUNC_get_func_arg_cnt:
17211736 return bpf_prog_has_trampoline(prog) ? &bpf_get_func_arg_cnt_proto : NULL;
1737+ case BPF_FUNC_get_attach_cookie:
1738+ return bpf_prog_has_trampoline(prog) ? &bpf_get_attach_cookie_proto_tracing : NULL;
17221739 default:
17231740 fn = raw_tp_prog_func_proto(func_id, prog);
17241741 if (!fn && prog->expected_attach_type == BPF_TRACE_ITER)