Changes v1 -> v2, suggested by Alexei:
- Resolved conflict with recent commit:
6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier");
- Variable `ctx_access` removed in function `convert_ctx_accesses()`;
- Macro `BPF_COPY_STORE` renamed to `BPF_EMIT_STORE` and fixed to
correctly extract original store instruction class from code.
Original message follows:
The function verifier.c:convert_ctx_access() applies some rewrites to BPF
instructions that read from or write to the BPF program context.
For example, the write instruction for the `struct bpf_sockopt::retval`
field:
*(u32 *)(r1 + offsetof(struct bpf_sockopt, retval)) = r2
Is transformed to:
*(u64 *)(r1 + offsetof(struct bpf_sockopt_kern, tmp_reg)) = r9
r9 = *(u64 *)(r1 + offsetof(struct bpf_sockopt_kern, current_task))
r9 = *(u64 *)(r9 + offsetof(struct task_struct, bpf_ctx))
*(u32 *)(r9 + offsetof(struct bpf_cg_run_ctx, retval)) = r2
r9 = *(u64 *)(r1 + offsetof(struct bpf_sockopt_kern, tmp_reg))
Currently, the verifier only supports such transformations for LDX
(memory-to-register read) and STX (register-to-memory write) instructions.
Error is reported for ST instructions (immediate-to-memory write).
This is fine because clang does not currently emit ST instructions.
However, new `-mcpu=v4` clang flag is planned, which would allow to emit
ST instructions (discussed in [1]).
This patch-set adjusts the verifier to support ST instructions in
`verifier.c:convert_ctx_access()`.
The patches #1 and #2 were previously shared as part of RFC [2]. The
changes compared to that RFC are:
- In patch #1, a bug in the handling of the
`struct __sk_buff::queue_mapping` field was fixed.
- Patch #3 is added, which is a set of disassembler-based test cases for
context access rewrites. The test cases cover all fields for which the
handling code is modified in patch #1.
[1] Propose some new instructions for -mcpu=v4
https://lore.kernel.org/bpf/4bfe98be-5333-1c7e-2f6d-42486c8ec039@xxxxxxxx/
[2] RFC Support for BPF_ST instruction in LLVM C compiler
https://lore.kernel.org/bpf/20221231163122.1360813-1-eddyz87@xxxxxxxxx/
[3] v1
https://lore.kernel.org/bpf/20230302225507.3413720-1-eddyz87@xxxxxxxxx/
Eduard Zingerman (3):
bpf: allow ctx writes using BPF_ST_MEM instruction
selftests/bpf: test if pointer type is tracked for BPF_ST_MEM
selftests/bpf: Disassembler tests for verifier.c:convert_ctx_access()
kernel/bpf/cgroup.c | 49 +-
kernel/bpf/verifier.c | 110 +--
net/core/filter.c | 79 +-
tools/testing/selftests/bpf/Makefile | 2 +-
tools/testing/selftests/bpf/disasm.c | 1 +
tools/testing/selftests/bpf/disasm.h | 1 +
.../selftests/bpf/prog_tests/ctx_rewrite.c | 917 ++++++++++++++++++
tools/testing/selftests/bpf/verifier/ctx.c | 11 -
tools/testing/selftests/bpf/verifier/unpriv.c | 23 +
9 files changed, 1069 insertions(+), 124 deletions(-)
create mode 120000 tools/testing/selftests/bpf/disasm.c
create mode 120000 tools/testing/selftests/bpf/disasm.h
create mode 100644 tools/testing/selftests/bpf/prog_tests/ctx_rewrite.c
--
2.39.1
