From: Jean-Philippe Brucker <jean-philippe@linaro.org> To: linux-arm-kernel@lists.infradead.org, bpf@vger.kernel.org Cc: catalin.marinas@arm.com, will@kernel.org, daniel@iogearbox.net, ast@kernel.org, zlim.lnx@gmail.com, kafai@fb.com, songliubraving@fb.com, yhs@fb.com, andriin@fb.com, john.fastabend@gmail.com, kpsingh@chromium.org, Jean-Philippe Brucker <jean-philippe@linaro.org> Subject: [PATCH bpf-next 0/1] arm64: Add BPF exception tables Date: Tue, 28 Jul 2020 17:21:24 +0200 [thread overview] Message-ID: <20200728152122.1292756-1-jean-philippe@linaro.org> (raw) The following patch adds support for BPF_PROBE_MEM on arm64. The implementation is simple but I wanted to give a bit of background first. If you're familiar with recent BPF development you can skip to the patch (or fact-check the following blurb). BPF programs used for tracing can inspect any of the traced function's arguments and follow pointers in struct members. Traditionally the BPF program would get a struct pt_regs as argument and cast the register values to the appropriate struct pointer. The BPF verifier would mandate that any memory access uses the bpf_probe_read() helper, to suppress page faults (see samples/bpf/tracex1_kern.c). With BPF Type Format embedded into the kernel (CONFIG_DEBUG_INFO_BTF), the verifier can now check the type of any access performed by a BPF program. It rejects for example programs that cast to a different structure and perform out-of-bounds accesses, or programs that attempt to dereference something that isn't a pointer, or that hasn't gone through a NULL check. As this makes tracing programs safer, the verifier now allows loading programs that access struct members without bpf_probe_read(). It is however still possible to trigger page faults. For example in the following example with which I've tested this patch, the verifier does not mandate a NULL check for the second-level pointer: /* * From tools/testing/selftests/bpf/progs/bpf_iter_task.c * dump_task() is called for each task. */ SEC("iter/task") int dump_task(struct bpf_iter__task *ctx) { struct seq_file *seq = ctx->meta->seq; struct task_struct *task = ctx->task; /* Program would be rejected without this check */ if (task == NULL) return 0; /* * However the verifier does not currently mandate * checking task->mm, and the following faults for kernel * threads. */ BPF_SEQ_PRINTF(seq, "pid=%d vm=%d", task->pid, task->mm->total_vm); return 0; } Even if it checked this case, the verifier couldn't guarantee that all accesses are safe since kernel structures could in theory contain garbage or error pointers. So to allow fast access without bpf_probe_read(), a JIT implementation must support BPF exception tables. For each access to a BTF pointer, the JIT generates an entry into an exception table appended to the BPF program. If the access faults at runtime, the handler skips the faulting instruction. The example above will display vm=0 for kernel threads. See also * The original implementation on x86 https://lore.kernel.org/bpf/20191016032505.2089704-1-ast@kernel.org/ * The s390 implementation https://lore.kernel.org/bpf/20200715233301.933201-1-iii@linux.ibm.com/ Jean-Philippe Brucker (1): arm64: bpf: Add BPF exception tables arch/arm64/include/asm/extable.h | 3 ++ arch/arm64/mm/extable.c | 11 ++-- arch/arm64/net/bpf_jit_comp.c | 93 +++++++++++++++++++++++++++++--- 3 files changed, 98 insertions(+), 9 deletions(-) -- 2.27.0
WARNING: multiple messages have this Message-ID (diff)
From: Jean-Philippe Brucker <jean-philippe@linaro.org> To: linux-arm-kernel@lists.infradead.org, bpf@vger.kernel.org Cc: Jean-Philippe Brucker <jean-philippe@linaro.org>, songliubraving@fb.com, andriin@fb.com, daniel@iogearbox.net, catalin.marinas@arm.com, john.fastabend@gmail.com, ast@kernel.org, zlim.lnx@gmail.com, kpsingh@chromium.org, yhs@fb.com, will@kernel.org, kafai@fb.com Subject: [PATCH bpf-next 0/1] arm64: Add BPF exception tables Date: Tue, 28 Jul 2020 17:21:24 +0200 [thread overview] Message-ID: <20200728152122.1292756-1-jean-philippe@linaro.org> (raw) The following patch adds support for BPF_PROBE_MEM on arm64. The implementation is simple but I wanted to give a bit of background first. If you're familiar with recent BPF development you can skip to the patch (or fact-check the following blurb). BPF programs used for tracing can inspect any of the traced function's arguments and follow pointers in struct members. Traditionally the BPF program would get a struct pt_regs as argument and cast the register values to the appropriate struct pointer. The BPF verifier would mandate that any memory access uses the bpf_probe_read() helper, to suppress page faults (see samples/bpf/tracex1_kern.c). With BPF Type Format embedded into the kernel (CONFIG_DEBUG_INFO_BTF), the verifier can now check the type of any access performed by a BPF program. It rejects for example programs that cast to a different structure and perform out-of-bounds accesses, or programs that attempt to dereference something that isn't a pointer, or that hasn't gone through a NULL check. As this makes tracing programs safer, the verifier now allows loading programs that access struct members without bpf_probe_read(). It is however still possible to trigger page faults. For example in the following example with which I've tested this patch, the verifier does not mandate a NULL check for the second-level pointer: /* * From tools/testing/selftests/bpf/progs/bpf_iter_task.c * dump_task() is called for each task. */ SEC("iter/task") int dump_task(struct bpf_iter__task *ctx) { struct seq_file *seq = ctx->meta->seq; struct task_struct *task = ctx->task; /* Program would be rejected without this check */ if (task == NULL) return 0; /* * However the verifier does not currently mandate * checking task->mm, and the following faults for kernel * threads. */ BPF_SEQ_PRINTF(seq, "pid=%d vm=%d", task->pid, task->mm->total_vm); return 0; } Even if it checked this case, the verifier couldn't guarantee that all accesses are safe since kernel structures could in theory contain garbage or error pointers. So to allow fast access without bpf_probe_read(), a JIT implementation must support BPF exception tables. For each access to a BTF pointer, the JIT generates an entry into an exception table appended to the BPF program. If the access faults at runtime, the handler skips the faulting instruction. The example above will display vm=0 for kernel threads. See also * The original implementation on x86 https://lore.kernel.org/bpf/20191016032505.2089704-1-ast@kernel.org/ * The s390 implementation https://lore.kernel.org/bpf/20200715233301.933201-1-iii@linux.ibm.com/ Jean-Philippe Brucker (1): arm64: bpf: Add BPF exception tables arch/arm64/include/asm/extable.h | 3 ++ arch/arm64/mm/extable.c | 11 ++-- arch/arm64/net/bpf_jit_comp.c | 93 +++++++++++++++++++++++++++++--- 3 files changed, 98 insertions(+), 9 deletions(-) -- 2.27.0 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2020-07-28 15:35 UTC|newest] Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-07-28 15:21 Jean-Philippe Brucker [this message] 2020-07-28 15:21 ` [PATCH bpf-next 0/1] arm64: Add BPF exception tables Jean-Philippe Brucker 2020-07-28 15:21 ` [PATCH bpf-next 1/1] arm64: bpf: " Jean-Philippe Brucker 2020-07-28 15:21 ` Jean-Philippe Brucker 2020-07-29 17:28 ` Song Liu 2020-07-29 17:28 ` Song Liu 2020-07-29 21:29 ` Daniel Borkmann 2020-07-29 21:29 ` Daniel Borkmann 2020-07-30 8:28 ` Jean-Philippe Brucker 2020-07-30 8:28 ` Jean-Philippe Brucker 2020-07-30 12:28 ` Qian Cai 2020-07-30 12:28 ` Qian Cai 2020-07-30 14:22 ` Jean-Philippe Brucker 2020-07-30 14:22 ` Jean-Philippe Brucker 2020-07-30 19:47 ` Daniel Borkmann 2020-07-30 19:47 ` Daniel Borkmann 2020-07-30 21:14 ` Jean-Philippe Brucker 2020-07-30 21:14 ` Jean-Philippe Brucker 2020-07-30 22:45 ` Daniel Borkmann 2020-07-30 22:45 ` Daniel Borkmann 2021-06-09 12:04 ` [PATCH bpf-next 0/1] arm64: " Ravi Bangoria 2021-06-09 12:04 ` Ravi Bangoria 2021-06-11 0:12 ` Alexei Starovoitov 2021-06-11 0:12 ` Alexei Starovoitov 2021-06-17 6:58 ` Ravi Bangoria 2021-06-17 6:58 ` Ravi Bangoria 2021-06-18 16:34 ` Alexei Starovoitov 2021-06-18 16:34 ` Alexei Starovoitov 2021-06-22 7:10 ` Ravi Bangoria 2021-06-22 7:10 ` Ravi Bangoria 2021-06-22 11:00 ` [PATCH] x86 bpf: Fix extable offset calculation Ravi Bangoria 2021-06-25 4:01 ` Alexei Starovoitov 2021-06-25 6:22 ` Ravi Bangoria 2021-06-25 15:07 ` Alexei Starovoitov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200728152122.1292756-1-jean-philippe@linaro.org \ --to=jean-philippe@linaro.org \ --cc=andriin@fb.com \ --cc=ast@kernel.org \ --cc=bpf@vger.kernel.org \ --cc=catalin.marinas@arm.com \ --cc=daniel@iogearbox.net \ --cc=john.fastabend@gmail.com \ --cc=kafai@fb.com \ --cc=kpsingh@chromium.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=songliubraving@fb.com \ --cc=will@kernel.org \ --cc=yhs@fb.com \ --cc=zlim.lnx@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.