| Message ID | 20231213190842.3844987-1-andrii@kernel.org (mailing list archive) |
|---|---|
| Headers | show |
| Series | BPF token support in libbpf's BPF object | expand |
Hello: This series was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <ast@kernel.org>: On Wed, 13 Dec 2023 11:08:32 -0800 you wrote: > Add fuller support for BPF token in high-level BPF object APIs. This is the > most frequently used way to work with BPF using libbpf, so supporting BPF > token there is critical. > > Patch #1 is improving kernel-side BPF_TOKEN_CREATE behavior by rejecting to > create "empty" BPF token with no delegation. This seems like saner behavior > which also makes libbpf's caching better overall. If we ever want to create > BPF token with no delegate_xxx options set on BPF FS, we can use a new flag to > enable that. > > [...] Here is the summary with links: - [v3,bpf-next,01/10] bpf: fail BPF_TOKEN_CREATE if no delegation option was set on BPF FS https://git.kernel.org/bpf/bpf-next/c/f5fdb51fb980 - [v3,bpf-next,02/10] libbpf: split feature detectors definitions from cached results https://git.kernel.org/bpf/bpf-next/c/c6c5be3eee97 - [v3,bpf-next,03/10] libbpf: further decouple feature checking logic from bpf_object https://git.kernel.org/bpf/bpf-next/c/29c302a2e265 - [v3,bpf-next,04/10] libbpf: move feature detection code into its own file https://git.kernel.org/bpf/bpf-next/c/ab8fc393b27c - [v3,bpf-next,05/10] libbpf: wire up token_fd into feature probing logic https://git.kernel.org/bpf/bpf-next/c/a75bb6a16518 - [v3,bpf-next,06/10] libbpf: wire up BPF token support at BPF object level https://git.kernel.org/bpf/bpf-next/c/1d0dd6ea2e38 - [v3,bpf-next,07/10] selftests/bpf: add BPF object loading tests with explicit token passing https://git.kernel.org/bpf/bpf-next/c/98e0eaa36adf - [v3,bpf-next,08/10] selftests/bpf: add tests for BPF object load with implicit token https://git.kernel.org/bpf/bpf-next/c/18678cf0ee13 - [v3,bpf-next,09/10] libbpf: support BPF token path setting through LIBBPF_BPF_TOKEN_PATH envvar https://git.kernel.org/bpf/bpf-next/c/ed54124b8805 - [v3,bpf-next,10/10] selftests/bpf: add tests for LIBBPF_BPF_TOKEN_PATH envvar https://git.kernel.org/bpf/bpf-next/c/322122bf8c75 You are awesome, thank you!
Andrii Nakryiko wrote: > Add fuller support for BPF token in high-level BPF object APIs. This is the > most frequently used way to work with BPF using libbpf, so supporting BPF > token there is critical. > > Patch #1 is improving kernel-side BPF_TOKEN_CREATE behavior by rejecting to > create "empty" BPF token with no delegation. This seems like saner behavior > which also makes libbpf's caching better overall. If we ever want to create > BPF token with no delegate_xxx options set on BPF FS, we can use a new flag to > enable that. > > Patches #2-#5 refactor libbpf internals, mostly feature detection code, to > prepare it from BPF token FD. > > Patch #6 adds options to pass BPF token into BPF object open options. It also > adds implicit BPF token creation logic to BPF object load step, even without > any explicit involvement of the user. If the environment is setup properly, > BPF token will be created transparently and used implicitly. This allows for > all existing application to gain BPF token support by just linking with > latest version of libbpf library. No source code modifications are required. > All that under assumption that privileged container management agent properly > set up default BPF FS instance at /sys/bpf/fs to allow BPF token creation. > > Patches #7-#8 adds more selftests, validating BPF object APIs work as expected > under unprivileged user namespaced conditions in the presence of BPF token. > > Patch #9 extends libbpf with LIBBPF_BPF_TOKEN_PATH envvar knowledge, which can > be used to override custom BPF FS location used for implicit BPF token > creation logic without needing to adjust application code. This allows admins > or container managers to mount BPF token-enabled BPF FS at non-standard > location without the need to coordinate with applications. > LIBBPF_BPF_TOKEN_PATH can also be used to disable BPF token implicit creation > by setting it to an empty value. Patch #10 tests this new envvar functionality. > > v2->v3: > - move some stray feature cache refactorings into patch #4 (Alexei); > - add LIBBPF_BPF_TOKEN_PATH envvar support (Alexei); We can do same thing from golang ebpf lib when we get around to adding it. Looks good to me. I see its merged but, Ack for me. > v1->v2: > - remove minor code redundancies (Eduard, John); > - add acks and rebase. > > Andrii Nakryiko (10): > bpf: fail BPF_TOKEN_CREATE if no delegation option was set on BPF FS > libbpf: split feature detectors definitions from cached results > libbpf: further decouple feature checking logic from bpf_object > libbpf: move feature detection code into its own file > libbpf: wire up token_fd into feature probing logic > libbpf: wire up BPF token support at BPF object level > selftests/bpf: add BPF object loading tests with explicit token > passing > selftests/bpf: add tests for BPF object load with implicit token > libbpf: support BPF token path setting through LIBBPF_BPF_TOKEN_PATH > envvar > selftests/bpf: add tests for LIBBPF_BPF_TOKEN_PATH envvar > > kernel/bpf/token.c | 10 +- > tools/lib/bpf/Build | 2 +- > tools/lib/bpf/bpf.c | 9 +- > tools/lib/bpf/btf.c | 7 +- > tools/lib/bpf/elf.c | 2 - > tools/lib/bpf/features.c | 478 +++++++++++++++ > tools/lib/bpf/libbpf.c | 573 ++++-------------- > tools/lib/bpf/libbpf.h | 37 +- > tools/lib/bpf/libbpf_internal.h | 36 +- > tools/lib/bpf/libbpf_probes.c | 8 +- > tools/lib/bpf/str_error.h | 3 + > .../testing/selftests/bpf/prog_tests/token.c | 347 +++++++++++ > tools/testing/selftests/bpf/progs/priv_map.c | 13 + > tools/testing/selftests/bpf/progs/priv_prog.c | 13 + > 14 files changed, 1065 insertions(+), 473 deletions(-) > create mode 100644 tools/lib/bpf/features.c > create mode 100644 tools/testing/selftests/bpf/progs/priv_map.c > create mode 100644 tools/testing/selftests/bpf/progs/priv_prog.c > > -- > 2.34.1 > >
Add fuller support for BPF token in high-level BPF object APIs. This is the most frequently used way to work with BPF using libbpf, so supporting BPF token there is critical. Patch #1 is improving kernel-side BPF_TOKEN_CREATE behavior by rejecting to create "empty" BPF token with no delegation. This seems like saner behavior which also makes libbpf's caching better overall. If we ever want to create BPF token with no delegate_xxx options set on BPF FS, we can use a new flag to enable that. Patches #2-#5 refactor libbpf internals, mostly feature detection code, to prepare it from BPF token FD. Patch #6 adds options to pass BPF token into BPF object open options. It also adds implicit BPF token creation logic to BPF object load step, even without any explicit involvement of the user. If the environment is setup properly, BPF token will be created transparently and used implicitly. This allows for all existing application to gain BPF token support by just linking with latest version of libbpf library. No source code modifications are required. All that under assumption that privileged container management agent properly set up default BPF FS instance at /sys/bpf/fs to allow BPF token creation. Patches #7-#8 adds more selftests, validating BPF object APIs work as expected under unprivileged user namespaced conditions in the presence of BPF token. Patch #9 extends libbpf with LIBBPF_BPF_TOKEN_PATH envvar knowledge, which can be used to override custom BPF FS location used for implicit BPF token creation logic without needing to adjust application code. This allows admins or container managers to mount BPF token-enabled BPF FS at non-standard location without the need to coordinate with applications. LIBBPF_BPF_TOKEN_PATH can also be used to disable BPF token implicit creation by setting it to an empty value. Patch #10 tests this new envvar functionality. v2->v3: - move some stray feature cache refactorings into patch #4 (Alexei); - add LIBBPF_BPF_TOKEN_PATH envvar support (Alexei); v1->v2: - remove minor code redundancies (Eduard, John); - add acks and rebase. Andrii Nakryiko (10): bpf: fail BPF_TOKEN_CREATE if no delegation option was set on BPF FS libbpf: split feature detectors definitions from cached results libbpf: further decouple feature checking logic from bpf_object libbpf: move feature detection code into its own file libbpf: wire up token_fd into feature probing logic libbpf: wire up BPF token support at BPF object level selftests/bpf: add BPF object loading tests with explicit token passing selftests/bpf: add tests for BPF object load with implicit token libbpf: support BPF token path setting through LIBBPF_BPF_TOKEN_PATH envvar selftests/bpf: add tests for LIBBPF_BPF_TOKEN_PATH envvar kernel/bpf/token.c | 10 +- tools/lib/bpf/Build | 2 +- tools/lib/bpf/bpf.c | 9 +- tools/lib/bpf/btf.c | 7 +- tools/lib/bpf/elf.c | 2 - tools/lib/bpf/features.c | 478 +++++++++++++++ tools/lib/bpf/libbpf.c | 573 ++++-------------- tools/lib/bpf/libbpf.h | 37 +- tools/lib/bpf/libbpf_internal.h | 36 +- tools/lib/bpf/libbpf_probes.c | 8 +- tools/lib/bpf/str_error.h | 3 + .../testing/selftests/bpf/prog_tests/token.c | 347 +++++++++++ tools/testing/selftests/bpf/progs/priv_map.c | 13 + tools/testing/selftests/bpf/progs/priv_prog.c | 13 + 14 files changed, 1065 insertions(+), 473 deletions(-) create mode 100644 tools/lib/bpf/features.c create mode 100644 tools/testing/selftests/bpf/progs/priv_map.c create mode 100644 tools/testing/selftests/bpf/progs/priv_prog.c