[bpf-next,v2,0/3] bpf: allow ctx writes using BPF_ST_MEM instruction

Message

Eduard Zingerman March 4, 2023, 1:12 a.m. UTC

Changes v1 -> v2, suggested by Alexei:
- Resolved conflict with recent commit:
  6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier");
- Variable `ctx_access` removed in function `convert_ctx_accesses()`;
- Macro `BPF_COPY_STORE` renamed to `BPF_EMIT_STORE` and fixed to
  correctly extract original store instruction class from code.
  
Original message follows:

The function verifier.c:convert_ctx_access() applies some rewrites to BPF
instructions that read from or write to the BPF program context.
For example, the write instruction for the `struct bpf_sockopt::retval`
field:

    *(u32 *)(r1 + offsetof(struct bpf_sockopt, retval)) = r2

Is transformed to:

    *(u64 *)(r1 + offsetof(struct bpf_sockopt_kern, tmp_reg)) = r9
    r9 = *(u64 *)(r1 + offsetof(struct bpf_sockopt_kern, current_task))
    r9 = *(u64 *)(r9 + offsetof(struct task_struct, bpf_ctx))
    *(u32 *)(r9 + offsetof(struct bpf_cg_run_ctx, retval)) = r2
    r9 = *(u64 *)(r1 + offsetof(struct bpf_sockopt_kern, tmp_reg))
    
Currently, the verifier only supports such transformations for LDX
(memory-to-register read) and STX (register-to-memory write) instructions.
Error is reported for ST instructions (immediate-to-memory write).
This is fine because clang does not currently emit ST instructions.

However, new `-mcpu=v4` clang flag is planned, which would allow to emit
ST instructions (discussed in [1]).

This patch-set adjusts the verifier to support ST instructions in
`verifier.c:convert_ctx_access()`.

The patches #1 and #2 were previously shared as part of RFC [2]. The
changes compared to that RFC are:
- In patch #1, a bug in the handling of the
  `struct __sk_buff::queue_mapping` field was fixed.
- Patch #3 is added, which is a set of disassembler-based test cases for
  context access rewrites. The test cases cover all fields for which the
  handling code is modified in patch #1.

[1] Propose some new instructions for -mcpu=v4
    https://lore.kernel.org/bpf/[e-mail]/
[2] RFC Support for BPF_ST instruction in LLVM C compiler
    https://lore.kernel.org/bpf/[e-mail]/
[3] v1
    https://lore.kernel.org/bpf/[e-mail]/

Eduard Zingerman (3):
  bpf: allow ctx writes using BPF_ST_MEM instruction
  selftests/bpf: test if pointer type is tracked for BPF_ST_MEM
  selftests/bpf: Disassembler tests for verifier.c:convert_ctx_access()

 kernel/bpf/cgroup.c                           |  49 +-
 kernel/bpf/verifier.c                         | 110 +--
 net/core/filter.c                             |  79 +-
 tools/testing/selftests/bpf/Makefile          |   2 +-
 tools/testing/selftests/bpf/disasm.c          |   1 +
 tools/testing/selftests/bpf/disasm.h          |   1 +
 .../selftests/bpf/prog_tests/ctx_rewrite.c    | 917 ++++++++++++++++++
 tools/testing/selftests/bpf/verifier/ctx.c    |  11 -
 tools/testing/selftests/bpf/verifier/unpriv.c |  23 +
 9 files changed, 1069 insertions(+), 124 deletions(-)
 create mode 120000 tools/testing/selftests/bpf/disasm.c
 create mode 120000 tools/testing/selftests/bpf/disasm.h
 create mode 100644 tools/testing/selftests/bpf/prog_tests/ctx_rewrite.c

Comments

[e-mail] March 4, 2023, 5:50 a.m. UTC | #1

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <[e-mail]>:

On Sat,  4 Mar 2023 03:12:44 +0200 you wrote:
> Changes v1 -> v2, suggested by Alexei:
> - Resolved conflict with recent commit:
>   6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier");
> - Variable `ctx_access` removed in function `convert_ctx_accesses()`;
> - Macro `BPF_COPY_STORE` renamed to `BPF_EMIT_STORE` and fixed to
>   correctly extract original store instruction class from code.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v2,1/3] bpf: allow ctx writes using BPF_ST_MEM instruction
    https://git.kernel.org/bpf/bpf-next/c/0d80a619c113
  - [bpf-next,v2,2/3] selftests/bpf: test if pointer type is tracked for BPF_ST_MEM
    https://git.kernel.org/bpf/bpf-next/c/806f81cd1ee3
  - [bpf-next,v2,3/3] selftests/bpf: Disassembler tests for verifier.c:convert_ctx_access()
    https://git.kernel.org/bpf/bpf-next/c/71cf4d027ad5

You are awesome, thank you!