From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: Matt Cover <werekraken@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>,
"David S. Miller" <davem@davemloft.net>,
Matthew Cover <matthew.cover@stackpath.com>,
netdev <netdev@vger.kernel.org>, bpf <bpf@vger.kernel.org>,
kernel-team@fb.com
Subject: Re: unstable bpf helpers proposal. Was: [PATCH bpf-next v2 1/2] bpf: add bpf_ct_lookup_{tcp,udp}() helpers
Date: Mon, 6 Apr 2020 20:03:03 -0700 [thread overview]
Message-ID: <20200407030303.ffs7xxruuktss5fs@ast-mbp.dhcp.thefacebook.com> (raw)
In-Reply-To: <CAGyo_hrcibFyz=b=+y=yO_yapw=TbtbO8d1vGPSLpTU0Y2gzBw@mail.gmail.com>
On Fri, Apr 03, 2020 at 04:56:01PM -0700, Matt Cover wrote:
> > I think doing BTF annotation for EXPORT_SYMBOL_BPF(bpf_icmp_send); is trivial.
>
> I've been looking into this more; here is what I'm thinking.
>
> 1. Export symbols for bpf the same as modules, but into one or more
> special namespaces.
>
> Exported symbols recently gained namespaces.
> https://lore.kernel.org/linux-usb/20190906103235.197072-1-maennich@google.com/
> Documentation/kbuild/namespaces.rst
>
> This makes the in-kernel changes needed for export super simple.
>
> #define EXPORT_SYMBOL_BPF(sym) EXPORT_SYMBOL_NS(sym, BPF_PROG)
> #define EXPORT_SYMBOL_BPF_GPL(sym) EXPORT_SYMBOL_NS_GPL(sym, BPF_PROG)
>
> BPF_PROG is our special namespace above. We can easily add
> BPF_PROG_ACQUIRES and BPF_PROG_RELEASES for those types of
> unstable helpers.
>
> Exports for bpf progs are then as simple as for modules.
>
> EXPORT_SYMBOL_BPF(bpf_icmp_send);
>
> Documenting these namespaces as not for use by modules should be
> enough; an explicit import statement to use namespaced symbols is
> already required. Explicitly preventing module use in
> MODULE_IMPORT_NS or modpost are also options if we feel more is
> needed.
>
> 2. Teach pahole's (dwarves') dwarf loader to parse __ksymtab*.
>
> I've got a functional wip which retrieves the namespace from the
> __kstrtab ELF section. Working to differentiate between __ksymtab
> and __ksymtab_gpl symbols next. Good news is this info is readily
> available in vmlinux and module .o files. The interface here will
> probably end up similar to dwarves' elf_symtab__*, but with an
> struct elf_ksymtab per __ksymtab* section (all pointing to the
> same __kstrtab section though).
>
> 3. Teach pahole's btf encoder to encode the following bools: export,
> gpl_only, acquires, releases.
>
> I'm envisioning this info will end up in a new struct
> btf_func_proto in btf.h. Perhaps like this.
>
> struct btf_func_proto {
> /* "info" bits arrangement
> * bit 0: exported (callable by bpf prog)
> * bit 1: gpl_only (only callable from GPL licensed bpf prog)
> * bit 2: acquires (acquires and returns a refcounted pointer)
> * bit 3: releases (first argument, a refcounted pointer,
> is released)
> * bits 4-31: unused
> */
> __u32 info;
> };
>
> Currently, a "struct btf_type" of type BTF_KIND_FUNC_PROTO is
> directly followed by vlen struct btf_param/s. I'm hoping we can
> insert btf_func_proto before the first btf_param or after the
> last. If that's not workable, adding a new type,
> BTF_KIND_FUNC_EXPORT, is another idea.
I don't see why 1 and 2 are necessary.
What is the value of true export_symbol here?
What is the value of namespaced true export_symbol?
Imo it only adds memory overhead to vmlinux.
The same information is available in BTF as a _name_.
What is the point to replicate it into kcrc?
Imo kcrc is a poor protection mechanism that is already worse
that BTF. I really don't see a value going that route.
I think just encoding the intent to export into BTF is enough.
Option 3 above looks like overkill too. Just name convention would do.
We already use different prefixes to encode certain BTFs
(see struct_ops and btf_trace).
Just say when BTF func_proto starts with "export_" it means it's exported.
It would be trivial for users to grep as well:
bpftool btf dump file ./vmlinux |grep export_
>
> The crcs could be used to improve the developer experience when
> using unstable helpers.
crc don't add any additional value on top of BTF. BTF types has to match exactly.
It's like C compiler checking that you can call a function with correct proto.
next prev parent reply other threads:[~2020-04-07 3:03 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-18 0:01 [PATCH bpf-next] bpf: add bpf_ct_lookup_{tcp,udp}() helpers Matthew Cover
2020-01-18 11:37 ` kbuild test robot
2020-01-18 11:58 ` kbuild test robot
2020-01-19 3:05 ` John Fastabend
2020-01-20 18:11 ` Matt Cover
2020-01-20 20:10 ` Matt Cover
2020-01-20 21:11 ` Daniel Borkmann
2020-01-20 21:21 ` Matt Cover
2020-01-23 21:28 ` Matt Cover
2020-01-21 20:20 ` [PATCH bpf-next v2 1/2] " Matthew Cover
2020-01-21 20:22 ` [PATCH bpf-next v2 2/2] selftests/bpf: test references to nf_conn Matthew Cover
2020-01-21 20:35 ` [PATCH bpf-next v2 1/2] bpf: add bpf_ct_lookup_{tcp,udp}() helpers Matt Cover
2020-01-21 21:31 ` Matt Cover
2020-01-24 19:11 ` Joe Stringer
2020-01-24 21:46 ` Matt Cover
2020-01-30 21:53 ` unstable bpf helpers proposal. Was: " Alexei Starovoitov
2020-02-06 6:13 ` Matt Cover
2020-02-20 4:45 ` Alexei Starovoitov
2020-04-03 23:56 ` Matt Cover
2020-04-07 3:03 ` Alexei Starovoitov [this message]
2020-04-07 5:28 ` Matt Cover
2020-04-07 17:34 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200407030303.ffs7xxruuktss5fs@ast-mbp.dhcp.thefacebook.com \
--to=alexei.starovoitov@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=kernel-team@fb.com \
--cc=matthew.cover@stackpath.com \
--cc=netdev@vger.kernel.org \
--cc=werekraken@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).