BPF Archive on lore.kernel.org
 help / color / Atom feed
From: Andrii Nakryiko <andrii.nakryiko@gmail.com>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: Alexei Starovoitov <ast@kernel.org>,
	"David S. Miller" <davem@davemloft.net>,
	Daniel Borkmann <daniel@iogearbox.net>,
	x86@kernel.org, Networking <netdev@vger.kernel.org>,
	bpf <bpf@vger.kernel.org>, Kernel Team <kernel-team@fb.com>
Subject: Re: [PATCH v3 bpf-next 15/18] bpf: Support attaching tracing BPF program to other BPF programs
Date: Mon, 11 Nov 2019 20:38:54 -0800
Message-ID: <CAEf4BzahNJXbpJ6mfhDT=G-dspCg-Zzm9jGYUexxfz62Yop_oQ@mail.gmail.com> (raw)
In-Reply-To: <20191111230358.t3tcqkxaupcxyfap@ast-mbp.dhcp.thefacebook.com>

On Mon, Nov 11, 2019 at 3:04 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Sat, Nov 09, 2019 at 11:17:37PM -0800, Andrii Nakryiko wrote:
> > On Thu, Nov 7, 2019 at 10:41 PM Alexei Starovoitov <ast@kernel.org> wrote:
> > >
> > > Allow FENTRY/FEXIT BPF programs to attach to other BPF programs of any type
> > > including their subprograms. This feature allows snooping on input and output
> > > packets in XDP, TC programs including their return values. In order to do that
> > > the verifier needs to track types not only of vmlinux, but types of other BPF
> > > programs as well. The verifier also needs to translate uapi/linux/bpf.h types
> > > used by networking programs into kernel internal BTF types used by FENTRY/FEXIT
> > > BPF programs. In some cases LLVM optimizations can remove arguments from BPF
> > > subprograms without adjusting BTF info that LLVM backend knows. When BTF info
> > > disagrees with actual types that the verifiers sees the BPF trampoline has to
> > > fallback to conservative and treat all arguments as u64. The FENTRY/FEXIT
> > > program can still attach to such subprograms, but won't be able to recognize
> > > pointer types like 'struct sk_buff *' into won't be able to pass them to
> > > bpf_skb_output() for dumping to user space.
> > >
> > > The BPF_PROG_LOAD command is extended with attach_prog_fd field. When it's set
> > > to zero the attach_btf_id is one vmlinux BTF type ids. When attach_prog_fd
> > > points to previously loaded BPF program the attach_btf_id is BTF type id of
> > > main function or one of its subprograms.
> > >
> > > Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> > > ---
> > >  arch/x86/net/bpf_jit_comp.c |  3 +-
> > >  include/linux/bpf.h         |  2 +
> > >  include/linux/btf.h         |  1 +
> > >  include/uapi/linux/bpf.h    |  1 +
> > >  kernel/bpf/btf.c            | 58 +++++++++++++++++++---
> > >  kernel/bpf/core.c           |  2 +
> > >  kernel/bpf/syscall.c        | 19 +++++--
> > >  kernel/bpf/verifier.c       | 98 +++++++++++++++++++++++++++++--------
> > >  kernel/trace/bpf_trace.c    |  2 -
> > >  9 files changed, 151 insertions(+), 35 deletions(-)
> > >
> >
> > [...]
> >
> > > +
> > > +static bool btf_translate_to_vmlinux(struct bpf_verifier_log *log,
> > > +                                    struct btf *btf,
> > > +                                    const struct btf_type *t,
> > > +                                    struct bpf_insn_access_aux *info)
> > > +{
> > > +       const char *tname = __btf_name_by_offset(btf, t->name_off);
> > > +       int btf_id;
> > > +
> > > +       if (!tname) {
> > > +               bpf_log(log, "Program's type doesn't have a name\n");
> > > +               return false;
> > > +       }
> > > +       if (strcmp(tname, "__sk_buff") == 0) {
> >
> > might be a good idea to ensure that t's type is also a struct?
> >
> > > +               btf_id = btf_resolve_helper_id(log, &bpf_skb_output_proto, 0);
> >
> > This is kind of ugly and high-maintenance. Have you considered having
> > something like this, to do this mapping:
> >
> > struct bpf_ctx_mapping {
> >     struct sk_buff *__sk_buff;
> >     struct xdp_buff *xdp_md;
> > };
> >
> > So field name is a name you are trying to match, while field type is
> > actual type you are mapping to? You won't need to find special
> > function protos (like bpf_skb_output_proto), it will be easy to
> > extend, you'll have real vmlinux types automatically captured for you
> > (you'll just have to initially find bpf_ctx_mapping's btf_id).
>
> I was thinking something along these lines.
> The problem with single struct like above is that it's centralized.
> convert_ctx_access callbacks are all over the place.
> So I'm thinking to add macro like this to bpf.h
> +#define BPF_RECORD_CTX_CONVERSION(user_type, kernel_type) \
> +       ({typedef kernel_type (*bpf_ctx_convert)(user_type); \
> +        (void) (bpf_ctx_convert) (void *) 0;})
>
> and then do
> BPF_RECORD_CTX_CONVERSION(struct bpf_xdp_sock, struct xdp_sock);
> inside convert_ctx_access functions (like bpf_xdp_sock_convert_ctx_access).
> There will be several typedefs with 'bpf_ctx_convert' name. The
> btf_translate_to_vmlinux() will iterate over them. Speed is not criticial here,

I guess that works as well. Please leave a comment explaining the idea
behind this distributed mapping :)

> but long term we probably need to merge prog's BTF with vmlinux's BTF, so most
> of the type comparison is done during prog load. It probably should reduce the
> size of prog's BTF too. Renumbering of prog's BTF will be annoying though.
> Something to consider long term.
>
> >
> > > +               if (btf_id < 0)
> > > +                       return false;
> > > +               info->btf_id = btf_id;
> > > +               return true;
> > > +       }
> > > +       return false;
> > > +}
> > >
> >
> > [...]
> >
> > > +               if (tgt_prog && conservative) {
> > > +                       struct btf_func_model *m = &tr->func.model;
> > > +
> > > +                       /* BTF function prototype doesn't match the verifier types.
> > > +                        * Fall back to 5 u64 args.
> > > +                        */
> > > +                       for (i = 0; i < 5; i++)
> > > +                               m->arg_size[i] = 8;
> > > +                       m->ret_size = 8;
> > > +                       m->nr_args = 5;
> > > +                       prog->aux->attach_func_proto = NULL;
> > > +               } else {
> > > +                       ret = btf_distill_func_proto(&env->log, btf, t,
> > > +                                                    tname, &tr->func.model);
> >
> > there is nothing preventing some parallel thread to modify
> > tr->func.model in parallel, right? Should these modifications be
> > either locked or at least WRITE_ONCE, similar to
> > btf_resolve_helper_id?
>
> hmm. Right. There is a race with bpf_trampoline_lookup. One thread could have
> just created the trampoline and still doing distill, while another thread is
> trying to use it after getting it from bpf_trampoline_lookup. The fix choices
> are not pretty. Either to add a mutex to check_attach_btf_id() or do
> bpf_trampoline_lookup_or_create() with extra callback that does
> btf_distill_func_proto while bpf_trampoline_lookup_or_create is holding
> trampoline_mutex or move most of the check_attach_btf_id() logic into
> bpf_trampoline_lookup_or_create().
> I tried to keep trampoline as abstract concept, but with callback or move
> the verifer and btf logic will bleed into trampoline. Hmm.

yeah, that sounds too intrusive. I'd change btf_distill_func_proto to
accept struct btf_func_model **m, allocate model dynamically, and then
compare_exchange the final constructed model pointer.

Similarly for "fallback to conservative" case.

>

  reply index

Thread overview: 67+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-08  6:40 [PATCH v3 bpf-next 00/18] Introduce BPF trampoline Alexei Starovoitov
2019-11-08  6:40 ` [PATCH v3 bpf-next 01/18] bpf: refactor x86 JIT into helpers Alexei Starovoitov
2019-11-08 19:27   ` Andrii Nakryiko
2019-11-08  6:40 ` [PATCH v3 bpf-next 02/18] bpf: Add bpf_arch_text_poke() helper Alexei Starovoitov
2019-11-08  6:56   ` Song Liu
2019-11-08  8:23   ` Björn Töpel
2019-11-08 14:09     ` Alexei Starovoitov
2019-11-08  9:11   ` Peter Zijlstra
2019-11-08  9:36     ` Peter Zijlstra
2019-11-08 13:41       ` Alexei Starovoitov
2019-11-08 19:32         ` Alexei Starovoitov
2019-11-08 21:36           ` Peter Zijlstra
2019-11-08 21:39             ` David Miller
2019-11-11  8:14               ` Peter Zijlstra
2019-11-11 10:21                 ` Daniel Borkmann
2019-11-11 16:10                 ` Jonathan Corbet
2019-11-08 23:05             ` Alexei Starovoitov
2019-11-10 10:54               ` Thomas Gleixner
2019-11-08  6:40 ` [PATCH v3 bpf-next 03/18] bpf: Introduce BPF trampoline Alexei Starovoitov
2019-11-08  7:04   ` Song Liu
2019-11-08  6:40 ` [PATCH v3 bpf-next 04/18] libbpf: Introduce btf__find_by_name_kind() Alexei Starovoitov
2019-11-08  7:05   ` Song Liu
2019-11-08 19:21   ` Andrii Nakryiko
2019-11-08  6:40 ` [PATCH v3 bpf-next 05/18] libbpf: Add support to attach to fentry/fexit tracing progs Alexei Starovoitov
2019-11-08  7:12   ` Song Liu
2019-11-08 19:44   ` Andrii Nakryiko
2019-11-08  6:40 ` [PATCH v3 bpf-next 06/18] selftest/bpf: Simple test for fentry/fexit Alexei Starovoitov
2019-11-08  6:40 ` [PATCH v3 bpf-next 07/18] bpf: Add kernel test functions for fentry testing Alexei Starovoitov
2019-11-08  6:40 ` [PATCH v3 bpf-next 08/18] selftests/bpf: Add test for BPF trampoline Alexei Starovoitov
2019-11-08  6:40 ` [PATCH v3 bpf-next 09/18] selftests/bpf: Add fexit tests " Alexei Starovoitov
2019-11-08  6:40 ` [PATCH v3 bpf-next 10/18] selftests/bpf: Add combined fentry/fexit test Alexei Starovoitov
2019-11-08  7:14   ` Song Liu
2019-11-08  6:40 ` [PATCH v3 bpf-next 11/18] selftests/bpf: Add stress test for maximum number of progs Alexei Starovoitov
2019-11-08  7:24   ` Song Liu
2019-11-08  6:40 ` [PATCH v3 bpf-next 12/18] bpf: Reserve space for BPF trampoline in BPF programs Alexei Starovoitov
2019-11-08  7:25   ` Song Liu
2019-11-08  6:40 ` [PATCH v3 bpf-next 13/18] bpf: Fix race in btf_resolve_helper_id() Alexei Starovoitov
2019-11-08  7:32   ` Song Liu
2019-11-08 19:58   ` Andrii Nakryiko
2019-11-08  6:40 ` [PATCH v3 bpf-next 14/18] bpf: Compare BTF types of functions arguments with actual types Alexei Starovoitov
2019-11-08 17:28   ` Song Liu
2019-11-08 17:32     ` Song Liu
2019-11-08 17:57       ` Alexei Starovoitov
2019-11-08 17:59         ` Song Liu
2019-11-08 23:46   ` Andrii Nakryiko
2019-11-08  6:40 ` [PATCH v3 bpf-next 15/18] bpf: Support attaching tracing BPF program to other BPF programs Alexei Starovoitov
2019-11-08 18:49   ` Song Liu
2019-11-08 18:59     ` Alexei Starovoitov
2019-11-08 20:17   ` Toke Høiland-Jørgensen
2019-11-08 21:14     ` Alexei Starovoitov
2019-11-08 21:32       ` Toke Høiland-Jørgensen
2019-11-10  7:17   ` Andrii Nakryiko
2019-11-11 23:04     ` Alexei Starovoitov
2019-11-12  4:38       ` Andrii Nakryiko [this message]
2019-11-12  4:47         ` Alexei Starovoitov
2019-11-08  6:40 ` [PATCH v3 bpf-next 16/18] libbpf: Add support for attaching BPF programs " Alexei Starovoitov
2019-11-08 18:57   ` Song Liu
2019-11-08 19:13     ` Alexei Starovoitov
2019-11-08 19:14       ` Song Liu
2019-11-10 16:56   ` Andrii Nakryiko
2019-11-08  6:40 ` [PATCH v3 bpf-next 17/18] selftests/bpf: Extend test_pkt_access test Alexei Starovoitov
2019-11-08 19:03   ` Song Liu
2019-11-10 16:58   ` Andrii Nakryiko
2019-11-08  6:40 ` [PATCH v3 bpf-next 18/18] selftests/bpf: Add a test for attaching BPF prog to another BPF prog and subprog Alexei Starovoitov
2019-11-08 19:13   ` Song Liu
2019-11-10 17:04   ` Andrii Nakryiko
2019-11-11 23:07     ` Alexei Starovoitov

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAEf4BzahNJXbpJ6mfhDT=G-dspCg-Zzm9jGYUexxfz62Yop_oQ@mail.gmail.com' \
    --to=andrii.nakryiko@gmail.com \
    --cc=alexei.starovoitov@gmail.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=davem@davemloft.net \
    --cc=kernel-team@fb.com \
    --cc=netdev@vger.kernel.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

BPF Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/bpf/0 bpf/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 bpf bpf/ https://lore.kernel.org/bpf \
		bpf@vger.kernel.org
	public-inbox-index bpf

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.bpf


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git