From: Yafang Shao <laoar.shao@gmail.com>
To: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
kafai@fb.com, songliubraving@fb.com, yhs@fb.com,
john.fastabend@gmail.com, kpsingh@kernel.org, sdf@google.com,
haoluo@google.com, jolsa@kernel.org
Cc: bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
Yafang Shao <laoar.shao@gmail.com>
Subject: [RFC PATCH bpf-next 06/13] bpf: Helpers to alloc and free object id in bpf namespace
Date: Sun, 26 Mar 2023 09:22:01 +0000 [thread overview]
Message-ID: <20230326092208.13613-7-laoar.shao@gmail.com> (raw)
In-Reply-To: <20230326092208.13613-1-laoar.shao@gmail.com>
Introduce generic helpers to alloc bpf_{map,prog,link} in bpf namespace.
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
---
include/linux/bpf_namespace.h | 36 ++++++++++++++++++
kernel/bpf/bpf_namespace.c | 86 +++++++++++++++++++++++++++++++++++++++++++
kernel/bpf/syscall.c | 6 +--
3 files changed, 125 insertions(+), 3 deletions(-)
diff --git a/include/linux/bpf_namespace.h b/include/linux/bpf_namespace.h
index 06aa51f..50bd68c 100644
--- a/include/linux/bpf_namespace.h
+++ b/include/linux/bpf_namespace.h
@@ -38,9 +38,45 @@ struct bpf_namespace {
extern struct bpf_namespace init_bpf_ns;
extern struct proc_ns_operations bpfns_operations;
+extern spinlock_t map_idr_lock;
+extern spinlock_t prog_idr_lock;
+extern spinlock_t link_idr_lock;
struct bpf_namespace *copy_bpfns(unsigned long flags,
struct user_namespace *user_ns,
struct bpf_namespace *old_ns);
void put_bpfns(struct bpf_namespace *ns);
+struct bpf_obj_id *bpf_alloc_obj_id(struct bpf_namespace *ns,
+ void *obj, int type);
+void bpf_free_obj_id(struct bpf_obj_id *obj_id, int type);
+
+/*
+ * The helpers to get the bpf_id's id seen from different namespaces
+ *
+ * bpf_id_nr() : global id, i.e. the id seen from the init namespace;
+ * bpf_id_vnr() : virtual id, i.e. the id seen from the pid namespace of
+ * current.
+ * bpf_id_nr_ns() : id seen from the ns specified.
+ *
+ * see also task_xid_nr() etc in include/linux/sched.h
+ */
+static inline int bpf_obj_id_nr(struct bpf_obj_id *obj_id)
+{
+ if (obj_id)
+ return obj_id->numbers[0].nr;
+ return 0;
+}
+
+static inline int bpf_obj_id_nr_ns(struct bpf_obj_id *obj_id,
+ struct bpf_namespace *ns)
+{
+ if (obj_id && ns->level <= obj_id->level)
+ return obj_id->numbers[ns->level].nr;
+ return 0;
+}
+
+static inline int bpf_obj_id_vnr(struct bpf_obj_id *obj_id)
+{
+ return bpf_obj_id_nr_ns(obj_id, current->nsproxy->bpf_ns);
+}
#endif /* _LINUX_BPF_ID_NS_H */
diff --git a/kernel/bpf/bpf_namespace.c b/kernel/bpf/bpf_namespace.c
index 88a86cd..1e98d1d 100644
--- a/kernel/bpf/bpf_namespace.c
+++ b/kernel/bpf/bpf_namespace.c
@@ -217,3 +217,89 @@ static __init int bpf_namespaces_init(void)
}
late_initcall(bpf_namespaces_init);
+
+struct bpf_obj_id *bpf_alloc_obj_id(struct bpf_namespace *ns,
+ void *obj, int type)
+{
+ struct bpf_namespace *tmp = ns;
+ struct bpf_obj_id *obj_id;
+ spinlock_t *idr_lock;
+ unsigned long flags;
+ int id;
+ int i;
+
+ switch (type) {
+ case MAP_OBJ_ID:
+ idr_lock = &map_idr_lock;
+ break;
+ case PROG_OBJ_ID:
+ idr_lock = &prog_idr_lock;
+ break;
+ case LINK_OBJ_ID:
+ idr_lock = &link_idr_lock;
+ break;
+ default:
+ return ERR_PTR(-EINVAL);
+ }
+
+ obj_id = kmem_cache_alloc(ns->obj_id_cachep, GFP_KERNEL);
+ if (!obj_id)
+ return ERR_PTR(-ENOMEM);
+
+ obj_id->level = ns->level;
+ for (i = ns->level; i >= 0; i--) {
+ idr_preload(GFP_KERNEL);
+ spin_lock_bh(idr_lock);
+ id = idr_alloc_cyclic(&tmp->idr[type], obj, 1, INT_MAX, GFP_ATOMIC);
+ spin_unlock_bh(idr_lock);
+ idr_preload_end();
+ if (id < 0)
+ goto out_free;
+ obj_id->numbers[i].nr = id;
+ obj_id->numbers[i].ns = tmp;
+ tmp = tmp->parent;
+ }
+
+ return obj_id;
+
+out_free:
+ for (; i <= ns->level; i++) {
+ tmp = obj_id->numbers[i].ns;
+ spin_lock_irqsave(idr_lock, flags);
+ idr_remove(&tmp->idr[type], obj_id->numbers[i].nr);
+ spin_unlock_irqrestore(idr_lock, flags);
+ }
+ kmem_cache_free(ns->obj_id_cachep, obj_id);
+ return ERR_PTR(id);
+}
+
+void bpf_free_obj_id(struct bpf_obj_id *obj_id, int type)
+{
+ struct bpf_namespace *ns;
+ spinlock_t *idr_lock;
+ unsigned long flags;
+ int i;
+
+ switch (type) {
+ case MAP_OBJ_ID:
+ idr_lock = &map_idr_lock;
+ break;
+ case PROG_OBJ_ID:
+ idr_lock = &prog_idr_lock;
+ break;
+ case LINK_OBJ_ID:
+ idr_lock = &link_idr_lock;
+ break;
+ default:
+ return;
+ }
+ /* Note that the level-0 should be freed at last */
+ for (i = obj_id->level; i >= 0; i--) {
+ spin_lock_irqsave(idr_lock, flags);
+ ns = obj_id->numbers[i].ns;
+ idr_remove(&ns->idr[type], obj_id->numbers[i].nr);
+ spin_unlock_irqrestore(idr_lock, flags);
+ }
+ ns = obj_id->numbers[obj_id->level].ns;
+ kmem_cache_free(ns->obj_id_cachep, obj_id);
+}
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index ee1297d..f24e550 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -48,11 +48,11 @@
DEFINE_PER_CPU(int, bpf_prog_active);
static DEFINE_IDR(prog_idr);
-static DEFINE_SPINLOCK(prog_idr_lock);
+DEFINE_SPINLOCK(prog_idr_lock);
static DEFINE_IDR(map_idr);
-static DEFINE_SPINLOCK(map_idr_lock);
+DEFINE_SPINLOCK(map_idr_lock);
static DEFINE_IDR(link_idr);
-static DEFINE_SPINLOCK(link_idr_lock);
+DEFINE_SPINLOCK(link_idr_lock);
int sysctl_unprivileged_bpf_disabled __read_mostly =
IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0;
--
1.8.3.1
next prev parent reply other threads:[~2023-03-26 9:22 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-26 9:21 [RFC PATCH bpf-next 00/13] bpf: Introduce BPF namespace Yafang Shao
2023-03-26 9:21 ` [RFC PATCH bpf-next 01/13] fork: New clone3 flag for " Yafang Shao
2023-03-26 9:21 ` [RFC PATCH bpf-next 02/13] proc_ns: Extend the field type in struct proc_ns_operations to long Yafang Shao
2023-03-26 9:21 ` [RFC PATCH bpf-next 03/13] bpf: Implement bpf namespace Yafang Shao
2023-03-26 9:21 ` [RFC PATCH bpf-next 04/13] bpf: No need to check if id is 0 Yafang Shao
2023-03-26 9:22 ` [RFC PATCH bpf-next 05/13] bpf: Make bpf objects id have the same alloc and free pattern Yafang Shao
2023-03-26 9:22 ` Yafang Shao [this message]
2023-03-26 9:22 ` [RFC PATCH bpf-next 07/13] bpf: Add bpf helper to get bpf object id Yafang Shao
2023-03-26 9:22 ` [RFC PATCH bpf-next 08/13] bpf: Alloc and free bpf_map id in bpf namespace Yafang Shao
2023-03-26 10:50 ` Toke Høiland-Jørgensen
2023-03-27 2:44 ` Yafang Shao
2023-03-26 9:22 ` [RFC PATCH bpf-next 09/13] bpf: Alloc and free bpf_prog " Yafang Shao
2023-03-26 9:22 ` [RFC PATCH bpf-next 10/13] bpf: Alloc and free bpf_link " Yafang Shao
2023-03-26 9:22 ` [RFC PATCH bpf-next 11/13] bpf: Allow iterating bpf objects with CAP_BPF " Yafang Shao
2023-03-26 9:22 ` [RFC PATCH bpf-next 12/13] bpf: Use bpf_idr_lock array instead Yafang Shao
2023-03-26 9:22 ` [RFC PATCH bpf-next 13/13] selftests/bpf: Add selftest for bpf namespace Yafang Shao
2023-03-26 10:49 ` [RFC PATCH bpf-next 00/13] bpf: Introduce BPF namespace Toke Høiland-Jørgensen
2023-03-27 3:07 ` Yafang Shao
2023-03-27 20:51 ` Toke Høiland-Jørgensen
2023-03-28 3:48 ` Yafang Shao
2023-03-27 17:28 ` Stanislav Fomichev
2023-03-28 3:42 ` Yafang Shao
2023-03-28 17:15 ` Stanislav Fomichev
2023-03-29 3:02 ` Yafang Shao
2023-03-29 20:50 ` Stanislav Fomichev
2023-03-30 2:40 ` Yafang Shao
2023-03-27 19:03 ` Song Liu
2023-03-28 3:47 ` Yafang Shao
2023-04-02 23:37 ` Alexei Starovoitov
2023-04-03 3:05 ` Yafang Shao
2023-04-03 22:50 ` Alexei Starovoitov
2023-04-04 2:59 ` Yafang Shao
2023-04-06 2:06 ` Alexei Starovoitov
2023-04-06 2:54 ` Yafang Shao
2023-04-06 3:05 ` Alexei Starovoitov
2023-04-06 3:22 ` Yafang Shao
2023-04-06 4:24 ` Alexei Starovoitov
2023-04-06 5:43 ` Yafang Shao
2023-04-06 20:22 ` Andrii Nakryiko
2023-04-07 1:43 ` Alexei Starovoitov
2023-04-07 4:33 ` Yafang Shao
2023-04-07 15:32 ` Alexei Starovoitov
2023-04-07 15:59 ` Andrii Nakryiko
2023-04-07 16:05 ` Alexei Starovoitov
2023-04-07 16:21 ` Yafang Shao
2023-04-07 16:31 ` Alexei Starovoitov
2023-04-07 16:35 ` Yafang Shao
2023-03-31 5:52 ` Hao Luo
2023-04-01 16:32 ` Yafang Shao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230326092208.13613-7-laoar.shao@gmail.com \
--to=laoar.shao@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kafai@fb.com \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sdf@google.com \
--cc=songliubraving@fb.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).