Re: [PATCH bpf-next 1/6] libbpf: Sanitize BTF_KIND_FUNC linkage

Alexei Starovoitov
2020-01-08T20:13:01Z

On Wed, Jan 08, 2020 at 06:57:18PM +0000, Yonghong Song wrote:
>
>
> On 1/7/20 11:25 PM, Alexei Starovoitov wrote:
> > In case kernel doesn't support static/global/extern liknage of BTF_KIND_FUNC
> > sanitize BTF produced by llvm.
> >
> > Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> > ---
> > tools/include/uapi/linux/btf.h | 6 ++++++
> > tools/lib/bpf/libbpf.c | 35 +++++++++++++++++++++++++++++++++-
> > 2 files changed, 40 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/include/uapi/linux/btf.h b/tools/include/uapi/linux/btf.h
> > index 1a2898c482ee..5a667107ad2c 100644
> > --- a/tools/include/uapi/linux/btf.h
> > +++ b/tools/include/uapi/linux/btf.h
> > @@ -146,6 +146,12 @@ enum {
> > BTF_VAR_GLOBAL_EXTERN = 2,
> > };
> >
> > +enum btf_func_linkage {
> > + BTF_FUNC_STATIC = 0,
> > + BTF_FUNC_GLOBAL = 1,
> > + BTF_FUNC_EXTERN = 2,
> > +};
> > +
> > /* BTF_KIND_VAR is followed by a single "struct btf_var" to describe
> > * additional information related to the variable such as its linkage.
> > */
> > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> > index 7513165b104f..f72b3ed6c34b 100644
> > --- a/tools/lib/bpf/libbpf.c
> > +++ b/tools/lib/bpf/libbpf.c
> > @@ -166,6 +166,8 @@ struct bpf_capabilities {
> > __u32 btf_datasec:1;
> > /* BPF_F_MMAPABLE is supported for arrays */
> > __u32 array_mmap:1;
> > + /* static/global/extern is supported for BTF_KIND_FUNC */
> > + __u32 btf_func_linkage:1;
> > };
> >
> > enum reloc_type {
> > @@ -1817,13 +1819,14 @@ static bool section_have_execinstr(struct bpf_object *obj, int idx)
> >
> > static void bpf_object__sanitize_btf(struct bpf_object *obj)
> > {
> > + bool has_func_linkage = obj->caps.btf_func_linkage;
> > bool has_datasec = obj->caps.btf_datasec;
> > bool has_func = obj->caps.btf_func;
> > struct btf *btf = obj->btf;
> > struct btf_type *t;
> > int i, j, vlen;
> >
> > - if (!obj->btf || (has_func && has_datasec))
> > + if (!obj->btf || (has_func && has_datasec && has_func_linkage))
> > return;
> >
> > for (i = 1; i <= btf__get_nr_types(btf); i++) {
> > @@ -1871,6 +1874,9 @@ static void bpf_object__sanitize_btf(struct bpf_object *obj)
> > } else if (!has_func && btf_is_func(t)) {
> > /* replace FUNC with TYPEDEF */
> > t->info = BTF_INFO_ENC(BTF_KIND_TYPEDEF, 0, 0);
> > + } else if (!has_func_linkage && btf_is_func(t)) {
> > + /* replace BTF_FUNC_GLOBAL with BTF_FUNC_STATIC */
> > + t->info = BTF_INFO_ENC(BTF_KIND_FUNC, 0, 0);
>
> The comment says we only sanitize BTF_FUNC_GLOBAL here.
> Actually, it also sanitize BTF_FUNC_EXTERN.
>
> Currently, in kernel/bpf/btf.c, we have
> static int btf_check_all_types(struct btf_verifier_env *env)
> {
> ...
> if (btf_type_is_func(t)) {
> err = btf_func_check(env, t);
> if (err)
> return err;
> }
> ...
> }
>
> btf_func_check() will ensure func btf_type->type is a func_proto
> and all arguments of func_proto has a name except void which is
> considered as varg.
>
> For extern function, the argument name is lost in llvm/clang.
>
> -bash-4.4$ cat test.c
>
> extern int foo(int a);
> int test() { return foo(5); }
> -bash-4.4$
> -bash-4.4$ clang -target bpf -O2 -g -S -emit-llvm test.c
>
> !2 = !{}
> !4 = !DISubprogram(name: "foo", scope: !1, file: !1, line: 1, type: !5,
> flags: DIFlagPrototyped, spFlags: DISPFlagOptimized, retainedNodes: !2)
> !5 = !DISubroutineType(types: !6)
> !6 = !{!7, !7}
> !7 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
>
> To avoid kernel complaints, we need to sanitize in a different way.
> For example extern BTF_KIND_FUNC could be rewritten to a
> BTF_KIND_PTR to void.

Good point. I'll reword the comment and rename the test to btf_func_global,
so it probes kernel for KIND_GLOBAL only and santizes only that bit.
KIND_EXTERN sanitization is to be done later. Separate libbpf and kernel patches.