Commit 7105e828 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov
Browse files

bpf: allow for correlation of maps and helpers in dump 



Currently a dump of an xlated prog (post verifier stage) doesn't
correlate used helpers as well as maps. The prog info lists
involved map ids, however there's no correlation of where in the
program they are used as of today. Likewise, bpftool does not
correlate helper calls with the target functions.

The latter can be done w/o any kernel changes through kallsyms,
and also has the advantage that this works with inlined helpers
and BPF calls.

Example, via interpreter:

  # tc filter show dev foo ingress
  filter protocol all pref 49152 bpf chain 0
  filter protocol all pref 49152 bpf chain 0 handle 0x1 foo.o:[ingress] \
                      direct-action not_in_hw id 1 tag c74773051b364165   <-- prog id:1

  * Output before patch (calls/maps remain unclear):

  # bpftool prog dump xlated id 1             <-- dump prog id:1
   0: (b7) r1 = 2
   1: (63) *(u32 *)(r10 -4) = r1
   2: (bf) r2 = r10
   3: (07) r2 += -4
   4: (18) r1 = 0xffff95c47a8d4800
   6: (85) call unknown#73040
   7: (15) if r0 == 0x0 goto pc+18
   8: (bf) r2 = r10
   9: (07) r2 += -4
  10: (bf) r1 = r0
  11: (85) call unknown#73040
  12: (15) if r0 == 0x0 goto pc+23
  [...]

  * Output after patch:

  # bpftool prog dump xlated id 1
   0: (b7) r1 = 2
   1: (63) *(u32 *)(r10 -4) = r1
   2: (bf) r2 = r10
   3: (07) r2 += -4
   4: (18) r1 = map[id:2]                     <-- map id:2
   6: (85) call bpf_map_lookup_elem#73424     <-- helper call
   7: (15) if r0 == 0x0 goto pc+18
   8: (bf) r2 = r10
   9: (07) r2 += -4
  10: (bf) r1 = r0
  11: (85) call bpf_map_lookup_elem#73424
  12: (15) if r0 == 0x0 goto pc+23
  [...]

  # bpftool map show id 2                     <-- show/dump/etc map id:2
  2: hash_of_maps  flags 0x0
        key 4B  value 4B  max_entries 3  memlock 4096B

Example, JITed, same prog:

  # tc filter show dev foo ingress
  filter protocol all pref 49152 bpf chain 0
  filter protocol all pref 49152 bpf chain 0 handle 0x1 foo.o:[ingress] \
                  direct-action not_in_hw id 3 tag c74773051b364165 jited

  # bpftool prog show id 3
  3: sched_cls  tag c74773051b364165
        loaded_at Dec 19/13:48  uid 0
        xlated 384B  jited 257B  memlock 4096B  map_ids 2

  # bpftool prog dump xlated id 3
   0: (b7) r1 = 2
   1: (63) *(u32 *)(r10 -4) = r1
   2: (bf) r2 = r10
   3: (07) r2 += -4
   4: (18) r1 = map[id:2]                      <-- map id:2
   6: (85) call __htab_map_lookup_elem#77408   <-+ inlined rewrite
   7: (15) if r0 == 0x0 goto pc+2                |
   8: (07) r0 += 56                              |
   9: (79) r0 = *(u64 *)(r0 +0)                <-+
  10: (15) if r0 == 0x0 goto pc+24
  11: (bf) r2 = r10
  12: (07) r2 += -4
  [...]

Example, same prog, but kallsyms disabled (in that case we are
also not allowed to pass any relative offsets, etc, so prog
becomes pointer sanitized on dump):

  # sysctl kernel.kptr_restrict=2
  kernel.kptr_restrict = 2

  # bpftool prog dump xlated id 3
   0: (b7) r1 = 2
   1: (63) *(u32 *)(r10 -4) = r1
   2: (bf) r2 = r10
   3: (07) r2 += -4
   4: (18) r1 = map[id:2]
   6: (85) call bpf_unspec#0
   7: (15) if r0 == 0x0 goto pc+2
  [...]

Example, BPF calls via interpreter:

  # bpftool prog dump xlated id 1
   0: (85) call pc+2#__bpf_prog_run_args32
   1: (b7) r0 = 1
   2: (95) exit
   3: (b7) r0 = 2
   4: (95) exit

Example, BPF calls via JIT:

  # sysctl net.core.bpf_jit_enable=1
  net.core.bpf_jit_enable = 1
  # sysctl net.core.bpf_jit_kallsyms=1
  net.core.bpf_jit_kallsyms = 1

  # bpftool prog dump xlated id 1
   0: (85) call pc+2#bpf_prog_3b185187f1855c4c_F
   1: (b7) r0 = 1
   2: (95) exit
   3: (b7) r0 = 2
   4: (95) exit

And finally, an example for tail calls that is now working
as well wrt correlation:

  # bpftool prog dump xlated id 2
  [...]
  10: (b7) r2 = 8
  11: (85) call bpf_trace_printk#-41312
  12: (bf) r1 = r6
  13: (18) r2 = map[id:1]
  15: (b7) r3 = 0
  16: (85) call bpf_tail_call#12
  17: (b7) r1 = 42
  18: (6b) *(u16 *)(r6 +46) = r1
  19: (b7) r0 = 0
  20: (95) exit

  # bpftool map show id 1
  1: prog_array  flags 0x0
        key 4B  value 4B  max_entries 1  memlock 4096B

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 4f74d809

include/linux/filter.h

+9 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ 
#include <linux/capability.h>

#include <linux/cryptohash.h>

#include <linux/set_memory.h>

#include <linux/kallsyms.h>



#include <net/sch_generic.h>
@@ -724,6 +725,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog); 
void bpf_jit_compile(struct bpf_prog *prog);

bool bpf_helper_changes_pkt_data(void *func);



static inline bool bpf_dump_raw_ok(void)

{

	/* Reconstruction of call-sites is dependent on kallsyms,

	 * thus make dump the same restriction.

	 */

	return kallsyms_show_value() == 1;

}



struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,

				       const struct bpf_insn *patch, u32 len);

kernel/bpf/core.c

+3 −1
Original line number Diff line number Diff line
@@ -771,7 +771,9 @@ struct bpf_prog *bpf_jit_blind_constants(struct bpf_prog *prog) 


/* Base function for offset calculation. Needs to go into .text section,

 * therefore keeping it non-static as well; will also be used by JITs

 * anyway later on, so do not let the compiler omit it.

 * anyway later on, so do not let the compiler omit it. This also needs

 * to go into kallsyms for correlation from e.g. bpftool, so naming

 * must not change.

 */

noinline u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)

{

kernel/bpf/disasm.c

+54 −11
Original line number Diff line number Diff line
@@ -21,10 +21,39 @@ static const char * const func_id_str[] = { 
};

#undef __BPF_FUNC_STR_FN



const char *func_id_name(int id)

static const char *__func_get_name(const struct bpf_insn_cbs *cbs,

				   const struct bpf_insn *insn,

				   char *buff, size_t len)

{

	BUILD_BUG_ON(ARRAY_SIZE(func_id_str) != __BPF_FUNC_MAX_ID);



	if (insn->src_reg != BPF_PSEUDO_CALL &&

	    insn->imm >= 0 && insn->imm < __BPF_FUNC_MAX_ID &&

	    func_id_str[insn->imm])

		return func_id_str[insn->imm];



	if (cbs && cbs->cb_call)

		return cbs->cb_call(cbs->private_data, insn);



	if (insn->src_reg == BPF_PSEUDO_CALL)

		snprintf(buff, len, "%+d", insn->imm);



	return buff;

}



static const char *__func_imm_name(const struct bpf_insn_cbs *cbs,

				   const struct bpf_insn *insn,

				   u64 full_imm, char *buff, size_t len)

{

	if (cbs && cbs->cb_imm)

		return cbs->cb_imm(cbs->private_data, insn, full_imm);



	snprintf(buff, len, "0x%llx", (unsigned long long)full_imm);

	return buff;

}



const char *func_id_name(int id)

{

	if (id >= 0 && id < __BPF_FUNC_MAX_ID && func_id_str[id])

		return func_id_str[id];

	else
@@ -83,7 +112,7 @@ static const char *const bpf_jmp_string[16] = { 
	[BPF_EXIT >> 4] = "exit",

};



static void print_bpf_end_insn(bpf_insn_print_cb verbose,

static void print_bpf_end_insn(bpf_insn_print_t verbose,

			       struct bpf_verifier_env *env,

			       const struct bpf_insn *insn)

{
@@ -92,9 +121,12 @@ static void print_bpf_end_insn(bpf_insn_print_cb verbose, 
		insn->imm, insn->dst_reg);

}



void print_bpf_insn(bpf_insn_print_cb verbose, struct bpf_verifier_env *env,

		    const struct bpf_insn *insn, bool allow_ptr_leaks)

void print_bpf_insn(const struct bpf_insn_cbs *cbs,

		    struct bpf_verifier_env *env,

		    const struct bpf_insn *insn,

		    bool allow_ptr_leaks)

{

	const bpf_insn_print_t verbose = cbs->cb_print;

	u8 class = BPF_CLASS(insn->code);



	if (class == BPF_ALU || class == BPF_ALU64) {
@@ -175,12 +207,15 @@ void print_bpf_insn(bpf_insn_print_cb verbose, struct bpf_verifier_env *env, 
			 */

			u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm;

			bool map_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD;

			char tmp[64];



			if (map_ptr && !allow_ptr_leaks)

				imm = 0;



			verbose(env, "(%02x) r%d = 0x%llx\n", insn->code,

				insn->dst_reg, (unsigned long long)imm);

			verbose(env, "(%02x) r%d = %s\n",

				insn->code, insn->dst_reg,

				__func_imm_name(cbs, insn, imm,

						tmp, sizeof(tmp)));

		} else {

			verbose(env, "BUG_ld_%02x\n", insn->code);

			return;
@@ -189,12 +224,20 @@ void print_bpf_insn(bpf_insn_print_cb verbose, struct bpf_verifier_env *env, 
		u8 opcode = BPF_OP(insn->code);



		if (opcode == BPF_CALL) {

			if (insn->src_reg == BPF_PSEUDO_CALL)

				verbose(env, "(%02x) call pc%+d\n", insn->code,

					insn->imm);

			else

			char tmp[64];



			if (insn->src_reg == BPF_PSEUDO_CALL) {

				verbose(env, "(%02x) call pc%s\n",

					insn->code,

					__func_get_name(cbs, insn,

							tmp, sizeof(tmp)));

			} else {

				strcpy(tmp, "unknown");

				verbose(env, "(%02x) call %s#%d\n", insn->code,

					func_id_name(insn->imm), insn->imm);

					__func_get_name(cbs, insn,

							tmp, sizeof(tmp)),

					insn->imm);

			}

		} else if (insn->code == (BPF_JMP | BPF_JA)) {

			verbose(env, "(%02x) goto pc%+d\n",

				insn->code, insn->off);

kernel/bpf/disasm.h

+24 −5
Original line number Diff line number Diff line
@@ -17,16 +17,35 @@ 
#include <linux/bpf.h>

#include <linux/kernel.h>

#include <linux/stringify.h>

#ifndef __KERNEL__

#include <stdio.h>

#include <string.h>

#endif



struct bpf_verifier_env;



extern const char *const bpf_alu_string[16];

extern const char *const bpf_class_string[8];



const char *func_id_name(int id);



struct bpf_verifier_env;

typedef void (*bpf_insn_print_cb)(struct bpf_verifier_env *env,

typedef void (*bpf_insn_print_t)(struct bpf_verifier_env *env,

				 const char *, ...);

void print_bpf_insn(bpf_insn_print_cb verbose, struct bpf_verifier_env *env,

		    const struct bpf_insn *insn, bool allow_ptr_leaks);

typedef const char *(*bpf_insn_revmap_call_t)(void *private_data,

					      const struct bpf_insn *insn);

typedef const char *(*bpf_insn_print_imm_t)(void *private_data,

					    const struct bpf_insn *insn,

					    __u64 full_imm);



struct bpf_insn_cbs {

	bpf_insn_print_t	cb_print;

	bpf_insn_revmap_call_t	cb_call;

	bpf_insn_print_imm_t	cb_imm;

	void			*private_data;

};



void print_bpf_insn(const struct bpf_insn_cbs *cbs,

		    struct bpf_verifier_env *env,

		    const struct bpf_insn *insn,

		    bool allow_ptr_leaks);

#endif

kernel/bpf/syscall.c

+82 −5
Original line number Diff line number Diff line
@@ -1558,6 +1558,67 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr) 
	return fd;

}



static const struct bpf_map *bpf_map_from_imm(const struct bpf_prog *prog,

					      unsigned long addr)

{

	int i;



	for (i = 0; i < prog->aux->used_map_cnt; i++)

		if (prog->aux->used_maps[i] == (void *)addr)

			return prog->aux->used_maps[i];

	return NULL;

}



static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog)

{

	const struct bpf_map *map;

	struct bpf_insn *insns;

	u64 imm;

	int i;



	insns = kmemdup(prog->insnsi, bpf_prog_insn_size(prog),

			GFP_USER);

	if (!insns)

		return insns;



	for (i = 0; i < prog->len; i++) {

		if (insns[i].code == (BPF_JMP | BPF_TAIL_CALL)) {

			insns[i].code = BPF_JMP | BPF_CALL;

			insns[i].imm = BPF_FUNC_tail_call;

			/* fall-through */

		}

		if (insns[i].code == (BPF_JMP | BPF_CALL) ||

		    insns[i].code == (BPF_JMP | BPF_CALL_ARGS)) {

			if (insns[i].code == (BPF_JMP | BPF_CALL_ARGS))

				insns[i].code = BPF_JMP | BPF_CALL;

			if (!bpf_dump_raw_ok())

				insns[i].imm = 0;

			continue;

		}



		if (insns[i].code != (BPF_LD | BPF_IMM | BPF_DW))

			continue;



		imm = ((u64)insns[i + 1].imm << 32) | (u32)insns[i].imm;

		map = bpf_map_from_imm(prog, imm);

		if (map) {

			insns[i].src_reg = BPF_PSEUDO_MAP_FD;

			insns[i].imm = map->id;

			insns[i + 1].imm = 0;

			continue;

		}



		if (!bpf_dump_raw_ok() &&

		    imm == (unsigned long)prog->aux) {

			insns[i].imm = 0;

			insns[i + 1].imm = 0;

			continue;

		}

	}



	return insns;

}



static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,

				   const union bpf_attr *attr,

				   union bpf_attr __user *uattr)
@@ -1608,18 +1669,34 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, 
	ulen = info.jited_prog_len;

	info.jited_prog_len = prog->jited_len;

	if (info.jited_prog_len && ulen) {

		if (bpf_dump_raw_ok()) {

			uinsns = u64_to_user_ptr(info.jited_prog_insns);

			ulen = min_t(u32, info.jited_prog_len, ulen);

			if (copy_to_user(uinsns, prog->bpf_func, ulen))

				return -EFAULT;

		} else {

			info.jited_prog_insns = 0;

		}

	}



	ulen = info.xlated_prog_len;

	info.xlated_prog_len = bpf_prog_insn_size(prog);

	if (info.xlated_prog_len && ulen) {

		struct bpf_insn *insns_sanitized;

		bool fault;



		if (prog->blinded && !bpf_dump_raw_ok()) {

			info.xlated_prog_insns = 0;

			goto done;

		}

		insns_sanitized = bpf_insn_prepare_dump(prog);

		if (!insns_sanitized)

			return -ENOMEM;

		uinsns = u64_to_user_ptr(info.xlated_prog_insns);

		ulen = min_t(u32, info.xlated_prog_len, ulen);

		if (copy_to_user(uinsns, prog->insnsi, ulen))

		fault = copy_to_user(uinsns, insns_sanitized, ulen);

		kfree(insns_sanitized);

		if (fault)

			return -EFAULT;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE