[RFC PATCH bpf-next v1 05/16] bpf: Allow scalar and atomic access to typed arena objects

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

Let a program read and write the ordinary fields of a typed arena object,
and run atomics on them, through the native pointer the cast produced.
Every byte the pointer can reach is mapped, either with real objects or
with the type's scratch chunk, so the accesses are plain loads and stores:
no probe mode, no exception table entry, and no address check at the
access. The verifier's bounds are the whole check. It already keeps a BTF
pointer's offset constant and inside the object, and the object is inside
its slot by construction, so a typed pointer never leaves its typed arena.
This is what the sanitizing cast buys: the cost of trust is paid once, where
a value enters, and every access after it is as cheap as a load from the
stack.

Reuse the rules for program-allocated objects. A typed arena object is a
program-BTF struct with a special-field record, as an allocated object is,
so give both the same treatment where the code asked whether a pointer is
allocated: reads and writes of scalar fields are permitted, an access that
overlaps a special field is rejected, a pointer field loads as a scalar
rather than as a pointer, and flexible arrays are not walked. Writes are
permitted because the memory under the object is never unmapped while a
program that saw it can still run, which is what allocated objects need a
reference for. The fault-prone dereference predicate does not match the
class, so the context conversion pass leaves the accesses alone and
load-acquire is allowed on it. Helpers and kfuncs keep rejecting the class
as plain memory, since none of the argument type tables lists it; a kfunc
that wants a typed arena pointer asks for it by type, as the page kfuncs and
the kptr exchange do.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 kernel/bpf/btf.c      |  9 +++++----
 kernel/bpf/verifier.c | 18 ++++++++----------
 2 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 9bcfefdfb734..6a29a9d87702 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -7782,7 +7782,7 @@ int btf_struct_access(struct bpf_verifier_log *log,
 	u32 id = reg->btf_id;
 	int err;
 
-	while (type_is_alloc(reg->type)) {
+	while (type_is_local_obj(reg->type)) {
 		struct btf_struct_meta *meta;
 		struct btf_record *rec;
 		int i;
@@ -7807,14 +7807,15 @@ int btf_struct_access(struct bpf_verifier_log *log,
 	t = btf_type_by_id(btf, id);
 	do {
 		err = btf_struct_walk(log, btf, t, off, size, &id, &tmp_flag,
-				      field_name, !type_is_alloc(reg->type));
+				      field_name, !type_is_local_obj(reg->type));
 
 		switch (err) {
 		case WALK_PTR:
-			/* For local types, the destination register cannot
+			/*
+			 * For local types, the destination register cannot
 			 * become a pointer again.
 			 */
-			if (type_is_alloc(reg->type))
+			if (type_is_local_obj(reg->type))
 				return SCALAR_VALUE;
 			/* If we found the pointer or scalar on t+off,
 			 * we're done.
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a0069983f103..75697e52a2df 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6341,12 +6341,6 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 	u32 btf_id = 0;
 	int ret;
 
-	/* The access rules for typed arena objects come with a later patch. */
-	if (type_is_typed_arena_obj(reg->type)) {
-		verbose(env, "typed arena access is not supported yet\n");
-		return -EACCES;
-	}
-
 	if (!env->allow_ptr_leaks) {
 		verbose(env,
 			"'struct %s' access is allowed only to CAP_PERFMON and CAP_SYS_ADMIN\n",
@@ -6398,7 +6392,7 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 		return -EACCES;
 	}
 
-	if (env->ops->btf_struct_access && !type_is_alloc(reg->type) && atype == BPF_WRITE) {
+	if (env->ops->btf_struct_access && !type_is_local_obj(reg->type) && atype == BPF_WRITE) {
 		if (!btf_is_kernel(reg->btf)) {
 			verifier_bug(env, "reg->btf must be kernel btf");
 			return -EFAULT;
@@ -6409,10 +6403,14 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 				"%s cannot write into ptr_%s at off=%d size=%d\n",
 				reg_arg_name(env, argno), tname, off, size);
 	} else {
-		/* Writes are permitted with default btf_struct_access for
-		 * program allocated objects (which always have id > 0).
+		/*
+		 * Writes are permitted with default btf_struct_access for
+		 * program allocated objects (which always have id > 0) and
+		 * for typed arena objects, whose memory is never unmapped
+		 * under a program.
 		 */
-		if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type)) {
+		if (atype != BPF_READ && !type_is_ptr_alloc_obj(reg->type) &&
+		    !type_is_typed_arena_obj(reg->type)) {
 			verbose(env, "only read is supported\n");
 			return -EACCES;
 		}
-- 
2.53.0