Message-Id: <20230119235833.2948341-1-void@manifault.com>
Date:   Thu, 19 Jan 2023 17:58:25 -0600
From:   David Vernet <void@...ifault.com>
To:     bpf@...r.kernel.org
Cc:     ast@...nel.org, daniel@...earbox.net, andrii@...nel.org,
        martin.lau@...ux.dev, song@...nel.org, yhs@...a.com,
        john.fastabend@...il.com, kpsingh@...nel.org, sdf@...gle.com,
        haoluo@...gle.com, jolsa@...nel.org, linux-kernel@...r.kernel.org,
        kernel-team@...a.com, tj@...nel.org
Subject: [PATCH bpf-next 0/8] Enable cpumasks to be used as kptrs

'struct cpumask' is a bitmap data structure in the kernel whose indices
reflect the CPUs on the system. Commonly, cpumasks are used to track
which CPUs a task is affinitized to, but they can also be used to e.g.
track which cores are associated with a scheduling domain, which cores
on a machine are idle, etc.

It would be useful to be able to query those cpumasks from BPF programs.
For example, when tracing percpu operations, it would be convenient to
have cpumask support if the tracing program wants to track which tasks
end up running on which CPUs in different time intervals, and to check
their cpumask distribution while doing so. Similarly, if we're tracking
NUMA allocations, CPU scheduling domain associations, etc, it would be
useful to be able to concretely compare decisions made by the kernel to
a task's cpumask.

So as to enable such use cases, this patch set proposes a set of kfuncs,
namespaced to bpf_cpumask_*, which allow BPF programs to make queries
against cpumasks, and to allocate and store them as kptrs.

In order to enable these kfuncs, this patch set adds two new
kfunc-related capabilities to the verifier:

1. Defining a mechanism that allows developers to specify which fields
   of a struct type should inherit their parent's trust. Specifically,
   we specify that the 'const cpumask_t *cpus_ptr' field will be
   considered trusted if the parent struct task_struct is trusted.

2. Allowing KF_TRUSTED_ARGS pointers to be walked to see if a BTF type
   is equivalent to what a kfunc requires. For example, the patch set
   defines the following type:

struct bpf_cpumask {
	cpumask_t cpumask;
	refcount_t usage;
};

  cpumask_t typedefs a struct cpumask, so if a BPF program has a trusted
  pointer to a struct bpf_cpumask, it would therefore be safe to pass
  that to a kfunc expecting a const struct cpumask *. Note that 

3. Updating the verifier to prevent NULL PTR_TO_MEM pointers to be
   passed to KF_TRUSTED_ARGS kfuncs. Without this, a kfunc may crash if
   it's given a pointer to what it thinks is a scalar struct, but in
   reality is an address. For example, a bitmap embedded in a cpumask_t.

Following these BPF verifier changes (and their associated selftest
additions), this patchset adds a set of cpumask kfuncs in
kernel/bpf/cpumask.c, and then tests and documents them.

Lastly, note that some of the kfuncs that were added would benefit from
additional verification logic. For example, any kfunc taking a CPU
argument that exceeds the number of CPUs on the system, etc. For now, we
silently check for and ignore these cases at runtime. When we have e.g.
per-argument kfunc flags, it might be helpful to add another KF_CPU-type
flag that specifies that the verifier should validate that it's a valid
CPU.

David Vernet (8):
  bpf: Enable annotating trusted nested pointers
  bpf: Allow trusted args to walk struct when checking BTF IDs
  bpf: Disallow NULL PTR_TO_MEM for trusted kfuncs
  bpf: Enable cpumasks to be queried and used as kptrs
  selftests/bpf: Add nested trust selftests suite
  selftests/bpf: Add selftest suite for cpumask kfuncs
  bpf/docs: Document cpumask kfuncs in a new file
  bpf/docs: Document how nested trusted fields may be defined

 Documentation/bpf/cpumasks.rst                | 353 +++++++++++++
 Documentation/bpf/index.rst                   |   1 +
 Documentation/bpf/kfuncs.rst                  |  26 +-
 include/linux/bpf.h                           |   4 +
 kernel/bpf/Makefile                           |   1 +
 kernel/bpf/btf.c                              |  64 ++-
 kernel/bpf/cpumask.c                          | 476 ++++++++++++++++++
 kernel/bpf/verifier.c                         |  67 ++-
 tools/testing/selftests/bpf/DENYLIST.s390x    |   2 +
 .../selftests/bpf/prog_tests/cpumask.c        |  74 +++
 .../selftests/bpf/prog_tests/nested_trust.c   |  64 +++
 .../selftests/bpf/progs/cpumask_common.h      | 114 +++++
 .../selftests/bpf/progs/cpumask_failure.c     | 125 +++++
 .../selftests/bpf/progs/cpumask_success.c     | 426 ++++++++++++++++
 .../selftests/bpf/progs/nested_trust_common.h |  12 +
 .../bpf/progs/nested_trust_failure.c          |  33 ++
 .../bpf/progs/nested_trust_success.c          |  29 ++
 17 files changed, 1865 insertions(+), 6 deletions(-)
 create mode 100644 Documentation/bpf/cpumasks.rst
 create mode 100644 kernel/bpf/cpumask.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/cpumask.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/nested_trust.c
 create mode 100644 tools/testing/selftests/bpf/progs/cpumask_common.h
 create mode 100644 tools/testing/selftests/bpf/progs/cpumask_failure.c
 create mode 100644 tools/testing/selftests/bpf/progs/cpumask_success.c
 create mode 100644 tools/testing/selftests/bpf/progs/nested_trust_common.h
 create mode 100644 tools/testing/selftests/bpf/progs/nested_trust_failure.c
 create mode 100644 tools/testing/selftests/bpf/progs/nested_trust_success.c

-- 
2.39.0

Powered by blists - more mailing lists