Alexei Starovoitov 06fa64d2b1 bpf: Introduce dynamic program extensions ... [upstream commit be8704ff07d2374bcc5c675526f95e70c6459683] Introduce dynamic program extensions. The users can load additional BPF functions and replace global functions in previously loaded BPF programs while these programs are executing. Global functions are verified individually by the verifier based on their types only. Hence the global function in the new program which types match older function can safely replace that corresponding function. This new function/program is called 'an extension' of old program. At load time the verifier uses (attach_prog_fd, attach_btf_id) pair to identify the function to be replaced. The BPF program type is derived from the target program into extension program. Technically bpf_verifier_ops is copied from target program. The BPF_PROG_TYPE_EXT program type is a placeholder. It has empty verifier_ops. The extension program can call the same bpf helper functions as target program. Single BPF_PROG_TYPE_EXT type is used to extend XDP, SKB and all other program types. The verifier allows only one level of replacement. Meaning that the extension program cannot recursively extend an extension. That also means that the maximum stack size is increasing from 512 to 1024 bytes and maximum function nesting level from 8 to 16. The programs don't always consume that much. The stack usage is determined by the number of on-stack variables used by the program. The verifier could have enforced 512 limit for combined original plus extension program, but it makes for difficult user experience. The main use case for extensions is to provide generic mechanism to plug external programs into policy program or function call chaining. BPF trampoline is used to track both fentry/fexit and program extensions because both are using the same nop slot at the beginning of every BPF function. Attaching fentry/fexit to a function that was replaced is not allowed. The opposite is true as well. Replacing a function that currently being analyzed with fentry/fexit is not allowed. The executable page allocated by BPF trampoline is not used by program extensions. This inefficiency will be optimized in future patches. Function by function verification of global function supports scalars and pointer to context only. Hence program extensions are supported for such class of global functions only. In the future the verifier will be extended with support to pointers to structures, arrays with sizes, etc. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.fastabend@gmail.com> Acked-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/bpf/20200121005348.2769920-2-ast@kernel.org		2022-06-21 10:27:07 +08:00
..
Makefile	bpf: Introduce BPF dispatcher	2022-06-21 10:27:06 +08:00
arraymap.c	bpf: Simplify __bpf_arch_text_poke poke type handling	2022-06-21 10:27:06 +08:00
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-04-12 12:52:15 +08:00
bpf_lru_list.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
bpf_struct_ops.c	bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS	2022-06-21 10:27:05 +08:00
bpf_struct_ops_types.h	bpf: tcp: Support tcp_congestion_ops in bpf	2022-06-21 10:27:05 +08:00
btf.c	bpf: Introduce dynamic program extensions	2022-06-21 10:27:07 +08:00
cgroup.c	Revert "bpf/cgroup: Replace rcu_swap_protected() with rcu_replace_pointer()"	2022-06-21 10:27:03 +08:00
core.c	bpf: Add poke dependency tracking for prog array maps	2022-06-21 10:27:05 +08:00
cpumap.c	cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled	2021-03-16 16:27:10 +08:00
devmap.c	devmap: Use bpf_map_area_alloc() for allocating hash buckets	2021-03-16 16:30:57 +08:00
disasm.c	bpf: Introduce BPF nospec instruction for mitigating Spectre v4	2022-06-21 10:27:02 +08:00
disasm.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
dispatcher.c	bpf: Introduce BPF dispatcher	2022-06-21 10:27:06 +08:00
hashtab.c	bpf: Zero-fill re-used per-cpu map element	2021-03-16 16:40:49 +08:00
helpers.c	bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback	2021-03-16 16:44:00 +08:00
inode.c	bpf: Convert bpf_prog refcnt to atomic64_t	2021-03-16 16:43:58 +08:00
local_storage.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
lpm_trie.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
map_in_map.c	bpf: Move owner type, jited info into array auxiliary data	2022-06-21 10:27:05 +08:00
map_in_map.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
offload.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
percpu_freelist.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
percpu_freelist.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
queue_stack_maps.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
reuseport_array.c	net: Generate reuseport group ID on group creation	2022-06-21 10:27:07 +08:00
stackmap.c	bpf: Check for integer overflow when using roundup_pow_of_two()	2021-04-12 12:52:03 +08:00
syscall.c	bpf: Introduce dynamic program extensions	2022-06-21 10:27:07 +08:00
sysfs_btf.c	bpf: Fix sysfs export of empty BTF section	2021-03-16 16:37:55 +08:00
tnum.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
trampoline.c	bpf: Introduce dynamic program extensions	2022-06-21 10:27:07 +08:00
verifier.c	bpf: Introduce dynamic program extensions	2022-06-21 10:27:07 +08:00
xskmap.c	bpf: Implement map_gen_lookup() callback for XSKMAP	2022-06-21 10:27:03 +08:00