From: Daniel Borkmann <daniel@iogearbox•net>
To: Alexei Starovoitov <alexei.starovoitov@gmail•com>,
Jakub Kicinski <jakub.kicinski@netronome•com>
Cc: netdev@vger•kernel.org, ast@kernel•org,
dinan.gunawardena@netronome•com, jiri@resnulli•us,
john.fastabend@gmail•com, kubakici@wp•pl
Subject: Re: [RFCv2 07/16] bpf: enable non-core use of the verfier
Date: Mon, 29 Aug 2016 22:17:10 +0200 [thread overview]
Message-ID: <57C49846.1080608@iogearbox.net> (raw)
In-Reply-To: <57C4976C.4010501@iogearbox.net>
On 08/29/2016 10:13 PM, Daniel Borkmann wrote:
> On 08/27/2016 07:32 PM, Alexei Starovoitov wrote:
>> On Sat, Aug 27, 2016 at 12:40:04PM +0100, Jakub Kicinski wrote:
>>> On Fri, 26 Aug 2016 16:29:05 -0700, Alexei Starovoitov wrote:
>>>> On Fri, Aug 26, 2016 at 07:06:06PM +0100, Jakub Kicinski wrote:
>>>>> Advanced JIT compilers and translators may want to use
>>>>> eBPF verifier as a base for parsers or to perform custom
>>>>> checks and validations.
>>>>>
>>>>> Add ability for external users to invoke the verifier
>>>>> and provide callbacks to be invoked for every intruction
>>>>> checked. For now only add most basic callback for
>>>>> per-instruction pre-interpretation checks is added. More
>>>>> advanced users may also like to have per-instruction post
>>>>> callback and state comparison callback.
>>>>>
>>>>> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome•com>
>>>>
>>>> I like the apporach. Making verifier into 'bytecode parser'
>>>> that JITs can reuse is a good design choice.
>
> +1
>
>>>> The only thing I would suggest is to tweak the verifier to
>>>> avoid in-place state recording. Then I think patch 8 for
>>>> clone/unclone of the program won't be needed, since verifier
>>>> will be read-only from bytecode point of view and patch 9
>>>> also will be slightly cleaner.
>>>> I think there are very few places in verifier that do this
>>>> state keeping inside insn. It was bugging me for some time.
>>>> Good time to clean that up.
>>>> Unless I misunderstand the patches 7,8,9...
>>>
>>> Agreed, I think the verifier only modifies the program to
>>> store pointer types in imm field. I will try to come up
>>> a way around this, any suggestions? Perhaps state_equal()
>>
>> probably array_of_insn_aux_data[num_insns] should do it.
>> Unlike reg_state that is forked on branches, this array
>> is only one.
>
> This would be for struct nfp_insn_meta, right? So, struct
> bpf_ext_parser_ops could become:
>
> static const struct bpf_ext_parser_ops nfp_bpf_pops = {
> .insn_hook = nfp_verify_insn,
> .insn_size = sizeof(struct nfp_insn_meta),
> };
>
> ... where bpf_parse() would prealloc that f.e. in env->insn_meta[].
(Well, actually everything can live in env->private_data.)
>>> logic could be modified to downgrade pointers to UNKONWNs
>>> when it detects other state had incompatible pointer type.
>>>
>>>> There is also small concern for patches 5 and 6 that add
>>>> more register state information. Potentially that extra
>>>> state can prevent states_equal() to recognize equivalent
>>>> states. Only patch 9 uses that info, right?
>>>
>>> 5 and 6 recognize more constant loads, those can only
>>> upgrade some UNKNOWN_VALUEs to CONST_IMMs. So yes, if the
>>> verifier hits the CONST first and then tries with UNKNOWN
>>> it will have to reverify the path.
>
> Agree, was also my concern when I read patch 5 and 6. It would
> not only be related to types, but also different imm values,
> where the memcmp() could fail on. Potentially the latter can be
> avoided by only checking types which should be sufficient. Hmm,
> maybe only bpf_parse() should go through this stricter mode since
> only relevant for drivers (otoh downside would be that bugs
> would end up less likely to be found).
>
>>>> Another question is do you need all state walking that
>>>> verifier does or single linear pass through insns
>>>> would have worked?
>>>> Looks like you're only using CONST_IMM and PTR_TO_CTX
>>>> state, right?
>>>
>>> I think I need all the parsing. Right now I mostly need
>>> the verification to check that exit codes are specific
>>> CONST_IMMs. Clang quite happily does this:
>>>
>>> r0 <- 0
>>> if (...)
>>> r0 <- 1
>>> exit
>>
>> I see. Indeed then you'd need the verifier to walk all paths
>> to make sure constant return values.
>
> I think this would still not cover the cases where you'd fetch
> a return value/verdict from a map, but this should be ignored/
> rejected for now, also since majority of programs are not written
> in such a way.
>
>> If you only need yes/no check then such info can probably be
>> collected unconditionally during initial program load.
>> Like prog->cb_access flag.
>
> One other comment wrt the header, when you move these things
> there, would be good to prefix with bpf_* so that this doesn't
> clash in future with other header files.
next prev parent reply other threads:[~2016-08-29 20:17 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-26 18:05 [RFCv2 00/16] BPF hardware offload (cls_bpf for now) Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 01/16] add basic register-field manipulation macros Jakub Kicinski
2016-08-29 14:34 ` Daniel Borkmann
2016-08-29 15:07 ` Jakub Kicinski
2016-08-29 15:40 ` Daniel Borkmann
2016-08-26 18:06 ` [RFCv2 02/16] net: cls_bpf: add hardware offload Jakub Kicinski
2016-08-29 14:51 ` Daniel Borkmann
2016-08-26 18:06 ` [RFCv2 03/16] net: cls_bpf: limit hardware offload by software-only flag Jakub Kicinski
2016-08-29 15:06 ` Daniel Borkmann
2016-08-29 15:15 ` Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 04/16] net: cls_bpf: add support for marking filters as hardware-only Jakub Kicinski
2016-08-29 15:28 ` Daniel Borkmann
2016-08-26 18:06 ` [RFCv2 05/16] bpf: recognize 64bit immediate loads as consts Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 06/16] bpf: verifier: recognize rN ^ rN as load of 0 Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 07/16] bpf: enable non-core use of the verfier Jakub Kicinski
2016-08-26 23:29 ` Alexei Starovoitov
2016-08-27 11:40 ` Jakub Kicinski
2016-08-27 17:32 ` Alexei Starovoitov
2016-08-29 20:13 ` Daniel Borkmann
2016-08-29 20:17 ` Daniel Borkmann [this message]
2016-08-30 10:48 ` Jakub Kicinski
2016-08-30 19:07 ` Daniel Borkmann
2016-08-30 20:22 ` Jakub Kicinski
2016-08-30 20:48 ` Alexei Starovoitov
2016-08-30 21:00 ` Daniel Borkmann
2016-08-31 1:18 ` Alexei Starovoitov
2016-08-26 18:06 ` [RFCv2 08/16] bpf: export bpf_prog_clone functions Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 09/16] nfp: add BPF to NFP code translator Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 10/16] nfp: bpf: add hardware bpf offload Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 11/16] net: cls_bpf: allow offloaded filters to update stats Jakub Kicinski
2016-08-29 20:43 ` Daniel Borkmann
2016-08-26 18:06 ` [RFCv2 12/16] net: bpf: " Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 13/16] nfp: bpf: add packet marking support Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 14/16] net: act_mirred: allow statistic updates from offloaded actions Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 15/16] nfp: bpf: add support for legacy redirect action Jakub Kicinski
2016-08-26 18:06 ` [RFCv2 16/16] nfp: bpf: add offload of TC direct action mode Jakub Kicinski
2016-08-29 21:09 ` Daniel Borkmann
2016-08-30 10:52 ` Jakub Kicinski
2016-08-30 20:02 ` Daniel Borkmann
2016-08-30 20:50 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=57C49846.1080608@iogearbox.net \
--to=daniel@iogearbox$(echo .)net \
--cc=alexei.starovoitov@gmail$(echo .)com \
--cc=ast@kernel$(echo .)org \
--cc=dinan.gunawardena@netronome$(echo .)com \
--cc=jakub.kicinski@netronome$(echo .)com \
--cc=jiri@resnulli$(echo .)us \
--cc=john.fastabend@gmail$(echo .)com \
--cc=kubakici@wp$(echo .)pl \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox