From: "Toke Høiland-Jørgensen" <toke@redhat.com>
To: Alexei Starovoitov <ast@kernel.org>, davem@davemloft.net
Cc: daniel@iogearbox.net, netdev@vger.kernel.org,
bpf@vger.kernel.org, kernel-team@fb.com
Subject: Re: [PATCH bpf-next 3/6] bpf: Introduce function-by-function verification
Date: Wed, 08 Jan 2020 11:28:21 +0100 [thread overview]
Message-ID: <87y2uigs3e.fsf@toke.dk> (raw)
In-Reply-To: <20200108072538.3359838-4-ast@kernel.org>
Alexei Starovoitov <ast@kernel.org> writes:
> New llvm and old llvm with libbpf help produce BTF that distinguish global and
> static functions. Unlike arguments of static function the arguments of global
> functions cannot be removed or optimized away by llvm. The compiler has to use
> exactly the arguments specified in a function prototype. The argument type
> information allows the verifier validate each global function independently.
> For now only supported argument types are pointer to context and scalars. In
> the future pointers to structures, sizes, pointer to packet data can be
> supported as well. Consider the following example:
>
> static int f1(int ...)
> {
> ...
> }
>
> int f3(int b);
>
> int f2(int a)
> {
> f1(a) + f3(a);
> }
>
> int f3(int b)
> {
> ...
> }
>
> int main(...)
> {
> f1(...) + f2(...) + f3(...);
> }
>
> The verifier will start its safety checks from the first global function f2().
> It will recursively descend into f1() because it's static. Then it will check
> that arguments match for the f3() invocation inside f2(). It will not descend
> into f3(). It will finish f2() that has to be successfully verified for all
> possible values of 'a'. Then it will proceed with f3(). That function also has
> to be safe for all possible values of 'b'. Then it will start subprog 0 (which
> is main() function). It will recursively descend into f1() and will skip full
> check of f2() and f3(), since they are global. The order of processing global
> functions doesn't affect safety, since all global functions must be proven safe
> based on their arguments only.
>
> Such function by function verification can drastically improve speed of the
> verification and reduce complexity.
>
> Note that the stack limit of 512 still applies to the call chain regardless whether
> functions were static or global. The nested level of 8 also still applies. The
> same recursion prevention checks are in place as well.
>
> The type information and static/global kind is preserved after the verification
> hence in the above example global function f2() and f3() can be replaced later
> by equivalent functions with the same types that are loaded and verified later
> without affecting safety of this main() program. Such replacement (re-linking)
> of global functions is a subject of future patches.
>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Great to see this progressing; and thanks for breaking things up, makes
it much easier to follow along!
One question:
> +enum btf_func_linkage {
> + BTF_FUNC_STATIC = 0,
> + BTF_FUNC_GLOBAL = 1,
> + BTF_FUNC_EXTERN = 2,
> +};
What's supposed to happen with FUNC_EXTERN? That is specifically for the
re-linking follow-up?
> /* BTF_KIND_VAR is followed by a single "struct btf_var" to describe
> * additional information related to the variable such as its linkage.
> */
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index ed2075884724..e28ec89971ce 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -2621,8 +2621,8 @@ static s32 btf_func_check_meta(struct btf_verifier_env *env,
> return -EINVAL;
> }
>
> - if (btf_type_vlen(t)) {
> - btf_verifier_log_type(env, t, "vlen != 0");
> + if (btf_type_vlen(t) > BTF_FUNC_EXTERN) {
> + btf_verifier_log_type(env, t, "invalid func linkage");
This doesn't reject linkage==BTF_FUNC_EXTERN; so for this patch
FUNC_EXTERN will be treated the same as FUNC_STATIC (it'll fail the
is_global check below)? Or did I miss somewhere else where
BTF_FUNC_EXTERN is rejected?
-Toke
next prev parent reply other threads:[~2020-01-08 10:28 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-08 7:25 [PATCH bpf-next 0/6] bpf: Introduce global functions Alexei Starovoitov
2020-01-08 7:25 ` [PATCH bpf-next 1/6] libbpf: Sanitize BTF_KIND_FUNC linkage Alexei Starovoitov
2020-01-08 17:35 ` Song Liu
2020-01-08 18:57 ` Yonghong Song
2020-01-08 20:12 ` Alexei Starovoitov
2020-01-08 7:25 ` [PATCH bpf-next 2/6] libbpf: Collect static vs global info about functions Alexei Starovoitov
2020-01-08 10:25 ` Toke Høiland-Jørgensen
2020-01-08 16:25 ` Yonghong Song
2020-01-09 8:50 ` Toke Høiland-Jørgensen
2020-01-08 17:57 ` Song Liu
2020-01-08 20:10 ` Alexei Starovoitov
2020-01-08 7:25 ` [PATCH bpf-next 3/6] bpf: Introduce function-by-function verification Alexei Starovoitov
2020-01-08 10:28 ` Toke Høiland-Jørgensen [this message]
2020-01-08 20:06 ` Alexei Starovoitov
2020-01-09 8:57 ` Toke Høiland-Jørgensen
2020-01-09 23:03 ` Alexei Starovoitov
2020-01-10 10:08 ` Toke Høiland-Jørgensen
2020-01-08 19:10 ` Song Liu
2020-01-08 20:20 ` Alexei Starovoitov
2020-01-08 21:24 ` Song Liu
2020-01-08 23:05 ` Alexei Starovoitov
2020-01-14 23:39 ` Stanislav Fomichev
2020-01-14 23:56 ` Andrii Nakryiko
2020-01-15 0:44 ` Stanislav Fomichev
2020-01-08 7:25 ` [PATCH bpf-next 4/6] selftests/bpf: Add fexit-to-skb test for global funcs Alexei Starovoitov
2020-01-08 19:15 ` Song Liu
2020-01-08 7:25 ` [PATCH bpf-next 5/6] selftests/bpf: Add a test for a large global function Alexei Starovoitov
2020-01-08 19:16 ` Song Liu
2020-01-08 19:17 ` Song Liu
2020-01-08 7:25 ` [PATCH bpf-next 6/6] selftests/bpf: Modify a test to check global functions Alexei Starovoitov
2020-01-08 19:18 ` Song Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87y2uigs3e.fsf@toke.dk \
--to=toke@redhat.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=kernel-team@fb.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).